For IT admins

Approving sheepdog for your organization.

• What sheepdog is
• What it reads
• Where it goes
• How it is signed
• Microsoft 365
• Google Workspace
• Publisher status
• Source and contact

What sheepdog is

sheepdog is a macOS menu bar meeting alarm. It reads upcoming calendar events on the user's Mac and sounds an alarm before each meeting. It is read-only and has no server.

What it reads

From each event sheepdog reads the title, start and end times, whether it is all day, canceled or marked free, the user's response, the organizer and attendees, the location, the online meeting link, the description and the link that opens the event in its calendar. It reads the description and location only to find the link that joins the meeting. It never creates, changes or deletes an event.

Where it goes

Nowhere. sheepdog talks directly to the calendar services you connect from the user's Mac, and nothing it reads is sent to its developer or to anyone else. Sign-in tokens are kept in the macOS login Keychain. The privacy policy has the details.

How it is signed

Sheepdog.app is signed with a Developer ID Application certificate and notarized by Apple. The Apple team ID is U7L4P2YHWJ. Release builds carry GitHub build attestations.

Microsoft 365

Application (client) ID: 8be262b6-e9bd-4b7c-8478-2a2da629580f. The ID is public. It ships in the app's Info.plist as SheepdogMicrosoftClientID.

Redirect URI: http://localhost.

Scopes

• openid signs the user in.
• email shows which account is connected.
• offline_access keeps the user signed in without asking every hour.
• Calendars.Read reads upcoming events, including the body text where meeting links live, the attendees and the user's response. sheepdog never writes.

Grant admin consent

1. Open the Microsoft Entra admin center and go to Enterprise applications.
2. Search for the application ID above. If it is not listed yet, open the admin consent URL below once and sign in as an admin.
3. Open the application, then Permissions, then choose Grant admin consent.

Admin consent URL:

https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=8be262b6-e9bd-4b7c-8478-2a2da629580f

Without approval

If the organization does not approve sheepdog, a user can add the work account in System Settings > Internet Accounts with Calendars turned on, where the organization allows that. sheepdog then reads it through macOS Calendar and never signs in to Microsoft itself. The setup window and the Calendars tab both carry an Open Internet Accounts button for this.

Google Workspace

OAuth client ID: 409717702595-p9894oo8r94bpp4al8j7rtk1p2ndnvov.apps.googleusercontent.com. The ID is public. It ships in the app's Info.plist as SheepdogGoogleClientID. Google has verified the app for its scopes.

Google sign-in asks for two read-only scopes: https://www.googleapis.com/auth/calendar.events.readonly to read upcoming events, and https://www.googleapis.com/auth/calendar.calendarlist.readonly to find which calendars are yours. To allow it, go to the Admin console, then Security, Access and data control, API controls, Manage Third-Party App Access, add the app by client ID and set it to Trusted.

Without approval, a user can add the Google account in System Settings > Internet Accounts with Calendars turned on, where the organization allows that, and sheepdog reads it through macOS Calendar.

Publisher status

Sheepdog is not yet a verified publisher with Microsoft, so Microsoft shows it as unverified on the consent screen.

Source and contact

The source is at github.com/dcadolph/sheepdog. Questions go to GitHub issues.