Skip to content
Submit support ticket
  • There are no suggestions because the search field is empty.

Security review FAQ: calendar access, scoping and data retention

This article answers the questions security teams most often ask when they review AskCody's access to Microsoft 365.

This article is for IT Admins, security reviewers and Exchange teams who are assessing AskCody before or during implementation. It collects the questions we get most often in cyber reviews and gives a short answer to each, with links to the full articles. If you need the complete permission list, read Permissions used and required connecting AskCody with MS Graph and Entra ID.

Does AskCody access our mailboxes or email?

No. AskCody works on calendars only. It does not read email, attachments, files, contacts or any other part of a mailbox. AskCody requests no Mail, Files or Sites permissions.

When this article talks about "mailbox scope", what is actually in scope is the calendar in each of those mailboxes.

What is the minimum scope AskCody needs?

AskCody needs access to two sets of calendars:

  • The calendars of every room and desk connected to AskCody.
  • The calendars of the people who book or attend meetings in those rooms.

Nothing beyond that. The rest of your tenant can stay outside the scope.

Note: Two permissions, User.Read.All and GroupMember.Read.All, cannot be limited to specific mailboxes. That is how Microsoft designed them. They are read-only directory permissions that AskCody uses to sync users and groups from Microsoft Entra ID (former Azure AD). They give no access to calendar content, email or files.

Can we limit access to room and resource mailboxes only?

You can, but services, visitor registrations and utilization data will be incomplete.

AskCody reads and writes the organizer's calendar so that what you see in AskCody stays correct after a meeting is booked, for example when it is rescheduled or canceled in Outlook. AskCody also uses the organizer's calendar to link service orders and visitor registrations to the right meeting. With a rooms-only scope, AskCody cannot see those changes.

Read more in Limiting AskCody's access in Exchange Online.

Can we exclude sensitive groups, such as Executive Leadership, Legal or HR?

Yes. Your Exchange team builds the exclusion into the scope, and Microsoft enforces it inside your own tenant.

The effect is clear-cut: meetings organized by people outside the scope cannot be managed through AskCody. That means no services, no visitor registrations and no changes to those meetings through AskCody. Those users keep booking in Outlook exactly as they do today.

The exclusion is real because of how AskCody is built. AskCody does not keep its own calendar next to Exchange. Exchange stays the single source of truth, and AskCody works on top of it. There is no second copy of the excluded meetings in AskCody that could get around the restriction.

What excluded meetings look like in AskCody

A meeting organized by an excluded user in a room connected to AskCody is still in that room's calendar, because the room calendar is in scope. AskCody can show the meeting wherever it shows meetings from the meeting room's perspective, such as Room Displays, Dashboards, Maps and Central. The organizer's name is shown, because it is part of the meeting in the room calendar.

The meeting can only be viewed. It cannot be rescheduled, ended early, canceled or changed in any other way through AskCody, and it cannot be dragged to another room in Central.

Which meeting data does AskCody read from Exchange?

Only these calendar fields:

  • Organizer name and email
  • Subject and description
  • Private flag
  • Start and end time
  • Location
  • Attendees (name and email)
  • Resources (name and email)
  • Exchange identifiers

AskCody does not index or search mailbox content. See the full list in Data Categories and Data Subjects.

Does AskCody store our meetings?

No. AskCody does not keep a copy of your calendars. It reads meeting data from Exchange when a feature needs it, and writes back to Exchange when a meeting is booked or changed through AskCody. Exchange meeting data is neither synchronized to AskCody, nor backed up by AskCody.

This means what you see in AskCody always matches Exchange. A meeting is visible in AskCody for as long as it exists in Exchange. When it is deleted in Exchange, it is gone from AskCody.

AskCody does hold data that is created in AskCody itself:

  • Service orders and visitor registrations. When someone orders catering or registers a visitor, the few meeting details that order needs (room, start and end time, meeting name and the host) are saved with it. This is AskCody's own record of the order, not a copy of the calendar. A license plate is saved too if you use parking.
  • Users and groups synced from Microsoft Entra ID (name, email, profile picture, group membership), used for sign-in and access.
  • Insights data. Insights turns meeting data into utilization data about how a room is used. It is anonymized when it is collected and contains no personal data.

The full list of processing per sub-processor is in Appendix B of the Data Processing Agreement.

How long is data kept, and how do we delete it?

You control your data. Here is what applies:

  • Meeting data stays in Exchange, where you control it. AskCody processes it for as long as AskCody is active and integrated with your Exchange tenant (DPA Appendix C.4).
  • Data created in AskCody, such as service orders and visitor registrations, is kept for the duration of the agreement or until you delete it (DPA Appendix C.4).
  • Visitor data can be anonymized automatically. You set the retention period in the Admin Center under Account > Compliance, from 1 to 365 days. The default is 31 days. Every night, personal data for visitors past that period is replaced with "Anonymized". The visit itself stays, so you keep your visitor counts.
  • On request, AskCody extracts, corrects, erases or exports your data within 2 weeks (DPA Appendix C.3).
  • On termination, AskCody deletes all personal data processed on your behalf and certifies to you that it has done so (DPA Clause 11.1).
  • Backups hold AskCody-created data only, never Exchange data. They are kept for 31 days on a rolling basis, so deleted data is gone from backups within 31 days (DPA Appendix C.2).

Are there limitations when we use RBAC for Applications to restrict access?

A few. All of them are covered in Limiting AskCody's access in Exchange Online. In short:

  • The scope must include the rooms and users described above, or services, visitor registrations and utilization data will be incomplete.
  • Meetings organized by people outside the scope cannot be managed through AskCody. If they are in a room connected to AskCody, they are still shown, with the organizer's name, wherever AskCody shows meetings from the meeting room's perspective, but they can only be viewed.
  • User.Read.All and GroupMember.Read.All cannot be scoped.
  • Changes to the scope are not instant. Give it some time after you apply it.
  • AskCody cannot see your restriction, so the AskCody Management Portal still shows all permissions as Granted.

Do you have a recommended RBAC configuration?

No single configuration fits everyone. The right scope depends on how your organization structures its users, groups and Exchange, so your own Exchange team is best placed to design it.

The only requirement is the minimum scope above: every connected room and desk calendar, plus the calendars of the people who book or attend meetings in those rooms. Before you enforce the scope, test that an included calendar works and an excluded one is blocked.