Delete Calendar Events
Overview
Delete Calendar Events removes the calendar events that a malicious message's invite added to a user's calendar. It runs automatically when you apply Quarantine, Trash, or Move to Spam to a message that contains a calendar invite. It doesn't appear in the Action list when you create a Rule or Automation.
Sublime searches more than the receiving mailbox's primary calendar:
| Delete | Restore | |
|---|---|---|
| Primary calendar coverage | Sublime checks the receiving mailbox's primary calendar first. | Sublime recreates the placeholder on the primary calendar if the event was removed from it. |
| Shared / delegated calendar coverage | If the event isn't on the primary calendar, Sublime checks the other calendars the mailbox can edit. | Sublime recreates the placeholder on the calendar the event was removed from. It skips the calendar if the event is already there or the mailbox no longer has access. |
For example, an assistant's mailbox receives an invite that places the event on their executive's calendar. If the assistant has edit access to that calendar, Sublime finds and removes the event there too.
Setup requirements
Delete Calendar Events works on Google Workspace and Microsoft 365 message sources.
Sublime needs calendar permission to find and remove events. On Google Workspace, searching shared and delegated calendars needs one more scope, the calendar list scope (calendar.calendarlist.readonly). Without it, Sublime searches only the primary calendar. How to update permission settings to enable automatic deletion of calendar events covers cloud-managed and self-managed setup for both providers.
What you see in Sublime
When you review a message with a calendar invite and choose Quarantine, Trash, or Move to Spam, Sublime shows Also Delete Existing Event from Calendar. When you restore a message whose events were deleted, Sublime shows Also Restore Event to Calendar.
How it works with restore
When you restore a message from Quarantine, Trash, or Move to Spam, Sublime recreates its calendar events as placeholder events. Restore doesn't bring back the original event. It creates a new placeholder in its place.
Each placeholder:
- Has a title that starts with [See Original], followed by the original event title.
- Names the original organizer and the date of the original invite in its description, and notes that it is a placeholder and can be deleted.
- Directs the end user to the original email invitation for full details and RSVP, so they always reference the most up-to-date event information.
- Has no invitees, and Sublime doesn't keep the original organizer as the placeholder's organizer. This prevents duplicate or outdated events from reaching attendees and prevents the placeholder from conflicting with changes made to the original meeting.
On Google Workspace, the placeholder keeps the original event's attachments. On Microsoft 365, Sublime creates it without them.
Restoring the placeholder needs the same calendar permission as deletion. If your organization hasn't granted it, or has revoked it, the message still restores normally from Quarantine, Trash, or Move to Spam. Only the placeholder fails to get created.
What's next
Updated about 15 hours ago