The two machines
Organization relationships: org-level trust with another tenant/on-prem org — 'our users may see THEIR free/busy at level X' — powering scheduling-assistant lookups across companies and the hybrid seam. Levels run availability-only → limited details → full per configuration; scoping can target security groups rather than everyone.
Sharing policies: what INDIVIDUALS may share outward themselves (calendar publish/invite acceptance to external people) — the Anonymous:CalendarSharingFreeBusy* entries in your scanned Default Sharing Policy that our MC1446796 verdict reads. Different consent model (user-initiated), different risk profile (persistent published calendars).
The lookup FLOW in one line: your Outlook asks your Exchange → your org checks the relationship → queries the partner's availability endpoint → historically EWS-shaped, hence the retirement shadow: cross-premises/cross-org availability is on the EWS-to-Graph migration path (MC1446796's whole point) — partner orgs lagging on modernisation will surface as YOUR broken scheduling assistant.
Failure taxonomy
| Symptom | Machine |
|---|---|
| Whole partner org shows hash marks | Org relationship: trust broken, endpoint changed, or their side's retirement lag |
| One user can't be seen | Their mailbox's effective sharing/permissions, not the org layer |
| External individuals can't subscribe to a calendar | Sharing policy's external-sharing entries |
| Hybrid on-prem users blind to cloud (or reverse) | The hybrid trust glue's cert/endpoint state (hybrid-architecture) |
| Worked until a 'security hardening' Friday | Someone disabled EWS/legacy paths without the allow-list choreography (retirements concept) |
What to watch (proofs)
- The relationships: Get-OrganizationRelationship | fl — enabled, access level, target endpoints; plus Get-SharingPolicy (scanned — the verdict's evidence row) for the user-level machine.
- A live lookup test per partner: scheduling assistant against a known partner mailbox — the canary that catches THEIR migration lag before your execs' assistants do.
- Retirement exposure: the EWS census (retirements concept) filtered to availability/federation consumers — this surface's entries need Graph-era answers before Oct 2026.
- Hybrid seam health: cross-premises free/busy in both directions on the same canary cadence as mail (hybrid mail-flow's drill).