Introduction

We’ve added protection for malicious calendar invites. To enable this feature, the Sublime app requires updated permission that includes Calendar. This allows Sublime to detect and remediate harmful calendar events and aligns with the same security and privacy posture as your current setup.

How it works

Delete Calendar Events Action works with Quarantine, Trash, or Move to Spam Actions. When one of the three is applied, any calendar events associated with the message are also removed.

How restoring a message with a calendar event works

The placeholder event:

• Names the original organizer and the date of the original invite in its own description, and notes that the event is a placeholder and can be deleted
• Points the end user to the original invite for full details and RSVP, so they always reference the most up-to-date event information
• Does not include the original invitees, and does not keep the original organizer as the organizer. This prevents duplicate or outdated events from being sent to attendees or conflicting with changes made to the original meeting
• Is created on the calendar the original event was removed from

On a shared or delegated calendar, Sublime skips the placeholder if the original event is already there or the mailbox no longer has access to that calendar.

The title, organizer, and invitee behavior is the same for Google Workspace and Microsoft 365. Attachments differ: on Google Workspace, attachments from the original event are carried over to the placeholder, and on Microsoft 365 the placeholder is created without them.

Restoring a calendar event depends on the same Calendar permission covered in this doc. If your organization hasn't granted it, or it's since been revoked, the message itself still restores normally. Only the placeholder fails to get created.

Setup

Cloud-managed Google Workspace

1. Sign into the Google Workspace admin interface at https://admin.google.com
2. In the lefthand sidebar, click Apps → Google Workspace Marketplace apps → Apps list
3. Click on Sublime Platform in the list of domain installed apps
4. Grant access and confirm both calendar scopes are granted
5. Allow up to 24 hours for changes to propagate

Self-managed Google Workspace

1. Add the Calendar API scopes to the domain-wide delegation client you're using with Sublime: https://www.googleapis.com/auth/calendar.events and https://www.googleapis.com/auth/calendar.calendarlist.readonly. The calendar.calendarlist.readonly scope lets Sublime find invites on a user's secondary calendars as well. Without it, Sublime searches only the primary calendar.
2. Enable the Google Calendar API in your project
3. Allow up to 24 hours for changes to propagate
4. Confirm the setup. In the Google Admin console, go to Security → Access and data control → API controls → Manage Domain Wide Delegation. Find your client ID, click it, choose View details, and confirm both scopes are listed. Then confirm the Google Calendar API is still enabled in your project.

Cloud-managed Microsoft 365

1. Visit your organization‑specific authorization link to start the Microsoft consent flow. You can access the link by going into your Azure Portal https://portal.azure.com/#home → Enterprise Applications → Sublime → Permissions under Security → Click "Grant admin consent for [Company]"
   1. Or you can also access by going into your Azure Portal -> App Registrations → Sublime → Manage → API Permissions → Click "Grant admin consent for [Company]"
2. Accept the request that now includes “Read and write calendars”
3. Allow up to 24 hours for changes to propagate
4. Confirm admin consent. In the Azure Portal, go to Enterprise Applications → Sublime → Permissions under Security, and select the Admin consent tab. Confirm "Read and write calendars in all mailboxes" is listed.

Self-managed Microsoft 365

1. Add the application permission Calendars.ReadWrite to your Azure AD app
2. Grant admin consent
3. Allow up to 24 hours for changes to propagate
4. Confirm the permission. In the Azure Portal, go to App Registrations → your Sublime app → API permissions. Confirm Calendars.ReadWrite is listed as an Application permission, not a Delegated one, and that admin consent is granted.

Events from before access was granted

Granting access enables calendar deletion for new messages. Sublime doesn't remove the calendar events for messages it remediated before access was granted.

That's it!

Tips for further securing your Google calendar

Depending on how Google Workspace is configured, attackers may be able to add meetings to calendars without sending an email. To prevent these “silent” invitations, you can change the following org-wide settings. In Google Workspace Admin Console, go to Apps → Google Workspace → Calendar → Advanced settings. Set Add invitations to my calendar to “Invitations from known senders” or “Invitations users have responded to via email”.

As of publication, we have not verified a similar mitigation strategy for Microsoft 365.