Workspace calendar (Google & Microsoft)
Organization admins can connect workspace-wide calendar access so TeamPlot can read each team member’s calendar by work email, without every person completing OAuth. Personal calendar connections still work alongside this; if a direct report connects their own calendar, that connection is preferred.
Google Workspace (service account)
TeamPlot uses a Google Cloud service account with domain-wide delegation to impersonate users and call the Calendar API with readonly scope.
1. Google Cloud project
- Open Google Cloud Console and select or create a project.
- Enable the Google Calendar API for that project: APIs & Services → Library → Google Calendar API → Enable.
2. Create a service account
- Go to APIs & Services → Credentials.
- Create credentials → Service account. Give it a name (for example
teamplot-calendar-read).
- Grant the service account no additional IAM roles unless your policy requires them; Calendar access is granted via domain-wide delegation and Admin Console, not project IAM.
- Open the service account → Keys → Add key → Create new key → JSON. Download the file and keep it secure.
3. Enable domain-wide delegation
- In the service account details, check Enable Google Workspace Domain-wide Delegation.
- Note the Client ID (a long numeric ID). You will use it in Google Admin.
4. Google Admin: authorize the client
-
Sign in to Google Admin as a super admin.
-
Go to Security → Access and data control → API controls → Domain-wide delegation → Manage Domain Wide Delegation.
-
Add new and enter:
-
Client ID: the service account’s numeric client ID from Cloud Console.
-
OAuth scopes (comma-separated):
https://www.googleapis.com/auth/calendar.readonly
-
Save.
5. Paste the key in TeamPlot
- In TeamPlot, go to Settings → Integrations (as an owner or admin).
- Under Workspace calendar (Google), paste the entire contents of the downloaded JSON key file.
- Save.
TeamPlot encrypts the JSON at rest. If you rotate the key, paste the new JSON and save again.
Troubleshooting (Google)
- 401 / invalid_grant when syncing: confirm domain-wide delegation is enabled on the service account, the Client ID is added in Admin with the exact scope above, and propagation has finished (wait a few minutes).
- 404 / Not Found on calendar: the user’s primary calendar must exist for their Google account; the team member’s work email in TeamPlot must match their Google Workspace user email.
- Access denied: confirm the Calendar API is enabled on the Cloud project that owns the service account.
Microsoft 365 (Azure AD app)
Workspace-wide Microsoft access uses an Azure AD application with application permission Calendars.Read and admin consent. Configure this under Settings → Integrations → Workspace calendar (Microsoft) (tenant ID, client ID, client secret).
See your organization’s Azure documentation for registering the app and granting admin consent.
What TeamPlot reads
For meeting load and scheduling context, TeamPlot requests calendar metadata in a rolling window (titles, start/end times, attendees where available). It does not read event descriptions or body content from workspace calendar sync.
Related