Sign-in & directories

Calendar access

Connect everybody's calendar automatically — once for the whole organisation, with Microsoft 365 or Google Workspace.

With calendar access set up, everybody's calendar is simply there in the app — nobody has to choose Connect and consent themselves. You set it up once under Settings › Calendar. Only the organisation's owner can.

Calendar access finds a mailbox by its email address — however somebody signs in to DDM: with a password, through the directory service (LDAP/Active Directory) or with single sign-on. If your Active Directory's mailboxes live in Microsoft 365 or Google Workspace, everybody who signs in with LDAP is covered too.

In which order calendars are connected

Calendar access (this page): DDM connects every calendar the access reaches — when Calendar is opened, and every 15 minutes in the background, so newcomers within a quarter of an hour.
Company sign-in: where the access does not reach somebody, the Microsoft sign-in through single sign-on can bring the calendar along – see Microsoft Entra ID.
By hand: otherwise each person chooses Connect in the app, as before.

Microsoft 365

Calendar access uses an app in Microsoft Entra ID with the application permission Calendars.ReadWrite. You can reuse the app of your Microsoft sign-in — DDM then offers Take over credentials.

Register an app

In the Entra admin center, under App registrations, add a new registration, e.g. DDM Calendar, for accounts in this directory only.

Under API permissions › Add a permission › Microsoft Graph › Application permissions, choose Calendars.ReadWrite, then Grant admin consent.

Create a secret

Under Certificates & secrets, create a client secret and copy its value.

Enter it in DDM

Under Settings › Calendar › Microsoft 365, enter the directory (tenant) ID, the application (client) ID and the secret, save, Test connection with your own mailbox, and switch the access on.

An application permission applies to every mailbox in your tenant. DDM only uses it for members of your organisation in DDM — still, limit it to the group that uses DDM, with an Application Access Policy or RBAC for Applications in Exchange Online. Anybody outside it connects their calendar themselves, as before.

Google Workspace

Calendar access uses a service account with domain-wide delegation. DDM acts for each person in turn, and only in Calendar.

Create a service account

In the Google Cloud Console, enable the Google Calendar API, create a service account under IAM & Admin › Service accounts, and download a JSON key under Keys.

Grant delegation

In the Admin console, under Security › Access and data control › API controls › Domain-wide delegation, add the service account's client ID with the scope https://www.googleapis.com/auth/calendar.

Enter it in DDM

Under Settings › Calendar › Google Workspace, paste the content of the JSON file, save, test with your mailbox and switch it on.

If your calendar runs on a server of your own – Nextcloud, SOGo, Zimbra, Open-Xchange – that uses the same credentials as your directory service, DDM connects the calendar at sign-in:

Enter the server

Under Settings › Calendar › Company CalDAV with directory sign-in, enter the server's CalDAV address, e.g. https://cloud.example.com/remote.php/dav.

Choose the user name

Whether the server knows people by their email address or by the login name from the directory (uid, sAMAccountName).

Choose the directory and switch it on

Choose the directory service your people sign in with, save and switch it on.

When somebody then signs in through the directory service, DDM checks the credentials with the calendar server and connects the calendar. If that does not work, nothing happens – the sign-in goes ahead regardless.

For this DDM stores the person's directory password – encrypted, for the calendar only, anew at every sign-in. Without this access DDM never stores directory passwords. If somebody changes their password in the directory, the calendar does not sync until their next sign-in. Switching the access off or removing it deletes every password stored this way.

What people see

A calendar connected this way shows under its account in the app, marked Connected by your organisation. Whoever disconnects it does not get it back automatically — if they connect it themselves later, that counts again.

Switch the access off, and the calendars say it no longer works. Remove it, and the calendars connected through it are disconnected in DDM; the appointments stay with Microsoft or Google.

Passkeys

Signing in with a fingerprint, Face ID or the device PIN instead of a password — allowed, not allowed or required, as your organisation decides.

Overview

DDM's MCP server – search, read, analyse and, with your approval, change things in DDM from Claude, ChatGPT, Cursor and other AI apps.