Calendar Folder Permissions

The question it answers: Which mailbox calendars show full details to everyone in the organisation or to anonymous users?

By default everyone in the organisation sees only free/busy on a colleague’s calendar. Mailboxes where ‘Default’ was raised to Reviewer or above expose meeting subjects, attendees and locations to the whole company - and ‘Anonymous’ access exposes them to the internet.

Note

The scan makes three calls per mailbox in the single PowerShell runspace - expect a long run on large tenants; other PowerShell reports wait meanwhile.

At a glance

Where in the app	Exchange Online › Mail Security Posture › Calendar Permissions
Workload	Exchange Online
Kind	Table · dashboard tile
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online.
Report id (API and MCP)	exchange.posture.calendar-permissions

Columns

Column	Key	Type
Mailbox	Mailbox	Text
Finding	PermissionFinding	Status
Default	DefaultAccess	Text
Anonymous	AnonymousAccess	Text
Folder	CalendarFolder	Text
Scan error	ScanError	Text

Filters

Filter	Key (API)	On when the page opens
Only calendars shared beyond free/busy	shared	Yes

What it needs

Licence: Exchange Online.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application

Data sources it reads

• Get-EXOMailbox
• Get-MailboxFolderStatistics -FolderScope Calendar
• Get-MailboxFolderPermission
• Get-MailboxCalendarFolder

Through the API and MCP

GET /ir-api/v1/reports/exchange.posture.calendar-permissions?size=100
GET /ir-api/v1/reports/exchange.posture.calendar-permissions?filter=shared
POST /ir-api/v1/reports/exchange.posture.calendar-permissions/scan

An AI assistant reads it with the MCP tool get_report and the id exchange.posture.calendar-permissions. The client needs the Run scan grant for Exchange Online. See Using the API.