ExactHire's interview scheduling can connect to a user's work calendar so candidates are offered real open times and confirmed interviews land on the interviewer's calendar automatically. This article is written for IT and security reviewers. It explains how the connection works, exactly what ExactHire can and cannot access, and how to approve or restrict it, for every calendar and meeting service ExactHire supports.
Supported connections
|
Service |
Accounts supported |
Used for |
|---|---|---|
|
Google Calendar |
Google Workspace and personal Google accounts |
Availability, interview events, and Google Meet links |
|
Microsoft 365 |
Microsoft Entra ID work or school accounts |
Availability, interview events, and Microsoft Teams links |
|
Outlook.com |
Personal Microsoft accounts (Outlook.com, Hotmail, Live) |
Availability and interview events |
|
Zoom |
Zoom accounts |
Zoom meeting links on interviews. Zoom is not a calendar; it is used alongside one of the calendars above. |
Your organization only needs to review the services your users actually connect.
This is not a single sign-on (SSO) setup
The calendar connection is per-user OAuth 2.0 consent to an application ExactHire operates. It is not SSO, SAML, or an identity-provider configuration. There is no metadata, certificate, or federation trust to exchange, no attribute mapping, and no application for you to register or build. ExactHire holds its own application credentials, so nothing secret is exchanged with your team.
ExactHire does separately offer SSO for signing in to ExactHire itself. That is a different feature and is not covered here.
How it works
-
A recruiter or hiring manager opens My Calendar in ExactHire and chooses the service to connect.
-
They are sent to that provider's own sign-in and consent page (Google, Microsoft, or Zoom). ExactHire never sees their password.
-
After they approve, the provider issues ExactHire an access token and refresh token for that one user. ExactHire stores them encrypted.
-
When a candidate is invited to schedule, ExactHire checks that user's busy times and offers the candidate open slots. The candidate sees available times only.
-
When the candidate picks a time, ExactHire creates the interview event on the interviewer's calendar and invites the candidate and any other interviewers. If the interview is a video interview, ExactHire adds a Google Meet, Microsoft Teams, or Zoom link.
-
Reschedules and cancellations update or remove that same event.
-
For Google and Microsoft calendars, ExactHire subscribes to change notifications on the connected user's calendar, so an interview moved or declined in the calendar is reflected in ExactHire. The subscription is removed when the user disconnects.
What ExactHire can and cannot access
-
Only users who connect. Every permission is delegated: it acts only as the user who signed in and only within that user's own access. ExactHire requests no organization-wide or administrator permissions, so it cannot reach any other user's data.
-
Availability is busy time only. To find open times, ExactHire requests only the start time, end time, and busy status of calendar entries. It does not request titles, descriptions, attendees, or locations for that purpose, and candidates never see them.
-
Writes are limited to interviews. ExactHire creates, updates, and cancels only the interview events it created. It does not modify or delete any other event.
-
Never requested: email, files and documents, contacts, chat, directory or user lists, and device or policy management.
-
Tokens are encrypted at rest, sent only over TLS, and used only for that user's scheduling.
Permissions by service
Google Calendar
|
Scope |
Why ExactHire needs it |
|---|---|
|
|
Reads busy and free time to build the candidate's list of open slots. |
|
|
Creates, updates, and cancels the interview events ExactHire schedules, including the Google Meet link. |
|
|
Lists the user's calendars so they can choose which ones count toward their availability. |
|
|
Identifies which Google account was connected. |
Microsoft 365 (work or school accounts)
|
Permission |
Why ExactHire needs it |
|---|---|
|
|
Reads busy time and creates, updates, and cancels interview events. The |
|
|
Adds a Microsoft Teams link to video interviews ExactHire creates. |
|
|
Reads the signed-in user's basic profile to confirm which account is connected. |
|
|
Issues a refresh token so the connection keeps working without asking the user to sign in again every hour. |
|
|
Identifies which account was connected. |
All Microsoft permissions are delegated; no application (app-only) permissions are requested. ExactHire's application is multi-tenant and signs users in through Microsoft's organizations endpoint, so it accepts work or school accounts from any organization and your tenant is identified by whoever signs in.
Outlook.com (personal Microsoft accounts)
The same as Microsoft 365, except ExactHire requests Calendars.ReadWrite instead of Calendars.ReadWrite.Shared, and does not request OnlineMeetings.ReadWrite. Personal accounts have no organization administrator, so no IT approval applies.
Zoom
|
Scope |
Why ExactHire needs it |
|---|---|
|
|
Creates a Zoom meeting for a video interview so the join link can be added to the invitation. |
|
|
Reads the connected user's own Zoom profile to confirm which account is connected. |
ExactHire does not access Zoom recordings, chats, contacts, or participant data.
Approving or restricting access
If your organization lets users approve third-party apps themselves, no administrator action is needed: each user approves the connection when they connect. If your organization blocks that, use the steps for your service below.
Google Workspace
-
In the Google Admin console, go to Security > Access and data control > API controls, then Manage Third-Party App Access.
-
Click Configure new app and search for ExactHire's client ID:
356401368667-4lhcahm0kphrn7mj75nlebf0kkdevmo8.apps.googleusercontent.com -
Choose the organizational units or groups that should have access (for example, your recruiting team), and set access to Trusted or Limited.
You can change or block access from the same page at any time.
Microsoft 365
ExactHire's application (client) ID is ada72d64-0c24-467f-8cad-a3b6e7505092.
Grant admin consent. A Global Administrator, Privileged Role Administrator, or Cloud Application Administrator can consent once for the whole organization. Sign in with that account and visit:
https://login.microsoftonline.com/<your-tenant-id>/adminconsent?client_id=ada72d64-0c24-467f-8cad-a3b6e7505092
Replace <your-tenant-id> with your directory (tenant) ID or verified domain name, or use organizations to apply consent to the tenant of the signed-in administrator. Review the permissions on the consent screen, then approve. Admin consent does not give ExactHire access to anyone's calendar by itself; each user still connects their own calendar.
Restrict to specific users or groups (optional). After consent, the app appears in the Microsoft Entra admin center under Identity > Applications > Enterprise applications. Search for the client ID above, then:
-
Set Properties > Assignment required to Yes and add only the users or groups who should connect a calendar. Everyone else is blocked at sign-in. This is the recommended setup for most organizations.
-
Review sign-in activity under Monitoring > Sign-in logs.
-
Revoke access at any time by deleting the enterprise application or removing its consented permissions.
Zoom
If your Zoom account requires administrator pre-approval for Zoom App Marketplace apps, a Zoom administrator approves the ExactHire app in the Marketplace before users connect. Zoom administrators can also remove the app for the account at any time.
Disconnecting and revoking access
-
A user can disconnect any connected service at any time from My Calendar in ExactHire. ExactHire deletes the stored tokens and stops all access. For Google and Zoom, ExactHire also revokes the authorization with the provider. For Microsoft, which has no revocation endpoint for this type of connection, the user or an administrator can remove the remaining consent at myaccount.microsoft.com or in the Microsoft Entra admin center.
-
An administrator can cut off access for everyone from the provider's admin console, as described above. ExactHire needs no change on its side.
-
Interview events already on a calendar are not removed by disconnecting. They stay as ordinary calendar events.
Common questions
|
Question |
Answer |
|---|---|
|
Do we need to register an app or create credentials? |
No. ExactHire operates the applications and holds its own credentials. Nothing is exchanged. |
|
Can ExactHire read our email? |
No. No mail permissions are requested from any service. |
|
Can ExactHire see the details of other meetings on a connected calendar? |
For availability, ExactHire requests only start time, end time, and busy status. Candidates see open time slots only. ExactHire reads full detail only for the interview events it created. |
|
Can ExactHire see our directory or other users' calendars? |
No. It can only act as each user who connects, and only on that user's own calendars and calendars already shared with them. |
|
What if we block the app? |
Calendar scheduling is unavailable to the affected users. Everything else in ExactHire keeps working. |
Who to contact
IT and security reviewers can send questions through a support request, and our team will bring in ExactHire technical staff as needed. If your review requires a security questionnaire, a data processing agreement, or details beyond this article, request it the same way.
Still need help? Submit a support request and our team will get back to you.