A calendar-blocking permissions audit must cover more than whether a colleague can see that a time is busy. Review every calendar used for blocking, the people and groups with access, the detail level they can see, who can edit or manage sharing, and every scheduling or conferencing application connected to the account. The target state is the least access needed for scheduling to work without exposing event details or granting unnecessary control.
Inventory calendars and access paths
List primary, team, resource, project, and appointment calendars. For each one, capture the owner, organization default, public setting, named users and groups, external recipients, edit roles, delegates, and connected applications. Also check individual-event privacy and guest permissions, because a restrictive calendar default can be overridden by a more permissive event setting. Record whether a booking tool reads free/busy only or can create, edit, and delete events.
Translate platform roles into risk
Google Calendar distinguishes free/busy access, event-detail viewing, editing, and full control that includes managing sharing. Microsoft's Outlook permissions distinguish availability views, title-and-location views, all-details views, editing, and delegate access; a delegate can also schedule and respond to meetings on the owner's behalf. Those levels are not interchangeable. A scheduler that only needs collision detection should not automatically receive event details or sharing control.
Use Google's official calendar-sharing guide to inspect public, organization, group, and individual grants and their permission levels. Use Microsoft's Outlook edit and delegate guide to distinguish editors from delegates and to check whether a delegate can see private events. Include administrators and inherited organization policy in the record when the platform exposes them.
Reduce and document access
Remove former staff and unused app connections, replace individual grants with maintained groups where appropriate, turn off public access unless it is explicitly required, and reduce each role to the narrowest level that supports the workflow. Review whether guests can invite others, modify events, or see the guest list. Treat conferencing links and event descriptions as potentially sensitive content rather than assuming a busy block is empty. Record every exception, its owner, and a review date.
Verify from representative accounts
Test as a free/busy viewer, details viewer, editor, delegate, outside guest, and unauthorized user where those roles exist. Confirm that each account sees only the intended information and can perform only its approved actions. Create and remove a test block, verify the booking tool respects it, and confirm that revocations have propagated. Keep the native permission report and test results so the next audit begins from evidence rather than memory.