Best Practices for Maintaining Calendar/Mail Subscriptions When Users Are Signed Out

Question

Hi all,

We’re using Microsoft Graph API to subscribe to calendar and mail notifications for our users (using /me/events and /me/messages resources). We understand that these subscriptions require delegated permissions and a valid user token.

Challenge: Our clients are asking us to maintain these subscriptions even when users are signed out or their tokens have expired. We know that app permissions (client credentials flow) cannot be used to create or renew subscriptions for individual user mailboxes/calendars.

What we’ve tried:

• Fallback to app permissions for other Graph operations (works for some endpoints, but not for subscriptions).
• Tracking subscription expiration and prompting users to re-authenticate when their token expires.
• Considering delta queries as a polling alternative, but this isn’t real-time.

Questions for the community:

• Are there any best practices or patterns for maintaining subscriptions when users are not actively signed in?
• Is there any way to use application permissions for tenant-wide subscriptions for mail/calendar?
• Has anyone found a reliable way to notify users or admins when subscriptions are about to expire due to token issues?
• Are there alternative approaches for near real-time change tracking that work with app permissions?

Any tips, patterns, or experiences would be greatly appreciated!

Thanks in advance!

Answer 1

Dear @Logan Karnes,

Welcome to Microsoft Q&A Forum! 

Thank you for your inquiry regarding maintaining Microsoft Graph API subscriptions for calendar and mail notifications, especially when users are signed out or their tokens have expired. I understand the need for persistent, near real-time tracking of user mailbox and calendar changes. However, due to Microsoft’s security and privacy model, there are important limitations to be aware of: 

1.Subscriptions to user-specific resources such as /me/messages and /me/events require delegated permissions, meaning: 

• A signed-in user is required. 
• A valid user token must be present to create or renew subscriptions. 

2.Unfortunately, application permissions (client credentials flow) cannot be used to subscribe to or renew these types of subscriptions. This is a design limitation to protect user privacy and prevent unauthorized access to personal data. 

You can take a look in these articles: 

• Overview of Microsoft Graph permissions - Microsoft Graph | Microsoft Learn 
• Create subscription - Microsoft Graph v1.0 | Microsoft Learn 

Therefore, I have tried my best to research and find these suggestions that you can consider trying them to see if they can help you: 

1.You may try to use delta queries for change tracking. While not real-time, delta queries allow you to poll for changes efficiently using app permissions. This may be an alternative when users are not actively signed in. You can consult in here: 

• Use delta query to track changes in Microsoft Graph data - Microsoft Graph | Microsoft Learn 
• Get incremental changes to events in a calendar view - Microsoft Graph | Microsoft Learn 

2.You can track subscription expiration and prompt re-authentication. Subscriptions expire after a maximum of ~ 3 days (4230 minutes). You can track expiration timestamps and notify users to re-authenticate before expiry. You can see this: Update subscription - Microsoft Graph v1.0 | Microsoft Learn 

3.There is an idea that you can try application access policies for scoped mailbox access. While not applicable to subscriptions, you can try using Application Access Policies or RBAC for Applications to restrict app-only access to specific mailboxes. 

Note: Please note that our support is limited to providing guidance based on official Microsoft documentation. Any third-party resources or references shared are intended solely for informational or consultative purposes. Microsoft does not guarantee the accuracy, reliability, or continued availability of third-party content, and we recommend exercising discretion when referring to such materials. 

4.You may consider combining real-time subscriptions for active users with delta queries for inactive ones. This balances performance and coverage. 

Additionally, there may be some limitations of app-only permissions: 

• App-only tokens cannot be used to subscribe to /me/messages or /me/events. 
• There is no tenant-wide subscription model for individual user mailboxes or calendars using application permissions. 
• Application permissions are only supported for certain resources (e.g., /users, /groups, /drive) and not for personal mailbox/calendar subscriptions. 

You can see these articles: 

• Microsoft Graph permissions reference - Microsoft Graph | Microsoft Learn 
• Best practices for using Microsoft Graph permissions - Microsoft Graph | Microsoft Learn 

So, I would like to give a summary: 

• Maintaining subscriptions without user tokens is not supported for /me/messages and /me/events. 
• App-only permissions cannot be used for these subscriptions. 
• Polling via delta queries is the best alternative for near real-time tracking when users are offline. 

I hope this information can help you to have a good picture in this case and please correct me if I misunderstand your concern.  

Wish you a pleasant day! 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 2

Hello. If you need continuity without depending on user sign-in, you should switch to application (app-only) permissions and create subscriptions against /users/{id}/events or /users/{id}/messages instead of /me. This allows tenant-wide or scoped mailbox coverage, and you can further limit exposure using application access policies in Exchange Online, so the app only has access to specific mailboxes.

Microsoft’s documentation outlines this pattern here:

• Change notifications overview: https://learn.microsoft.com/graph/change-notifications-overview
• Outlook subscriptions with app permissions: https://learn.microsoft.com/graph/outlook-change-notifications-overview
• Restricting mailbox access with application access policies: https://learn.microsoft.com/graph/auth-limit-mailbox-access

For fallback, many developers combine webhook subscriptions with delta queries to catch missed events in near real time. This hybrid model is the recommended workaround when tokens or renewals fail.