EXO - Creating and Configuring Room Calendars (Visibility, Booking, and Access Control)

Overview

In Outlook, IT can add meeting rooms to the Address Book when requested. We can also control who has access to these meeting rooms.

This article explains how to:

• Create a new room mailbox
• Configure visibility and booking permissions
• Use a mail‑enabled security group to manage access
• Assign calendar managers
• Provide group owners with self‑service membership management
• Test access
• Handle future access requests

Each section begins with a decision statement so admins know when that section applies.

Cloud‑Only Room Mailboxes

All room mailboxes at Sault College are created and managed in Exchange Online (cloud‑only). These rooms are fully accessible through Outlook (desktop/mobile) and Outlook on the Web (OWA), and no on‑premises configuration is required. Propagation across Microsoft 365 services may take time after creation.

Target Audience

Solutions Specialists

Prerequisites

Required PIM Roles

Task	Required PIM Role
Create or modify room mailboxes	Exchange Administrator
Configure calendar visibility	Exchange Administrator
Configure booking rules	Exchange Administrator
Create or modify mail‑enabled security groups	Groups Administrator

Required Tools

• Exchange Admin Center (EAC)
• PowerShell with ExchangeOnlineManagement module

Applies To

• Cloud‑only room mailboxes
• Outlook Desktop, Outlook Mobile, and OWA

Section 0 — Creating a New Resource Room

Decision Statement

Perform this section only when a new room mailbox is required. If the room already exists, skip to Section 1.

Creating the Room in the Exchange Admin Center (EAC)

Open the Exchange Admin Center (EAC)

Navigate to:

https://admin.exchange.microsoft.com (admin.exchange.microsoft.com in Bing)

Create the Room

1. Go to Resources → Rooms & Equipment
2. Select + Add a room resource
3. Enter:
   • Name: {Room name}
   • Resource email address: {use saultcollege.ca domain, no dots}
4. Click Next

Set Room Properties

• Capacity
• Location
• Phone Number
• Department
• Company: Sault College

Address:

443 Northern Avenue
Sault Ste. Marie, Ontario
P6B 4J3
Canada

Booking Delegate Settings

• Allow repeating meetings: Yes
• Allow scheduling only during working hours: No
• Automatically decline outside limits: Yes
• Booking window: 180 days
• Max duration: 24 hours
• Automatic reply: Optional

Booking Delegates

Choose one:

• Automatically accept/decline
• Specify manual delegates

Finalize

• Review
• Create
• Done

Note: New rooms may take time to propagate.

Section 1 — Determine Whether a Security Group Is Required

Decision Statement

Use a mail‑enabled security group only when multiple users need visibility or booking access.

When to Use a Security Group

• Multiple users need access
• Access will change over time
• Department wants self‑management
• Predictable governance is needed

When Not to Use a Security Group

• Only one user needs access
• Access is temporary
• Room is fully public

Creating a Mail‑Enabled Security Group

1. Activate Groups Administrator in PIM
2. Go to Microsoft 365 Admin Center → Teams & Groups → Add a Group
3. Choose Security
4. Enable Mail‑enabled
5. Assign SMTP address
6. Add members
7. Assign owner

Section 2 — Determine Whether Calendar Visibility Needs to Be Modified

Decision Statement

Modify visibility only if users need to see more than Free/Busy.

When to Modify Visibility

• Staff need organizer + location
• Staff need full details
• Room is operationally sensitive
• Room should be hidden from general users

When Not to Modify Visibility

• Default Free/Busy is sufficient
• Room is intended to be public

Assigning Calendar Visibility Permissions

Common Permission Levels

• AvailabilityOnly
• LimitedDetails
• Reviewer
• Editor

These are the permission levels commonly used for room calendars.

For the complete list of Exchange permission levels, see Section 5 — Full Permission Levels Reference.

PowerShell Commands

Connect-ExchangeOnline -DisableWAM

$room = "roomname@saultcollege.ca"
$group = "RoomNameMembers@saultcollege.ca"
$manager = "manager@saultcollege.ca"

Set-MailboxFolderPermission "$room:\\Calendar" -User $group -AccessRights LimitedDetails
Set-MailboxFolderPermission "$room:\\Calendar" -User $manager -AccessRights Editor
Set-MailboxFolderPermission "$room:\\Calendar" -User Default -AccessRights None

Get-MailboxFolderPermission "$room:\\Calendar"

Section 3 — Determine Whether Booking Permissions Need to Be Restricted

Decision Statement

Restrict booking only if not everyone should be able to book the room.

When to Restrict Booking

• Only a department should book
• Room is sensitive
• Bookings must be controlled

When Not to Restrict Booking

• Room is open to all staff
• No operational need to limit bookings

Configuring Booking Permissions

Set-CalendarProcessing -Identity $room `
  -BookInPolicy $group `
  -AllBookInPolicy $false `
  -AllRequestInPolicy $false `
  -AllRequestOutOfPolicy $true

Explanation of Parameters

BookInPolicy $group

Only members of the security group can auto‑book the room.

AllBookInPolicy $false

Prevents everyone from auto‑booking. Ensures only the group can auto‑book.

AllRequestInPolicy $false

Group members do not need approval and cannot request approval. Their bookings are auto‑accepted.

AllRequestOutOfPolicy $true

Users outside the group cannot auto‑book but may submit a booking request for approval.

Important Note About Visibility

If visibility is restricted to the security group, users outside the group cannot see the room, and therefore cannot request bookings.

Booking request settings apply only to users who can see the room.

Section 4 — Determine Whether a Calendar Manager (Editor) Is Required

Decision Statement

Assign an Editor only if someone must manage the room’s schedule.

When to Assign an Editor

• Someone must modify/delete events
• Room requires oversight
• Department wants a delegate

When Not to Assign an Editor

• No one needs to manage the calendar
• Room is self‑service

Assigning Editor Access

Set-MailboxFolderPermission "$room:\\Calendar" -User "manager@saultcollege.ca" -AccessRights Editor

Section 5 — Full Permission Levels Reference

Permission Table

Level	What Users See	What Users Do	Use Case
None	Nothing	Nothing	Hide calendar
AvailabilityOnly	Free/Busy	Nothing	Default
LimitedDetails	Free/Busy + organizer + location	Nothing	Operational visibility
Reviewer	Full details	Read only	Shared calendars
Contributor	Nothing	Add items	Drop‑box
NonEditingAuthor	Full details	Create items	Submit bookings
Author	Full details	Modify own items	Personal calendars
Editor	Full details	Modify all items	Calendar managers
PublishingAuthor	Full details	Create + subfolders	Rare
PublishingEditor	Full details	Full control + subfolders	High‑trust
Owner	Full details	Full control	Admins

Section 6 — Testing Access

Decision Statement

Testing is required only when permissions or booking rules change.

Testing Steps

Calendar Manager Should

• See full details
• Create/modify/delete events

One SG Member Should

• See LimitedDetails
• Book the room
• Not modify existing events

Section 7 — How Group Owners Can Manage Membership (Non‑Admin Users)

Decision Statement

Provide this section only if the user is an Owner of the security group.

Managing Membership

Group owners manage membership at:

https://myaccount.microsoft.com/groups

Steps

1. Sign in
2. Select Groups
3. Choose the group
4. Select Members
5. Add/remove members

Owners Can

• Add members
• Remove members
• View group details

Owners Cannot

• Change calendar permissions
• Change booking rules
• Modify room mailbox settings

Section 8 — How Users Request Future Access Changes

Ticket Template

Please update access for the room calendar.

Security Group: RoomNameMembers
Calendar: {Room Name}

Add the following users:
- Firstname Lastname (email)

Remove the following users:
- Firstname Lastname (email)

If any user requires a different permission level:
- Firstname Lastname (email) → AccessRights: Editor

Section 9 — Admin Notes & Best Practices

Guidance

• Always use SMTP addresses
• Use Add‑MailboxFolderPermission for new entries
• Use Set‑MailboxFolderPermission for modifications
• Never remove Default or Anonymous — set to None
• SG membership does not create permissions automatically
• Editor access should be rare
• LimitedDetails is ideal for visibility without exposing content
• -------------------------------------------------

ORIGINAL INSTRUCTIONS
-------------------------------------------------

Permissions

If you don't request the PIM Exchange Admin role you will see the below message and won't be able to follow these instructions

To request the Exchange Admin PIM role, follow this article -  Article - Requesting PIM access (teamdynamix.com)

Creating a new Resource Room

• In Microsoft 365 Admin Center
  • Resources
  • Rooms & Equipment

OR

• In Exchange Admin Center (EAC)
  • Resources
     
• Click +Add a room resource
  Set up room Mailbox
  • Name: {Room name}
  • Email:  {use saultcollege.ca domain} Don't use dots in the email address
  • Click Next
• Set up room mailbox
  • Name: Employment Solutions Fishbowl
  • Resource Email address: EmploymentSolutionsFishbowl@saultcollege.ca
  • Capacity:  {capacity of room}  Note: if you don't know this reach out to Facilities Management
  • Location: {use this field for meeting room number}
  • Phone Number: {if there is an extension put it here}
  • Department: Employment Solutions
  • Company: Sault College
  • Address Book Policy: 
  • Street: 443 Northern Avenue
  • City: Sault Ste. Marie
  • Province: Ontario
  • Postal Code: P6B 4J7
  • Country: Canada
• Booking delegate settings
  • Allow repeating meetings: Yes
  • Allow scheduling only during working hours: No
  • Automatically decline meetings outside of booking limits below: Yes
    Booking windows (days):180 (default)
    Maximum duration (hours): 24
  • Enter an automatic reply to be sent to meeting organizers (optional): Ask the requester if they want this enable, and to provide a script for you to include.
  • Booking Delegates
    If you are requested for a user to manage a mailbox, but still automatically accept/decline then choose Yes for Automatic, and then add the delegates after the mailbox has been created
    • Automatically accept/decline meeting requests (yes/no)
    • Specify users whom you want to accept/decline meetings manually (yes/no)
  • Click Next
• Review resource - You now have an opportunity to review before Creating the room
• Click Create

Status - last stage

The new Meeting Resource will now be create

• Click Done

The meeting room will now be listed in the Resources screen you started on. 
You can review or change the meeting room settings by clicking on the new resource, this will allow the fly-out to open on the right side of the screen.

Now check All Rooms in the Address book, of your Outlook client, to see if the meeting room is available.

Granting reviewer access to a Shared Room Calendar resource

This allows anyone viewing the room booking in Calendar view to see the meeting organizer.
This should be added to each meeting room mailbox that is created. 

EXO - Calendars - Granting reviewer access to a Shared Room Calendar resource

Power Shell commands

If you want to see or modify the same sharing information, as seen above you can use the Power Shell commands to do that.

Set-ExecutionPolicy unrestricted -force
Install-Module msonline -Force
Install-Module exchangeonlinemanagement -Force
Connect-ExchangeOnline
$roomcalendaremailaddress = '{username}@saultcollege.ca'
$room = Get-Mailbox -Identity $roomcalendaremailaddress #{Change the email address here to reflect the Meeting room you are working on.
Get-Mailbox $room
Get-MailboxFolderPermission "$($room.Alias):\calendar"
You can also set permissions via Power Shell, instead of the GUI above, using the Set Command as well.
Set-MailboxFolderPermission "$($room.Alias):\calendar" -User default -AccessRights Reviewer

So, the command will retrieve the calendar processing settings for the specified room mailbox and display them as a formatted list.
Get-CalendarProcessing $roomcalendaremailaddress | FL 

How to Limit the room resource to only a specific group of users

Set-CalendarProcessing (ExchangePowerShell) | Microsoft Learn

Step 1 - Create/locate a <Dynamic Distribution> list to govern security, a standard Distrubution List should be ok too.

Step 2 - Locate the <UPN> - email address - of the meeting room you want to limit access to

Step 3 - Modifying Access rights using the Set-CalendarProcessing

To use the Set-CalendarProcessing cmdlet to allow only the <Requested group> to view a calendar in Exchange Online, you can follow these steps:

1. Connect to Exchange Online PowerShell. You can use the following command to connect: 

Install-Module ExchangeOnlineManagement - First time only on a new PC
Connect-ExchangeOnline -UserPrincipalName <UPN>

Replace `<UPN>` with the user principal name of a user who has the necessary permissions to manage calendar processing. IE: username@saultcollege.ca

2. Before making any changes you should capture the current state of the meeting room

Example of B1131 meeting room

Get-calendarprocessing b1131@saultcollege.ca | fl

Settings before modifying.

3. Set-CalendarProcessing -Identity "b1131@saultcollege.ca" -BookInPolicy "hr@saultcollege.ca" -AddOrganizerToSubject $true -AllBookInPolicy $true

Upon testing it was found that the -AllBookInPolicy has to be set to $true for the users to be able to see who booked the meeting room which is discussed in this article:
EXO - Calendars - Granting reviewer access to a Shared Room Calendar resource

Replace 'B1131@saultcollege.ca' with the `<CalendarIdentity>` of the calendar that you want to modify.
Replace 'hr@saultcollege.ca' with the '<Dynamic Distribution List>' created in Step 1 of the process

This command sets the "BookInPolicy" parameter to "hr@saultcollege.ca", which means that only the HR group can book appointments in the calendar. It also sets the "AddOrganizerToSubject" parameter to $true, which adds the organizer's name to the subject of the meeting request, and the "AllBookInPolicy" parameter to $false, which restricts the ability to book appointments only to the HR group.

After you run this command, only the HR group will be able to book appointments in the calendar. Other users will not be able to view or book appointments in the calendar.

4. Verify your changes were successful but re-running the command from Step 2 

Get-calendarprocessing b1131@saultcollege.ca | fl

After changing -AllbookInPolicy to $true

-AllbookInPolicy to $false

Making yourself a Delegate of the Room Resource Mailbox

Using the Microsoft 365 Admin Center (EAC), follow these steps:

1. Log in to your Microsoft 365 account and open the MS 365 Admin Poral https://admin.microsoft.com/

2. Click on "Resources" in the left-hand navigation menu and then select "Rooms & Equipment"

3. Find the room resource mailbox that you want to delegate access to and click on it to open its properties in the flyout.

4. Click on the "Delegation" link or "Edit"

5. Under "Manage delegates" type the email address of the user

6. Click "Save Changes" to add the delegate.

Once you have completed these steps, and a period of time has passed, this user will be able to manage the calendar.

They will need to open the room's calendar in Outlook or Outlook on the web to create and modify appointments.

Troubleshooting

If you see this message, when opening the calendar using outlook.office.com:

1. You have forgotten to give your self Delegate Full Access to the mailbox
2. Enough time hasn't passed for the setting to propogate

Deleting a Meeting Room

Select the meeting room and click delete at top or the screen

 

Archived Steps

MOVING Mailboxes {This section is retired now as all moves have been completed}

In AD

• Move object from: Staff\Service Accounts\Calendars
• to Staff\Not sysnced\Pending Delete-Room  ...

In Azure Active Directory

• Users
• Search for old meeting room {A user is still here that gets synced}
• Delete it
• Then go to Deleted Users
• Search for old meeting room {It takes a little time to show up here}
• Delete Permanently

 

---------------------- Below steps are sound but didnt' work ---------------------

Step 1: Grant yourself Full Access to the Room Resources Mailbox (which contains the calendar we want to work with)

Step 2: Open this mailbox in Outlook on the Web

Step 3: Share the calendar as requested

Step 1: Grant yourself Full Access to the Room Resources Mailbox

1. As an Exchange Admin login to https://admin.exchange.microsoft.com
2. Navigate to Recipients --> Resources
3. Locate the Resource you want to modify and select it.
4. In the flyout on the right hand side, under "Read & Manager (Full Access)", click "Edit"
5. Click "+ Add Members", then add the user you are granting the right to
6. Search the user and click "Save"

Note: This change will occur instantly.

Step 2: Open this mailbox in Outlook on the Web

1. Navigate to https://outlook.office.com and login with the account that you just added in Step 1
2. Click on he Circle Emoji icon in the top right hand corner of Outlook on the Web
3. Click on "Open another mailbox" at the bottom.
   NOTE: If you don't see the resource, and you've just created it, you'll have to wait for the Microsoft Back end to catch up.
4. Type the email address of the resource you are working on
5. The new resources mailbox will now be added.

Step 3: Share the calendar as requested

1. Navigate to https://outlook.office.com and login with the account that you just added in Step 1
2. If you aren't in the calendar, click on the Calendar icon in the left hand menu
3. Click "Share" in the top menu
4. Depending on the request, you can now 
   1. Add
   2. Remove
   3. Modify Permissions
5. You'll notice from the below example that, only the users in the list can Edit and See the Calendar Resource.
   People in my organization is set to "Not Shared"
   The all users all have Editor Access, which can be reduced at the request of the Resource Owner