Microsoft Graph Calendars.ReadBasic returns 403 ErrorAccessDenied for personal Outlook account while Graph Explorer returns 200

Question

We are implementing Microsoft Calendar availability sync for our web application, Groupbooka.

We have a dedicated Microsoft Entra app registration:

App name: Groupbooka Calendar Application (client) ID: fdb304b4-113d-4aab-a762-fc52b810c78d signInAudience: AzureADandPersonalMicrosoftAccount

The app uses delegated Microsoft Graph permission:

Calendars.ReadBasic

We are testing with a native personal Outlook.com account that has a working Outlook Mail mailbox and Outlook Calendar.

Using Microsoft Graph Explorer with the same account:

GET https://graph.microsoft.com/v1.0/me/calendars

returns:

200 OK

Using an access token issued to our Groupbooka Calendar app, the token is valid for Microsoft Graph:

GET /v1.0/me

returns:

200 OK

However:

GET /v1.0/me/calendars

returns:

403 Forbidden

Graph error:

ErrorAccessDenied

Message:

Access is denied. Check credentials and try again.

Microsoft request ID:

f78dea2a-4b6b-4b59-8db6-c79118b01925

Also:

GET /v1.0/me/calendar

returns:

403 Forbidden

with the same ErrorAccessDenied.

Microsoft request ID:

d13c4d28-03fb-4d55-86a9-10c2c87dd521

We have verified:

• signInAudience = AzureADandPersonalMicrosoftAccount
• correct delegated Calendars.ReadBasic permission
• correct OAuth v2 scope
• correct client ID and client secret pairing
• correct Web redirect URIs
• fresh authorization with prompt=consent
• previous refresh/access tokens removed before retesting
• Calendars.ReadBasic appears in the returned scopes
• the Outlook mailbox and calendar work normally
• the same Outlook account succeeds against /me/calendars in Microsoft Graph Explorer
• the issue reproduces with a fresh native Outlook.com account

We temporarily requested User.Read for diagnosis. This caused /me to return 200 successfully, but the calendar endpoints continued to return 403 ErrorAccessDenied. Therefore this is not a general access-token or authentication failure.

Expected behaviour:

A personal Outlook.com account that has consented to Calendars.ReadBasic should be able to call /me/calendars.

Actual behaviour:

Graph Explorer: 200 OK

Groupbooka Calendar app: 403 ErrorAccessDenied

Could you please investigate why the Outlook/Exchange-backed Microsoft Graph calendar endpoints reject the delegated Calendars.ReadBasic grant for this app registration?

Please use the Microsoft request IDs above to trace the authorization decision.

We would also appreciate confirmation whether any additional app-registration or consent setting is required for a third-party multitenant application to use Calendars.ReadBasic with personal Outlook.com accounts.