Published Calendars
The question it answers: Which mailbox calendars are published to the internet through a public HTML / ICS link, and with how much detail?
Calendar publishing creates a public web link (HTML / ICS) to a mailbox’s calendar that anyone with the URL can read, without signing in. Links get forwarded, indexed and forgotten - full-detail publishing exposes every meeting subject and location.
At a glance
Section titled “At a glance”| Where in the app | Exchange Online › Mail Security Posture › Published Calendars |
| Workload | Exchange Online |
| Kind | Table · dashboard tile |
| Data | A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report. |
| Licence | Exchange Online. |
| Report id (API and MCP) | exchange.posture.published-calendars |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Mailbox | Mailbox | Text |
| Detail level | PublishDetailLevel | Status |
| Folder | CalendarFolder | Text |
What it needs
Section titled “What it needs”Licence: Exchange Online.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Exchange.ManageAsApp | Office 365 Exchange Online | Manage Exchange As Application |
Data sources it reads
Get-MailboxCalendarFolder (per mailbox)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/exchange.posture.published-calendars?size=100POST /ir-api/v1/reports/exchange.posture.published-calendars/scanAn AI assistant reads it with the MCP tool get_report and the id exchange.posture.published-calendars. The client needs the Run scan grant for Exchange Online. See Using the API.