Your Outlook week, read back to you as the time entries you never made

If your work lives in Microsoft 365, your calendar is the most accurate record of your week that exists — and the least likely to end up on an invoice. BillNotch signs in through Microsoft, reads the past fortnight of your default calendar, and hands you back the meetings that look like work so you can turn them into entries one row at a time.

Calendars.Read · Microsoft 365 · Outlook.com

Work account or personal, the same door

In Settings → Calendar, press Connect Outlook. Sign-in is against Microsoft’s common authority rather than a single tenant, which is the reason a work or school account on Microsoft 365 and a personal Outlook.com account both authorise the same way, and the reason a contractor with one of each can connect whichever calendar the client’s work actually lives in.

The consent lists Calendars.Read and offline_access, and there is no ReadWrite anywhere in the request. Connections are per person: every member of a workspace can connect their own account without an administrator granting anything in BillNotch, and no member can see another’s meetings. If your tenant restricts third-party app consent, that is the one place an admin has to be involved, and it is a Microsoft setting rather than a BillNotch one.

How Outlook’s “show as” decides what you see

This is the part worth reading. Outlook’s showAs field carries five values, not two, and BillNotch takes the generous reading of every one of them except free — which is exactly inverted from how most tools handle a status they do not recognise.

Around that sit four blunter rules: all-day events are dropped, a meeting whose responseStatus records that you declined is dropped, anything under five minutes or over twelve hours is dropped, and a slot already covered by time you tracked never appears — the desktop app and the calendar cannot both bill the same hour.

The read itself goes to /me/calendarView, which is the Graph endpoint that returns a series already expanded into its occurrences, so a weekly project sync arrives as two separate rows rather than one recurrence you would have to unpick. Times come back pinned to UTC by an explicit header, because Graph will otherwise hand you naive datetimes and let you guess the zone.

What reaches the Review screen

A “Meetings” list, grouped with the day you are reviewing, holding only what survived those filters. Accepting one creates a time entry with the meeting’s subject as its description and the meeting’s exact start and end as its span. Pick a project on the row if you know it. The entry is non-billable until you decide otherwise, and the flip from suggestion to entry is guarded so it can only happen once. The Review screen is the same place the tracker’s own suggestions land, so this is one pass over the day rather than two.

Teams calls are just meetings here

On a Microsoft 365 team most of the week is Teams calls, and that is precisely the time an activity tracker records worst: the window is Teams whether you were in a client workshop or an internal retro, and half the calls happen with the laptop lid down or on a phone in a taxi. The calendar is the only honest record of them.

So BillNotch treats a Teams meeting as an ordinary calendar entry and nothing more. It does not read the join link, does not know whether the call actually took place, does not know who dialled in or for how long, and asks Graph for none of it. Nothing about Teams presence, chat or call records is requested — a meeting you skipped is a meeting you should dismiss, which takes one click and is the honest version of a feature that would otherwise need far more access to your workplace than a timesheet deserves.

Where a Microsoft connection tends to break

Microsoft hands back a new refresh token every time the old one is used, which is a good security property and a reliable way to lose a connection if you are careless with it. BillNotch stores the replacement before it does anything else with the session, so a sync that fails halfway leaves the connection intact rather than orphaned.

When access is genuinely gone — revoked, expired, a password changed under a policy — the Calendar settings card says so plainly and offers Reconnect, rather than showing a healthy connection that has quietly stopped returning meetings. Only the refresh token is kept, and it is encrypted at rest; the short-lived access token is never stored. Syncs run when you open the Review screen or press Sync now, at most once every fifteen minutes per connection, so nothing reads your mailbox while you are asleep.

What is stored, and what is never asked for

Four fields per meeting: an identifier, the subject, the start and the end. Bodies, locations, attendee lists, organisers and join links are not requested from Microsoft Graph and are not stored — which matters more on a work calendar than a personal one, where the body of a meeting invite is frequently the most confidential text in the company.

What it will not do

No writing to your calendar, no upcoming meetings, no shared or secondary calendars, no room mailboxes, and no automatic entry creation. It will not infer a client from who was invited, will not mark a meeting billable for you, and will not run the AI categorizer over an accepted meeting.

Outlook and Google Calendar are the two providers that exist. Apple Calendar, CalDAV and subscribed ICS feeds are not supported, and Exchange on-premises without Microsoft 365 has no path here.