Why does my Bookings iframe say 'refused to connect'?

How to tell which problem you have#

Open your browser's developer tools (F12), reload the page with the embed, and look at the Console.

Fix 1: allow anonymous bookings#

1. In Bookings, open the shared booking page and select Booking page.
2. Under access control, clear Require a Microsoft 365 account from my organization to book.
3. Save, wait a few minutes, and reload your site in a private window.

This fixed the 2019 "Bookings iframe denied" thread (3,000+ views) and the 2021 Q&A thread where the asker found the blank space was caused by the org-only setting.

If the checkbox is already clear, ask your Microsoft 365 admin to check the tenant-wide controls. Block shared bookings from outside your organization in the admin center (Settings, then Org settings, then Bookings) and Set-OrganizationConfig -BookingsAuthEnabled $true in PowerShell both force authentication on every booking page. More on these settings in why a booking page makes people sign in.

Fix 2: use the current page URL#

In 2023 Microsoft moved booking pages from https://outlook.office365.com/owa/calendar/<address>/bookings/ to https://outlook.office365.com/book/<address>/ (message center post MC528980). Microsoft said old links would redirect, but a Tech Community thread from May 2023 with 9,000+ views collected sites whose embeds stopped working around that change. One suggestion there was to replace book.ms/b/... short links with the full /book/ address.

Copy a fresh link from the Booking page and paste it into the iframe src instead of reusing an old one. The form currently seen is https://outlook.office.com/book/YourBusiness@contoso.com/.

Fix 3: remove parameters from the src#

Bookings pages have returned "Bad Request" when extra query strings were added: UTM tags, encoded spaces in UTMs, RefID values on some pages, and SharePoint's ?odSkipAutoFocus=true. Keep the src to the plain page URL (the ?ismsaljsauthenabled that the embed code adds is fine). See UTM parameters and Bad Request.

Fix 4: check your own site#

If your site sends a Content-Security-Policy header with a frame-src or child-src rule, add https://outlook.office.com and https://outlook.office365.com, or the browser blocks the frame before Microsoft is even asked. For SharePoint, the Bookings domain also has to be on the site's allowed embed list (see adding Bookings to SharePoint).

If the page itself won't load outside the frame either, it's not an embed problem; work through Bookings page not loading.

Doing this with BookingsXP#

If you need the booking form on your site and the frame keeps fighting you, BookingsXP renders its own booking widget on your page from your public shared booking page link, so there is no Microsoft iframe to block. The page still has to accept bookings from people outside your organization, and bookings are still created in Microsoft Bookings. See the embed feature. BookingsXP is independent and not affiliated with or endorsed by Microsoft.