Decision one: which calendar, and who owns it

The most common failure is not technical. Somebody publishes their own calendar, the sync works, and then that person leaves or their licence changes and the feed dies with them. Create a calendar owned by a shared or resource account, give edit rights to whoever maintains the schedule, and publish that.

It also solves the privacy question in one move: only what belongs on the website ever goes on that calendar, so there is nothing to filter and nothing to leak.

Decision two: how often to fetch

More often is not better. Microsoft regenerates a published ICS on its own schedule — often measured in hours — so fetching every fifteen minutes gets you the same file repeatedly and nothing else. Hourly is generous for most sites; a few times a day is plenty for a programme published weeks ahead.

What matters far more than frequency is that the fetch runs on a real schedule and not on the WordPress default. WordPress cron only fires when somebody visits your site, so a quiet Tuesday can mean nothing syncs at all. If accuracy matters, have your host or a server cron hit wp-cron.php on a real timer and switch the default off.

Decision three: what happens to deletions

This one catches people out. If an event is removed from the Office 365 calendar, what should the website do — delete it, hide it, or leave it? Deleting is usually right, but only if the sync is confident the event is genuinely gone rather than temporarily absent because the feed came back short or empty.

A well-built sync treats an empty or failed fetch as “no news”, not as “everything was cancelled”. If your calendar can be wiped by one bad response from Microsoft, that is a data loss bug waiting for a bad afternoon.

The thing to check monthly

Whether the sync is still running. A stalled feed does not look like an error — it looks like a calendar with nothing coming up, which is indistinguishable from a quiet month. Whatever plugin you use, find the screen that shows the last successful fetch and the last error, and look at it. If it does not have one, that is worth knowing before you rely on it.

Set a recurring reminder for the first of the month. Sixty seconds, and it catches the failure mode that otherwise takes an angry phone call to discover.