Virto Calendar App: the brief for your IT team

Someone in your organization wants Virto Calendar App. These are the answers an IT and security review asks for first.

For IT, security and procurement. Checked October 26, 2026.

At a glance

Your content stays in your Microsoft 365 tenant
Delegated permissions only
Each person sees only what they can already see
Admin consent for the whole organization
Installed from Microsoft Marketplace
Runs on Microsoft Azure in the US
No SOC 2 or ISO 27001 of our own
Deploy into Your Tenant on request

What the app does

Virto Calendar App shows events from sources you already have in Microsoft 365 in one calendar, on a SharePoint page, in a Teams tab or in the browser:

Outlook and Exchange calendars, Microsoft 365 group calendars, room and equipment calendars, public folders
SharePoint lists and Planner
iCal feeds, and Google Calendar if someone connects it

It has no event store of its own. Each event stays in its source.

Where your data is

Events stay in their sources in your tenant: Exchange, SharePoint and Planner.
The app backend runs on Microsoft Azure in the US. It processes content in memory to show it to the signed-in person and does not write it to disk.
What VirtoSoftware keeps: the Microsoft 365 user and tenant identifiers used for sign-in and licensing. If someone connects a Google Calendar, also its OAuth tokens and the calendar’s identifier, encrypted, until that data source is deleted (Privacy Policy).
Sub-processor: Microsoft, as the Azure hosting provider.
Data Processing Agreement under GDPR Article 28: request it, no NDA needed.

What the app asks Microsoft 365 for

All permissions are delegated. The app acts as the signed-in person and, in Microsoft’s words, “can’t access anything the signed-in user couldn’t access” (Microsoft Learn). It asks for no application permissions.

Permission	Microsoft’s description	Asked
`openid`, `profile`, `offline_access`, `User.Read`	Sign users in, view their basic profile, keep access while they use the app	First consent, at first sign-in
`User.ReadBasic.All`	Read all users’ basic profiles	First consent
`Calendars.ReadWrite.Shared`	Read and write user and shared calendars	First consent
`MailboxSettings.Read`	Read user mailbox settings	First consent
`EWS.AccessAsUser.All` (Exchange Online)	Access mailboxes as the signed-in user via Exchange Web Services	First consent
`Sites.Manage.All`	Create, edit, and delete items and lists in all site collections	First consent
`Sites.FullControl.All`	Have full control of all site collections	Second consent, from the calendar’s Settings > Permission
`Group.ReadWrite.All`	Read and write all groups	Second consent
`Place.Read.All`	Read all company places	Second consent

The app signs in through Virto Apps, the Entra app 1d610c9c-d68b-494e-baad-ecff3123c065, which Virto Kanban Board App uses as well. The two apps share one entry and one set of permissions: consent given for either covers both, and each works with everything your tenant has granted that entry, still only as the signed-in person. Virto Forms Designer App, Virto Charts & Data Visualization App and Virto Alerts & Reminder App sign in through Entra apps of their own. To see exactly what your tenant granted, open Microsoft Entra admin center > Enterprise applications and find Virto Apps by its ID. You can review or revoke the consent there at any time.

Exchange Web Services. EWS.AccessAsUser.All covers what Microsoft Graph cannot do: public folder calendars, the categories and settings of Microsoft 365 group calendars, and rooms or resources that Graph does not find. Your own calendar, calendars shared with you and your own categories come through Microsoft Graph. Microsoft starts turning EWS off in Exchange Online in October 2026 and turns it off everywhere in April 2027 (Microsoft Learn). Once it is off in your tenant, public folder calendars stop showing and the calendar says that EWS is turned off. Group calendar colours and settings, and rooms or resources that Graph does not find, stop working.

People sign in with their Microsoft 365 work account. VirtoSoftware never receives a password.
A SharePoint administrator adds the app from Microsoft Marketplace to your app catalog.
An administrator who can grant tenant-wide consent, such as a Global, Cloud Application or Application Administrator, then consents for the whole organization: once for everyday use, and once more for the admin settings. A SharePoint administrator cannot give this consent.
In Microsoft Teams, a Teams administrator makes the app available in the Teams admin center. There it is listed as Virto Calendar Pro, and it signs in through the same Entra app, Virto Apps.
The calendar loads from calendar-app.virtosoftware.com. If your browsers block third-party cookies, allow that domain.
Calendar Managers change calendars and their data sources; License Managers assign licences. Everyone else only uses the calendars.
No public or anonymous links. People outside your organization take part only as guests of the SharePoint site that holds the calendar.
How each source decides who sees and edits what: Who sees what in Virto Calendar App.

Certifications, plainly

Question	Answer
SOC 2, ISO/IEC 27001	VirtoSoftware has neither and does not plan to. If your policy requires them, use Deploy into Your Tenant.
Microsoft 365 Certification	No. Virto Calendar App has completed Microsoft Publisher Attestation, a self-assessment Microsoft publishes, not an audit.
Hosting	Microsoft Azure. Azure’s own certifications cover the infrastructure, not VirtoSoftware’s processes.
Your questionnaire	We fill in your organization’s own form.

More for legal and security reviewers, including the EULA terms and how to request our security policies under NDA: Security & Compliance.

If your policy rules out SaaS

Deploy into Your Tenant runs the app in your own Azure subscription and Microsoft 365 tenant, under your own security controls and certifications. It is part of an Enterprise agreement. How it works.

What it costs, and the alternatives

Microsoft 365 gives a calendar to each person, each site and each team. The question is what one calendar for everyone costs.

Microsoft 365 alone

No extra cost

Outlook shared and group calendars
The SharePoint Events web part
The Teams calendar and channel meetings
Each shows its own events, not one view across them

Compare them with Virto Calendar App →