Microsoft blocks user consent for calendar apps by default

What changed in November 2025

In November 2025, Microsoft changed a default that most people never knew existed. Microsoft Entra now blocks user consent for calendar apps out of the box: when a third-party app requests calendar permissions, Calendars.Read or Calendars.ReadWrite, individual users can no longer approve the request themselves. An administrator has to grant it. Existing grants were grandfathered, so connections made before the change kept working.

Defaults matter because most organizations never touch them. An admin can still deliberately allow user consent, and some do. But in the ordinary tenant that inherited the new default, every fresh calendar app connection now ends at a screen that says "Need admin approval" instead of a permission prompt you could accept yourself.

What it broke

Every calendar tool built on OAuth connects the same way: you sign in, the app requests calendar permissions, you approve, the app's servers get a token. That last step is what the new default removes for ordinary users on work and school accounts. The tools themselves did nothing wrong, and the good ones responded transparently. CalendarBridge, OneCal, Reclaim.ai, and Morgen all publish admin-approval help articles for managed Microsoft tenants, because their model requires each account to be connected and each new connection now needs an admin.

The grandfathering is why the breakage looks so uneven. Your existing connected account keeps syncing like nothing happened. It is the next connection that fails: the new client account, the new tool you are evaluating, the account you reconnect after revoking it. Two people at the same company can have opposite experiences with the same app, and both are behaving exactly as configured.

Who feels it most

If you have one employer and one calendar, you may never notice. The change lands hardest on people who work across organizations:

• Consultants and fractional executives with a managed Microsoft account at each client. Every client is a separate Entra tenant, each with its own default-deny consent policy and its own IT queue.
• Agency contractors handed an M365 login for the length of an engagement, with no standing to file IT requests.
• MSP technicians holding accounts in dozens of customer tenants.

Notice the pattern: the people who most need to combine calendars are the people least able to get an OAuth connection approved. Personal Microsoft accounts are not governed by tenant consent policy, so this is specifically a work and school account problem.

To be fair to Microsoft

This was a defensible security decision. Consent phishing is a real attack: register an innocent-looking app, ask victims to grant it mailbox or calendar scopes, and quietly read their data through a token that survives password changes. Locking user consent by default closes that door for calendar data. The cost just happens to land on legitimate tools and the multi-client professionals who rely on them. Both things are true.

Your three options now

1. Ask the admin. Realistic at a small company with a responsive IT person, slow to impossible at a client. We wrote a full guide to that screen and how to make the request well: the "Need admin approval" calendar app screen, explained.
2. Lean on grandfathered grants. Connections made before November 2025 keep working. That helps with accounts you already connected, and does nothing for any account you add from now on.
3. Go local. Use a tool that never requests API access, so there is no consent to block.

The local alternative

manyCalendars takes the third path. It is a desktop browser extension that shows all your calendars in one view, entirely on your machine, without connecting to any account. That makes it, as far as we know, the only calendar tool that works when IT says no. Two ways to bring a calendar in:

• Manual calendars: unlimited .ics files and feed URLs on the free tier. No account needed, 100 percent local. See sync a calendar without connecting your account.
• Tab Sync (Pro, 15 dollars a month or 150 dollars a year): open your Outlook or Google calendar in a tab like you already do and sync it. The calendar follows its tab from then on. No OAuth request ever leaves your browser, so the November 2025 default is simply not in play.

The honest limits: desktop browsers only, no phone app. Tab Sync reads what is visible in a tab you are signed into, and it is read-only on the source calendar. If you need true two-way sync between accounts and your admins will approve it, a cloud service like CalendarBridge (4, 8, or 32 dollars per user per month, with patented server-mediated two-way sync, booking pages, and a HIPAA BAA) remains a genuinely good product. The comparison is here: manyCalendars vs CalendarBridge.

Every install starts a 14-day full trial, no card and no account. Install it free, check the pricing, or start from the top with the complete guide to calendars without admin approval.