How to sync a locked-down Microsoft 365 work calendar with iCloud or Google

Your work calendar lives in Outlook. Your life lives in iCloud or Google Calendar. Every sync app you try answers with "Need admin approval", and IT won't approve it. This guide covers the three methods that actually work in 2026, from zero-permission to full two-way sync.

Why everything is blocked

Three separate locks, and most workplaces (universities especially) have all of them on:

• App consent is disabled. When a sync service asks Microsoft 365 for calendar access via OAuth, your tenant replies "Need admin approval" (error AADSTS65001/90094). Every subscription sync tool — however reputable — dies here.
• External sharing is capped at free/busy. Outlook will only share your calendar outside the organisation as anonymous "Busy" blocks, if at all.
• Classic Outlook add-ins are gone. The old fix — desktop plug-ins like CalDAV Synchronizer running inside Outlook — died with New Outlook, which doesn't support COM add-ins.

Method 1: the free/busy ICS link (no approvals, one-way, works today)

Exchange still lets you share your calendar outward at the level your tenant allows, and that share comes with a hidden ICS feed URL.

1. Open Outlook on the web with your work account.
2. Settings (gear) → Calendar → Shared calendars.
3. Under Publish a calendar, pick your main calendar (usually just "Calendar" — beware picking an empty one) and the highest detail level offered, then Publish and copy the ICS link.
4. If publishing is greyed out: under Share a calendar, share it with your personal Gmail or iCloud address. The invitation email contains a link ending in calendar.ics. That's the same feed.
5. Subscribe to that URL from Google Calendar ("From URL") or iCloud (Settings → Calendar → Accounts → Add subscribed calendar).

Method 2: the Power Automate bridge (no approvals, two-way, full details)

This is the method almost nobody writes about. The insight: your tenant blocks third-party apps, but Power Automate is Microsoft's own service, already licensed and pre-approved in most tenants — and its Outlook connector can read and write your calendar as you.

The architecture:

1. You build one flow in Power Automate with an HTTP trigger (the premium trigger — check you can add it; many organisation and education licences include it).
2. The flow is a tiny API for your own calendar: given a shared secret and an operation (list, create, update, delete), it runs the matching Outlook connector action and returns the result.
3. A sync service you control — running on a free-tier cloud, or anywhere — calls that flow to mirror events both ways between the work calendar and iCloud/Google: full details out, busy-blocks (or full events) in, on a schedule, with markers so nothing ever loops.

Fine print: build the flow so every branch ends in a Response action (a flow that dies mid-run returns an opaque "NoResponse" error), and note the Outlook connector caps calendar reads at 256 events per call unless you enable pagination or your sync layer splits date windows.

Method 3: ask IT to consent (the front door)

Admin consent for a single app's Calendars.ReadWrite delegated permission is a one-minute task in the Entra admin centre, and some IT teams will do it on request for personal-productivity tools. Worth one polite ticket before building anything — but if the answer is no, methods 1 and 2 don't need to ask.

Which method should you use?

Written by the maker of CalSync Kit, who spent a day fighting a university tenant so you don't have to. Corrections welcome: support@saassy-saas.com.