Need Help with MGGraph Calendar Permissions - Getting Access Denied

June 23, 2025 4 answers
Asked by TechieTurtle123
I'm having some trouble with granting calendar permissions on a room mailbox using Microsoft Graph. The client needs everyone to be able to edit the calendar, which I'd normally handle easily with MSOnline. However, I'm hitting an 'Access Denied' error even though I believe I have all the right scopes. I'm logged in as the global admin, and I've already consented to the necessary permissions for my organization. Here's the code snippet I'm working with for context: ``` $UserID = Read-Host -Prompt 'Enter Target Mailbox Email' Connect-MgGraph -Scopes "Application.ReadWrite.All", "AppRoleAssignment.ReadWrite.All", "RoleManagement.ReadWrite.Directory", "Calendars.ReadWrite" $Calendar = Get-MgUserCalendar -UserId $UserId | Where-Object { $_.IsDefaultCalendar -eq $true } $CalendarId = $Calendar.Id $Permissions = Get-MgUserCalendarPermission -UserId $UserId -CalendarId $CalendarId $DefaultPermission = $Permissions | Where-Object { $_.EmailAddress.Name -eq "My Organization" } $CalendarPermissionId = $DefaultPermission.Id $Params = @{ Role = "Write" } Update-MgUserCalendarPermission -UserId $UserId -CalendarId $CalendarId -CalendarPermissionId $CalendarPermissionId -BodyParameter $Params $UpdatedPermissions = Get-MgUserCalendarPermission -UserId $UserId -CalendarId $CalendarId $UpdatedPermissions | Where-Object { $_.EmailAddress.Name -eq "My Organization" } | Select-Object Role Disconnect-MgGraph ``` The first 'Access Denied' comes from the `Get-MgUserCalendarPermission` command. I'd appreciate any advice on how to resolve this! Thanks a lot!

Answers

ScriptingSage456
Thanks for your input! I ran into some documentation issues with Microsoft, and I've learned that the command I needed isn't available right now. Fortunately, they updated their tools, so I could skip some manual steps I'd been doing before, which is a relief!
Reply to this answer
PowerShellPal77
When working with delegated permissions, make sure you have owner status on the target calendar. If you're not sure about that, try using the `ExchangeOnlineManagement` module to manage permissions; it might simplify things for you.
Reply to this answer
CloudyCoder98
I feel your pain! Unfortunately, `ExchangeOnlineManagement` doesn't have all the features of MSOnline, and it canโ€™t even detect some Azure services like Multi-Factor Authentication. I can see everything in Microsoft Graph and Entra, but EOM is not recognizing them. Hang in there!
Reply to this answer
GraphGuru89
It looks like you're dealing with a permissions issue. According to the Microsoft Graph permissions reference, the `Calendars.ReadWrite` scope only permits access to the user's calendar if you're using delegated permissions. You may have better luck creating an App Registration to utilize application permissions instead. That should help you bypass the access denial you're experiencing.
Reply to this answer

Add your answer

Answers are reviewed before publication.

Related Discussions