How to Add and Fetch Outlook Calendar Appointments in ASP.NET MVC

If you're integrating with Outlook calendars today, the current, actively supported path is the Microsoft Graph API, not Exchange Web Services (EWS) — a lot of older tutorials and Stack Overflow answers still describe EWS-based approaches, but Microsoft has been steadily deprecating EWS access in favor of Graph, and building new integrations against it in 2026 means building against something Microsoft is actively moving away from.

Before writing any code, the integration needs to be registered as an application in Microsoft Entra ID (formerly Azure AD), where you configure OAuth authentication and request the specific Graph API permissions your integration needs — typically Calendars.Read for fetching appointments, or Calendars.ReadWrite if your application also needs to create or modify them.

Authentication follows the standard OAuth 2.0 authorization code flow for a web application acting on behalf of a signed-in user — your ASP.NET MVC application redirects the user to Microsoft's sign-in page, receives an authorization code back, and exchanges that code for an access token your server then uses to call the Graph API on the user's behalf. The Microsoft.Identity.Web NuGet package handles most of this flow for you in an ASP.NET application, rather than requiring you to hand-implement the OAuth exchange yourself.

Once authenticated, fetching a user's calendar events is a call to the Graph API's /me/calendar/events endpoint (or /me/calendarview for a specific date range, which is almost always what you actually want for a calendar UI, since it correctly expands recurring events into their individual occurrences within the requested window). The Microsoft.Graph SDK for .NET wraps these endpoints in a strongly typed client, which is worth using over hand-building raw HTTP requests, since it handles pagination and response deserialization for you.

Creating an appointment works the same way in reverse — a POST request to the events endpoint with a properly structured event object, including subject, start and end times with explicit time zone information, and attendee email addresses if you're inviting other people. Time zone handling deserves particular care here too, exactly as with FullCalendar integrations — Graph API events include an explicit time zone field precisely because assuming UTC or the server's local time silently produces appointments at the wrong time for users in different zones.

Token expiration and refresh need explicit handling for any long-running integration — access tokens from Microsoft's identity platform are short-lived by design, and your application needs to either use the refresh token flow to obtain new access tokens transparently, or rely on the Microsoft.Identity.Web library's built-in token caching and refresh handling, which manages this automatically if configured correctly, rather than requiring users to re-authenticate every time a token expires.

For local development and testing, use a dedicated test account in your organization's Entra ID tenant rather than a real user's mailbox, and be deliberate about requesting only the specific Graph permissions your integration actually needs — requesting broader permissions than necessary both raises legitimate security concerns during any admin consent review and increases the blast radius if your application's credentials are ever compromised.