Clarification on App-only Access to Subject and Location Fields in Calendar Events

Question

Hello Microsoft Graph Team,

I’m working on integrating calendar data using Microsoft Graph and would like clarification regarding the visibility of event subject and location when using application (app-only) permissions.

Specifically, under what conditions are these fields available when using permissions such as Calendars.Read.All or Calendars.ReadBasic.All?

I’ve reviewed the getSchedule documentation and understand that visibility depends on the sensitivity of events and calendar sharing settings. However, it's unclear whether these details can consistently be accessed using app-only tokens, especially if events are not explicitly shared with the application identity.

Could you please confirm:

Whether subject and location are visible with app-only permissions without explicit calendar sharing?

What calendar settings or permissions must be in place for full visibility of these fields under app-only access?

Thanks in advance for your help and for the great work on Microsoft Graph!

Regards,
Amrita Dhawan

Answer 1

Thanks for reaching out to the team here. I can see you are looking to understand the visibility of event subject and location when using Microsoft Graph API with application (app-only) permissions.

Conditions for Visibility

Calendars.Read.All Permission:

• This permission allows the application to read all calendars in the organization without a signed-in user.
  • The visibility of event details such as subject and location depends on the calendar sharing settings and the sensitivity of the events.
    • If the events are as private or if the calendar is not shared with the application identity, the subject and location may not be visible.
    Calendars.ReadBasic.All Permission:

    - This permission allows the application to read basic event details (such as start and end times) in all calendars in the organization.
    
       - The subject and location fields are generally not available with this permission, as it is intended for basic access only.
    

Accessing Event Details

Without Explicit Calendar Sharing:

• For Calendars.Read.All, the application can access event details if the calendar is not explicitly shared, provided the events are not marked as private.
  • For Calendars.ReadBasic.All, the application will not have access to detailed event information such as subject and location.
  With Explicit Calendar Sharing:

  - If the calendar is explicitly shared with the application identity, the application can access detailed event information, including subject and location, regardless of the event sensitivity.
  

Required Calendar Settings or Permissions

• To ensure full visibility of event details under app-only access, the following settings or permissions should be in place:
  • The application should have Calendars.Read.All permission.
    • The calendar should be shared with the application identity, or the events should not be marked as private.
      • Appropriate calendar sharing settings should be configured to allow the application to access detailed event information.

Summary

• Subject and location visibility: With Calendars.Read.All, subject and location are visible if events are not private and the calendar is not explicitly shared. With Calendars.ReadBasic.All, these fields are generally not visible.
• Calendar settings: Ensure the calendar is shared with the application identity or events are not marked as private for full visibility.The customer seems to be having an issue with understanding the visibility of event subject and location when using Microsoft Graph API with application (app-only) permissions.
  **
  Relevant documentation**
  -Difference between the Calendars.Read.All and Calendars.ReadBasic.All- https://learn.microsoft.com/en-us/graph/permissions-reference
  -Understanding the Event Resource type- https://docs.microsoft.com/en-us/graph/api/resources/event?view=graph-rest-1.0
  -Handling Private events- https://docs.microsoft.com/en-us/graph/api/user-list-events?view=graph-rest-1.0&tabs=http#example-2-retrieve-private-events

I hope this clarifies but please feel free to reach out in the comment section and we can assist further.

Answer 2

Thanks for your reply. I just wanted to clarify on one more point.
In this link : https://learn.microsoft.com/en-us/graph/permissions-reference,
i see : Calendars.Read and you have mentioned Calendars.Read.All in your suggestion.
I hope you are referring to the same permission here ?

Regards,
Amrita Dhawan