Microsoft has announced that on October 1st, 2026, EWS requests from non-Microsoft apps will be blocked to Exchange Online.

As a result, this request seeks to enable the connector to handle connecting to hosted Exchange environments by introducing support for MS Graph as a means to read the contents of the inbox (i.e. the emails used for processing), instead of using Exchange Web Services to do so. #171 includes many (but not all) of the steps that would need to be factored into the current connector.

As a result of the proposed changes, a unique benefit to Exchange Online users would exist wherein the connector would no longer have a dependency on the EWS dll. It would be a combination of SMLets, Active Directory (as has been the case for Reviewer management), and PowerShell's native Invoke-RestMethod for communicating with Graph.

• Maintain on premise support via EWS

• Support connectivity via MS Graph and its native Mail.ReadWrite, Mail.Send, and Calendars.ReadWrite based permissions

  • Support IPM.Note (regular emails)
    • Rebuild the Graph message response to match the one provided by EWS as closely as possible, so as to fit within the connector and avoid rewrites to other connector functions
      • Graph message properties are not a 1 to 1 match with EWS Message properties
      • Graph message responses do not include attachments by default, they must be retrieved in seperate graph calls
    • Support Merge Replies
  • Support for Azure Public and Government
  • Support to mark items as read, move, and delete for Graph
  • Modify Add-EmailToSCSMObject to support adding messages to Work/Config Items
  • Modify Add-FileToSCSMObject to support adding message attachments to Work/Config Items
  • Modify Send-EmailFromWorkflowAccount to support EWS or Graph
  • Support IPM.Schedule.Meeting.Request and IPM.Schedule.Meeting.Canceled (outlook/teams meetings)
  • Support for digital signing/encryption
    • Modify Read-MimeMessage to support getting mime content from Graph

• Updating relevant documentation on configuring the Azure App associated with the connector

  • API Permission changes: Instead of using EWS.AccessAsUser.All the configured app must use the following MS Graph permissions:
    • Mail.ReadWrite: Required to read the inbox, mark items as read, and move to Deleted Items
    • Mail.Send: Required for any functionality that makes use of Send-EmailFromWorkflowAccount (Suggest KA/RO and Custom Events)
    • Calendars.ReadWrite: Required to accept Calendar Events
  • Verify reconsent/consent flow for current deployments