A newly observed Exchange Online issue causes Remove-CalendarEvents to fail with the following error:
PS C:\> Remove-CalendarEvents -Identity jole@azure.skrubbeltrang.com -QueryWindowInDays 365 `
-CancelOrganizedMeetings
Write-ErrorMessage : ||Error on proxy command 'Remove-CalendarEvents -QueryWindowInDays:'365'
-CancelOrganizedMeetings:$True -Confirm:$False -PreviewOnly:$True
-Identity:'jole@azure.skrubbeltrang.com'' to server MI3PR09MB8547.eurprd09.prod.outlook.com:
Server version 15.21.0472.0000, Proxy method PSWS:
BadRequest: Error executing cmdlet : {
"code": "BadRequest",
"message": "Error executing cmdlet",
"details": [
{
"code": "7",
"message": "|System.InvalidOperationException|You do not have permission to access the
mailbox 'Lennon, John'. The mailbox is outside your RBAC scope. Please verify you have
the necessary permissions.",
"target": "Lennon, John"
}
],
"innererror": {
"message": "Error executing cmdlet",
"type": "Microsoft.Exchange.Admin.OData.Core.ODataServiceException",
"internalexception": {
"message": "Exception of type 'Microsoft.Exchange.Management.
PSDirectInvoke.DirectInvokeCmdletExecutionException' was thrown.",
"type": "Microsoft.Exchange.Management.PSDirectInvoke.
DirectInvokeCmdletExecutionException"
}
},
"adminapi.warnings@odata.type": "#Collection(String)",
"@adminapi.warnings": []
} [Server=AS8PR09MB4727,RequestId=2b5c443c-6f83-743e-9f9b-49eda5f1ce7c,
TimeStamp=10/2/2026 2:53:41 PM] .
At C:\Users\username\AppData\Local\Temp\tmpEXO_djhja5ce.xra\tmpEXO_djhja5ce.xra.psm1:1196
char:13
+ Write-ErrorMessage $ErrorObject
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Remove-CalendarEvents], CmdletProxyException
+ FullyQualifiedErrorId : [Server=AS8PR09MB4727,RequestId=2b5c443c-6f83-743e-9f9b-49eda5f1ce7c
,TimeStamp=Fri, 02 Oct 2026 14:53:41 GMT],Write-ErrorMessage Clients first reported the issue to us on October 1, 2026, and we reproduced it in our test tenant on October 2. The affected PowerShell operation previously worked with no changes to access or credentials.
The failure occurs directly in Exchange Online PowerShell. Both -PreviewOnly and -UseCustomRouting also fail.
Reproducing the Error
The original failure occurred with this cancellation command:
Remove-CalendarEvents -Identity jole@azure.skrubbeltrang.com `
-QueryWindowInDays 365 -CancelOrganizedMeetings -Confirm:$falseFor diagnostic reproduction, use the preview version below. Unlike the original command, it does not cancel meetings. See Microsoft’s Remove-CalendarEvents documentation.
Remove-CalendarEvents -Identity jole@azure.skrubbeltrang.com `
-QueryWindowInDays 365 -CancelOrganizedMeetings -Confirm:$false `
-PreviewOnlyBoth commands return the same underlying error. Relevant response fields, abbreviated:
Proxy target: MI3PR09MB8547.eurprd09.prod.outlook.com
Server version: 15.21.0472.0000
Proxy method PSWS: BadRequest: Error executing cmdlet
"code": "7"
"message": "|System.InvalidOperationException|You do not have permission
to access the mailbox 'Lennon, John'. The mailbox is outside your
RBAC scope. Please verify you have the necessary permissions."
CategoryInfo: NotSpecified: (:) [Remove-CalendarEvents],
CmdletProxyExceptionUseCustomRouting Also Fails
Adding the UseCustomRouting switch to the preview command returns faster in our test, but still fails:
Remove-CalendarEvents -Identity jole@azure.skrubbeltrang.com `
-QueryWindowInDays 365 -CancelOrganizedMeetings -Confirm:$false `
-PreviewOnly -UseCustomRoutingThe response is shorter and no longer contains the proxy error wrapper:
Write-ErrorMessage : ||You do not have permission to access the
mailbox 'Lennon, John'. The mailbox is outside your RBAC scope.
Please verify you have the necessary permissions.
CategoryInfo : InvalidOperation: (Lennon, John:ADObjectId)
[Remove-CalendarEvents], InvalidOperationExceptionNeither switch is a workaround in this test tenant. You can reproduce the failure without actually canceling meetings.
Suspected Exchange Online Backend Regression
The recent onset across multiple tenants makes an Exchange Online backend regression a credible explanation. The custom-routing result shows that the underlying denial persists when routing changes; it does not establish why access is denied.
As of October 2, our public-source research found no Microsoft advisory matching this exact error.
Reporting the Issue to Microsoft Support
Open a case through Help & support in the Microsoft 365 admin center, or through your support partner. Check Service health for a related incident. See Microsoft’s support instructions.
To reduce initial troubleshooting exchanges, update to the latest version of Exchange Online PowerShell (currently 3.10.1) and include the following output in your support ticket:
- Current EXO PowerShell version
- Verbose sign-in to Exchange Online
- Verification of RBAC entitlement
- Basic attributes of the mailbox showing the error
- Verbose output of the failing Remove-CalendarEvents command
Run the following commands:
Get-Module ExchangeOnlineManagement |
Format-List Name,Version,Path
Connect-ExchangeOnline -Verbose
$roles = (Get-ManagementRole -Cmdlet Remove-CalendarEvents).Name
Get-ManagementRoleAssignment `
-RoleAssignee (Get-ConnectionInformation).UserPrincipalName `
-Enabled $true -Delegating $false |
Where-Object { $_.Role -in $roles } |
Format-List Role,RoleAssigneeName,*Scope*
$m = 'jole@azure.skrubbeltrang.com'
Get-Mailbox $m | Format-List `
DisplayName,UserPrincipalName,PrimarySmtpAddress,
ExchangeGuid,ExternalDirectoryObjectId,DistinguishedName,
RecipientTypeDetails,IsDirSynced,IsInactiveMailbox,
WhenSoftDeleted,WhenCreatedUTC,WhenChangedUTC,
CustomAttribute*
Remove-CalendarEvents -Identity '$m' -QueryWindowInDays 365 `
-CancelOrganizedMeetings -VerboseCode output will look similar to this:
PS C:\> Get-Module ExchangeOnlineManagement | Format-List Name,Version,Path
Name : ExchangeOnlineManagement
Version : 3.10.1
Path : C:\Users\username\Documents\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.10.1\netFramework\ExchangeOnlineManagement.psm1
PS C:\> Connect-ExchangeOnline -Verbose -ShowBanner:$false
VERBOSE: Returning precomputed version info: 3.10.1
VERBOSE: ModuleVersion: 3.10.1
VERBOSE: [ThreadID: #] Trying to get a new token from AAD
VERBOSE: [ThreadID: #] Trying to acquire token based on UI flow
VERBOSE: [ThreadID: #] Acquired new token when no params are passed
VERBOSE: [ThreadID: #] Successfully got a token from AAD
VERBOSE: AutoGen EXOModule created at C:\Users\username\AppData\Local\Temp\tmpEXO_hml4x0br.bp0
VERBOSE: Running Configure-AppSettings
VERBOSE: Setting PrintWarningsReceivedFromServer to False
VERBOSE: PageSizes is set to: 1000
VERBOSE: Logs location is reset to C:\Users\username\AppData\Local\Temp\EXOCmdletTelemetry
VERBOSE: Max directory size reset to 2000000000
VERBOSE: Max log size reset to 100000000
VERBOSE: Log level reset to Default
VERBOSE: Logger reset to null.
VERBOSE: TrackPerformance is set to: False
VERBOSE: ShowProgress is set to: False
VERBOSE: UseMultithreading is set to: True
PS C:\> $roles = (Get-ManagementRole -Cmdlet Remove-CalendarEvents).Name
PS C:\> Get-ManagementRoleAssignment -RoleAssignee (Get-ConnectionInformation).UserPrincipalName -Enabled $true -Delegating $false |
>> Where-Object { $_.Role -in $roles } |
>> Format-List Role,RoleAssigneeName,*Scope*
Role : Mail Recipient Creation
RoleAssigneeName : Organization Management
CustomRecipientWriteScope :
CustomResourceScope :
CustomConfigWriteScope :
RecipientReadScope : Organization
ConfigReadScope : OrganizationConfig
RecipientWriteScope : Organization
ConfigWriteScope : OrganizationConfig
PS C:\> $m = "jole@azure.skrubbeltrang.com"
PS C:\> Get-Mailbox $m | Format-List `
>> DisplayName,UserPrincipalName,PrimarySmtpAddress,
>> ExchangeGuid,ExternalDirectoryObjectId,DistinguishedName,
>> RecipientTypeDetails,IsDirSynced,IsInactiveMailbox,WhenSoftDeleted,
>> WhenCreatedUTC,WhenChangedUTC,CustomAttribute*
DisplayName : Lennon, John
UserPrincipalName : JoLe@azure.skrubbeltrang.com
PrimarySmtpAddress : JLennon@azure.skrubbeltrang.com
ExchangeGuid : 80ab3214-cc24-4c83-9ae5-9b45a41c6dc1
ExternalDirectoryObjectId : 70e6dcdc-d8aa-4c46-8946-bd38477c7d37
DistinguishedName : CN=Lennon\, John,OU=e365m.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR09A010,DC=PROD,DC=OUTLOOK,DC=COM
RecipientTypeDetails : UserMailbox
IsDirSynced : True
IsInactiveMailbox : False
WhenSoftDeleted :
WhenCreatedUTC : 10/2/2026 11:10:08 AM
WhenChangedUTC : 10/2/2026 3:47:57 PM
CustomAttribute1 : Researchers
CustomAttribute10 :
CustomAttribute11 :
CustomAttribute12 :
CustomAttribute13 :
CustomAttribute14 :
CustomAttribute15 :
CustomAttribute2 : AB123
CustomAttribute3 : Test_Attrib_3
CustomAttribute4 :
CustomAttribute5 :
CustomAttribute6 :
CustomAttribute7 :
CustomAttribute8 : Team-B1
CustomAttribute9 :
PS C:\> Remove-CalendarEvents -Identity $m -QueryWindowInDays 365 -CancelOrganizedMeetings -Verbose -Confirm:$false
VERBOSE: Returning precomputed version info: 3.10.1
VERBOSE: POST https://outlook.office365.com/adminapi/beta/8a35f394-855d-4d13-9f6f-86d8eb24dc6b/InvokeCommand with -1-byte payload
VERBOSE: Query 1 failed.
Write-ErrorMessage : ||Error on proxy command 'Remove-CalendarEvents -QueryWindowInDays:'365' -Confirm:$False -CancelOrganizedMeetings:$True -Identity:'jole@azure.skrubbeltrang.com'' to server MI3PR09MB8547.eurprd09.prod.outlook.com: Server version 15.21.0472.0000, Proxy method PSWS:
BadRequest: Error executing cmdlet : {
"code": "BadRequest",
"message": "Error executing cmdlet",
"details": [
{
"code": "7",
"message": "|System.InvalidOperationException|You do not have permission to access the mailbox 'Lennon, John'. The mailbox is outside your RBAC scope. Please verify you have the necessary permissions.",
"target": "Lennon, John"
}
],
"innererror": {
"message": "Error executing cmdlet",
"type": "Microsoft.Exchange.Admin.OData.Core.ODataServiceException",
"internalexception": {
"message": "Exception of type 'Microsoft.Exchange.Management.PSDirectInvoke.DirectInvokeCmdletExecutionException' was thrown.",
"type": "Microsoft.Exchange.Management.PSDirectInvoke.DirectInvokeCmdletExecutionException"
}
},
"adminapi.warnings@odata.type": "#Collection(String)",
"@adminapi.warnings": []
} [Server=AS8PR09MB4727,RequestId=7605c49b-1dff-984f-98f6-3342fc7159ec,TimeStamp=10/2/2026 3:52:05 PM] .
At C:\Users\Skrubbeltrang\AppData\Local\Temp\tmpEXO_jvptgark.ivk\tmpEXO_jvptgark.ivk.psm1:1196 char:13
+ Write-ErrorMessage $ErrorObject
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Remove-CalendarEvents], CmdletProxyException
+ FullyQualifiedErrorId : [Server=AS8PR09MB4727,RequestId=7605c49b-1dff-984f-98f6-3342fc7159ec,TimeStamp=Fri, 02 Oct 2026 15:52:05 GMT],Write-ErrorMessage
This output collects evidence, documents the permission model, and should minimize the need for excessive ping-pong with first-line support.
Update 2026-10-03
We created a ticket on this issue with Microsoft support and received the following feedback:
“… the issue appears to be related to a recent behavior observed in Exchange Online where the Remove-CalendarEvents cmdlet returns an RBAC scope error, even when executed by administrators who previously had the required permissions and were able to run the command successfully.”
We still urge clients to create a ticket for this issue to push for a solution.
Update 2026-10-08
We received additional reports from clients that this error is also surfacing with another error message:
“The action ‘Remove-CalendarEvents’, ‘CancelOrganizedMeetings,Confirm,Identity,QueryWindowInDays’, can’t be performed on the object ‘username’ because the object is being synchronized from your on-premises organization. This action should be performed on the object in your on-premises organization.“
The underlying cause is the same, and you can verify and report it using the above procedures.
