[Inquiry] Mass Cancellation of Outlook Calendar Events and Synchronization Behavior

Please note that this is the ko-kr forum. We kindly recommend posting your question in Korean so that more community members can assist you. Alternatively, you may consider posting in the en-us forum if you prefer to use English. We sincerely appreciate your understanding. 

Hi mic815025

Based on the pattern you described particularly the batch-like waves, identical timestamps, and cross-mailbox impact the behavior strongly suggests automated or programmatic activity, rather than manual end-user action. This aligns with several of your initial hypotheses.

The following provides a structured investigation approach for your consideration.

Primary Investigation – Unified Audit Log

A recommended starting point is the Unified Audit Log in the Microsoft Purview compliance portal, as it captures a wide range of user, admin, and application activities within the tenant.

• Go to Microsoft Purview compliance portal > look at the navigation pane on left side, under "Solution" section > click on Audit
• Set the time range:
  • 2026-05-22 00:00 to 09:00 (KST)
  • Convert to UTC when running the search
• Under Activities, search for something similar to: Deleted message; Moved messages to Deleted Items
• Optionally narrow scope by adding affected organizers or resource mailboxes

Wait for the search job to complete > click on the completed job to open the results > click on an individual result, you will see the detail:

• User / UserId: Identifies whether the action was performed by a user, admin, or service
• AppId: This is a key indicator of automation. If present, it means the action was performed by an application (e.g., Microsoft Graph, Power Automate, or a third-party system)
• UserAgent: Indicates the client used, such as Microsoft Graph or Exchange Web Services
• ClientIPAddress: Helps identify the originating system

The audit log is particularly useful for distinguishing between user-driven actions and application-driven operations.

Critical Validation Tool - Calendar Diagnostic Logs (CDL)

In addition to audit logs, it is strongly recommended to collect Calendar Diagnostic Logs (CDL) for several affected meetings.

CDL is the most authoritative source for calendaring investigations and provides:

• A detailed timeline of meeting actions (create, update, cancel)
• The originating client or service
• The actor responsible for the change (user, delegate, or service)

This allows you to determine exactly what triggered the cancellation event and how it propagated across attendees and resources. For more information, you can see: Analyze Calendar diagnostic logs for Exchange Online mailboxes - Exchange | Microsoft Learn

Interpreting Findings Against Potential Causes

The findings from audit logs and CDL can help validate the following scenarios:

1/ Automation or application-based modification

If the audit log shows an AppId, especially one associated with your external reservation platform or integration:

• This would strongly indicate that an application executed the cancellations
• The batch-like timing pattern is consistent with: Scheduled jobs; Bulk synchronization processes

In such cases, I recommend reviewing the external system’s logs for:

• Sync jobs or retries
• Token resets or re-authentication events
• Full re-synchronization triggers

2/ Microsoft Graph synchronization behavior

If:

• UserAgent indicates Microsoft Graph
• Activity is tied to an application

Then it is possible the integration is using calendarView/delta synchronization:

• Delta queries return created, updated, and deleted events for sync scenarios: Get incremental changes to events in a calendar view - Microsoft Graph | Microsoft Learn
• If synchronization logic is not handled correctly (for example, token invalidation or replay scenarios), an application may:
• Perform a full resync
  • Misinterpret events as deleted
  • Issue cancellation updates back to Exchange

This can result in large-scale, repeated processing similar to the pattern you observed.

3/ Resource mailbox auto-processing (secondary factor)

You may also review resource mailbox configuration:

Get-CalendarProcessing -Identity "RoomMailboxName" | Format-List

Please focus on:

• AutomateProcessing
• RemoveCanceledMeetings

Resource mailboxes can automatically process meeting updates and cancellations depending on configuration. While this typically operates at an individual mailbox level, it can amplify changes triggered by upstream systems.

4/ Recurring meeting inconsistencies or repair activity (lower likelihood)

Exchange Online includes background processes such as the Calendar Repair Assistant (CRA) that reconcile calendar inconsistencies.

However, it would be unusual for this type of process alone to generate:

• Large-scale cancellations across unrelated organizers
• Coordinated batch timing

This scenario is therefore considered less likely unless combined with another trigger.

To move forward efficiently, start by running a Unified Audit Log search to check whether an AppId is present and to identify who initiated the deletion activity. Next, collect Calendar Diagnostic Logs for a small sample of affected meetings and correlate the audit timestamps with the CDL timeline and any activity from the external platform.

If the findings indicate an integration or application, engage the vendor with the relevant timestamps and evidence. If the results remain unclear, proceed with opening a Microsoft support ticket and provide sample meeting IDs along with the audit log results and CDL output.

I hope this information helps and if you have any further question, please feel free to ask via comment section!

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.