The Outlook calendar integration lets employees connect their personal Microsoft 365 or Outlook calendar with ZEP. The selected appointments appear in the calendar view of the project times (in ZEP Clock: working times) and serve as orientation during time recording.
Note: Available in ZEP Clock, ZEP Compact and ZEP Professional. The connection is made per employee. ZEP uses a centrally provided Microsoft application. You do not need to register your own app, configure a redirect URI or store a client secret.
Requirements
Microsoft 365 or Exchange Online account of the employee
Access to the calendar view of the project times in ZEP
A current browser in which redirects and pop-ups for ZEP are not blocked
For the approval, a suitable Microsoft Entra administrator role or a configured reviewer
Scope of synchronisation
The integration displays appointments from the employee's own, selected calendars. Shared calendars of other users are not offered. Whether private appointments are visible is decided by the employee.
The appointments are read for display only. ZEP does not currently create, change or delete any Outlook appointments.
Note: The permissions are delegated. The application acts on behalf of the signed-in user and does not receive blanket tenant-wide access to other mailboxes. A tenant-wide administrator consent authorises the app for the organisation, while the actual access remains bound to the signed-in user.
Two approval paths
Which flow appears depends on the setting for admin consent requests in Microsoft Entra.
Setting | Effect | Applicable path |
No | Users cannot send an approval request from the Microsoft dialog. An administrator grants consent directly for the organisation. | Path 1 |
Yes | Users can send an approval request with a justification to the configured reviewers. | Path 2 |
Tip: For a structured approval process, Path 2 makes sense if the admin consent workflow is already set up. For a deliberately centralised, one-time approval, Path 1 can be faster. Your internal security and approval policy remains authoritative.
Path 1 – Administrator consent for the organisation
This path is suitable when users cannot send admin consent requests or when the application is to be approved directly by an administrator. After consent, employees connect their personal Microsoft account with ZEP without each user needing a separate admin approval.
1. Open the Outlook connection. Open the Project Times area in ZEP and select the Outlook icon on the right.
2. Start the connection. In the dialog, select Link to Outlook Calendar.
3. Select a Microsoft account. Choose the desired Microsoft account or Use another account.
4. Recognise the admin approval requirement. If consent by regular users is blocked, Need admin approval appears. The connection cannot be completed by the user at this point.
5. Start the process as an administrator. An administrator opens the Outlook connection in ZEP again.
They then sign in with a suitable administrator account.
6. Grant consent for the organisation. Review the requested permissions, enable Consent on behalf of your organisation and select Accept.
Warning: Before accepting, check the application name ZEP Outlook Kalender Integration, the publisher ZEP GmbH and the requested permissions. Grant the approval only via the expected Microsoft sign-in dialog.
Path 2 – User request and approval in Microsoft Entra
This path requires the admin consent workflow to be enabled in Microsoft Entra and at least one reviewer to be defined. The user submits the request, and a reviewer or administrator processes it in the Entra admin center.
Part A – Request by the employee
1. Open the Outlook connection. Under Project Times, select the Outlook icon.
2. Start the connection. Select Link to Outlook Calendar.
3. Select a Microsoft account. Choose your personal Microsoft 365 account.
4. Justify the request. Microsoft displays the required permissions. Optionally enter a short justification, for example for project time recording.
5. Submit the request. Select Request approval. Microsoft then confirms that the request has been sent.
Note: The Outlook connection is not yet complete at this point. Wait for the approval and then start the connection in ZEP again.
Part B – Review by the administrator
6. Open the requests in Entra. In the Microsoft Entra admin center, go to Enterprise applications and then to Admin consent requests.
7. Select the ZEP application. Open the application ZEP Outlook Kalender Integration in the list.
8. Review requester and justification. Under Requested by, you can see which user submitted the request and which justification was provided.
9. Review permissions and consent. Select Review permissions and consent.
10. Select an administrator account. Sign in with an account that is allowed to grant the required consent.
11. Accept the permissions. Check the application name, publisher and permissions and approve the request with Accept.
12. Verify the successful approval. Entra shows a confirmation. The request disappears from the list of pending requests.
Part C – Complete the connection
13. Start the connection again. The employee opens the Outlook dialog in ZEP again and selects Link to Outlook Calendar.
14. Select the Microsoft account. Choose the previously used Microsoft account.
15. Select calendars and save. In the Manage Outlook Calendar dialog, enable the desired calendars, optionally set the visibility via Show private appointments and confirm with Save. The selected Outlook appointments now appear in ZEP.
Microsoft Graph permissions
The ZEP application requests delegated permissions. Delegated means that the application acts in the context of the signed-in user and only accesses resources that this user can access themselves.
Permission | Type | Purpose |
openid | OpenID Connect scope | Enables sign-in and provides a unique user identity. |
profile | OpenID Connect scope | Provides basic profile information for sign-in. |
offline_access | OpenID Connect scope | Allows the connection to persist without the employee having to sign in again on each refresh. |
User.Read | Delegated Graph permission | Reads the basic profile of the signed-in user. No access to the profiles of other users. |
Calendars.ReadWrite | Delegated Graph permission | Allows access to the calendars and appointments of the signed-in user. The current ZEP function uses the access for display only. Technically, the scope also includes write access. |
Why Calendars.ReadWrite. Microsoft displays the technically requested permission. The ZEP Outlook calendar integration currently uses calendars and appointments for display only. The broader scope is already requested with a view to a planned future synchronisation of appointments between ZEP and Outlook. These write functions are not currently part of the integration.
Note: The integration does not use application permissions for unattended, tenant-wide access. The calendar permission is delegated and bound to the signed-in user.
Operation and administration
After setup, employees and administrators manage the connection in the following places.
Removing the connection
The employee opens the Outlook dialog again and selects Delete calendars. This removes the connection and the associated tokens stored in ZEP. A tenant-wide consent already granted in Entra remains unaffected.
Reviewing or revoking consent centrally
Administrators find the application under Microsoft Entra > Enterprise applications and review the granted permissions there. Revoking or disabling the application affects all users of the tenant and should therefore be coordinated.
Organisational recommendations
Document the approval by IT or information security
Check the application name, publisher and permissions before granting consent
Authorise only the necessary Entra administrators or reviewers
Review approvals and enterprise applications regularly
Inform employees about the visibility of private appointments and the corresponding ZEP setting
On offboarding, remove the ZEP connection and revoke Microsoft sessions according to your company process
Troubleshooting
Message "Need admin approval". User consent is restricted in the tenant, or the requested permissions may not be granted by the user themselves. Use Path 1 or set up the admin consent workflow for Path 2.
No "Request approval" button. The setting for user requests is disabled or the workflow is not fully configured. Check the admin consent settings in Entra and whether reviewers are configured.
The request does not appear in Entra. Check whether the request was actually sent, whether the correct tenant is active and whether the signed-in administrator is authorised as a reviewer. After changes to the workflow, a short delay can occur. Refresh the list.
The administrator cannot approve the request. Check the assigned Entra role or the reviewer configuration. Use only a role that is allowed to grant the required consent.
The approval dialog still appears after approval. Start the ZEP connection again. Refresh the browser session, sign out and in again if necessary, or test a private browser window. Also check the Microsoft account and tenant.
No return to ZEP after the Microsoft sign-in. Check pop-up and redirect blockers and allow cookies for ZEP and Microsoft. Disable tracking or script blockers as a test and start the process again.
The calendar list is empty. Check whether the selected account has Exchange Online or a reachable Outlook calendar and whether the correct account was used. Shared calendars of other users are not offered.
Appointments are missing. Check whether the calendar concerned was enabled and saved in the ZEP dialog, and refresh the calendar view. For private appointments, additionally enable Show private appointments.
Display "Have full access to user calendars" although ZEP only reads. Microsoft summarises the requested scope Calendars.ReadWrite in this form. The current ZEP function uses the appointments for display only, but the technical scope contains read and write rights.
Own Entra app registration. The customer does not need to register their own Entra app. ZEP uses a centrally provided Microsoft application. A redirect URI or a client secret on the customer side are not required.
Scope of the administrator approval. The approval allows the use of the application in the tenant. It does not automatically connect the calendars of all employees. Each employee establishes the connection themselves, and the access is delegated and takes place in the context of the signed-in user.
Information for support. Helpful details are the time of the error, the affected user, the tenant used, a screenshot of the message, the browser, the application name and, if applicable, the Microsoft trace ID or correlation ID and whether Path 1 or Path 2 was used. Do not transmit any passwords or tokens.
Checklists
The following checklists summarise the steps briefly.
Checklist for employees
Open Project Times
Select the Outlook icon
Start Link to Outlook Calendar
Select the correct Microsoft account
If required, request approval and wait for it
Start the connection again after the approval
Select the desired calendars
Deliberately set the display of private appointments
Save and check the display in the calendar
Checklist for Entra administrators
Check which setup path applies
Verify the application name and publisher
Review the requested Graph permissions
For Path 2, review the requester and justification
Grant consent with a suitable administrator account
Verify the successful approval
Document the approval internally
Review the permissions regularly
Further Microsoft information
The following Microsoft documents explain permissions and consent processes. Names and navigation paths in the Entra admin center can change due to Microsoft updates.
Support and responsibility
For questions about the ZEP configuration or the ZEP application used, contact ZEP support. Questions about roles, policies and consent processes in Microsoft Entra are handled by your Microsoft 365 or Entra administration.
Note: This integration embeds Outlook appointments for display in ZEP. If you instead want to subscribe to your ZEP calendar in Outlook, use the CalDav connection described in the article Profile.