Admin guide: approve Calendar Fix for your Microsoft 365 organization

If people in your organization see Microsoft’s “Need admin approval” screen when they sign in to Calendar Time Zone Fix for Outlook, a work or school administrator has to approve the app once. This page shows what you would be approving and how to do it.

Show me the steps See the permissions first

What the app is

A web app for the Nov 1, 2026 time change in British Columbia, Alberta and Manitoba. Each person signs in with their own account, scans their own calendar, reviews the before and after times, and fixes the Outlook and Teams meetings they organize. Nothing changes until that person presses Fix, and they can undo a change for 30 days. It is not an admin tool and does not run across your mailboxes.

Name in Microsoft Entra	Calendar Time Zone Fix
Application (client) ID	`a682336a-3cc9-4671-b8bd-3500d11f19e5`
Verified publisher	Virtuoso Technologies
Permission type	Delegated only. No application permissions.
Policies	Terms and privacy policy

The exact permissions it asks for

All of these are Microsoft Graph delegated permissions. The wording in the middle column is Microsoft’s own.

Permission	Microsoft’s description	Why the app needs it
`Calendars.ReadWrite`	Have full access to user calendars	Reads the signed-in person’s events and corrects the stored time zone on the ones they choose.
`offline_access`	Maintain access to data you have given it access to	Keeps the person signed in while a fix runs, for a session of up to 30 days.
`User.Read`	Sign in and read user profile	Signs the person in.
`openid`, `profile`, `email`	Sign users in; View users’ basic profile; View users’ email address	Identifies the person at sign-in. These are requested at sign-in. Microsoft says they are generally not listed on an enterprise app’s Permissions page.

“Full access” is Microsoft’s name for read and write access to calendars. Because the permission is delegated, the app can reach only the calendar of the person who is signed in. After you approve it, the app has no access to anyone’s calendar until that person signs in, and approving does not scan or change anything. It does not ask for mail, contacts or files.

Why people see “Need admin approval”

Your organization’s user consent settings in Microsoft Entra decide whether people can approve an app for themselves. If they cannot, Microsoft shows “Need admin approval” at sign-in, before the app opens, so the app cannot help them past it. If your organization has turned on the admin consent workflow, the screen also lets them send you a request.

How to approve it

Option 1: use the admin consent link (quickest)

Make sure you have one of the roles that can approve.
Open the link and sign in with your administrator account:
Open the admin consent link
Check the app name, the publisher and the permissions on Microsoft’s screen, then select Accept.
Microsoft sends you back to Calendar Fix, which says “Administrator approval is done”. If you land anywhere else, check the result under Permissions in Enterprise apps.
Tell your people they can sign in at calendarfix.virtuoso.services/app.

The link in full, if you would rather check it or paste it:

https://login.microsoftonline.com/organizations/adminconsent?client_id=a682336a-3cc9-4671-b8bd-3500d11f19e5&redirect_uri=https%3A%2F%2Fcalendarfix.virtuoso.services%2Fauth%2Fcallback&state=admin_consent

organizations means the home tenant of the account you sign in with. If you manage the tenant with a personal account, replace it with your tenant ID.

Option 2: Enterprise apps in the Entra admin center

This works once the app is already in your tenant, for example after someone has consented to it. If you cannot find it, use the link above.

Sign in to the Microsoft Entra admin center.
Go to Entra ID > Enterprise apps > All applications.
Search for Calendar Time Zone Fix and select it.
Under Security, select Permissions.
Review the permissions, then select Grant admin consent.

Option 3: approve a request from your queue

This applies if your organization uses the admin consent workflow and you are a designated reviewer. You can act only on requests made after you became a reviewer.

In the Microsoft Entra admin center, go to Entra ID > Enterprise apps.
Under Activity, select Admin consent requests, then the My Pending tab.
Select the app, then Review permissions and consent, and grant consent.

Everyone who asked is told the result. Being a reviewer does not add rights: you still need a role that can approve. To turn the workflow on, a Global Administrator goes to Enterprise apps > Consent and permissions > Admin consent settings and sets Users can request admin consent to apps they are unable to consent to to Yes. It can take up to an hour to start working.

Option 4: sign in to the app as an administrator

Sign in to the app with your administrator account. If Microsoft shows you a consent screen, tick Consent on behalf of your organization and accept.

Who can approve it

Microsoft lists these roles for granting tenant-wide consent:

Privileged Role Administrator
Cloud Application Administrator
Application Administrator
AI Administrator
A custom role that includes the permission to grant permissions to applications

The Cloud Application, Application and AI Administrator roles cannot grant Microsoft Graph application permissions, but this app does not ask for any. A Global Administrator can also approve it, though Microsoft recommends using the role with the fewest permissions.

Limit who can use it, or remove it

Everyone, by default. Once you approve it, all users in your tenant can use the app unless you restrict it.
Only chosen people. In the app under Enterprise apps, go to Properties and set Assignment required to Yes. Then go to Users and groups > Add user/group. Assigning groups needs Microsoft Entra ID P1 or P2.
Remove the approval. In the app, go to Permissions and the Admin consent tab, select ... beside a permission, then Revoke permission. People may still be able to approve it themselves if your user consent settings allow that.

What is and is not stored

Approving the app stores nothing with us: the return from Microsoft creates no session. Data is only created when someone signs in.

What we keep	Details	How long
Sign-in session	Microsoft account ID, tenant ID, email, and an encrypted refresh token	30 days, or until sign-out or delete-my-data
Change log	Event ID, old and new times and zones, so the change can be undone	30 days
Fix job record	Counts and event IDs, including the IDs of meetings the person was only invited to	30 days
Free-fix count and licences	Scrambled (hashed) account and event IDs, the seat count, and the Stripe payment reference	Kept, so a purchase is honoured after data is deleted

Never stored: event subjects, event bodies, locations, attendee lists, passwords and card numbers. Stripe handles payments. Scan results, which include subjects and organizer addresses, stay in memory for up to two hours and are not written to disk. Each person can delete their data with the delete-my-data button in the app. See the privacy policy, which also covers the analytics on these public pages. Analytics does not run in the app.

How organization seats work

Approval and payment are separate. Approval is free and buys nothing. Each person’s first 10 event fixes are free, and after that they need a personal licence (CA$5.99 once) or an organization seat.

Any signed-in work or school user can buy seats from the Organization licence panel in the app, so people need to be able to sign in first. Seats belong to your tenant.
A person takes a seat the first time they fix beyond their free 10. They keep it: a seat is never released to someone else.
Unused seats expire 12 months after purchase. The flat licence stops giving out new seats after 12 months.
Someone who already bought a personal licence does not use a seat.
Seats are a one-time purchase, not a subscription, and purchases are final.

Seats in the purchase	Price in CAD, one time
1	$5.99
2 to 10	$5.49 per seat
11 to 25	$4.99 per seat
26 to 50	$4.49 per seat
51 to 100	$3.99 per seat
101 or more	$599 flat, unlimited seats

If people still see the message after you approve

Check that the app shows the permissions on its Permissions page, on the Admin consent tab.
Check that you approved it in the tenant the person belongs to.
If Assignment required is on, check that the person is assigned to the app.
Still stuck? Email calendarfix@virtuoso.services with the exact message and any error code starting with AADSTS. Please do not send meeting contents.

Microsoft’s documentation

Microsoft sometimes renames these menus. If a label differs, its documentation has the current one.

How the app works and pricing · Support · Privacy policy · Recurring meetings · Teams meetings

Frequently asked questions

Why do people in my organization see “Need admin approval”?

Your organization’s Microsoft Entra settings do not let those people approve this app’s permissions for themselves. Microsoft shows the message before the app opens, so only an administrator can clear it, and it needs doing once.

After I approve it, can the app read everyone’s calendar?

No. The permissions are delegated, not application permissions. The app reaches a calendar only when that person signs in, and only their own. Approving does not scan or change anything.

Which Microsoft 365 roles can approve the app?

Microsoft lists Privileged Role Administrator, Cloud Application Administrator, Application Administrator, AI Administrator, or a custom role with the permission to grant permissions to applications. A Global Administrator can also approve it, but Microsoft recommends using the role with the fewest permissions.

Does approving the app cost anything?

No. Approval is free and buys nothing. Each person gets their first 10 event fixes free, then needs a personal licence or an organization seat.

Can I limit who uses the app, or remove it later?

Yes. In Enterprise apps you can require assignment so only chosen users can sign in, and you can revoke the permissions from the app’s Permissions page.

Last updated November 3, 2026.