Microsoft Bookings

MICROSOFT 365 · CALENDAR

Booking businesses, services, and appointments through Graph.

Connect Microsoft Bookings with Fabriq Developer

Your user consents at Microsoft Bookings. The credential lands in a vault your agent cannot read, and the tool list it gets back is the intersection of that user’s grant and the agent’s own scopes.

provider “microsoft_bookings”

from af_sdk import AgenticFabriq

af = AgenticFabriq()                      # reads AF_APP_ID / AF_APP_SECRET

url = await af.initiate_connection(request, provider="microsoft_bookings")   # consent at Microsoft Bookings
return redirect(url)

async with await af.for_user(request) as session:
    tools = await session.get_tools()     # only what this user granted

Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.

Connecting Microsoft Bookings in practice

Listing the Bookings businesses in a tenant is capped at 500 mailboxes with no pagination at all, and the list returns only id and displayName, so every business you actually want costs its own GET. The single throttling figure Microsoft publishes for Bookings is four concurrent requests per app and booking mailbox — there is no documented requests-per-minute ceiling to design against.

Scopes that draw scrutiny

Bookings.Read.All Reads appointments, businesses, customers, services and staff, which means customer names, email addresses and phone numbers. Admin consent is required for the application form, not the delegated one.
Bookings.ReadWrite.All Read and write bookings information, but Microsoft notes it "Does not allow create, delete and publish of booking businesses" — so it is not enough to stand up a new scheduling page.
Bookings.Manage.All The only permission that can create, delete and publish a booking business, which is the grant that can make a public scheduling URL appear or disappear.
BookingsAppointment.ReadWrite.All Reads and writes appointments and customers while only reading businesses, services and staff — the narrowest write grant for an agent that just books things.

Rate limits

Four concurrent requests per app ID and booking-mailbox combination, on both the v1.0 and beta endpoints. Exceeding it for one mailbox does not affect the app’s access to another.
No request-count limit is published for the Bookings service, unlike the Outlook service’s 10,000 requests per 10 minutes.
Microsoft Graph’s global ceiling of 130,000 requests per 10 seconds per app across all tenants still applies.
GET /solutions/bookingBusinesses returns at most 500 mailboxes, and Microsoft states that "Pagination of the results is not currently supported".

Who has to approve

Every Bookings permission requires tenant admin consent in its application form and none of them does in the delegated form, so a staff member can connect their own booking calendar while an unattended tenant-wide agent stops at a consent screen. Personal Microsoft accounts are not supported for the Bookings API at all.

Worth knowing

The businesses list returns only id and displayName "for performance considerations", and a bookingBusiness id is an SMTP address rather than a GUID, which breaks code that assumes Graph ids are opaque GUIDs.
customerNotes, serviceNotes and reminders are populated only when you read a single appointment by its id — they are simply absent from the appointments collection, so a list-then-process pipeline loses them.
publicUrl and isPublished are read-only: making a scheduling page live is the separate publish action, and unpublish nulls the URL, so the customer-facing link is not a property you can set.
When a service allows more than one attendee you have to create bookingCustomer records first and pass valid customer IDs; you cannot just put names on the appointment.

Checked against Microsoft Graph throttling limits — Bookings service (2026-09-29), List bookingBusinesses (2026-09-29), bookingAppointment resource type (2026-09-29), Microsoft Graph permissions reference (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

microsoft_bookings_cancel_booking_appointmentWRITE

Cancel an appointment in a Bookings business.

BookingsAppointment.ReadWrite.All

microsoft_bookings_create_booking_appointmentWRITE

Create a new appointment in a Microsoft Bookings business.

BookingsAppointment.ReadWrite.All

microsoft_bookings_create_booking_businessWRITE

Create a new Microsoft Bookings business.

Bookings.ReadWrite.All

microsoft_bookings_create_booking_customerWRITE

Create a new customer for a Bookings business.

Bookings.ReadWrite.All

microsoft_bookings_create_booking_serviceWRITE

Create a new service for a Bookings business.

Bookings.ReadWrite.All

microsoft_bookings_create_booking_staff_memberWRITE

Add a staff member to a Bookings business.

Bookings.ReadWrite.All

microsoft_bookings_delete_booking_appointmentWRITE

Delete an appointment from a Bookings business.

BookingsAppointment.ReadWrite.All

microsoft_bookings_delete_booking_businessWRITE

Delete a Microsoft Bookings business. Requires Bookings.Manage.All.

Bookings.Manage.All

microsoft_bookings_delete_booking_customerWRITE

Delete a customer from a Bookings business.

Bookings.ReadWrite.All

microsoft_bookings_delete_booking_serviceWRITE

Delete a service from a Bookings business.

Bookings.ReadWrite.All

microsoft_bookings_delete_booking_staff_memberWRITE

Delete a staff member from a Bookings business.

Bookings.ReadWrite.All

microsoft_bookings_get_booking_businessREAD

Get a specific Microsoft Bookings business by ID.

Bookings.Read.All

microsoft_bookings_list_booking_appointmentsREAD

List appointments for a Microsoft Bookings business.

Bookings.Read.All

microsoft_bookings_list_booking_businessesREAD

List Microsoft Bookings businesses for the authenticated user.

Bookings.Read.All

microsoft_bookings_list_booking_customersREAD

List customers of a Microsoft Bookings business.

Bookings.Read.All

microsoft_bookings_list_booking_servicesREAD

List services offered by a Microsoft Bookings business.

Bookings.Read.All

microsoft_bookings_list_booking_staffREAD

List staff members of a Microsoft Bookings business.

Bookings.Read.All

microsoft_bookings_update_booking_appointmentWRITE

Update an existing appointment in a Bookings business.

BookingsAppointment.ReadWrite.All

microsoft_bookings_update_booking_businessWRITE

Update a Microsoft Bookings business.

Bookings.ReadWrite.All

microsoft_bookings_update_booking_customerWRITE

Update a customer of a Bookings business.

Bookings.ReadWrite.All

microsoft_bookings_update_booking_serviceWRITE

Update a service for a Bookings business.

Bookings.ReadWrite.All

microsoft_bookings_update_booking_staff_memberWRITE

Update a staff member of a Bookings business.

Bookings.ReadWrite.All

Often connected alongside

Put Microsoft Bookings behind one governed endpoint.

Same permissions, same audit trail, whatever else you connect next.

Start free See pricing