Microsoft Bookings admin checklist

Microsoft Bookings has no central admin console. Its tenant controls are spread across the Microsoft 365 admin center (Settings → Org settings → Bookings), Outlook on the web mailbox policies, and Exchange Online PowerShell. This checklist puts them in one order: licences, who can create pages, domain and naming, access, data collection, staff approvals, SMS, admin access, deletion and auditing. It's for Microsoft 365 admins setting Bookings up properly or cleaning up after years of sprawl. Allow about an hour, plus up to four hours for tenant settings to apply.

The demand is real. "Admin for Microsoft Bookings", a global admin who couldn't open calendars created by people who had left, has 199 "same question" votes on Microsoft Q&A. The top Feedback Portal idea for Bookings, "Centralized Administration Needed", had 85 votes as of September 2026. Two threads asking how to delete a page have 198 and 160.

Before you start#

• Roles. Microsoft documents the org-wide switch and the default domain with a global admin sign-in. Use the least-privileged role that works in your tenant, and keep global admin for the steps that need it.
• Exchange Online PowerShell. Install the module and run Connect-ExchangeOnline. Most of this list needs it.
• A current snapshot. Save the output of these before you change anything:

Get-OrganizationConfig | Format-List Bookings*
Get-OwaMailboxPolicy | Format-List Name, BookingsMailboxCreationEnabled, BookingsMailboxDomain, PersonalBookingsDisabled
Get-EXOMailbox -RecipientTypeDetails SchedulingMailbox -ResultSize Unlimited | Select-Object DisplayName, PrimarySmtpAddress, WhenCreated

• Sovereign clouds. Microsoft says these admin controls aren't available in Microsoft 365 operated by 21Vianet, and the Bookings app in Teams isn't supported in GCC, GCC High, DoD or sovereign clouds.

1. Confirm licences#

Bookings comes with Office 365 A3, A5, E1, E3, E5, F1, F3, G1, G3 and G5, and Microsoft 365 A3, A5, E1, E3, E5, F1, F3, Business Basic, Business Standard, Business Premium, Teams Essentials and Teams Premium. There's no standalone licence, and Outlook on the web must be enabled. Staff don't need a licence to be booked, but staff who deliver Teams meetings need a licence that supports Teams meeting scheduling. Customers need nothing. Details, including the A1 question, are in Bookings licence requirements.

2. Decide who gets Bookings#

• Everyone or no one: Settings → Org settings → Bookings, then Allow your organization to use Bookings. In PowerShell, Set-OrganizationConfig -BookingsEnabled $false. Turning it off blocks all access, including managing existing pages.
• Per user: Users → Active users → the user → Licenses and apps, then clear Microsoft Bookings under Apps.
• Bookings with me has its own switch: Set-OwaMailboxPolicy -Identity "OwaMailboxPolicy-Default" -PersonalBookingsDisabled $true. Microsoft says the old EWS settings no longer control it.

The trade-offs of each switch are in turning Bookings off for users.

3. Limit who can create shared pages#

Every shared page creates an Exchange mailbox and an unlicensed Entra ID user, which is how tenants end up with dozens of "Ben's booking page" entries. To let only named people create pages:

New-OwaMailboxPolicy -Name "BookingsCreators"
Set-CASMailbox -Identity creator@contoso.com -OwaMailboxPolicy "BookingsCreators"
Set-OwaMailboxPolicy "OwaMailboxPolicy-Default" -BookingsMailboxCreationEnabled:$false

Microsoft wrote these steps assuming no other OWA mailbox policies exist. If you have more, set BookingsMailboxCreationEnabled on each one. People outside the policy can still be added to existing pages as staff in any role, including Administrator.

4. Set the email domain for new pages#

A page's address, and its public URL, comes from the booking mailbox's email address. By default that can be your onmicrosoft.com domain, and Microsoft warns that invites from it may land in junk. Set the domain before people create pages:

Get-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default | Format-List BookingsMailboxDomain
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -BookingsMailboxDomain "contoso.com"

You can also set a different BookingsMailboxDomain on a separate policy for particular users. The setting affects new pages only. For existing pages, the Teams admin article gives Set-Mailbox -Identity business@contoso.onmicrosoft.com -WindowsEmailAddress business@contoso.com -EmailAddresses business@contoso.com. What that does to the sender and to the page link is covered in changing the sender email and changing the page URL.

5. Enforce a naming policy#

Under Org settings → Bookings, Enforce naming policy for shared booking pages alias sets a prefix and suffix for page aliases, for example bk- or -bookings. That makes booking mailboxes easy to find and filter. Existing pages are affected only when someone edits their business information, and their SMTP addresses don't change. Set-OrganizationConfig has matching BookingsNamingPolicy* parameters, but Microsoft hasn't written descriptions for them yet, so use the admin center.

6. Control who can book#

• Tenant-wide: Block shared bookings from outside your organization restricts every page to signed-in users from your organization. The PowerShell property is BookingsAuthEnabled. Page owners can't override it.
• Per page: Require a Microsoft 365 account from my organization to book, on the page's Booking page settings.
• Search engines: Disable direct search engine indexing hides pages from search results tenant-wide. Owners can also set it per page.
• Social sharing: Block social sharing options controls how pages can be shared on social networks.

If outside customers suddenly get a sign-in screen, one of the first two is on. See why a page asks people to sign in.

7. Know where email verification lives#

The one-time password (email code) for shared pages is a page setting, not a tenant one. Microsoft Graph (beta) exposes it as enforceOneTimePassword, off by default. Microsoft says changes to it can take up to 10 minutes. Users quote the checkbox as Require a one-time password to create bookings. The Bookings admin docs don't describe a tenant switch that forces it on or off. Our shared test page, left on default settings, never asked for a code.

Personal pages are different. As of September 2026, Bookings with me users can't turn the code off at all. See email verification on Bookings with me and, for why you might want the code, spam bookings.

8. Restrict customer data#

Under Org settings → Bookings, Restrict collection of customer data removes fields from every booking form in the tenant. The matching Set-OrganizationConfig parameters are BookingsPhoneNumberEntryRestricted, BookingsAddressEntryRestricted, BookingsNotesEntryRestricted and BookingsCreationOfCustomQuestionsRestricted. The last one stops page admins adding custom questions.

Block sharing staff details with customers (BookingsExposureOfStaffDetailsRestricted) stops staff attributes such as email addresses being shown to external customers.

What we saw when testing (September 2026)#

We captured the public booking page and the calls it makes in 13 live captures. Every shared page loads these tenant flags, and when they're set the page hides phone, address and notes and drops custom questions, whatever the service settings say. If a department says its form lost its custom questions, check this setting first.

9. Decide on staff approvals#

Require staff approvals before sharing free/busy information (BookingsMembershipApprovalRequired) makes newly added staff accept by email before their availability is shared and before they can be booked. It's often mistaken for approving appointments, which Bookings can't do (see approving bookings before they're confirmed). If you turn it on, tell page owners, because staff who ignore the email stay unbookable. See staff not bookable.

10. Check SMS and Teams Premium#

Allow Microsoft to send SMS text message notifications is in the same Org settings list and is on by default (BookingsSmsMicrosoftEnabled). SMS is now a Teams Premium feature. The Teams admin article and the SMS article list Canada, the UK and the US, while the Bookings FAQ still says North America via Skype or Twilio. Treat the Teams Premium articles as current. Usage is under Teams admin center → Analytics & reports → Usage reports → SMS notifications usage. More in SMS reminders.

11. Give admins access to every page#

Tenant admins can list booking mailboxes but can't open them in Bookings. To manage one without becoming bookable staff, grant Full Access and Send As on its mailbox, which Microsoft calls making someone a super user:

Add-MailboxPermission -Identity "page@contoso.com" -User "admin@contoso.com" -AccessRights FullAccess -Deny:$false -AutoMapping:$false
Add-RecipientPermission -Identity "page@contoso.com" -Trustee "admin@contoso.com" -AccessRights SendAs -Confirm:$false

This only works if the person doesn't already have the Viewer role on that page. Then switch pages with the caret next to the business name in Bookings, which the FAQ calls the only consolidated view. The full takeover steps for pages owned by people who left are in how an admin opens every calendar. Assign page owners the right role using what each staff role can do.

12. Find orphaned pages#

The Bookings FAQ gives this command. It lists every booking mailbox and who has access:

Get-Mailbox -RecipientTypeDetails SchedulingMailbox -ResultSize Unlimited |
  Get-MailboxPermission |
  Select-Object Identity, User, AccessRights |
  Where-Object { $_.User -like '*@*' }

Pages whose only users have left are the ones to take over or remove. Removing someone from Microsoft 365 doesn't remove them from a page's staff list, so clean up staff on every page they were on.

13. Delete pages you don't need#

Only Microsoft 365 admins can delete a shared page, by deleting its user in Users → Active users → Delete user, or with Remove-Mailbox. Pages created in 2017 or earlier need PowerShell. Deletion is permanent, including staff, services and every booking, so export first. If the owner just wants it offline, they can Unpublish instead. See deleting a booking page.

14. Decide about the address book#

Booking mailboxes show in the global address list. Microsoft doesn't document hiding them. Community reports say that hiding them can make the pages hard for admins to find, so if you try it, try one page first and confirm its owners can still open it in Bookings.

15. Set up auditing#

Microsoft documents no Bookings-specific audit activities. What you can audit:

• Admin changes. The Exchange admin audit log records cmdlets run in Exchange Online PowerShell or the Exchange admin center, except those starting with Get-, Search- or Test-. That covers Set-OrganizationConfig, Set-OwaMailboxPolicy, Add-MailboxPermission and Remove-Mailbox. Search it with Search-UnifiedAuditLog -RecordType ExchangeAdmin.
• Mailbox access. Mailbox auditing covers shared mailboxes by default. The FAQ says Bookings uses shared mailboxes, but booking mailboxes are a separate type, and Microsoft doesn't say whether the default mailbox audit applies to them. Check the DefaultAuditSet on one with Get-Mailbox.
• Inventory. Re-run the commands in step 12 on a schedule and compare.

16. Review apps and flows#

• Microsoft Graph. Bookings permissions are tenant-wide. An app with Bookings.Read.All can read every page, and a Q&A answer confirms there's no per-page scoping. Review consented apps in Entra ID. Add-ons that work only from the public booking page link, such as BookingsXP, need no admin consent or Graph permissions.
• Power Automate. The Bookings connector is still in preview. Only a page's Bookings admins can create flows with its triggers, and Microsoft allows five flows per booking mailbox.

Test your settings#

1. Run Get-OrganizationConfig | Format-List Bookings* and compare with your snapshot.
2. Sign in as a user outside the creators policy and try to create a shared page. You should get an error.
3. Create a page as an allowed user and check its address uses your domain and naming policy.
4. Open a public page in a private window. Check for the sign-in prompt, the fields you restricted and the code step, depending on what you chose.
5. Search the audit log for your own Set-OrganizationConfig change.

Common problems#

• Nothing changed. Tenant settings can take up to four hours. Page settings up to 10 minutes.
• A user outside the policy can still create pages. They're on a second OWA mailbox policy that still allows creation.
• "We recently changed our licensing model" on a Business Basic tenant. Business Basic includes Bookings. The workaround in that thread was switching Bookings off and on, then escalating to support.
• A deleted page still appears in Bookings. A Feedback Portal idea with 35 votes reports this. If Get-EXOMailbox no longer lists it, the deletion worked.
• New pages still use onmicrosoft.com. BookingsMailboxDomain is set on a different policy than the one the creator has.

Limits as of September 2026#

• No console that manages every page, and no cross-page reporting. Export works one page at a time for the Administrator role.
• No tenant-wide email-code switch and no CAPTCHA setting.
• Settings changed after a page exists don't rename its address.

BookingsXP is independent and not affiliated with or endorsed by Microsoft.