Configuring Exchange on-premises for scheduling

Secure Scheduler for Exchange uses a service account to log into Exchange. You can use an existing service account (the same service account can be used by more than one integration), or create a new account.

You need to provide the authentication credentials of this service account when configuring Pexip Infinity to integrate with a Microsoft Exchange deployment.

A single service account can be used by more than one integration.

Changes to the service account may take some time to take effect, depending on the cache lifetime configured on the Microsoft Exchange server.

You can create a new service account using either EAC or PowerShell, as follows:

$password = Read-Host "Enter password" -AsSecureString

New-Mailbox -Name "<Account Name>" -UserPrincipalName "<UPN>" -Password $password -Alias "<Account Alias>" -FirstName "<Account First Name>" -LastName "<Account Last Name>" -DisplayName "<Account Name>"

Set-ADUser -Identity "<UPN>" -PasswordNeverExpires $true

New-Mailbox -Name "Service Account" -UserPrincipalName pexip@example.com -Password $password -Alias pexip -FirstName Service -LastName Account -DisplayName "Service Account"

Set-ADUser -Identity pexip@example.com -PasswordNeverExpires $true

Impersonating all users and resources

The Secure Scheduler for Exchange service impersonates users when sending email updates containing joining instructions (in cases where these instructions could not be added at the time of scheduling). This makes it appear to the recipients that the joining instructions were sent from the meeting organizer, instead of the service account. The service account also impersonates the Secure Scheduler for Exchange equipment resource to read the calendar.

To check if your service account has Application Impersonation already configured, use the PowerShell command:

Get-ManagementRoleAssignment -RoleAssignee "<email_of_service_account>" -Role ApplicationImpersonation | Format-List

Below is an example of the output of the command when the service account already has Application Impersonation configured:

If the service account does not have Application Impersonation configured, then the above command will not return anything at all. If this is the case, enable Application Impersonation as follows:

New-ManagementRoleAssignment -name:"<role_name>" -Role:ApplicationImpersonation -User:"<email_of_service_account>"

For example:

New-ManagementRoleAssignment -name:PexipSchedulingService -Role:ApplicationImpersonation -User:pexip@exchange.example.com

This enables the service account to impersonate all users and resources in the organization.

For more information on these commands, see Microsoft help:

• Configuring Application Impersonation: https://msdn.microsoft.com/en-us/library/office/dn722376%28v=exchg.150%29.aspx
• Get-ManagementRoleAssignment command: https://technet.microsoft.com/en-us/library/dd351024(v=exchg.150).aspx
• New-ManagementRoleAssignment command: https://technet.microsoft.com/en-us/library/dd335193(v=exchg.150).aspx
• Set-ManagementRoleAssignment command (used if you need to edit the role assignment): https://technet.microsoft.com/en-us/library/dd335173(v=exchg.150).aspx

Impersonating resources only

If you do not want to permit the service account to access all users and resources in your organization, you can instead permit it to access the Secure Scheduler for Exchange equipment resource only, but this limits the functionality of the feature. For more information, see Using application impersonation.

To do this, you must first create the equipment resource and assign it an email address.

Then use the following PowerShell command:

$restriction_filter = "UserPrincipalName -eq ""<email_of_equipment_resource>"""
$scheduling_service_account = "<email_of_service_account>"
$management_scope_to_create = "Pexip Scheduling Management Scope"
$impersonation_role_name_to_create = "Pexip Scheduling Impersonation"

New-ManagementScope -Name $management_scope_to_create -RecipientRestrictionFilter $restriction_filter

New-ManagementRoleAssignment -Name $impersonation_role_name_to_create -Role ApplicationImpersonation -User $scheduling_service_account -CustomRecipientWriteScope $management_scope_to_create

The equipment resource is added as a resource attendee to all Secure Scheduler for Exchange meetings. Users will see replies from this resource when it accepts or rejects a meeting request.

Each equipment resource can be used by only one Secure Scheduler for Exchange Integration. If you have separate test and development environments, you must use a different equipment resource for each.

Previously we recommended using a room resource, but this may cause issues when using the Room Finder tool. Thus, we now recommend using an equipment resource.

You can create an equipment resource using either EAC or PowerShell, as follows:

New-Mailbox -Equipment -Name "<Equipment Name>" -Alias "<Equipment Alias>" -DisplayName "<Equipment Name>"

New-Mailbox -Equipment -Name "Pexip Scheduling Service" -Alias pexip.scheduling -DisplayName "Pexip Scheduling Service"

Calendar processing

This configuration is done using the following PowerShell command:

Set-CalendarProcessing -Identity "<email_of_equipment_resource>" -AutomateProcessing None -AllowConflicts $true -BookingWindowInDays 1080 -MaximumDurationInMinutes 0 -AllowRecurringMeetings $true -EnforceSchedulingHorizon $false -ScheduleOnlyDuringWorkHours $false -ConflictPercentageAllowed 100 -MaximumConflictInstances 2147483647

To verify that the above command has configured everything correctly, use the PowerShell command:

Get-CalendarProcessing -Identity "<email_of_equipment_resource>" | Format-List

The output should look something like this:

Hiding resource availability in scheduling assistant

When viewing meetings in Outlook's Scheduling Assistant, the equipment resource and its availability will appear in the list of attendees. Because the same equipment resource is used for all scheduled meetings, it may show as unavailable if there are other meetings scheduled at the same time, which may be confusing to users.

To avoid this, you can hide the availability of the equipment resource's mailbox, so that it is always shown as "unknown". This is done using the PowerShell command:

Set-MailboxFolderPermission -Identity "<email_of_equipment_resource>:\Calendar" -User Default -AccessRights None

More information

For more information on these commands, see Microsoft help:

• Set-CalendarProcessing command: https://learn.microsoft.com/en-us/powershell/module/exchange/set-calendarprocessing
• Get-CalendarProcessing command: https://learn.microsoft.com/en-us/powershell/module/exchange/get-calendarprocessing

• Set-MailboxFolderPermission command: https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailboxfolderpermission