Microsoft Booking Security Architecture

[Jiehher]

My customer is planning to use this Microsoft Booking and would like to know the following:

• What’s the architecture design of this service?
• How is confidentiality of store/registered information managed (i.e. Customer A should no be able to search or see Customer B booking information)
• Where are all the submitted information stored? (e.g. SharePoint site, mailbox, etc.)

These are some of the question asked by security.

[#2]

Dear Jiehher,

Any luck on the reply from Microsoft? or any documentation you managed to find?

My side has similar security considerations. Especially in terms of if preventing mass booking by Bots (as we see the submission did not utilize anti-bot like Encapture); and also data protection (eg. there is customer database, but is there access control on Staffs and any housekeeping functions).

[#3]

I've seen Security issue that when the mailbox user is created for the Bookings calendar its creating a user in Azure AD which is allowing signin.  Has anyone else seen this and/or seen a solution?

thanks

mikie

[#4]

@sup mikie swie o365 We can see it create a customer profile but not one in azure have you any more information on what you are seeing or how you are creating the account?