What can an AI agent do with
Full access to your calendar (Calendars.ReadWrite, delegated)?
It can see your calendar and add, change, or delete events on it. When it creates a meeting with attendees, they get an invitation from you.
How to spot it
On a Microsoft 365 (Microsoft Graph) connection or settings screen, this is Calendars.ReadWrite.
With it, an agent can
- Read your calendar events, including their details
- Create new events
- Change event times or details
- Delete events
- Send meeting invitations in your name when it creates a meeting with attendees
It cannot, on its own
- Send regular email that is not a meeting invitation (that needs Mail.Send)
What a bad day looks like
An agent that misunderstands a request could delete or move your client appointments, or send meeting invitations to customers in your name, and you might only find out when someone does not show up.
Set it up safer
- If it only needs to see your schedule, ask for Calendars.Read.
- If it only needs times and titles, ask for Calendars.ReadBasic, which leaves out things like the event body and attachments.
Ask the company selling the agent
- Will the agent ever delete or move an event without asking me?
- Will it ever invite people to meetings in my name?
- Does it need to read the notes and attachments on my meetings?
- Can I see a history of what it changed on my calendar?
Source
Checked against Microsoft 365 (Microsoft Graph) documentation on 2026-09-28. All Microsoft 365 (Microsoft Graph) permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.