2. Allow Calendar users to see Exchange availability

Before you begin

Make sure each Exchange user:

1. Has an Exchange account with an associated mailbox.
2. Doesn't have a personal Google Account using the domain name of your organization because this can create a conflicting account. To resolve issues with conflicting accounts, go to Add users with unmanaged accounts.
3. Doesn't have a Google Workspace account or has a Google Workspace account with Google Calendar turned off.

Turn on full event detail lookups

You need to set each user’s calendar visibility to Limited details (the default visibility is Availability only).

1. If you want to set the visibility for an individual mailbox, in Exchange PowerShell enter the following command:

   Set-MailboxFolderPermission -Identity (Mailbox Folder Id Parameter:\Calendar) -User Default -AccessRights LimitedDetails

2. If you want to set the visibility for all mailboxes, enter the following command:

   ForEach ($Mailbox in @(Get-Mailbox -ResultSize Unlimited)) {Set-MailboxFolderPermission –Identity (Mailbox Folder Id Parameter:\Calendar) –User Default –AccessRights LimitedDetails}

If you're using Exchange Online (Microsoft 365), you probably don't need to make any changes. Exchange Online can accept connections from the internet by default.

1. On port 443, turn on inbound internet connectivity so Google Calendar can reach the Exchange server. This step requires a valid SSL certificate issued by a trusted public internet root Certificate Authority. For details on certificates for Exchange servers, consult your Microsoft documentation.
2. If you’re blocking external incoming network traffic, add the following address ranges to your allowlist to permit requests from Calendar Interop:
   • IPv4–Add 74.125.88.0/27 to your allowlist
   • IPv6–Add the following IP blocks to your allowlist:
     • 2001:4860:4::/64
     • 2404:6800:4::/64
     • 2607:f8b0:4::/64
     • 2800:3f0:4::/64
     • 2a00:1450:4::/64
     • 2c0f:fb50:4::/64

Google Calendar uses Exchange role accounts to authenticate with your Exchange server when it looks for availability details. For an Exchange event to be visible to Google Calendar users, it must be visible to the role accounts. If you have an existing account that you use for organization-wide availability lookups from untrusted forests, you can reuse it.

To create Exchange role accounts:

1. Set the Exchange recipient type as a user mailbox account.
2. If you create multiple role accounts, use the same password for each account.
3. If you're using basic authentication for Exchange, it's recommended that you turn off password expiration for the role account to avoid service disruption.

For more information on creating user mailboxes in an Exchange server and Exchange recipient types, consult your Microsoft documentation.

Complete this step if you're using Exchange Online (Microsoft 365). If you're using other versions of Exchange, skip to step 5.

1. Sign in with a super administrator account to the Google Admin console.

   If you aren’t using a super administrator account, you can’t complete these steps.

2. Go to Menu  Apps > Google Workspace > Calendar.

   Requires having the Calendar > Settings administrator privilege.

3. Click Calendar Interop management.
4. Click Edit to open the Exchange availability in Calendar section.
5. Check the Allow Google Calendar to display Exchange users’ availability box.
6. Click Add an Exchange endpoint.
7. Click the Endpoint type:
   • If you use Exchange Online (Microsoft 365), select Microsoft 365 (Graph API), and enter the following fields:
     • Exchange domain name—Supported domain for this endpoint. Leave blank to have it as the default endpoint.
     • Exchange Role Accounts—The primary SMTP addresses of the Exchange role accounts in the format: username1@example.com. We recommend setting up multiple role accounts.

       If you're using more than one role account, separate the accounts with a comma. We recommend using approximately 10 role accounts, especially if you want to query rooms from Microsoft.

     • Tenant ID—Your Microsoft 365 directory (tenant) ID that you noted in step 4.
     • Application (client) Id—The Application ID assigned to your app during app registration in step 4.
     • Client secret—The value from the client secret assigned to your app during app registration in step 4.
   • If you don’t use Exchange Online (Microsoft 365), select Exchange Server on-premises and enter the following fields:
     • Exchange Web Services URL—The URL of the default Exchange Web Services (EWS) server endpoint associated with your Exchange server.

       For details, go to Find EWS server endpoint URL (on this page).

     • Exchange domain name—Supported domain for this endpoint. Leave blank to have it as the default endpoint.
     • Exchange Role Accounts—The primary SMTP addresses of the Exchange role accounts in the username1@example.com format.

       If you're using more than one role account, separate the accounts with a comma. We recommend setting up multiple role accounts.

     • Password—The password for the Exchange role account or accounts.
   • If using EWS to connect to Exchange Online, select Microsoft 365 (Legacy EWS) and enter the following fields:

     Microsoft will deprecate this on October 1, 2026. 

     • Exchange Web Services URL—The URL of the default EWS server endpoint associated with your Exchange server.

       For details, go to Find EWS server endpoint URL (on this page).

     • Exchange domain name—Supported domain for this endpoint, leave blank to have it as default endpoint
     • Exchange role accounts—The primary SMTP addresses of the Exchange role accounts in the username1@example.com format.

       If you're using more than one role account, separate the accounts with a comma. We recommend setting up multiple role accounts.

     • Token endpoint URL—The OAuth 2.0 token endpoint URL from your Entra ID tenant. For details, go to Step 6: (Exchange Online only) Set up OAuth 2.0 authentication.
     • Application (client) ID—The Application ID assigned to your app during app registration.
     • Client secret—The value from the client secret assigned to your app during app registration.
8. Click Add.
9. (Optional) To add more Exchange endpoints, click Add an Exchange endpoint and repeat steps 7–8 for each endpoint you’d like to add.

   Each new endpoint must have a unique domain not already used by a previously added endpoint (for example, if your organization has multiple subsidiaries or if you want to share calendar availability between trusted external partners).

   There can only be a maximum of one default Exchange endpoint.

10. (Optional) To view event details (title, location, and so on) from Exchange and Calendar, check the Show event details box. Otherwise, leave the box unchecked.
11. Click Save.

Find EWS server endpoint URL

The URL of the EWS server endpoint is the same as the URL for the Exchange server where you created the role accounts.

Examples:

• https://Exchange server hostname/ews/exchange.asmx (EWS server)
• https://outlook.office365.com/ews/exchange.asmx (Exchange Online)

To verify the URL for an on-premises Exchange server, open Exchange PowerShell and enter the following command:

Get-WebServicesVirtualDirectory | Select name, *url* | fl

If the result returns multiple URLs, use the result for ExternalUrl.

If you have multiple Exchange servers under the same domain (for example, you're using a hybrid Exchange environment) and you want to view the availability of Exchange users in your entire environment, make sure the URL is from a server that can access availability for all Exchange users.