Fix Microsoft Graph Calendar Event POST 401 Unauthorized Error
Question details
A custom application receives a 401 Unauthorized error when attempting to create Outlook calendar events via the Microsoft Graph API.
- Product
- Microsoft Graph API
- Device & OS
- not provided
- Scenario
- Integrating a custom Angular application with Microsoft Graph to authenticate users and POST new calendar events.
- Observed behavior
- The application authenticates users successfully, but returns a 401 Unauthorized response during the calendar POST request due to potential missing permissions or incorrect audience claims.
Ensure you have access to your application's source code, administrative access to the Azure portal for app registration, and a secure tool to decode and inspect your JWT access tokens.
Verify Token Audience and Permissions in Azure AD
Check if your access token has the correct audience and delegated permissions required to create Microsoft Graph calendar events.
A successfully authenticated user token does not automatically grant access to Microsoft Graph. The token must be explicitly minted for the Microsoft Graph API and contain the appropriate calendar access scopes.
Copy the access token your Angular application is sending and paste it into a secure JWT decoding tool to inspect the payload claims.
Locate the 'aud' (audience) claim in the decoded payload. It must be exactly 'https://graph.microsoft.com'. If it points to your custom API's client ID, Microsoft Graph will reject it with a 401 error.
Look for the 'scp' (scopes) claim in the token payload. Ensure it includes the 'Calendars.ReadWrite' permission.
If the required scopes are missing, log into the Azure Portal, navigate to 'App registrations', select your application, go to 'API permissions', and add 'Calendars.ReadWrite' under Microsoft Graph delegated permissions.
Consult the Microsoft Developer Forum
Since this is an application-development and integration issue, complex scenarios may require dedicated engineering support.
Looking for a simpler office suite? Try WPS Office
If you are dealing with complex Microsoft 365 integrations and need a standalone, reliable, and lightweight productivity suite for your daily document tasks, WPS Office provides an excellent free alternative. It offers powerful tools for creating text documents, spreadsheets, and presentations without the overhead of enterprise API management.
- 1. Download the installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the suite: Run the downloaded setup file and follow the on-screen instructions to install the software.
- 3. Open your files: Launch WPS Office and instantly open, edit, or create new documents seamlessly.
Frequently Asked Questions
Why does my Microsoft Graph API token decode successfully but still return 401 Unauthorized?
A token can be validly signed and authenticated for your front-end application, but if it lacks the specific API scopes (like Calendars.ReadWrite) or has an incorrect audience (targeting your backend instead of Microsoft Graph), the Graph API will reject it.
What is the correct scope needed to create an Outlook calendar event?
To POST a new calendar event, your application typically requires the 'Calendars.ReadWrite' delegated permission if acting on behalf of a user. For app-only access without a signed-in user, it requires the application permission of the same name.
How do I check the audience of my access token?
You can inspect your access token by pasting it into a JWT decoding tool. Look for the 'aud' claim in the payload section; for Microsoft Graph requests, this value must exactly match 'https://graph.microsoft.com'.
Does the account type affect Microsoft Graph API permissions?
Yes. Certain Microsoft Graph permissions and endpoints may behave differently depending on whether the authenticated user is logging in with a personal Microsoft account (like Outlook.com) or a Work/School account associated with an Azure AD tenant.
