Personal Outlook.com calendar returns 401 with Calendars.ReadBasic after fresh consent

The documented permission model supports this scenario:

• Calendars.ReadBasic delegated permission is available for consent in personal Microsoft accounts.
• Listing events from a user calendar is supported for delegated personal Microsoft accounts with Calendars.ReadBasic, Calendars.Read, or Calendars.ReadWrite.
• MSAL requires requesting the Graph scope explicitly when acquiring tokens.

Given the reported setup, the most likely causes are:

1. The access token is not actually a Microsoft Graph token
   • A successful sign-in and a cached token do not by themselves prove the token is valid for Graph.
   • The supported pattern is to request Graph scopes such as https://graph.microsoft.com/User.Read and https://graph.microsoft.com/Calendar.Read when acquiring the token.
   • Since token audience was not independently verified, the first diagnostic is to confirm the token is for Microsoft Graph.
2. The request is authenticated correctly but the mailbox/account path is the failing component
   • The Graph permission reference says Calendars.ReadBasic is supported for personal Microsoft accounts.
   • The calendar API documentation says delegated personal Microsoft accounts can call calendar event APIs with Calendars.ReadBasic.
   • If the token is confirmed as a Graph token and the scope is present, repeated 401 responses on /me/calendars and calendar endpoints point more toward an account or mailbox-side issue than a consent-flow issue.
3. Scope selection may be too narrow for diagnosis
   • The context shows examples of requesting both User.Read and a calendar scope.
   • Adding User.Read as a diagnostic does not increase calendar access and helps verify that the same token can call a basic Graph endpoint such as /me.
   • If /me succeeds with the same token while calendar endpoints return 401, that separates general token validity from calendar/mailbox access.

Useful non-sensitive diagnostics:

1. Verify the token is a Graph token
   • Confirm the token audience is Microsoft Graph.
   • Confirm the granted delegated scope includes Calendars.ReadBasic.
2. Add User.Read temporarily for diagnosis
   • Request https://graph.microsoft.com/User.Read together with the calendar scope.
   • Acquire a fresh delegated token.
   • Test a basic Graph call such as /me.
   • Expected result:
     • /me succeeds, calendar calls fail: token acquisition is broadly correct; focus shifts to calendar/mailbox-specific behavior.
     • /me also fails with 401: focus shifts to token audience, scope request, or authorization configuration.
3. Keep using delegated permissions only
   • For personal Microsoft accounts, the accepted guidance in similar cases is to use delegated permissions.
   • Personal Microsoft account scenarios that try to use app-only/application permission patterns can produce 401 behavior.
   • The current no-client-secret interactive delegated setup is aligned with that guidance.
4. Confirm the authority and account type remain aligned
   • For personal Microsoft accounts, accepted guidance is to use the consumers endpoint or common for sign-in compatibility.
   • The current consumers authority matches the personal-account-only app registration.
5. Capture full HTTP response metadata on the failing Graph calls
   • Preserve the Graph response status, headers, request ID, and UTC timestamp.
   • The existing request IDs are useful, but exact UTC timestamps are also important for correlation.
   • This is the safest next diagnostic if the token audience and /me test do not explain the issue.
6. Compare with a broader read permission only if needed
   • If minimum-permission diagnosis stalls, test once with delegated Calendars.Read.
   • If Calendars.Read works and Calendars.ReadBasic does not, that isolates the issue to permission handling rather than general authentication.
   • If both fail with a confirmed Graph token, that strengthens the mailbox/account-issue hypothesis.

What the current evidence already rules out:

• It does not look like a basic-auth issue.
• It does not look like an application-permission design issue, because the flow described is delegated and interactive.
• It does not suggest that personal Microsoft accounts are unsupported for Calendars.ReadBasic; the documentation explicitly says they are supported.

Most effective decision tree:

1. Confirm token audience is Graph.
2. Request User.Read + Calendars.ReadBasic and test /me.
3. If /me succeeds but calendar endpoints still return 401, treat it as likely mailbox/account-specific and collect exact UTC timestamps with the request IDs.
4. If needed, test once with delegated Calendars.Read to determine whether the failure is specific to ReadBasic or affects calendar access generally.

• Microsoft Graph permissions reference
• List events
• Acquire and cache tokens using the Microsoft Authentication Library (MSAL)
• 401 Unauthorized When accessing calendar events - Microsoft Q&A
• Persistent 401 error with no explanation - Microsoft Q&A