Why are calendar events created via the graph API sometimes missing attendees?

Question

My application uses delegated user access tokens to interact with the graph API. These access tokens have Calendars.ReadWrite.Shared permission.

When creating a calendar event on behalf of the logged-in user, the application creates the event, adds attachments, and adds attendees as separate requests, in that order. The rationale for doing so comes from this question -- The attendees have to be added after the attachments, or else the attendees won't see the attachments.

The process looks like this:

1. Create Event: POST - https://graph.microsoft.com/v1.0/me/calendars/{calendar_id}/events

   Request Body:

   {
       "start": <start_time>,
       "end": <end_time>,
       "subject": <summary>,
       "body": {"content": <description>, "contentType": "HTML"},
       "sensitivity": <"Private" | "Normal">
   }
   

2. Add Attachments: POST - https://graph.microsoft.com/v1.0/me/calendars/{calendar_id}/events/{event_id}/attachments (once for each attachment, see here)

3. Add Attendees by updating the event: PATCH - https://graph.microsoft.com/v1.0/me/calendars/{calendar_id}/events/{event_id}

   Request Body:

   {"attendees": <attendees>, "locations": <locations>}
   

In some (but not all) cases the attendees added in step 3 don't show up on the calendar event, even though they are present in the response body from the PATCH request to add the attendees. For example, the response to the PATCH request in step 3 is a 200 status code with the following response body (most keys omitted):

{
    . . .
    'attendees': [
        {
            'type': 'required',
            'emailAddress': {'address': <attendee_1_email>, 'name': <attendee_1_name>},
            'status': {'time': '0001-01-01T00:00:00Z', 'response': 'none'}},
        {
            'type': 'required',
            'emailAddress': {'address': <attendee_2_email>, 'name': <attendee_2_name>},
            'status': {'time': '0001-01-01T00:00:00Z', 'response': 'none'}
        }
    ],
    'iCalUId': '040000008200E00074C5B7101A82E00800000000F479DE9EE035D601000000000000000010000000FBDBFAB438A5E840909F45F20F158E21',
    'id': 'AAMkADcyMzRlMmVjLWFiYmUtNDVmMy04NTg0LWQzYjNmN2U5OWRjMABGAAAAAAAc9_qSTiomRKxjr7R_hq5GBwC0CN1kXdTSSrZO4_ImB_wpAAACr6PWAAC0CN1kXdTSSrZO4_ImB_wpAAEQJo-HAAA='
    . . .
}

But when fetching the event immediately after receiving the above response from the PATCH request, via GET - https://graph.microsoft.com/v1.0/me/calendars/{calendar_id}/events/{event_id}, the response body describing the event has an empty array for the attendees, and the user doesn't see any attendees on the event in the O365 web UI.

{
    . . .
    'attendees': [],
    'iCalUId': '040000008200E00074C5B7101A82E00800000000F479DE9EE035D601000000000000000010000000FBDBFAB438A5E840909F45F20F158E21',
    'id': 'AAMkADcyMzRlMmVjLWFiYmUtNDVmMy04NTg0LWQzYjNmN2U5OWRjMABGAAAAAAAc9_qSTiomRKxjr7R_hq5GBwC0CN1kXdTSSrZO4_ImB_wpAAACr6PWAAC0CN1kXdTSSrZO4_ImB_wpAAEQJo-HAAA='
    . . .
}