1-on-1 Outlook Calendar Integration Security

Mitzy Ullrich

Modified on: Mon, Dec 18, 2023 at 12:10 PM

Before you start syncing your Outlook calendar with your 1-on-1s, you may be wondering how we ensure the privacy of your data with the integration. Rest assured that we take the privacy of your data very seriously. Continue reading to learn more about how we secure your Outlook calendar data.

1. What does Microsoft provide in their API?

2. What do we pull from the API into our system?

3. How do we secure the data that is in our system?

1. What does Microsoft provide in their API?

To call Microsoft Graph and read Calendar events, we require an access token from the Microsoft identity platform. We only have read permissions for calendars. This is what you are giving us access to when you approve the integration.

The Limeade Listening app is registered with Microsoft Azure Active Directory as an authorized app to request access to organizations' Microsoft Graph Toolkits. When a user requests to have their Outlook calendar be integrated with Limeade Listening, the authorized Limeade Listening app in Azure Active Directory is granted access to specific resources on behalf of the user at your organization who requested the integration.

Below are the steps that we follow with Microsoft Graph when a user adds the Outlook integration to their account:

1. The user logs in to their Microsoft account and gives their consent to sync their Outlook calendar with Limeade Listening so that the 1-on-1s page can be authorized to access their Outlook events.

2. We get an access token from Microsoft. (Limeade Listening is registered with Microsoft as an identity platform and can be authorized by a Microsoft user to access Microsoft Graph.)

3. We call Microsoft Graph with the access token that is provided to us. Limeade Listening then fetches the data from the Microsoft Graph API as in the example below.

HTTP request

The following is an example of a user's calendar:

https://graph.microsoft.com/v1.0/me/calendars/{id}/calendarview?startDatetime=2021-05-28T14:58:39&en

Response

If successful, this method returns a 200 OK response code and the calendar object in the response body. We exclude body and bodyPreview attributes upon fetching recurring events from Outlook Calendar. The following is an example of the response data from the Microsoft Graph API:

{   "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users('1781a97d-8a09-4179-b40d-fddb5c53d31a')/calendars('AQMkADcyNzQxNmVkLTg1OTEtNGU4My1iZjRhLTA3OGU5YTE2MmNiMQBGAAAD-2iESTCQHkG0NpG8YwDBwAcAlCyGeTulaUWJBctu1aa7bQAAAgEGAAAAlCyGeTulaUWJBctu1aa7bQABQAHpJwAAAA%3D%3D')/calendarView(attendees,categories,changeKey,createdDateTime,end,hasAttachments,iCalUId,id,importance,isAllDay,isCancelled,isOrganizer,isReminderOn,lastModifiedDateTime,location,locations,onlineMeetingUrl,organizer,originalEndTimeZone,originalStart,originalStartTimeZone,recurrence,reminderMinutesBeforeStart,responseRequested,responseStatus,sensitivity,seriesMasterId,showAs,start,subject,type,webLink,attachments,calendar,extensions,instances,multiValueExtendedProperties,singleValueExtendedProperties)",   "value": [     {       "@odata.etag": "W/\"lCyGeTulaUWJBctu1aa7bQACXtRGPg==\"",       "id": "AAMkADcyNzQxNmVkLTg1OTEtNGU4My1iZjRhLTA3OGU5YTE2MmNiMQFRAAgI2SVZXXaAAEYAAAAA-2iESTCQHkG0NpG8YwDBwAcAlCyGeTulaUWJBctu1aa7bQAAAAABDQAAlCyGeTulaUWJBctu1aa7bQACXwD34wAAEA==",       "createdDateTime": "2021-05-28T08:10:36.0163396Z",       "lastModifiedDateTime": "2021-05-28T08:10:37.0916191Z",       "changeKey": "lCyGeTulaUWJBctu1aa7bQACXtRGPg==",       "categories": [],       "originalStartTimeZone": "SE Asia Standard Time",       "originalEndTimeZone": "SE Asia Standard Time",       "iCalUId": "040000008200E00074C5B7101A82E00807E5060203B22AF09853D7010000000000000000100000002D3811DD6CBB4C4CBFDF5B1644F7EA24",       "reminderMinutesBeforeStart": 15,       "isReminderOn": true,       "hasAttachments": false,       "subject": "1-on-1 meeting",       "importance": "normal",       "sensitivity": "normal",       "originalStart": "2021-06-02T01:00:00Z",       "isAllDay": false,       "isCancelled": false,       "isOrganizer": true,       "responseRequested": true,       "seriesMasterId": "AQMkADcyNzQxNmVkLTg1OTEtNGU4My1iZjRhLTA3OGU5YTE2MmNiMQBGAAAD-2iESTCQHkG0NpG8YwDBwAcAlCyGeTulaUWJBctu1aa7bQAAAgENAAAAlCyGeTulaUWJBctu1aa7bQACXwD34wAAAA==",       "showAs": "busy",       "type": "occurrence",       "webLink": "https://outlook.office365.com/owa/?itemid=AAMkADcyNzQxNmVkLTg1OTEtNGU4My1iZjRhLTA3OGU5YTE2MmNiMQFRAAgI2SVZXXaAAEYAAAAA%2F2iESTCQHkG0NpG8YwDBwAcAlCyGeTulaUWJBctu1aa7bQAAAAABDQAAlCyGeTulaUWJBctu1aa7bQACXwD34wAAEA%3D%3D&exvsurl=1&path=/calendar/item",       "onlineMeetingUrl": null,       "responseStatus": {         "response": "organizer",         "time": "0001-01-01T00:00:00Z"       },       "start": {         "dateTime": "2021-06-02T01:00:00.0000000",         "timeZone": "UTC"       },       "end": {         "dateTime": "2021-06-02T01:30:00.0000000",         "timeZone": "UTC"       },       "location": {         "displayName": "",         "locationType": "default",         "uniqueIdType": "unknown",         "address": {},         "coordinates": {}       },       "locations": [],       "recurrence": null,       "attendees": [         {           "type": "required",           "status": {             "response": "none",             "time": "0001-01-01T00:00:00Z"           },           "emailAddress": {             "name": "may261@tinypulse.com",             "address": "may261@tinypulse.com"           }         }       ],       "organizer": {         "emailAddress": {           "name": "Phong",           "address": "phong@tinypulse.com"         }       }     },     {       "@odata.etag": "W/\"lCyGeTulaUWJBctu1aa7bQACXtRGPg==\"",       "id": "AAMkADcyNzQxNmVkLTg1OTEtNGU4My1iZjRhLTA3OGU5YTE2MmNiMQFRAAgI2SrZhlrAAEYAAAAA-2iESTCQHkG0NpG8YwDBwAcAlCyGeTulaUWJBctu1aa7bQAAAAABDQAAlCyGeTulaUWJBctu1aa7bQACXwD34wAAEA==",       "createdDateTime": "2021-05-28T08:10:36.0163396Z",       "lastModifiedDateTime": "2021-05-28T08:10:37.0916191Z",       "changeKey": "lCyGeTulaUWJBctu1aa7bQACXtRGPg==",       "categories": [],       "originalStartTimeZone": "SE Asia Standard Time",       "originalEndTimeZone": "SE Asia Standard Time",       "iCalUId": "040000008200E00074C5B7101A82E00807E5060903B22AF09853D7010000000000000000100000002D3811DD6CBB4C4CBFDF5B1644F7EA24",       "reminderMinutesBeforeStart": 15,       "isReminderOn": true,       "hasAttachments": false,       "subject": "1-on-1 meeting",       "importance": "normal",       "sensitivity": "normal",       "originalStart": "2021-06-09T01:00:00Z",       "isAllDay": false,       "isCancelled": false,       "isOrganizer": true,       "responseRequested": true,       "seriesMasterId": "AQMkADcyNzQxNmVkLTg1OTEtNGU4My1iZjRhLTA3OGU5YTE2MmNiMQBGAAAD-2iESTCQHkG0NpG8YwDBwAcAlCyGeTulaUWJBctu1aa7bQAAAgENAAAAlCyGeTulaUWJBctu1aa7bQACXwD34wAAAA==",       "showAs": "busy",       "type": "occurrence",       "webLink": "https://outlook.office365.com/owa/?itemid=AAMkADcyNzQxNmVkLTg1OTEtNGU4My1iZjRhLTA3OGU5YTE2MmNiMQFRAAgI2SrZhlrAAEYAAAAA%2F2iESTCQHkG0NpG8YwDBwAcAlCyGeTulaUWJBctu1aa7bQAAAAABDQAAlCyGeTulaUWJBctu1aa7bQACXwD34wAAEA%3D%3D&exvsurl=1&path=/calendar/item",       "onlineMeetingUrl": null,       "responseStatus": {         "response": "organizer",         "time": "0001-01-01T00:00:00Z"       },       "start": {         "dateTime": "2021-06-09T01:00:00.0000000",         "timeZone": "UTC"       },       "end": {         "dateTime": "2021-06-09T01:30:00.0000000",         "timeZone": "UTC"       },       "location": {         "displayName": "",         "locationType": "default",         "uniqueIdType": "unknown",         "address": {},         "coordinates": {}       },       "locations": [],       "recurrence": null,       "attendees": [         {           "type": "required",           "status": {             "response": "none",             "time": "0001-01-01T00:00:00Z"           },           "emailAddress": {             "name": "may261@tinypulse.com",             "address": "may261@tinypulse.com"           }         }       ],       "organizer": {         "emailAddress": {           "name": "Phong",           "address": "phong@tinypulse.com"         }       }     }   ] }

2. What do we pull from the API into our system?

In Limeade Listening

After fetching Outlook events from Microsoft Graph, the 1-on-1s page selects the events that meet our requirements and display the list in 1-on-1s Outlook page.

Outlook calendar events will only be displayed as an option for a 1-on-1 if they meet all of the following conditions:

The Outlook event must be a recurring meeting
The Outlook event must only include you (the manager) and your direct report
The privacy settings on your calendar event must be public so that Limeade Listening can see the event
The Outlook event must be a unique creation - please make sure that it is not copied and pasted from another event

In our database

In our database, we store the provider_data which is granted to us with the Microsoft Graph API.

The following is an example of the data we store from the Microsoft Graph API:

{   "id": "AAMkADliODkzZWY3LTllYzAtNDBiZi04MTU0LWNlOTIxNWE3MDFmZAFRAAgI2TtaAQeAAEYAAAAATBx21GhwC0SkJVGP8P4K-gcAGjtRCEQQa0eljhSJXnPrmAAAALidtgAAHgaZ3DsqzUWXn5Gl_FDdRAACK8mO_wAAEA==",   "end": {     "date_time": "2021-06-30T23:15:00.0000000",     "time_zone": "America/Los_Angeles"   },   "type": "occurrence",   "start": {     "date_time": "2021-06-30T22:45:00.0000000",     "time_zone": "America/Los_Angeles"   },   "showAs": "busy",   "iCalUId": "040000008200E00074C5B7101A82E00807E5061ED095127C4C19D60100000000000000001000000027FA54554C06BC40B04EEB0254466606",   "subject": "Werner / Jesse O3",   "webLink": "https://outlook.office365.com/owa/?itemid=AAMkADliODkzZWY3LTllYzAtNDBiZi04MTU0LWNlOTIxNWE3MDFmZAFRAAgI2TtaAQeAAEYAAAAATBx21GhwC0SkJVGP8P4K%2FgcAGjtRCEQQa0eljhSJXnPrmAAAALidtgAAHgaZ3DsqzUWXn5Gl%2BFDdRAACK8mO%2BwAAEA%3D%3D&exvsurl=1&path=/calendar/item",   "declined": null,   "isAllDay": false,   "location": {     "uniqueId": "Microsoft Teams Meeting",     "displayName": "Microsoft Teams Meeting",     "locationType": "default",     "uniqueIdType": "private"   },   "provider": "microsoft",   "attendees": [     {       "type": "required",       "status": {         "time": "0001-01-01T00:00:00Z",         "response": "none"       },       "emailAddress": {         "name": "Jesse Smith",         "address": "jesse.smith@smartdolphins.com"       }     },     {       "type": "required",       "status": {         "time": "2020-12-07T16:45:12.057Z",         "response": "accepted"       },       "emailAddress": {         "name": "Werner Baron",         "address": "werner.baron@smartdolphins.com"       }     }   ],   "changeKey": "HgaZ3DsqzUWXn5Gl+FDdRAADy11vtw==",   "locations": [     {       "uniqueId": "ec7c7126-ad45-4f26-beb9-442fc830feb0",       "displayName": "Microsoft Teams Meeting",       "locationType": "default",       "uniqueIdType": "locationStore"     }   ],   "organizer": {     "emailAddress": {       "name": "Jesse Smith",       "address": "jesse.smith@smartdolphins.com"     }   },   "categories": [     "Orange category"   ],   "importance": "normal",   "recurrence": [],   "@odata.etag": "W/\"HgaZ3DsqzUWXn5Gl+FDdRAADy11vtw==\"",   "isCancelled": false,   "isOrganizer": true,   "sensitivity": "normal",   "isReminderOn": true,   "originalStart": "2021-06-30T22:45:00Z",   "hasAttachments": false,   "responseStatus": {     "time": "0001-01-01T00:00:00Z",     "response": "organizer"   },   "seriesMasterId": "AAMkADliODkzZWY3LTllYzAtNDBiZi04MTU0LWNlOTIxNWE3MDFmZABGAAAAAABMHHbUaHALRKQlUY-w-gr_BwAaO1EIRBBrR6WOFIlec_uYAAAAuJ22AAAeBpncOyrNRZefkaX4UN1EAAIryY77AAA=",   "createdDateTime": "2020-04-23T15:52:24.6158594Z",   "onlineMeetingUrl": null,   "provider_event_id": "AAMkADliODkzZWY3LTllYzAtNDBiZi04MTU0LWNlOTIxNWE3MDFmZAFRAAgI2TtaAQeAAEYAAAAATBx21GhwC0SkJVGP8P4K-gcAGjtRCEQQa0eljhSJXnPrmAAAALidtgAAHgaZ3DsqzUWXn5Gl_FDdRAACK8mO_wAAEA==",   "responseRequested": true,   "originalEndTimeZone": "Pacific Standard Time",   "original_start_time": {     "date_time": "2021-06-30T22:45:00Z",     "time_zone": "America/Los_Angeles"   },   "lastModifiedDateTime": "2021-03-13T16:19:33.7438326Z",   "originalStartTimeZone": "Pacific Standard Time",   "provider_parent_event_id": "AAMkADliODkzZWY3LTllYzAtNDBiZi04MTU0LWNlOTIxNWE3MDFmZABGAAAAAABMHHbUaHALRKQlUY-w-gr_BwAaO1EIRBBrR6WOFIlec_uYAAAAuJ22AAAeBpncOyrNRZefkaX4UN1EAAIryY77AAA=",   "reminderMinutesBeforeStart": 15 }

3. How do we secure the data that is in our system?

Since we are a cloud-stored software service, all of our data is stored in Amazon's secure data centers (AWS Aurora databases) located in the United States in Virginia. Limeade Listening uses secure methods supplied by AWS to connect our data to their secure data centers. Our data is backed up daily and our backup retention period is 45 days.

Only granted and authorized employees (on behalf of Limeade Listening) have access to the data centers to do maintenance tasks, and every employee’s action is logged and audited.

Limeade Listening is ISO 27001 compliant and does an annual penetration test to find any security vulnerabilities.