Free tools Windows power users keep installed
One-click scans. No signup required.
To audit shared calendars in Microsoft 365, inventory each calendar and its owner, inspect permissions from the owner’s perspective, review Exchange sharing policies and relevant audit logs, then pilot a target calendar model before removing old access. A permissions list shows who can access a calendar now; mailbox audit records can help show what actions occurred. Neither replaces the other.
What belongs in a shared-calendar audit?
Set the scope before collecting permissions. Include user primary and custom calendars, resource calendars, shared mailboxes, Microsoft 365 Group calendars, and cross-tenant sharing arrangements. A calendar can be shared without being a shared mailbox, and those arrangements have different ownership and access implications.
As an Amazon Associate I earn from qualifying purchases.
Use a register as the working record. For each calendar, capture:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Calendar name and location, owner, purpose, and business steward.
- When the business need was last confirmed and whether the calendar should remain, be consolidated, or be retired.
- Recipients and groups, their permission levels, and whether access is internal or external.
- Whether private event details are exposed, where applicable.
- For external access, the relevant domain or tenant and the policy boundary governing it.
- Any migration dependencies, such as target mailboxes and identities that must exist first.
Confirm the business owner and any retention requirements before proposing removal. The register is a governance control, not a Microsoft-generated inventory format.
#1 Best Overall
How do you determine who can access a calendar?
Inspect Outlook or Exchange sharing and delegation permissions from the calendar owner’s context. Microsoft Graph returns the owner’s calendar permission objects; querying as a recipient or delegate returns an empty permissions collection. An empty collection from that perspective does not establish that the calendar has no shares.
Record permission level rather than marking a calendar simply “shared.” Depending on the share, access can be limited to free/busy information, limited event details, read, write, or delegate capabilities. Some delegate arrangements distinguish whether private events are visible. Capture organization-wide default access too, where it applies.
Graph supports listing, creating, reading, updating, and deleting calendar permissions subject to the API’s documented limits. Once a recipient is configured, the role can be updated; changing the recipient identity requires removing that permission and creating a new one. Validate the owner, recipient, and intended role before making changes.
Which tenant controls govern sharing?
External sharing policies
Exchange Online sharing policies can limit the external domains users share with and the calendar detail level they expose. Review both policy definitions and mailbox assignments: creating a policy does not make it effective for a mailbox until it is applied there. A mailbox’s sharing policy can also be disabled to prevent external calendar sharing.
Cross-tenant sharing
Microsoft documents Microsoft 365 cross-tenant access policies as the newer standard for free/busy, calendar sharing, and MailTips between Microsoft 365 organizations, replacing organization relationships and sharing policies for those scenarios. Availability can vary by tenant, so verify rollout status before planning a change. The organization that owns the calendar controls inbound access; reciprocal access requires complementary configuration in both organizations.
Before replacing legacy cross-tenant configuration, inventory existing sharing policies and organization relationship or availability settings, configure the corresponding cross-tenant policies, and test the result. Microsoft recommends testing before cleaning up the old configuration. Cross-tenant sharing governs access between organizations; it does not combine events into one calendar.
What can mailbox audit logs tell you?
A permission inventory answers who currently has access. Mailbox audit records can help investigate actions. Microsoft’s documented mailbox audit actions include Create for items created in Calendar and UpdateCalendarDelegation for delegation assignments. Check audited actions by owner, delegate, and admin sign-in type for the mailboxes in scope instead of assuming every action is recorded identically.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsMailbox auditing is on by default for supported user and shared mailboxes, according to Microsoft. However, customized action lists may not automatically receive newly added Microsoft default actions. Confirm the actual action configuration and audit retention in the tenant before using logs to support a compliance conclusion.
In multigeo environments, actions by a user accessing a shared mailbox in another geo are not logged in that shared mailbox’s mailbox audit log. For admin events across locations, Microsoft’s documentation points to Exchange admin audit events in Purview Audit and the Search-UnifiedAuditLog cmdlet. This limitation means a missing entry in that mailbox log is not, on its own, proof that an action did not occur.
Which calendar model fits the intended access?
| Model | Best fit | Governance consideration |
|---|---|---|
| Owner-shared calendar | A person or team owner manages access for a limited audience with different read, write, or delegate needs. | Keep the owner and steward current; set only the level of detail and event access recipients need. |
| Shared mailbox calendar with a security group | A team needs a stable mailbox and calendar with group-based access management. | Microsoft documents Full Access for the security group. Full Access also grants members access to email sent to that mailbox, so use this model only if the coupled email access is acceptable. |
| Cross-tenant calendar sharing | People in another Microsoft 365 organization need calendar capabilities permitted by tenant policy. | The resource tenant controls inbound access; reciprocal access needs configuration in both organizations. This shares access, not event data into a combined calendar. |
Choose against the actual audience, edit requirements, private-event expectations, stewardship model, and tolerance for mailbox-wide access. Also plan how group membership and departed-user access will be maintained, and what activity evidence is available for the chosen arrangement.
Does Microsoft 365 automatically merge shared calendars?
Microsoft’s documented support for sharing and accessing calendars, including reading and writing shared or delegated events through Graph, does not establish a universal automatic merge or one-click deduplication feature. Treat consolidation as an event-level migration project rather than assuming that changing permissions will combine calendar contents.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Define the destination calendar and decide which events should be copied or recreated. Specify who owns the destination, which people or groups receive access, and how duplicates or obsolete events will be handled. The migration behavior and available tooling depend on the source and target scenario; validate the selected method against Microsoft’s guidance for that specific path.
How should you migrate and validate changes?
- Baseline the current setup. Complete the calendar register, record existing roles and sharing policies, identify owners and external relationships, and confirm retention requirements.
- Provision target identities. Ensure target mailboxes and users exist and are appropriately provisioned before migration. Microsoft’s migration guidance describes cases where missing target users prevent permissions from copying, as well as object-level limitations. Confirm behavior for the exact source scenario; a limitation documented for one migration path should not be generalized to every path.
- Configure the target model. Apply the intended calendar permissions, group membership, mailbox policy assignments, and cross-tenant settings. Keep legacy access available while the pilot is being checked, unless a security requirement calls for a different sequence.
- Pilot representative cases. Include different owners, recipients, permission levels, private-event expectations, shared mailboxes, and external tenants where those apply.
- Verify both allowed and blocked access. Ask intended users to check the calendar details and perform the required read or edit tasks. Check that users who should not have access cannot see it, and that private-event visibility matches the intended role.
- Review evidence and client behavior. Confirm the relevant audit configuration and available events, and test the clients users rely on. Investigate mismatches before removing the old share or relationship.
- Retire old access deliberately. Once the pilot meets the requirements, remove superseded permissions and legacy configuration, then update the register with the decision and responsible steward.
The sequence is a risk-control approach: Microsoft’s migration and cross-tenant guidance calls for reviewing existing configuration and testing before cleanup, while the event-copy plan depends on the specific migration scenario.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
