← cd ~/graph-permissions
// graph-permissions · Calendars
Calendars.ReadWrite.AllMicrosoft Graph permission · High risk
Allows the app to read, create, update, and delete work hours and locations settings, recurrences, and occurrences for all users in the organization, without a signed-in user.
Application permission
High riskRead and write all users' work hours and locations. Allows the app to read, create, update, and delete work hours and locations settings, recurrences, and occurrences for all users in the organization, without a signed-in user.
| ID | d91697b0-a708-4c11-a712-8fb2dc081aa2 |
|---|---|
| Consent | Always needs admin consent |
| Risk | As an application permission this reaches every user's data in the tenant, without anyone signed in. |
Grant it to an app
In the portal: App registrations › your app › API permissions › Add a permission › Microsoft Graph › Application permissions, then grant admin consent. Or with Graph PowerShell:
Connect-MgGraph -Scopes "Application.Read.All", "AppRoleAssignment.ReadWrite.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$app = Get-MgServicePrincipal -Filter "appId eq '<your app's client id>'"
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $app.Id `
-PrincipalId $app.Id -ResourceId $graph.Id -AppRoleId "d91697b0-a708-4c11-a712-8fb2dc081aa2"Which apps already have it?
# Apps that hold Calendars.ReadWrite.All as an application permission
Connect-MgGraph -Scopes "Application.Read.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graph.Id -All |
Where-Object AppRoleId -eq "d91697b0-a708-4c11-a712-8fb2dc081aa2" |
Select-Object PrincipalDisplayName, PrincipalId, CreatedDateTime