What Does Turning on Microsoft Graph Do to the Tenant?

Ian Hays 0 Reputation points
2026-04-22T17:25:43.5766667+00:00

With Microsoft retiring Exchange Web Services (EWS) for Microsoft Office 365, Salesforce is requiring us to use Microsoft Graph as a new authentication method. What I have been wondering is if I turn on Microsoft Graph, in our tenant, what will happen exactly? Is it just allowing you to connect to M365 through a different means or should there be other things I need to be aware of, such as something might break as a result of turning it on?

Microsoft Security | Microsoft Graph
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-04-22T17:26:05.16+00:00

    Enabling or using Microsoft Graph in a tenant does not “turn on” a separate service that changes tenant behavior globally. Microsoft Graph is the modern API endpoint over Microsoft 365 and Microsoft Entra ID that applications use instead of legacy APIs such as Exchange Web Services (EWS) and Azure AD Graph.

    For a scenario like Salesforce moving from EWS to Microsoft Graph, the main impacts are:

    1. Different API and permission model, not a new workload
      • Microsoft Graph is the unified REST API for Microsoft 365 and Microsoft Entra services. It replaces EWS for Exchange Online access and Azure AD Graph for directory access.
      • It uses the same Microsoft identity platform (OAuth 2.0) for authentication and authorization as modern EWS apps, but with a more granular permission model.
      • There is no separate “Graph switch” that, when enabled, changes how Exchange Online or other services behave for users.
    2. More granular and secure permissions than EWS
      • EWS uses an all‑or‑nothing access model: an app with EWS permissions can typically access everything the user or service account can access in the mailbox.
      • Microsoft Graph offers granular scopes such as “read mail only,” “read calendars only,” etc., instead of broad mailbox access.
      • For delegated permissions, effective access is the intersection of the signed‑in user’s rights and the app’s consented permissions. For application permissions, effective access is what an admin has consented to for that app.
      • This generally improves security posture compared to EWS, but it also means the Salesforce integration must request and be granted the correct Graph permissions to function.
    3. Change in how “impersonation”/service access works
      • EWS impersonation uses a service account that acts as a user.
      • With Microsoft Graph there are no service accounts in the same sense; instead, the app authenticates with its own identity using the client credentials flow and is granted application permissions.
      • By default, admin consent to those application permissions can allow access to all mailboxes, but an administrator can restrict the app to specific mailboxes using app‑access policies.
      • For Salesforce, this means reviewing which mailboxes it should be allowed to access and configuring app‑access policies if needed.
    4. No automatic breaking changes just from “enabling Graph”
      • Existing EWS‑based apps continue to work until EWS is disabled in Exchange Online (currently announced for October 2026).
      • Using Microsoft Graph for Salesforce does not in itself break other applications; issues only arise if other apps are modified, removed, or if permissions are changed in a way that affects them.
      • The main operational change is that administrators must manage Graph app registrations and permissions (consent, review, and possibly mailbox scoping) for Salesforce instead of or in addition to EWS permissions.
    5. Why this change is being pushed now
      • EWS is deprecated and will be disabled in Exchange Online, and Microsoft is investing in closing parity gaps between EWS and Microsoft Graph for Exchange scenarios.
      • Microsoft Graph is the strategic API surface going forward for both Exchange Online and Microsoft Entra ID, with better security, resilience, and feature coverage than legacy APIs.

    In practice, adopting Microsoft Graph for Salesforce means:

    • Registering or updating an app in Microsoft Entra ID for Salesforce.
    • Granting the appropriate Microsoft Graph delegated or application permissions (for mail, calendar, etc.).
    • Optionally restricting mailbox access via app‑access policies.
    • Leaving other tenant services unchanged unless their configurations are explicitly modified.

    There is no tenant‑wide “Graph on/off” switch that would by itself cause unrelated workloads or apps to break.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.