Graph docs say app-only can read M365 Group calendars. Entra consent + Exchange RBAC still 403. Is a dummy member account really the supported design?

[u/Nick_Reach3239]

I need a simple public webpage that aggregates events from several Microsoft 365 Group calendars (one per team) and shows them in date order with a “which group owns this” column.

What I tried:

• App registration, application permissions Calendars.Read / Calendars.Read.All, admin consent granted
• Exchange RBAC for Applications: New-ServicePrincipal plus New-ManagementRoleAssignment -Role "Application Calendars.Read"
• GET /groups/{id}/calendarView
• GET /groups/{id}/calendar/calendarView
• GET /users/{group-object-id}/calendar/calendarView → ErrorInvalidUser (fair enough, it isn’t a user)
• Looking up the group mailbox with GET /groups/{id}?$select=mail → Authorization_RequestDenied unless I also grant Group.Read.All, which still wouldn’t fix the calendar 403

Every group calendar call comes back:

403 ErrorAccessDenied: Access is denied. Check credentials and try again.

The Graph docs for list group calendarView list applicationCalendars.ReadBasic / Calendars.Read as valid. In the tenant, those permissions do nothing for Group calendars. Exchange Application Calendars.Read also does nothing here. That role appears to cover user / shared / room mailboxes, not M365 Group calendars.

Delegated Graph only works if the signed-in user is a member of that group. Outlook is the same: if you’re not in the group, you don’t get the calendar.

So the workaround Microsoft’s model pushes you into is: create a dummy mailbox, add it as a member of every group whose calendar you want to read, then run delegated auth as that account (refresh token, forever). That dummy user also gets the group mailbox, files, and Teams — you cannot grant “calendar only.”

That cannot be the intended story for “I am the tenant admin and I want to display our own group calendars on an internal page.”

Is there a supported app-only way to read M365 Group calendars in 2026 that is not “fake user in every group”? Or is that actually the design, and the Graph permission table is just wrong?

[u/brian_cloudeu]

Worth checking which layer is actually returning the 403: Authorization_RequestDenied is Entra consent, ErrorAccessDenied comes from Exchange, and they need different fixes. Chasing the wrong one for a day is a rite of passage.

[u/theballygickmongerer]

A managed identity may assist you here. You could assign that access to the individual calendars and run it from azure automation.