How to stop spam or bot bookings in Microsoft Bookings

• restrict the page to your organization, if it's internal
• hide it from search engines
• require a one-time email code, where your tenant exposes that option
• shorten the booking window
• clean up fake bookings quickly

Why the usual fixes aren't available#

The public page runs on Microsoft's domain (outlook.office.com), so you can't add your own scripts, reCAPTCHA or firewall rules to it. Tenant admins get eight Bookings controls under Settings → Org settings → Bookings, and none of them handles abuse beyond restricting access.

Settings that reduce spam#

About the one-time password option#

Microsoft Graph (beta) has a booking page property called enforceOneTimePassword, described as "Determines if the one-time password is required to create an appointment", with a default of false. So shared pages can ask bookers for an emailed code. Microsoft's admin docs don't name or document a matching toggle in the Bookings web app, so check your booking page settings for an email verification option. Graph beta endpoints aren't supported for production use, so treat setting the property through the API as a last resort.

For internal pages, requiring sign-in is the strongest option. See why a booking page makes people sign in for how the page-level and tenant-level settings interact.

Keep the link out of reach#

• Share service-specific links in emails and on gated pages instead of posting the main page URL everywhere.
• If you embed the page on your website, you can put it behind your own form (with your own CAPTCHA) that reveals the booking step. Once the Bookings URL is known, though, it can be reached directly, because Microsoft doesn't let you change a page's URL.

Cleaning up fake bookings#

• In the app: open the page's Calendar, then open and cancel each fake appointment. The FAQ notes that Bookings only lets one person book a given slot, so fakes block real customers until you remove them.
• In bulk: Bookings has no bulk-delete in the interface. A script using the Microsoft Graph Bookings API can list appointments and cancel them. The same applies to the fake customer records that bots leave behind; see bulk deleting customers.
• Stop repeats: tighten lead times (minimum notice and booking window). There's still no native per-customer or per-day cap; see limiting bookings per day.

Spam email arriving in the booking mailbox#

The second forum thread is a different problem. Each shared page has its own mailbox with an email address, and it can receive ordinary junk mail that then reaches the page owner. A Microsoft moderator called this normal. Treat it like any other Exchange Online mailbox: block the senders and tune your anti-spam policies for that address.

If your own confirmation emails are landing in customers' junk folders, that's a sender-domain problem. See Bookings emails going to spam.