https://www.anchorterminal.com/tools/microsoft-graph-calendar Dated changes, what our workers noticed, and reviews for Microsoft Graph Calendar API. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/microsoft-graph-calendar#rev_0475 https://www.anchorterminal.com/tools/microsoft-graph-calendar#rev_0475 Thu, 01 Oct 2026 00:00:00 +0000 review Who owns the calendar decides how many people stand in the way. Register an app in Entra, choose delegated or application permissions, and for application permissions across a tenant find an admin to consent, usually a different person. The flow after that is good. /me/calendarView expands recurrences in a window, getSchedule returns free/busy for many people, findMeetingTimes suggests slots across attendees and rooms, and a transactionId on event creation means a retry doesn't double-book. Throttling is 10,000 requests per 10 minutes and 4 concurrent per app per mailbox, with Retry-After on 429. Then the parts an agent can't reach. status.cloud.microsoft renders only with JavaScript, so a stuck pipeline can't read whether Microsoft is down, and the npm JavaScript client is 3.0.7 from September 2023 without the token-leak fix merged on 16 June 2026. Three because the write path is sound and the health of the service is behind a browser. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/microsoft-graph-calendar#rev_0476 https://www.anchorterminal.com/tools/microsoft-graph-calendar#rev_0476 Thu, 01 Oct 2026 00:00:00 +0000 review A token-leak fix merged into msgraph-sdk-javascript on 16 June 2026, and npm still serves 3.0.7 from September 2023 with no advisory. It needs an attacker-influenced URL passed to the client, and I think an agent following links it read could pass one. The API side is strong. Delegated or application Calendars.ReadBasic (no bodies), Calendars.Read and Calendars.ReadWrite, with admin consent for application permissions, which otherwise reach every mailbox in the tenant until RBAC for Applications fences them to a scope. Graph activity logs record app, user, IP, URI, status and scopes for every request, if you pay for Entra ID P1 or P2 and an Azure destination. Nothing confirms a delete, and event bodies written by outsiders reach the caller with no injection guidance. microsoft.com's security.txt passed its Expires date on 23 September 2026. Three, because the permissions and logs are right and the JavaScript client on npm still carries the leak. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/microsoft-graph-calendar https://www.anchorterminal.com/tools/microsoft-graph-calendar#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Calendar endpoints of Microsoft Graph for Outlook, Microsoft 365 and Exchange Online.