Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Audit shared calendars in Microsoft 365 from the calendar owner’s perspective: record who owns each calendar, why it exists, who can access it, and what each person can do. Then review Exchange sharing policies and audit coverage, choose a target calendar model, pilot the change, and remove obsolete access only after validation. A permissions inventory shows current access; mailbox audit logs help investigate activity. They are not interchangeable.
What to include in a shared-calendar audit
Define the scope before collecting permissions. A useful inventory may include user primary calendars, custom calendars, resource calendars, shared mailboxes, Microsoft 365 Group calendars, and cross-tenant sharing arrangements. Not every calendar type is governed or administered in exactly the same way, so record its location and type rather than treating every calendar as a personal calendar share.
Use a register that connects access to a business purpose. For each calendar, capture:
- Calendar name, type, and location, plus its owner and business steward.
- Purpose and last-confirmed business need.
- Named recipients and groups, their permission roles, and whether access is internal or external.
- Any organization-wide default access and whether private-event details are visible.
- Relevant sharing policy, external domain or tenant, and proposed disposition: retain, revise, consolidate, or retire.
This register is a practical governance control, not a Microsoft-prescribed universal schema. Microsoft’s cross-tenant migration guidance also calls for inventorying existing configurations before replacing them.
#1 Best Overall
- The Microsoft Office 365 Bible: The Most Updated and Complete Guide to Excel, Word, PowerPoint, Outlook, OneNote, OneDrive, Teams, Access, and Publisher from Beginners to Advanced
- ABIS BOOK
How to inspect who can access a calendar
Query permissions as the calendar owner
For Microsoft Graph discovery, inspect the calendar permission collection in the owner’s context. Microsoft documents that querying on behalf of a recipient or delegate returns an empty permissions collection; that result does not establish that nobody else has access. The permission objects identify recipients and roles. Graph supports listing, creating, reading, updating, and deleting permissions within its documented limits.
There is an important update constraint: after a recipient is configured, only the role property can be updated. To change the recipient identity, remove the existing permission and create a new one. Plan for that replacement carefully so you do not leave an unintended access gap or retain a stale recipient.
Record access as a role, not a yes-or-no flag
“Shared” does not describe what a person can actually do. Microsoft documents levels that include free/busy visibility, limited details, read access, write access, and delegate access. Delegate variants can differ in whether private-event information is exposed. Capture the applicable role and private-event visibility separately; also record organization-wide default access where it applies.
Before removing a permission, confirm the business owner, the recipient’s continuing need, and any retention requirements. Use the supported owner or administrator workflow for the calendar type rather than assuming every calendar permission is managed through the same interface.
Rank #3
How to review external-sharing controls
Check both Exchange sharing policies and mailbox assignments
Exchange Online sharing policies set boundaries for what users can share with people outside the organization, including allowed domains and the calendar detail level. Review the policy definitions and the mailboxes to which they are assigned. Creating a policy alone does not make it effective for a mailbox: the policy must be applied to the affected mailbox. Administrators can also disable a user’s sharing policy to prevent external sharing.
For each external share, record the external domain or tenant, the level of calendar detail exposed, and the policy that governs the mailbox. This helps distinguish a specific user’s current share from the tenant-level rules that constrain sharing.
Handle cross-tenant access as a separate policy boundary
For free/busy and calendar sharing between Microsoft 365 organizations, Microsoft describes cross-tenant access policies as the successor to organization relationships and sharing policies. The resource tenant—the organization that owns the calendar—controls inbound access to its resources. If both organizations need reciprocal access, each must configure complementary policies. Rollout can vary by tenant, so check availability and behavior in the tenants involved before scheduling a change.
Recommended Free Tools
Microsoft’s migration guidance recommends inventorying current sharing policies and organization relationship or availability configurations, configuring the corresponding cross-tenant access policies, testing the result, and only then cleaning up the legacy configuration. Cross-tenant sharing governs access between organizations; it does not combine event data into one calendar.
What mailbox audit logs can—and cannot—tell you
A permission inventory answers who currently has access. Mailbox audit records can help establish which actions occurred. Microsoft’s Exchange mailbox audit documentation identifies Create for items created in Calendar and UpdateCalendarDelegation for delegation assignments. Review audited actions for the owner, delegate, and admin sign-in types in scope rather than assuming all actions are captured identically.
Mailbox auditing is on by default for supported user and shared mailboxes, according to Microsoft. However, a customized action list may not automatically receive newly added Microsoft default actions. Confirm the actual action configuration and audit retention for the mailboxes in scope before relying on logs for a compliance determination.
There is also a multigeo limitation: actions by a user accessing a shared mailbox in another geo are not logged in that shared mailbox’s mailbox audit log. Microsoft points administrators to Exchange admin audit events in Purview Audit and the Search-UnifiedAuditLog cmdlet for admin events across locations. This limitation means the mailbox’s audit log alone may not provide a complete account of cross-geo activity.
Which calendar model fits the need?
Choose the target based on ownership, audience, edit requirements, privacy, and the scope of access that comes with the mailbox or tenant boundary.
| Model | Best fit | Key governance consideration |
|---|---|---|
| Owner-shared calendar | A person or team owner can manage access for a limited audience. | Use distinct permission levels for free/busy, detail, read, write, or delegate needs; account for private-event visibility. |
| Shared mailbox calendar with a security group | A stable mailbox and calendar are needed for a team or larger group. | Microsoft documents granting the group Full Access. That permission also lets members access email sent to the shared mailbox, so use this pattern only when that coupled access is acceptable. |
| Cross-tenant calendar sharing | People in another Microsoft 365 organization need access to calendar availability or shared-calendar information. | Use tenant policies to define external capabilities. The resource tenant controls inbound access; reciprocal access requires the other tenant’s complementary configuration. |
Microsoft’s reviewed documentation supports sharing and accessing calendars, including reading and writing shared or delegated events through Graph, but does not establish a universal automatic calendar-merge function. Do not promise one-click merging or automatic deduplication. For event-level consolidation, define the destination, determine which events should be copied or recreated, plan ownership and permissions, and validate the result against the source. The appropriate procedure and tooling depend on the source and target scenario.
Quick Recap
How to consolidate and validate without losing control
- Inventory the existing setup. Record calendar type and location, owner, business purpose, recipients, roles, private-event expectations, external domains or tenants, and the sharing or availability configuration in use.
- Choose the target model and provision identities. Confirm that destination mailboxes and target users exist and are appropriately provisioned. Microsoft migration guidance describes cases where missing target users prevent permissions from copying, as well as object-level limits. Check the guide for the specific source scenario; do not assume behavior documented for one migration type applies to another.
- Define the event-level plan. Specify what will be copied or recreated, which calendar becomes authoritative, who will own it, and how access will be assigned. Decide how to handle duplicates and private events based on the needs of the source and target, and document any choices that require business approval.
- Pilot representative cases. Include different owner and recipient roles, private-event expectations, shared mailboxes where relevant, and external tenants if they are in scope. Test that intended users see or edit the right information and that access outside the intended audience is blocked.
- Verify before cleanup. Check calendar access, client behavior, and available audit evidence. For cross-tenant changes, test the new functionality before removing legacy policies or relationships. Delete old shares or configurations only after the target is working and the business owner has confirmed the result.
Governance checks to keep the result current
- Assign an accountable owner and business steward to every retained calendar.
- Review named recipients and group membership, including departed users and access that no longer serves a stated purpose.
- Keep the permission role, external boundary, and private-event visibility explicit in the register.
- Review Exchange sharing-policy definitions alongside mailbox assignments; an unassigned policy does not govern a mailbox.
- Confirm that audit actions, sign-in types, and retention meet the purpose for which logs will be used.
- For cross-tenant sharing, confirm both tenant configurations where reciprocal access is required and verify rollout status before relying on the feature.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
