How to approve Caltsu in Microsoft Entra

This guide is for Microsoft 365 administrators. A user in your organization tried to connect their work calendar to Caltsu, and Microsoft asked for admin approval. Below is what Caltsu requests, why, and how to approve it.

Why you are seeing this

Many tenants block users from consenting to third-party apps on their own, or allow it only for apps from verified publishers with low-risk permissions. When a user signs in to Caltsu with a work account in such a tenant, Microsoft shows them a "Need admin approval" screen instead of the consent prompt.

If your tenant has the admin consent workflow turned on, the user can send a request with a short justification. That request lands in the Microsoft Entra admin center for a reviewer to approve or deny. If the workflow is off, the user has to contact you directly.

Permissions Caltsu requests

Caltsu uses delegated permissions only. It acts on behalf of the signed-in user and can reach only that user's calendars.

Permission	What Caltsu uses it for
`openid`	Sign the user in with their Microsoft account
`email`	Read the user's email address to identify the account
`profile`	Read the user's basic profile, such as their name
`Calendars.ReadWrite`	Read events to know when the user is busy, and create, update and delete the blocks Caltsu adds
`offline_access`	Keep syncing when the user is not signed in to Caltsu

Caltsu does not request mail, files, contacts, directory or any application permissions.

Option 1: Approve a pending request

Use this if a user has already sent an admin consent request.

Sign in to the Microsoft Entra admin center as a user who is allowed to review consent requests.
Go to Entra ID > Enterprise apps. In older layouts this is Identity > Applications > Enterprise applications.
Under Activity, open Admin consent requests.
Select the request for Caltsu.
Review the permissions listed. They should match the table above.
Select Review permissions and consent, then Accept.

After you approve, the user can go back to Caltsu and connect their account again. Menu names in the admin center change from time to time, so the path may look slightly different in your tenant.

Caltsu appears under Enterprise applications once any user in your tenant has started a sign-in.

In the Microsoft Entra admin center, go to Entra ID > Enterprise apps. In older layouts this is Identity > Applications > Enterprise applications.
Search for Caltsu and open it.
Under Security, select Permissions.
Select "Grant admin consent for" followed by your tenant name.
Review the permissions in the Microsoft window and select Accept.

This grants consent for every user in the tenant, so users are not asked again.

If the permission list does not show Calendars.ReadWrite and offline_access, email support@caltsu.com before granting.

Optional: limit Caltsu to specific users

If only some people should be able to use Caltsu:

Open Caltsu under Enterprise applications.
Go to Properties and set Assignment required to Yes. Save.
Go to Users and groups and add the users or groups who may sign in.

Microsoft then blocks sign-in for anyone you have not assigned.

What Caltsu writes to calendars

When a user sets up a sync rule, Caltsu adds blocks to their other calendars. Each block carries:

The start and end time of the original event
A title, "Busy" by default, which the user can change
The description "Blocked time from" followed by the source calendar name

Blocks never include the original event's title, attendees, location, notes or meeting link. Caltsu stores event IDs and a change fingerprint derived from the event's title and times, so it can update the right block when an event changes. Removing a sync rule removes the blocks it created.

Caltsu's database is in Frankfurt, Germany. The company behind it is DataDux Oy in Helsinki.