Connect Microsoft Exchange via a service account

The service account connection is a new way to integrate UnSpot with Microsoft Exchange: you connect a single service account with impersonation rights once, and that one connection serves all meeting room resource calendars. There is no need to delegate permissions for every calendar or re-authorize users. The classic delegation-based scheme keeps working — see Prepare Exchange calendar to work with UnSpot.

Requirements

• An Exchange service account allowed to impersonate the meeting room resource calendars (the ApplicationImpersonation role). When you save the connection, UnSpot verifies that it can sign in with this account.
• Supported versions: Exchange 2010, 2010 SP1, 2010 SP2, 2013, 2013 SP1, 2016.
• UnSpot permissions: the setup is done in the admin console (Super Administrator or Integrations Administrator).

Creating the service account in Exchange

The service account is created with the standard Exchange tools: in the ECP panel open Recipients → Mailboxes, click “+ User mailbox” and create a user (for example, app_impersonation).

Then grant the account impersonation rights: on the Exchange server, run the Exchange Management Shell and execute the command below, substituting the name of the account you created:

New-ManagementRoleAssignment `
  -Name "UnSpotAppImpersonation" `
  -Role "ApplicationImpersonation" `
  -User "app_impersonation"

New-ManagementRoleAssignment `
  -Name "UnSpotAppImpersonation" `
  -Role "ApplicationImpersonation" `
  -User "app_impersonation"

Applying the role can take a while: if UnSpot reports a permission-check error when you save the connection, wait a few minutes and try again.

If needed, you can limit impersonation to the meeting room resource calendars only — create a scope and assign the role with it:

# remove the previous assignment (if the role was granted without a scope)
Remove-ManagementRoleAssignment `
  -Identity "UnSpotAppImpersonation" `
  -Confirm:$false

# a scope limited to room resource mailboxes
New-ManagementScope `
  -Name "UnSpotResourceMailboxes" `
  -RecipientRestrictionFilter {RecipientTypeDetails -eq "RoomMailbox"}

# assign the role with the scope
New-ManagementRoleAssignment `
  -Name "UnSpotAppImpersonation" `
  -Role ApplicationImpersonation `
  -User "app_impersonation" `
  -CustomRecipientWriteScope "UnSpotResourceMailboxes"

# remove the previous assignment (if the role was granted without a scope)
Remove-ManagementRoleAssignment `
  -Identity "UnSpotAppImpersonation" `
  -Confirm:$false

# a scope limited to room resource mailboxes
New-ManagementScope `
  -Name "UnSpotResourceMailboxes" `
  -RecipientRestrictionFilter {RecipientTypeDetails -eq "RoomMailbox"}

# assign the role with the scope
New-ManagementRoleAssignment `
  -Name "UnSpotAppImpersonation" `
  -Role ApplicationImpersonation `
  -User "app_impersonation" `
  -CustomRecipientWriteScope "UnSpotResourceMailboxes"

Creating a connection

Go to Manage → Integrations → Synchronizations, find the Microsoft Exchange card in the Calendar synchronization section and click Connect. Fill in the form — all fields are required, up to 255 characters each:

When you click Save, UnSpot tries to sign in with the service account. On success the connection appears in the card list. If authorization fails, the window stays open and the notification shows the reason — including the error text returned by Exchange itself.

Managing connections

• You can have several connections — each is shown as a separate card, and there is always a card with a Connect button to add another one.
• Edit — change any field of the connection; the password is masked in the form. Saving re-checks the authorization. If nothing was changed, the button simply closes the window.
• Disconnect — deletes the connection after a confirmation dialog.
• If a connection stops working (for example, the account password changed), its card is marked as invalid — update the details via Edit.

Connecting a room calendar

A meeting room calendar is connected by entering the email of its resource calendar — no user authorization is required:

1. Open the meeting room card and go to the calendar connection.
2. Choose the Microsoft Exchange (service account) connection.
3. Enter the email of the room’s resource calendar (for example, room@company.com) and confirm.

During the connection UnSpot verifies that it can create an event in the calendar. If the connection fails, the notification shows the reason, including the Exchange error text. Rooms with a connected calendar show an Exchange icon on the spaces page. The calendar is disconnected the same way as for other providers — from the meeting room card.

Note: Exchange does not provide a ready-made list of resource calendars, so the calendar email has to be entered manually. If you don’t know the resource calendar email of a room, ask your Exchange administrator.