← cd ~/compare
// compare · graph permissions
Calendars.Read vs Calendars.ReadWrite
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: If the app only reads calendars, use Calendars.Read. For application permissions, limit mailboxes with Exchange Online RBAC for applications.
| Calendars.Read | Calendars.ReadWrite | |
|---|---|---|
| Application | Read calendars in all mailboxes Allows the app to read events of all calendars without a signed-in user. Always needs admin consent · High risk | Read and write calendars in all mailboxes Allows the app to create, read, update, and delete events of all calendars without a signed-in user. Always needs admin consent · High risk |
| Delegated | Read user calendars Allows the app to read events in user calendars. Users can consent · Medium risk | Have full access to user calendars Allows the app to create, read, update, and delete events in user calendars. Users can consent · Medium risk |