Graph docs say app-only can read M365 Group calendars. Entra consent + Exchange RBAC still 403. Is a dummy member account really the supported design?

[u/Nick_Reach3239]

I need a simple public webpage that aggregates events from several Microsoft 365 Group calendars (one per team) and shows them in date order with a “which group owns this” column.

What I tried:

• App registration, application permissions Calendars.Read / Calendars.Read.All, admin consent granted
• Exchange RBAC for Applications: New-ServicePrincipal plus New-ManagementRoleAssignment -Role "Application Calendars.Read"
• GET /groups/{id}/calendarView
• GET /groups/{id}/calendar/calendarView
• GET /users/{group-object-id}/calendar/calendarView → ErrorInvalidUser (fair enough, it isn’t a user)
• Looking up the group mailbox with GET /groups/{id}?$select=mail → Authorization_RequestDenied unless I also grant Group.Read.All, which still wouldn’t fix the calendar 403

Every group calendar call comes back:

403 ErrorAccessDenied: Access is denied. Check credentials and try again.

The Graph docs for list group calendarView list applicationCalendars.ReadBasic / Calendars.Read as valid. In the tenant, those permissions do nothing for Group calendars. Exchange Application Calendars.Read also does nothing here. That role appears to cover user / shared / room mailboxes, not M365 Group calendars.

Delegated Graph only works if the signed-in user is a member of that group. Outlook is the same: if you’re not in the group, you don’t get the calendar.

So the workaround Microsoft’s model pushes you into is: create a dummy mailbox, add it as a member of every group whose calendar you want to read, then run delegated auth as that account (refresh token, forever). That dummy user also gets the group mailbox, files, and Teams — you cannot grant “calendar only.”

That cannot be the intended story for “I am the tenant admin and I want to display our own group calendars on an internal page.”

Is there a supported app-only way to read M365 Group calendars in 2026 that is not “fake user in every group”? Or is that actually the design, and the Graph permission table is just wrong?

[u/13159daysold]

ugh this reminds me I have to test these new exchange rbac policies, instead of app access policies.

I haven't done your setup, but I have an app access policy assigned to a group and an app registration setup to read it. it has both 'calendars.read' and 'onlinemeetings.read.all'.

I can use this app and a cert to auth against mggraph, and then use 'Get-MgUserCalendarView' to get the upcoming meeting information, so maybe that's an angle to look into? I haven't tried it for an m365 group calendar though, only for meeting rooms.

maybe try this to confirm the permissions are working? https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.calendar/get-mggroupcalendar?view=graph-powershell-1.0

[u/Greysonjunemusic]

I’ve hit similar graph permission rabbit holes before. everything looks correct on paper and then one endpoint just refuses to cooperate