Connect Outlook using a URL and shared secret

Compare the connection options

This guide applies to the current compatible Outlook setup. An existing connection using an HMAC signing secret retains that original authentication; do not reinterpret its secret or change its flow merely to preview sync history. Optional live Outlook comparison is a separate capability.

Choose this when

You want direct delivery to Power Automate while requiring an extra credential in addition to the private webhook URL. Someone who has only the URL cannot pass the flow's additional check.

You do not need an Azure verifier, but you do need someone to store and replace the same secret in both systems. This checks possession of the extra credential; it does not sign each request's contents or prevent a valid request from being sent again.

Before you start

You need Planning Sync Advanced administration access, an active licence, Tempo connected, and a Microsoft account with calendar access. For a new receiver, follow flow preparation and test in a separate calendar. Preserve an existing working receiver’s URL, calendar, full occurrence ID and mappings; history preview does not require a receiver change. Adding an extra secret does require both sides to use the matching authentication.

1. Save the shared secret in Power Automate

1. Use an approved password manager or local generator to create at least 32 random bytes, for example represented as 64 hexadecimal characters. Save the value securely. You supply this additional secret; Power Automate's signed URL is a different credential.

2. In the prepared flow's HTTP trigger, set Who can trigger the flow? → Anyone. The signed URL and the flow's additional secret check protect this route.

3. Save your secret in Direct secret configuration → Inputs, or in the restricted configuration parameter used by that action.

4. Save, turn on the flow, and copy its complete HTTP POST URL, including the sig part.

Keep both values private. A secret entered directly in the designer can be read by privileged flow owners and included in exports. Keep supported secure-history settings enabled. The configured secret is checked for original events as well as new preview/sync commands. Older queued requests retain their original authentication and may not include this header: finish or reconcile them before enforcing the secret, and update any other original callers to send the matching header. URL-only is the compatible choice for original headerless calls.

2. Save the same secret in Planning Sync

1. Open Apps → Planning Sync → Outbound. Use Add Destination to open the Power Automate form. The form supports flows for Outlook or other services; this guide explains where to configure the additional secret in the supplied Outlook flow. Edit the existing connection when deliberately changing its access; preserve its saved URL, payload and timing settings. You do not need a second destination or optional live comparison merely to preview sync history.

2. Select Authentication → Signed webhook URL + shared secret. There is no receiver-protocol choice. For a new connection, enter a recognisable Destination name and paste the complete signed HTTP POST URL into Power Automate webhook URL.

3. Enter the identical additional secret. Under Advanced settings, keep all three plan events selected. Under How plans are sent → Delivery format, use Daily events with start and end times. Keep the automatically prepared Event payload; leave Customize payload and Customize delivery closed. Review these settings against the preparation guide. Existing connections retain their original payload and matching rules.

4. Leave Enable automatic delivery unchecked for the first check, then select Create destination (or Save changes when editing). No installation/review checkbox is required. The app sends the secret; it does not copy it into Power Automate. Both sides and any retained original callers must match.

3. Check the result

Open Preview planning sync and prepare a preview. An existing receiver’s Sync history compares proposed requests with prior accepted deliveries; it does not inspect Outlook or change appointments. Only optional live-calendar comparison calls the receiver to read the current calendar. On that path, resolve Unable to verify before proceeding; an authentication error may mean the secret values differ.

In an isolated test, enable forwarding, refresh and submit the intended occurrence twice. Confirm Outlook still contains one appointment with that complete ID. Resending after a time or description change should update the same appointment. Restore the intended disabled state afterwards. See Preview planning sync.

Replace or remove the extra secret

Leaving the app's secret field blank when editing keeps the saved secret. To replace it, finish queued work and resolve held deliveries, disable forwarding, save a new matching secret on both sides, then check a fresh preview. Already queued requests keep their earlier credentials.

To remove it, explicitly select Signed webhook URL only in the app and clear the flow's secret configuration after outstanding work is resolved. For a suspected leak, turn the flow off first and involve its owner before resuming.