Calendar integration - Moving to Microsoft Graph (November release)

IRIS Cascade currently uses Exchange Web Services (EWS) for the Outlook integration. Microsoft have now begun the process to deprecate EWS, removing support for it entirely by April 2027. The November release of IRIS Cascade includes changes to our software to switch this module from EWS to GraphAPI – a more modern solution.

Please read the Microsoft Exchange Team Blog for more up to date info. It has details on what IT admins might be able to do to enable EWS for specific applications using an 'allow list'.

At a glance - does this affect you?

Do I use Outlook Integration? If you can answer 'Yes' to both these questions you most likely do.

  • Check your Cascade licence (Admin > Licences), do you have 'Outlook Integration' ticked?

  • Check your Calendar Integration Providers in Admin, is Microsoft Outlook enabled?

Do I need to enable EWS if it was already disabled?

No. Once the November release goes live, you can safely switch to using the newer GraphAPI seamlessly. You just need to speak to your IT team.

Our recommendation

We recommend giving your IT team/administrator access to the Calendar Integration Providers page within Admin. This allows them to enter a “Client Secret” value without having to share it – this secret value ensures that it is the IRIS Cascade system authenticating with the app registration and nothing else, allowing the integration of your holidays and absences to work securely.

This can be done by creating a new role and assigning it to the IT users. The role should have access to;

  • Admin > Admin dashboard

  • Interfaces and diagnostics

  • Interfaces and diagnostics > Calendar integration providers

Re-use any existing Entra App registration, simply updating it for the new Graph API permissions required. You can even ask your IT to do this ahead of time, so your integration is ready to run as soon as IRIS Cascade is updated.

How do you check the existing setup?

Look in Admin > Calendar integration providers > Microsoft Outlook. In here you will find 3 fields: Tenant ID, Application ID, and Client Secret.

Note down the values of the Tenant ID and Application ID fields and take them to your IT. These values will help them identify any Entra App registration you have in place already.

How to reuse the existing Entra application

Your IT will need to complete this for you.

  1. In the Microsoft Entra blade of the Azure portal, go to App registrations and open the existing Cascade application.

  2. Certificates & secrets: if there's no client secret or the secret will expire soon, create and a new client secret and copy the Value immediately.

  3. Under API permissions, add Microsoft Graph application permissions:

    1. Calendars.ReadWrite - enables the creation, updating and deletion of calendar events.

    2. MailboxSettings.Read - read the mailbox timezone settings for the correct event scheduling.

    3. User.Read.All - Translate item IDs from events created using EWS to the new IDs used by Graph.

    4. Important: Keep EWS permissions temporarily if you need rollback capability. Only remove EWS permissions after it is verified that everything is working and no other systems depend on them.

    5. Click 'Grant admin consent for [Your Organisation]' and confirm.

  4. Proceed to 'Configure Cascade' below and update the Client Secret field only. The Tenant ID and Application ID should already be populated.

How to create a new Entra application

Your IT will need to complete this for you.

Use this path only if you do not have an existing Cascade application registration, or if your IT want to separate the existing one.

  1. In the Microsoft Entra blade of the Azure portal, go to App registrations and create a new registration.

    1. Name: IRIS Cascade Calendar Integration (or your naming convention)

    2. Supported account types: choose according to your tenant requirements.

    3. Click Register

  2. Copy and Save:

    • Application (client) ID

    • Directory (tenant) ID

  3. Go to Certificates & secrets > New secret. Enter a description and expiry, create the secret, then immediately copy the Value. You will not be able to see the Value again.

  4. Under API permissions, add Microsoft Graph application permissions:

    • Calendars.ReadWrite - Enables the creation, updating and deletion of calendar events.

    • MailboxSettings.Read - Read the mailbox timezone settings for correct event scheduling.

    • User.Read.All - Translate item IDs from events created using EWS to the new IDs used by Graph

  5. Click 'Grant admin consent for [Your organisation]' and confirm.

Updating Cascade

In Admin > Calendar integration providers > Microsoft Outlook, update as follows.

  • Authentication Method: Modern (Microsoft365)

  • Tenant ID: paste Directory (tenant) ID from Entra

  • Application ID: paste Application (client) ID from Entra

  • Client Secret: paste the secret value created in Entra

  • Microsoft Graph Scopes: {https://graph.microsoft.com/.default}

  • Save

Verify and test

Create a test calendar event in Cascade and confirm it appears in the linked Outlook/Exchange mailbox. Note: mailboxes are linked based on the employee’s Work Email field on the MAIN screen.

Troubleshooting

  • Symptom: Authentication failures

    • Check: Secret copied correctly and not expired. Confirm Application (client) ID and Directory (tenant) ID match the app.

  • Symptom: Permissions denied errors

    • Check: Microsoft Graph permissions (Calendars.ReadWrite, MailboxSettings.Read) are present and admin consent has been granted.