Migrate to Microsoft 365 Cross-Tenant Access Policy for sharing Free/Busy, Calendars, and MailTips

Overview

Microsoft 365 Cross-Tenant Access Policy is the new Microsoft standard for collaboration between Microsoft 365 tenants and replaces Organization Relationship, Availability Address Space, and Sharing Policies for sharing Free/Busy, Calendars, and MailTips between organizations hosted in Microsoft 365. This guide provides step-by-step instructions for completing the migration: understand your current configurations, set up new Cross-Tenant Access Policies, test functionality, and lastly clean up old configurations.

Why Migrate?

Sharing Free/Busy, Calendars, and MailTips with another Exchange organization via Organization Relationship, Availability Address Space, or Sharing Policy relies on Exchange Web Services (EWS) which is being deprecated in Exchange Online and High-Privilege Access which is being migrated to modern authentication technology. As part of this effort, all Microsoft products — including Outlook, Teams, and Dynamics 365 — are removing their EWS dependencies and moving away from High-Privilege Access patterns. Migrating to Microsoft 365 Cross-Tenant Access Policy ensures your existing scenarios continue to work and moves your organization to a stronger security posture. For more context, see:

• Exchange Online EWS, Your Time is Almost Up

• Deprecation of EWS in Exchange Online

• Enhancing Microsoft 365 security by eliminating high-privilege access

Important

Microsoft 365 Cross-Tenant Access Policies for managing Free/Busy, Shared Calendar, and MailTips is rolling out and may not have reached your tenant yet. Check Message Center for additional rollout information. Plan to migrate after the rollout reaches your tenant and before EWS deprecation.

Part 1 – Understand your current configurations

Before making any changes, create an inventory of existing configurations that need to be migrated. You’ll use this inventory in Part 2 to set up the equivalent Microsoft 365 Cross-Tenant Access Policy.

Note

The following steps require connecting to Exchange Online PowerShell with an account assigned the Organization Management role. For more information, see Connect to Exchange Online PowerShell.

Review your Organization Relationship configurations

Organization Relationship configurations allow organizations to share Free/Busy or MailTips information, with granular controls for access levels and scopes. Use the following steps to understand your existing configurations and decide which ones to migrate to Cross-Tenant Access Policies.

1. From Exchange Online PowerShell, run the following command to view all configured Organization Relationships:

   Get-OrganizationRelationship | Format-List Name, DomainNames, Enabled, FreeBusyAccessEnabled, FreeBusyAccessLevel, FreeBusyAccessScope, MailTipsAccessEnabled, MailTipsAccessLevel, MailTipsAccessScope
   

2. Review the output. If nothing is returned, you have no Organization Relationships configured and can move on to review your Availability Address Space configurations. For each configured Organization Relationship, review the following values to understand how Free/Busy and MailTips sharing is configured.

   Parameter	Description
   Name	A unique name for the Organization Relationship.
   DomainNames	The SMTP domain(s) of the external organization.
   Enabled	Whether this Organization Relationship is enabled. If this value is False, the entire Organization Relationship is disabled and isn't functional for sharing Free/Busy or MailTips, regardless of FreeBusyAccessEnabled and MailTipsAccessEnabled values.
   FreeBusyAccessEnabled	Specifies if this Organization Relationship can be used to access Free/Busy information in the external organization. If this value is False, this Organization Relationship isn't functional for retrieving Free/Busy information from the external organization.
   FreeBusyAccessLevel	Specifies the maximum amount of detail returned to the requesting organization. Valid values are None: no free/busy access, AvailabilityOnly: free/busy access with time only, and LimitedDetails: free/busy access with time, subject, and location.
   FreeBusyAccessScope	Specifies the scope of this Organization Relationship for sharing Free/Busy with the external organization. If this value is set, users in the external organization can only retrieve Free/Busy information from members of this group.
   MailTipsAccessEnabled	Specifies if this Organization Relationship can be used by the external organization to access MailTips information for users in this organization.
   MailTipsAccessLevel	Specifies the amount of detail returned to the requesting organization. Valid values are None: no MailTips access, Limited: only MailTips that could prevent a non-delivery report (NDR) or Auto Reply are returned, and All: all MailTips are returned, including Auto Reply, Custom MailTips, Large Audience MailTip, and more.
   MailTipsAccessScope	Specifies the scope of this Organization Relationship for sharing MailTips with the external organization. If this value is set, users in the external organization can only retrieve MailTips information from members of this group.

3. For each Organization Relationship that configures Free/Busy or MailTips sharing, confirm that the external organization is hosted in Microsoft 365 and has a corresponding Organization Relationship configured. If so, migrate the configuration to Microsoft 365 Cross-Tenant Access Policies.

Review your Availability Address Space configurations

Availability Address Space configurations allow organizations to share Free/Busy information. Use the following steps to understand your existing configurations and decide which ones to migrate to Cross-Tenant Access Policies.

1. From Exchange Online PowerShell, run the following command to view all Availability Address Space configurations:

   Get-AvailabilityAddressSpace | Format-List ForestName, AccessMethod
   

2. Review the output. If nothing is returned, you have no Availability Address Space configurations and can move on to review your Sharing Policy configurations. For each configured Availability Address Space, review the following values to understand how Free/Busy sharing is configured.

   Parameter	Description
   ForestName	The SMTP domain of the external organization
   AccessMethod	Specifies authentication used to access free/busy information from the external organization. Only OrgWideFBToken is functional for sharing free/busy information between two Exchange Online tenants. If this value is any other value, you can't migrate the Availability Address Space to Microsoft 365 Cross-Tenant Access Policy.

3. For each Availability Address Space configuration that configures Free/Busy sharing, confirm that the external organization is hosted in Microsoft 365 and has a corresponding Availability Address Space configured. If so, migrate the configuration to Microsoft 365 Cross-Tenant Access Policies.

Review your Sharing Policy configurations

Sharing Policy configurations control how your users share their calendars with people in other organizations. Use the following steps to understand your existing configurations and decide which ones to migrate to Cross-Tenant Access Policies.

1. From Exchange Online PowerShell, run the following command to view all Sharing Policies:

   Get-SharingPolicy | Format-List Name, Enabled, Domains, Default
   

2. Review the output. If nothing is returned, you have no Sharing Policies configured. For each configured Sharing Policy, review the following values:

   Parameter	Description
   Name	A unique name for the Sharing Policy
   Enabled	Whether this Sharing Policy is enabled. If this value is False, the policy isn't functional for external calendar sharing.
   Domains	Describes the calendar sharing allowed with external domains. Contains one or more comma-separated entries in the format <domain>:<access level>. A wildcard * domain applies to all external organizations. An Anonymous entry controls calendar publishing to anonymous internet recipients via a published URL. The access level controls what external users in the domain can see: Access level What external users can see CalendarSharingFreeBusySimple Free/busy — time only CalendarSharingFreeBusyDetail Free/busy — time, subject, and location CalendarSharingFreeBusyReviewer Full calendar details
   Default	Whether this is the default policy applied to mailboxes that aren't explicitly assigned another policy.

3. Run the following command to understand which sharing policies are assigned to mailboxes:

   Get-Mailbox -ResultSize Unlimited | Group-Object SharingPolicy | Select-Object Name, Count
   

4. For each enabled Sharing Policy assigned to mailboxes, confirm that the external organization is hosted in Microsoft 365. If it is, migrate the configuration to Microsoft 365 Cross-Tenant Access Policies.

Part 2 – Configure your new Microsoft 365 Cross-Tenant Access Policies

For each existing configuration for sharing Free/Busy, MailTips, or Calendar Sharing information, follow the steps in this section to create the corresponding Microsoft 365 Cross-Tenant Access Policy.

Important

Microsoft 365 Cross-Tenant Access Policy is an inbound setting. Each organization controls whether Free/Busy, MailTips, and Calendar Sharing information can be accessed by external users via the policy. For bidirectional sharing, both organizations must create complementary Microsoft 365 Cross-Tenant Access Policies.

Prerequisites

Before continuing, ensure you have the following:

• Global Administrator privileges for your tenant

• The unique Microsoft Entra Tenant ID of the external organization. An administrator for the external organization can find this ID in their Azure Portal under Microsoft Entra ID.

• Microsoft Graph PowerShell SDK Beta installed

• For bidirectional sharing, ensure an administrator in the external organization is also migrating to Microsoft 365 Cross-Tenant Access Policy.

Check your Entra Cross-Tenant Access Policy Trust Relationship

Microsoft 365 Cross-Tenant Access Policy builds on Entra Cross-Tenant Access Policy. Before sharing Free/Busy, Calendars, or MailTips using Microsoft 365 Cross-Tenant Access Policy, follow the steps in this section to enable the Microsoft 365 Collaboration trust level in Entra Cross-Tenant Access Policy for each external organization. In this guide, you enable the Microsoft 365 Collaboration trust level for all users in your organization. You can define narrower scopes in later steps to control effective access. Applying narrower scopes at the Microsoft 365 Collaboration trust level is supported but not covered in this guide. For more information, review the Microsoft 365 Cross-Tenant Access Policies documentation.

Note

Complete this step once for each external organization you want to share Free/Busy, Calendars, or MailTips with. Unlike previous configuration types, you don't need to add the external organization domain names in the configuration. Instead, use the Tenant ID to uniquely identify the external organization. All domain names are automatically included in the relationship.

1. Connect Microsoft Graph PowerShell SDK Beta with the required scopes:

   Connect-MgGraph -Scopes "Policy.Read.All,Policy.ReadWrite.CrossTenantAccess,Policy.ReadWrite.CrossTenantCapability" -ContextScope Process
   

2. For each external organization identified in Part 1, enable Microsoft 365 Collaboration trust by running the following commands:

   $partnerId = "<partnerTenantId>"
   $body = @{
     tenantId = $partnerId
     m365CollaborationInbound = @{
       users = @{
         accessType = "allowed"
         targets = @(
             @{ target = "AllUsers"; targetType = "user" }
         )
       }
     }
   }
   
   New-MgBetaPolicyCrossTenantAccessPolicyPartner -BodyParameter $body
   

Create Microsoft 365 Cross-Tenant Access Policies for Free/Busy

For each existing Free/Busy configuration from Part 1, create the corresponding Microsoft 365 Cross-Tenant Access Policy. You need the following information:

• The unique Microsoft Entra Tenant ID of the external organization. An administrator for the external organization can find this ID in their Azure Portal under Microsoft Entra ID.

• The correct capability for the desired Free/Busy access. Use the following table to determine the correct capability:

  Capability	Effective Access	Replaces
  crossTenantCalendarAvailabilityBasic	Allows access to Free/Busy with Time information only.	Organization Relationships with FreeBusyAccessLevel set to AvailabilityOnly or Availability Address Spaces
  crossTenantCalendarAvailabilityLimitedDetails	Allows access to Free/Busy with Time, Subject, and Location information.	Organization Relationships with FreeBusyAccessLevel set to Limited Details

• Optionally, a security group containing internal users whose Free/Busy information the external organization can retrieve. When you provide this group, users in the external organization can only retrieve Free/Busy information from internal users in this group.

1. For each Free/Busy sharing configuration identified in Part 1, enable the corresponding capability in the partner policy:

   $partnerId = "<partnerTenantId>"
   $capability = "<capabilityName>"
   

   If you're using a security group to limit which users the external organization can retrieve Free/Busy information for, run:

   $group = @{
     resourceId = "<groupId>"
     resourceType = "group"
   }
   

   Otherwise, run:

   $group = @{
     resourceId = "All"
     resourceType = "user"
   }
   

   $body = @{
     "@odata.type" = "microsoft.graph.$capability"
     inboundAccess = @{
       isAllowed = $true
       resourceScopes = @{
         included = @(
           $group
         )
         excluded = @(
           @{ }
         )
       }
     }
   }
   
   New-MgBetaPolicyCrossTenantAccessPolicyPartnerM365Capability -CrossTenantAccessPolicyConfigurationPartnerTenantId $partnerId -BodyParameter $body
   

Create Microsoft 365 Cross-Tenant Access Policies for MailTips

For each existing MailTips configuration from Part 1, create the corresponding Microsoft 365 Cross-Tenant Access Policy. You need the following information:

• The unique Microsoft Entra Tenant ID of the external organization. An administrator for the external organization can find this ID in their Azure Portal under Microsoft Entra ID.

• The correct capability for the desired MailTips access. Use the following table to determine the correct capability:

Capability	Effective Access	Replaces
crossTenantMailTipsLimited	Allows access to MailTips with restricted subset of recipient information	Organization Relationships with MailTipsAccessLevel set to Limited
crossTenantMailTipsAll	Allows access to MailTips with out-of-office status, automatic replies, and all recipient-specific info	Organization Relationships with MailTipsAccessLevel set to All

• Optionally, a security group containing internal users whose MailTips information the external organization can retrieve. When you provide this group, users in the external organization can only retrieve MailTips information from internal users in this group.

1. For each MailTips sharing configuration identified in Part 1, enable the corresponding capability in the partner policy:

   $partnerId = "<partnerTenantId>"
   $capability = "<capabilityName>"
   

   If you're using a security group to limit which users the external organization can retrieve MailTips information for, run:

   $group = @{
     resourceId = "<groupId>"
     resourceType = "group"
   }
   

   Otherwise, run:

   $group = @{
     resourceId = "All"
     resourceType = "user"
   }
   

   $body = @{
     "@odata.type" = "microsoft.graph.$capability"
     inboundAccess = @{
       isAllowed = $true
       resourceScopes = @{
         included = @(
           $group
         )
         excluded = @(
           @{ }
         )
       }
     }
   }
   
   New-MgBetaPolicyCrossTenantAccessPolicyPartnerM365Capability -CrossTenantAccessPolicyConfigurationPartnerTenantId $partnerId -BodyParameter $body
   

Create Microsoft 365 Cross-Tenant Access Policies for Calendar Sharing

For each existing Sharing Policy configuration from Part 1, create the corresponding Microsoft 365 Cross-Tenant Access Policy capability. You need the following information:

• For domain-specific Sharing Policies, the unique Microsoft Entra Tenant ID of the external organization. An administrator for the external organization can find this ID in their Azure Portal under Microsoft Entra ID.

• The correct capability for the desired Calendar Sharing access. Use the following table to determine the correct capability:

Capability	Effective Access	Replaces
crossTenantCalendarSharingFreeBusySimple	Calendar sharing - time only	Sharing Policies with CalendarSharingFreeBusySimple
crossTenantCalendarSharingFreeBusyDetail	Calendar sharing - time, subject, and location	Sharing Policies with CalendarSharingFreeBusyDetail
crossTenantCalendarSharingFreeBusyReviewer	Calendar sharing - full details	Sharing Policies with CalendarSharingFreeBusyReviewer

• Optionally, a security group containing internal users whose calendar information the external organization can retrieve. When you provide this group, users in the external organization can only retrieve calendar information from internal users in this group. For organizations with multiple existing Sharing Policies assigned to different mailboxes, you need to use security groups to create comparable Cross-Tenant Access Policies.

1. Create the corresponding wildcard (Domain: *) policy. If your existing Sharing Policy didn't include a wildcard policy, you can skip to step 2.

   $capability = "<capabilityName>"
   

   If you're using a security group to limit which users the external organizations can retrieve Calendar information from, run:

   $group = @{
     resourceId = "<groupId>"
     resourceType = "group"
   }
   

   Otherwise, run:

   $group = @{
     resourceId = "All"
     resourceType = "user"
   }
   

   $body = @{
     "@odata.type" = "microsoft.graph.$capability"
     inboundAccess = @{
       isAllowed = $true
       resourceScopes = @{
         included = @(
           $group
         )
         excluded = @(
           @{ }
         )
       }
     }
   }
   
   New-MgBetaPolicyCrossTenantAccessPolicyDefaultM365Capability -BodyParameter $body
   

2. Create the corresponding Anonymous policy. If your existing Sharing Policy didn't include an Anonymous policy, you can skip to step 3.

   Note

   Anonymous capabilities are set in the default Microsoft 365 Cross-Tenant Access Policy only. It is not possible to set an anonymous policy for a specific partner Tenant ID.

   Capability	Effective Access	Replaces
   AnonymousCalendarFreeBusySimple	Calendar sharing - time only	Anonymous Sharing Policies with CalendarSharingFreeBusySimple
   AnonymousCalendarSharingFreeBusyDetail	Calendar sharing - time, subject, and location	Anonymous Sharing Policies with CalendarSharingFreeBusyDetail
   AnonymousCalendarSharingFreeBusyReviewer	Calendar sharing - full details	Anonymous Sharing Policies with CalendarSharingFreeBusyReviewer

   $capability = "<capabilityName>"
   

   If you're using a security group to limit which users can publish their calendars anonymously, run:

   $group = @{
     resourceId = "<groupId>"
     resourceType = "group"
   }
   

   Otherwise, run:

   $group = @{
     resourceId = "All"
     resourceType = "user"
   }
   

   $body = @{
     "@odata.type" = "microsoft.graph.$capability"
     inboundAccess = @{
       isAllowed = $true
       resourceScopes = @{
         included = @(
           $group
         )
         excluded = @(
           @{ }
         )
       }
     }
   }
   

3. Create the corresponding domain specific policies. For each domain in your existing Sharing Policy, run:

   $partnerId = "<partnerTenantId>"
   $capability = "<capabilityName>"
   

   If you are using a security group to limit which users Calendar information may be retrieved by the external organization, run:

   $group = @{
     resourceId = "<groupId>"
     resourceType = "group"
   }
   

   Otherwise, run:

   $group = @{
     resourceId = "All"
     resourceType = "user"
   }
   

   $body = @{
     "@odata.type" = "microsoft.graph.$capability"
     inboundAccess = @{
       isAllowed = $true
       resourceScopes = @{
         included = @(
           $group
         )
         excluded = @(
           @{ }
         )
       }
     }
   }
   
   New-MgBetaPolicyCrossTenantAccessPolicyPartnerM365Capability -CrossTenantAccessPolicyConfigurationPartnerTenantId $partnerId -BodyParameter $body
   

Part 3 – Test functionality

Existing Organization Relationships, Availability Address Spaces, and Sharing Policies take precedence over Microsoft 365 Cross-Tenant Access Policies. Before verifying that the new policies work as expected, disable these existing configurations. You need to coordinate with an administrator in the external organization to confirm functionality.

1. Disable existing Organization Relationships, Availability Address Spaces, and Sharing Policies:

   For each Organization Relationship, run:

   Set-OrganizationRelationship -Identity "<RelationshipName>" -Enabled $False  
   

   You can't temporarily disable Availability Address Spaces. Instead, back them up and remove them:

   Get-AvailabilityAddressSpace | Export-CliXML .\AvailabilityAddressSpaceBackup.xml  
   Get-AvailabilityAddressSpace | Remove-AvailabilityAddressSpace  
   

   For each Sharing Policy, run:

   Set-SharingPolicy -Identity "<PolicyName>" -Enabled $False
   

2. Coordinate with an administrator in each external organization to validate that sharing Free/Busy, MailTips, and calendars is working as expected. If it is, continue to Part 4 to clean up the old configurations.

3. If needed, re-enable existing Organization Relationships, Availability Address Spaces, and Sharing Policies:

   For each Organization Relationship, run:

   Set-OrganizationRelationship -Identity "<RelationshipName>" -Enabled $True  
   

   Restore Availability Address Spaces from your backup file:

   Import-Clixml .\AvailabilityAddressSpaceBackup.xml | ForEach-Object {  
     $p = @{ ForestName = $_.ForestName; AccessMethod = $_.AccessMethod }  
     foreach ($n in 'Credentials', 'DomainController',  
       'ProxyUrl', 'TargetAutodiscoverEpr', 'TargetServiceEpr',  
       'TargetTenantId', 'UseServiceAccount') {  
       if ($null -ne $_.$n) {  
         $p[$n] = $_.$n  
       }  
       Add-AvailabilityAddressSpace @p  
     }  
   }
   

   For each Sharing Policy, run:

   Set-SharingPolicy -Identity "<PolicyName>" -Enabled $True
   

Part 4 – Clean up old configurations

After you migrate your Free/Busy, MailTips, and Calendar Sharing configurations to Microsoft 365 Cross-Tenant Access Policies, remove the old configurations.

1. Remove unused Organization Relationships.

   Remove-OrganizationRelationship -Identity "<RelationshipName>"
   

2. Remove Availability Address Space.

   Remove-AvailabilityAddressSpace
   

3. Remove unused Calendar Sharing policies.

   Remove-SharingPolicy -Identity "<PolicyName>"
   

References

Working with Entra Cross-Tenant Access Policies:

• Overview: Cross-tenant access with Microsoft Entra External ID

Working with Microsoft 365 Cross-Tenant Access Policies:

• Microsoft 365 Cross-Tenant Access Policies (Coming Soon)
• Microsoft 365 Cross-Tenant Access Policies - Graph Cmdlets (Coming Soon)

Working with Organization Relationships:

• Organization Relationships
• Set-OrganizationRelationship

Working with Availability Address Space:

• Get-AvailabilityAddressSpace

Working with Sharing Policies:

• Sharing policies in Exchange Online