Migration Guide: Exchange Web Services (EWS) to Microsoft Graph API

Migrate Exchange integrations from Exchange Web Services (EWS) to Microsoft Graph API before the October 2026 deprecation deadline.

Overview

Microsoft is retiring the Exchange Web Services (EWS) API for Exchange Online, with full disablement on October 1, 2026. The retirement applies to Exchange Online only: on-premises Exchange Server is not affected.

You must migrate all Exchange Online integrations that currently use EWS to the Microsoft Graph API to make sure that these continue to function.

Best practices

• Treat production integrations with care. Switching credentials directly affects a live integration, and a credential change cannot be undone within the platform. Plan each production switchover deliberately instead of migrating everything at once.
• Test with a separate integration first. Create a dedicated test integration with the new Graph API credentials before you touch any production integration (see Step 3: Test your Graph API credentials). This confirms your application registration, permissions, and admin consent are correct without risking a production mailbox.
• Schedule switchovers outside peak hours. Plan each production switchover for a time when a gap is acceptable, to limit the impact of the temporary ingestion gap that occurs after switching credentials.

Prerequisites

Before you start the migration, make sure you meet the following requirements:

• Azure Portal access: Administrative access to the Azure portal of your organization.
• Permissions: The ability to register applications and grant admin consent in Azure AD.
• Integration access: Administrative access to your Communications Mining integrations.
• Mailbox information: List of all mailboxes currently connected via EWS integrations.

Migration process

After you switch an integration's credentials, the Graph integration resumes from the earliest point that any folder in the mailbox had reached over EWS, and re-checks emails from there onward, skipping anything already synced. Nothing is imported twice as a result.

Warning:

When you switch a production integration's credentials to Graph, expect a temporary gap in email ingestion before the new integration catches up. This is an expected side effect of the differences between the EWS and Graph integrations, not an error. Schedule the switchover for outside peak hours, when a gap in ingestion is acceptable.

Step 1: Identify your current EWS integrations

1. Log into Communications Mining through IXP in Automation Cloud.
2. Navigate to Settings, then to the Integrations tab.
3. Document all existing Exchange integrations, including:
   • Integration names
   • Connected mailboxes
   • Associated projects

Step 2: Register an Azure application

If you have not already created an Azure application for Graph API access, apply the following steps:

2.1 Create the application registration

1. Sign into your Azure portal.

2. Navigate to App Registrations and select New Registration.

   

3. Configure the application as follows:

   • Name: Use a descriptive name, for example, uipath-exchange-graph-integration.
   • Supported account types: Select Accounts in this organizational directory only (Single tenant).

4. Select Register.

5. Note down the following values from the application overview page:

   • Application (client) ID
   • Directory (tenant) ID

2.2 Create a client secret

1. In your application, select Certificates & secrets from the left menu.

2. Under Client secrets, select New client secret.

   

3. This opens the Add a client secret sidepanel. Configure the secret:

   • Description: Enter a meaningful description, for example, Exchange Graph Integration Secret.
   • Expires: Select an expiration period. The recommended option is 12 or 24 months. Note the expiry date somewhere you will see it: when the secret expires, email ingestion stops until you rotate it.

4. Select Add.

5. Immediately copy the secret Value and store it securely.

   

Note:

Azure displays the secret value only once. If you lose it, you must create a new secret.

2.3 Set API permissions for Microsoft Graph

1. Select API permissions from the left menu.

2. Select Add a permission.

   

3. Select Microsoft Graph under the Microsoft APIs tab.

   

4. Select Application permissions.

   

5. Expand Mail and select Mail.Read.

   

6. Select Add permissions.

7. Select Add a permission again, then select Microsoft Graph → Application permissions.

8. Search for and select MailboxFolder.Read.All.

   

9. Select Add permissions.

10. Returning to the API permissions menu, select Grant admin consent for [Your Organization].

11. Select Yes in the confirmation dialog.

    

Your configured permissions should show:

• Mail.Read (Application) — green checkmark under Status.
• MailboxFolder.Read.All (Application) — green checkmark under Status.

2.4 Restrict mailbox access (recommended)

For enhanced security, your Exchange administrator can limit the application to access only the required mailboxes by creating an application access policy. Make sure you follow the Microsoft guide: Limiting application permissions to specific Exchange Online mailboxes.

Before you migrate a production integration, verify that the policy covers every mailbox you plan to sync. A mailbox outside the policy is disabled with an ErrorAccessDenied error the first time the sync attempts to read it. For details, check Troubleshooting Exchange integrations.

Step 3: Test your Graph API credentials

Before updating your production integrations, test the new Graph API credentials in a separate test integration first.

1. Go to Communications Mining in IXP in Automation Cloud.
2. Navigate to Settings → Integrations tab.
3. Select New integration.
4. Configure the test integration:
   • Select a test project.
   • Enter a clear test name, for example, Exchange Graph Test or [Production Name] - Test.
5. Under Connect with your application, select Graph API.
6. Select With application access.
7. Fill in the credentials from Step 2:
   • OAuth Authority: https://login.microsoftonline.com/{tenant_id}
   • OAuth Client ID: Your Application (client) ID.
   • Client Secret: Your client secret value.
8. Select Validate & save credentials.
9. Add the mailboxes used in your production integration. Use a recent start timestamp to limit the amount of data synced initially.
10. Select Create Integration.
11. Wait for the first sync to complete.

Verify that emails are syncing successfully and that no error messages appear on the integration status page. The mailbox starts syncing within minutes; catching up takes longer when a large amount of email falls after the chosen start timestamp. If no emails have arrived after an hour, check Troubleshooting Exchange integrations.

Once confirmed, proceed to update your production integrations.

Step 4: Back up your current EWS configuration

Before modifying your production integration, record your current EWS connection details, and confirm that you still hold a copy of the EWS client secret, for example in your organization's secret store. The platform does not display saved credentials back to you, so you can only revert to EWS if you kept the secret elsewhere.

Step 5: Update your production integration

Note:

If you need to revert, edit the integration and switch the credentials back to your EWS details.

1. Go to Communications Mining in IXP in Automation Cloud.

2. Navigate to Settings, then to the Integrations tab.

3. Locate the production integration you want to migrate and open its settings.

4. Select the Credentials tab, then select Change Credentials.

5. Under Connect with your application, select Graph API.

6. Select With application access.

7. Update the following fields:

   • OAuth Authority: https://login.microsoftonline.com/{tenant_id} — replace {tenant_id} with your Azure Directory (tenant) ID.
   • OAuth Client ID: Your Application (client) ID.
   • Client Secret: Your client secret value.

8. Select Validate & save credentials to verify your configuration.

   Note:

   If validation fails, double-check your tenant ID, client ID, and client secret. Ensure admin consent was granted for the API permissions. Note that successful validation confirms authentication only: it does not check access to any mailbox.

9. Select Save or Continue to apply the updated configuration.

10. Monitor the integration for at least one hour to confirm stable operation and successful email sync. If the integration or a mailbox shows an error, check Troubleshooting Exchange integrations.

Step 6: Update remaining integrations

Repeat Steps 3–5 for each remaining EWS integration in your organization.