---
title: "Face Kicker for IT admins: permissions and deployment"
description: "Exactly what Face Kicker asks Microsoft for: delegated, read-only access to the signed-in person's own calendar. No mail, no files, no Face Kicker server."
url: https://facekickapp.com/it-admins/
---

For IT admins

# What Face Kicker asks for, and what it doesn't.

Face Kicker is a macOS menu-bar app that alerts people before meetings. To see Microsoft 365 meetings it asks for one delegated permission: read the signed-in person's own calendar.

## In short

- Delegated `Calendars.Read`, plus the standard sign-in scopes. No application permissions.
- Read-only, and only the signed-in person's own calendar.
- Requests go straight from the Mac to Microsoft Graph. Nothing is sent to a Face Kicker server.
- No mail, no files, no contacts, no write access.
- Tokens are kept in the macOS Keychain on that Mac.
- Published by a verified publisher in Microsoft Entra.

## Permissions requested

| Scope | Type | Why |
| --- | --- | --- |
| `Calendars.Read` | Delegated | Find the person's upcoming meetings and their Join links. |
| `openid`, `profile` | Delegated | Sign the person in and show their name in Settings. |
| `offline_access` | Delegated | Keep the person signed in between polls with a refresh token. |

`Calendars.Read` doesn't need admin consent by default. Tenants that disable user consent, or require user assignment, will need an admin to grant it. Tenants that allow user consent only for verified publishers and selected permissions will need `Calendars.Read` classified as low impact, or an admin to grant it.

## What it reads, and how often

One request, every five minutes and when the Mac wakes: `GET /me/calendarView` on Microsoft Graph v1.0, for roughly the next 24 hours, with these fields only:

`subject` `start` `end` `isOnlineMeeting` `onlineMeeting` `onlineMeetingProvider` `isCancelled` `responseStatus` `showAs` `seriesMasterId` `type` `iCalUId` `bodyPreview` `location`

Cancelled and declined meetings are skipped. Events are kept in memory on the Mac to time the alerts. They aren't written to a server, logged, or shared.

## How sign-in works

- A public client using the authorization code flow with PKCE. There's no client secret.
- Sign-in happens in the system browser sheet, never in an embedded web view.
- The authority is always tenant-specific, never `common`.
- Redirect URIs use the app's own scheme: `msauth.com.facekickapp.facekicker://auth` for the Mac App Store build and `msauth.com.facekickapp.facekicker.direct://auth` for the direct download.
- The refresh token is stored in the macOS Keychain and never logged.

## What it doesn't do

- No access to mail, files, contacts, Teams chats or anyone else's calendar.
- No write access of any kind. It can't create, change or delete events.
- No application permissions and no admin roles.
- No analytics, telemetry or account. Nothing is sent to a Face Kicker server.

The one thing a person can choose to send is a feedback note from the app's menu: what they type, plus the app and macOS versions and the alert colour they picked. No calendar data is included. See the [privacy policy](https://facekickapp.com/privacy/).

## Publisher verification

Face Kicker is a verified publisher in Microsoft Entra. Microsoft has verified the organisation that publishes it through the Microsoft AI Cloud Partner Program, and the consent prompt shows Microsoft's blue verified badge. If you would rather keep the registration entirely in your hands, the option below still works.

## Register it in your own tenant

You can register Face Kicker in your organisation's Entra tenant and have people point the app at your registration. You then control consent, assignment and revocation end to end. A step-by-step guide will follow; in outline:

1. Create an app registration, single tenant (*Accounts in this organizational directory only*). Note the Application (client) ID and Directory (tenant) ID.
2. Add the *Mobile and desktop applications* platform with the redirect URIs above for the builds you allow.
3. Set *Allow public client flows* to Yes. Don't create a client secret or certificate.
4. Add the delegated Microsoft Graph permissions `Calendars.Read`, `openid`, `profile` and `offline_access`. Grant admin consent if your policies need it.
5. Give people the two IDs to enter under Settings, Advanced, in Face Kicker.

## No sign-in, for Exchange Server

If your organisation runs Exchange Server on its own premises and syncs it into Apple Calendar through macOS Internet Accounts, Face Kicker can read meetings from there. That needs no Microsoft sign-in and no app registration.

This route doesn't hold for Exchange Online. Apple Calendar reaches Exchange Online through Exchange Web Services (EWS), which Microsoft began disabling by default on 1 October 2026, tenant by tenant, and removes on 1 April 2027 (message center MC1227454). Once EWS is off for a tenant, its calendars stop updating in Apple Calendar until Apple moves Calendar to Microsoft Graph, which Apple has promised for a macOS 27 update without a date. Face Kicker's own sign-in uses Microsoft Graph, so it isn't affected.

## Security questions

Write to [security@facekickapp.com](mailto:security@facekickapp.com). A person answers.