Never mind; I figured out the answer. My device was already "logged into" the chc Office 365 account to gain access to the Bookings page. Bookings doesn't check the e-mail address entered by the client against the Office 365 account's registered e-mail address.
Bookings restrict organization
I have created a Bookings page for the Math Resource Center at chc.edu. I want to set it so that only students or staff (anyone with a @firstname.lastname@example.org .edu e-mail address) can make an appointment. (For the convenience of the students, there will eventually be a link to the Bookings page from the public chc.edu webpage, so a non-CHC person could "accidentally" come upon the Bookings page.)
I have checked the "Require a Microsoft 365 or Office 365 account from my organization to book" (and the "Disable direct search engine indexing of booking page") box in the Booking page access control section of the Booking page tab.
To test this, I attempted to make a reservation using my own @comcast.net e-mail address and it accepted it. Is there something I am missing?
Director, Math Resource Center
Chestnut Hill College