When a user logs in on https://app.askdonna.com with a Microsoft account, a Microsoft Enterprise Application is created in the Microsoft tenant of the user.

To view the enterprise application, a Microsoft/Azure administrator can go to https://portal.azure.com and go to the Microsoft Entra ID service, then Enterprise applications.

You should see a list of all enterprise applications

Find and go to the enterprise application called “Donna”

Here an administrator can manage properties, users and groups and permissions.

A useful setting is “Assignment required?”. With this setting set to Yes, an administrator can restrict the users who can login and connect their Outlook calendar to Donna using their Microsoft account to only those users that are listed under Users and groups. If this setting is set to Yes, a user will first have to be added under “Users and groups” before he/she can user their Microsoft account to login and connect their Outlook calendar.

Note that Donna currently also allows to login using the email address, so the above setting can be bypassed in the app. The above setting however cannot be bypassed for users connecting their Outlook calendar.

On the permissions page, administrators can review the permissions granted to Donna.

The permissions required to login to the app using a Microsoft account are openid, profile, offline_access and User.Read. To connect their calendar, a user also requires the permission Calendars.Read.

Depending on your Microsoft Entra ID consent and permissions settings, the user can grant consent themselves for these permissions (User consent for applications is set to "Allow user consent for apps") or requires administrator consent (User consent for applications is set to "Do not allow user consent" or "Allow user consent for apps from verified publishers, for selected permissions").

If admin consent is required, the user will first submit an approval request (the user will automatically get a screen to submit an approval request when logging in into Donna using his/her Microsoft account or when trying to connect their calendar) and the administrator can subsequently approve the request to grant the permissions to the entire organisation. It is not possible for an administrator to grant these permissions upfront without a user's request. Subsequent users will then be able to login or connect their calendar without having to request approval.

Note: Permissions are different for login and connecting the calendar. If previous admin consent was granted for login permissions, another admin consent is to be granted for connecting the calendar permissions.