Personal Work Sync Setup Guide

Before you start

You need:

• A Microsoft 365 admin account that can create app registrations and grant admin consent. In practice: Application Administrator or Cloud Application Administrator to register the app, and Privileged Role Administrator or Global Administrator to grant consent. A Global Administrator can do everything.
• Freshservice admin access, to open the app's settings page.
• Agents whose Freshservice email matches their Microsoft 365 mailbox. The app finds each agent's calendar by email address. An agent whose Freshservice email has no matching mailbox in your tenant is skipped. See Check that your agents match.

Keep two browser tabs open: the Microsoft Entra admin center and the app's settings page in Freshservice.

1. Register the app in Microsoft Entra

1. Sign in to the Microsoft Entra admin center. If you manage more than one tenant, use the Settings icon in the top menu to switch to the tenant whose calendars you want to sync.
2. Go to Entra ID > App registrations and select New registration.
3. Fill in the form:
   • Name: anything recognizable, for example Freshservice Calendar Sync.
   • Supported account types: choose Single tenant only - your tenant name.
   • Redirect URI: leave it blank. Sync runs in the background and has no sign-in step, so it doesn't need one.
4. Select Register.

You're now on the app's Overview page. Copy these two values into a scratch file. You'll paste them into Freshservice in step 4:

2. Add the two permissions

The app needs two Microsoft Graph application permissions. Application permissions let the app work in the background without a signed-in user, which is what makes sync possible.

1. In your app registration, select API permissions.
2. Select Add a permission > Microsoft Graph > Application permissions.
3. Search for and tick each of these:

   Permission	Why the app needs it
   Calendars.ReadWrite	Create, update and delete the sync events on agents' calendars
   User.Read.All	Find each agent's mailbox from their email address

4. Select Add permissions.

Choose Application permissions, not Delegated permissions. With delegated permissions, verification fails.

The app registration also starts with a User.Read delegated permission. You can leave it or remove it. Sync doesn't use it.

3. Grant admin consent

Application permissions do nothing until an administrator approves them.

1. Still on API permissions, select Grant admin consent for your tenant name.
2. Select Yes.
3. Select Refresh and check that both permissions show a green check and Granted for your tenant name under Status.

If the button is greyed out, your account isn't an admin who can consent. Ask a Global Administrator to do this step.

4. Create a client secret and enter it in Freshservice

The client secret is like a password for the app.

1. In your app registration, select Certificates & secrets > Client secrets > New client secret.
2. Enter a Description (for example Freshservice sync) and choose an Expires period.
3. Select Add.
4. Copy the secret's Value right away. Microsoft shows it only once. Don't copy the Secret ID, which is a different field and won't work.

Secret expiry: when the secret expires, sync stops. Microsoft limits how long a secret can last, so put a reminder in your calendar a few weeks before the expiry date. To rotate it, create a new secret, paste it into the app (below), and select Verify again.

Now enter the values in Freshservice:

1. Open the app's settings page and go to the Sync tab, then Connection.
2. Fill in:
   • Tenant ID: the Directory (tenant) ID from step 1
   • Client ID: the Application (client) ID from step 1
   • Client secret: the secret Value you just copied
   • Secret expires (optional): the expiry date, so the settings page can remind you
3. Select Verify.

You should see a green Connected · verified … message. If you get an error, see Troubleshooting.

4. Save the settings.

5. Check that your agents match

Sync finds each agent's Outlook calendar by matching the agent's Freshservice email address to a Microsoft 365 mailbox in your tenant.

After sync has run, the Unmatched agents panel on the Connection tab lists agents the app couldn't match. Common reasons:

• The agent's Freshservice email uses a different domain from their Microsoft 365 address, for example a public domain like [email protected] when the mailbox is [email protected].
• The person has no Exchange Online mailbox (no Microsoft 365 license that includes email).
• The email has a typo.

To fix an unmatched agent, change their email in Freshservice so it matches their Microsoft 365 mailbox address (or an alias on that mailbox).

6. Choose what to sync

Open Sync > Preferences. Sync only starts working once Enable calendar sync is on and you've verified the connection.

Tickets and tasks use their planned start and end dates. Work without planned dates doesn't get a calendar event.

What agents see

Nothing to set up. Once sync is on, an agent's assigned work appears on their own Outlook calendar automatically. Each event's subject shows the type and the title, and it links back to the record in Freshservice. The event doesn't copy the ticket's description.

If an agent deletes a sync event from their calendar, it stays deleted. The app doesn't put it back.

Troubleshooting

What access does this grant?

Calendars.ReadWrite as an application permission lets the app read and write calendars for all mailboxes in your tenant, not just the agents you sync. The app only touches the calendars of matched agents, and only the events it created. If your security team needs to limit which mailboxes the app can reach, ask your Exchange administrator about scoping the app in Exchange Online.

To stop sync completely, turn off Enable calendar sync in Sync > Preferences. To revoke the app's access entirely, delete the app registration in Microsoft Entra.