Configuring ReadWriteMailbox for Granular Access in Outlook Add-Ins

Question

Dear Team,

I am developing a JavaScript-based Outlook add-in that uses EWS to fetch calendar data for on-premises mailboxes.

As per Microsoft’s documentation, I am currently using the ReadWriteMailbox permission to access EWS APIs for retrieving calendar information.

My use case requires restricting the add-in’s access strictly to calendar data, blocking it from reading emails or other mailbox content, as well as from composing or modifying emails and other items that become available when the ReadWriteMailbox permission is granted.

Could you please confirm whether such fine-grained permission control is supported through this mechanism? Specifically, is there any configuration or setting within the manifest.xml file that would allow me to limit access to calendar data only?

Answer 1

Hello,

I’m not too familiar with javascript or web APIs but this service seems to fit your description.

Share or delegate a calendar in Outlook - Microsoft Graph | Microsoft Learn

This function of the Microsoft Graph API only specifically asks for the outlook calendar data, nothing else included.

Hope this helps,

JC