--- title: "Virto Calendar App: the brief for your IT team" description: "Where the data stays, which delegated Microsoft 365 permissions Virto Calendar App asks for, certifications we hold and do not, and what it costs." url: https://www.virtosoftware.com/virto-calendar-app-it-brief/ language: en-US last_modified: 2026-10-26T00:00:00+01:00 translations: de: https://www.virtosoftware.com/de/virto-calendar-app-it-brief/index.md --- # Virto Calendar App: the brief for your IT team Someone in your organization wants Virto Calendar App. These are the answers an IT and security review asks for first. For IT, security and procurement. Checked October 26, 2026. ## At a glance - Your content stays in your Microsoft 365 tenant - Delegated permissions only - Each person sees only what they can already see - Admin consent for the whole organization - Installed from Microsoft Marketplace - Runs on Microsoft Azure in the US - No SOC 2 or ISO 27001 of our own - Deploy into Your Tenant on request ## What the app does Virto Calendar App shows events from sources you already have in Microsoft 365 in one calendar, on a SharePoint page, in a Teams tab or in the browser: - Outlook and Exchange calendars, Microsoft 365 group calendars, room and equipment calendars, public folders - SharePoint lists and Planner - iCal feeds, and Google Calendar if someone connects it It has no event store of its own. Each event stays in its source. ## Where your data is - **Events stay in their sources** in your tenant: Exchange, SharePoint and Planner. - **The app backend runs on Microsoft Azure in the US.** It processes content in memory to show it to the signed-in person and does not write it to disk. - **What VirtoSoftware keeps:** the Microsoft 365 user and tenant identifiers used for sign-in and licensing. If someone connects a Google Calendar, also its OAuth tokens and the calendar’s identifier, encrypted, until that data source is deleted ([Privacy Policy](https://www.virtosoftware.com/privacy-policy/#google-retention)). - **Sub-processor:** Microsoft, as the Azure hosting provider. - **Data Processing Agreement** under GDPR Article 28: [request it](https://docs.virtosoftware.com/trust-and-security-center/request-dpa/data-processing-agreement/), no NDA needed. ## What the app asks Microsoft 365 for All permissions are **delegated**. The app acts as the signed-in person and, in Microsoft’s words, “can’t access anything the signed-in user couldn’t access” ([Microsoft Learn](https://learn.microsoft.com/graph/permissions-overview#delegated-permissions)). It asks for no application permissions. | Permission | Microsoft’s description | Asked | | --- | --- | --- | | `openid`, `profile`, `offline_access`, `User.Read` | Sign users in, view their basic profile, keep access while they use the app | First consent, at first sign-in | | `User.ReadBasic.All` | Read all users’ basic profiles | First consent | | `Calendars.ReadWrite.Shared` | Read and write user and shared calendars | First consent | | `MailboxSettings.Read` | Read user mailbox settings | First consent | | `EWS.AccessAsUser.All` (Exchange Online) | Access mailboxes as the signed-in user via Exchange Web Services | First consent | | `Sites.Manage.All` | Create, edit, and delete items and lists in all site collections | First consent | | `Sites.FullControl.All` | Have full control of all site collections | Second consent, from the calendar’s **Settings > Permission** | | `Group.ReadWrite.All` | Read and write all groups | Second consent | | `Place.Read.All` | Read all company places | Second consent | The app signs in through **Virto Apps**, the Entra app `1d610c9c-d68b-494e-baad-ecff3123c065`, which Virto Kanban Board App uses as well. The two apps share one entry and one set of permissions: consent given for either covers both, and each works with everything your tenant has granted that entry, still only as the signed-in person. Virto Forms Designer App, Virto Charts & Data Visualization App and Virto Alerts & Reminder App sign in through Entra apps of their own. To see exactly what your tenant granted, open **Microsoft Entra admin center > Enterprise applications** and find Virto Apps by its ID. You can review or revoke the consent there at any time. **Exchange Web Services.** `EWS.AccessAsUser.All` covers what Microsoft Graph cannot do: public folder calendars, the categories and settings of Microsoft 365 group calendars, and rooms or resources that Graph does not find. Your own calendar, calendars shared with you and your own categories come through Microsoft Graph. Microsoft starts turning EWS off in Exchange Online in October 2026 and turns it off everywhere in April 2027 ([Microsoft Learn](https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/deprecation-of-ews-exchange-online)). Once it is off in your tenant, public folder calendars stop showing and the calendar says that EWS is turned off. Group calendar colours and settings, and rooms or resources that Graph does not find, stop working. ## Sign-in and control - People sign in with their Microsoft 365 work account. VirtoSoftware never receives a password. - A SharePoint administrator adds the app from [Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/WA200005908) to your app catalog. - An administrator who can grant tenant-wide consent, such as a Global, Cloud Application or Application Administrator, then consents for the whole organization: once for everyday use, and once more for the admin settings. A SharePoint administrator cannot give this consent. - In Microsoft Teams, a Teams administrator makes the app available in the Teams admin center. There it is listed as [Virto Calendar Pro](https://marketplace.microsoft.com/en-us/product/WA200006993), and it signs in through the same Entra app, Virto Apps. - The calendar loads from `calendar-app.virtosoftware.com`. If your browsers block third-party cookies, allow that domain. - **Calendar Managers** change calendars and their data sources; **License Managers** assign licences. Everyone else only uses the calendars. - No public or anonymous links. People outside your organization take part only as guests of the SharePoint site that holds the calendar. - How each source decides who sees and edits what: [Who sees what in Virto Calendar App](https://www.virtosoftware.com/microsoft-365-guides/virto-calendar-permissions/). ## Certifications, plainly | Question | Answer | | --- | --- | | SOC 2, ISO/IEC 27001 | VirtoSoftware has neither and does not plan to. If your policy requires them, use Deploy into Your Tenant. | | Microsoft 365 Certification | No. Virto Calendar App has completed Microsoft Publisher Attestation, a self-assessment Microsoft publishes, not an audit. | | Hosting | Microsoft Azure. Azure’s own certifications cover the infrastructure, not VirtoSoftware’s processes. | | Your questionnaire | We fill in your organization’s own form. | More for legal and security reviewers, including the EULA terms and how to request our security policies under NDA: [Security & Compliance](https://www.virtosoftware.com/security-compliance/). ## If your policy rules out SaaS **Deploy into Your Tenant** runs the app in your own Azure subscription and Microsoft 365 tenant, under your own security controls and certifications. It is part of an Enterprise agreement. [How it works](https://www.virtosoftware.com/deploy-virto-apps-in-m365/). ## On this page - What the app does - Where your data is - What the app asks Microsoft 365 for - Sign-in and control - Certifications, plainly - If your policy rules out SaaS - What it costs, and the alternatives ## What it costs, and the alternatives Microsoft 365 gives a calendar to each person, each site and each team. The question is what one calendar for everyone costs. ### Microsoft 365 alone No extra cost - Outlook shared and group calendars - The SharePoint Events web part - The Teams calendar and channel meetings - Each shows its own events, not one view across them [Compare them with Virto Calendar App →](https://www.virtosoftware.com/virto-calendar-app-vs-microsoft-365-calendars/) ### Virto Calendar App $2,412 a year for 100 users - Price valid with a 3-year agreement - 30-day free trial - Everyone who opens the calendar needs a licence - Count the people who will open it, not the whole tenant [See plans and pricing →](https://www.virtosoftware.com/microsoft-365/virto-calendar-overlay-app/#buy-now) ### Build it yourself Your developers’ time - A SharePoint Framework web part and a Teams app - An app registration and its permissions - Upkeep each time Microsoft changes an API ### Deploy into Your Tenant Quote - Runs in your own Azure subscription - For policies that rule out third-party SaaS - Or that require SOC 2 or ISO 27001 from vendors [How it works →](https://www.virtosoftware.com/deploy-virto-apps-in-m365/) **Fewer than 100 people?** [Virto Shared Calendar](https://www.virtosoftware.com/microsoft-teams/virto-teams-shared-calendar/) is priced per creator and editor, and viewers need no licence. Unlike Virto Calendar App, it keeps its events on VirtoSoftware’s Azure. ## Questions from your review? Send us your security questionnaire, or book a call to go through the review with us.