MS Graph Calendar API: Get event for private events is not currently allowed

Icaro Oliveira 1 Reputation point
2021-10-14T01:25:14.817+00:00

Hello,

We noticed an inconsistency that looks more like a bug.

The GET event endpoint does not seem to have permission to retrieve private events of a user other than yourself (when using an account that it is supposed to have permission to READ a specific user calendar)
GET /users/{id | userPrincipalName}/events/{id} (https://learn.microsoft.com/en-us/graph/api/event-get?view=graph-rest-1.0&tabs=http)

That seems to be a bug because the LIST event endpoint does retrieve private events:
GET /users/{id | userPrincipalName}/events (https://learn.microsoft.com/en-us/graph/api/user-list-events?view=graph-rest-1.0)

The GET event endpoint is very relevant when using it in combination with the Change notification subscription. It is pretty much the only way of retrieving the details of an event that was CREATED/UPDATED and received via a webhook notification.

We are almost certainty this a bug because we can also observe an odd behaviour on the Microsoft Calendar dashboard: When looking at someone else calendar (given that you have READ permission to see it), we can also see their private events until we try to click on any of the private ones. In that case, the private event disappear until we refresh the page again.

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
10,493 questions
0 comments No comments
{count} votes