For mailbox access we are currently using the permission EWS.AccessAsUser.All and SOAP-based API-calls to https://outlook.office365.com/EWS/Exchange.asmx. This constitutes two major problems:
- This permission cannot be obtained for personal accounts (https://us-kb.sage.com/portal/app/portlets/results/viewsolution.jsp?solutionid=221924560117216)
- Access by "non-Microsoft apps" to the Exchange online EWS API is scheduled to be retired Oct 1st 2026 (https://devblogs.microsoft.com/microsoft365dev/retirement-of-exchange-web-services-in-exchange-online/)
Both problems seem to require us to fully move to the "Microsoft Graph" API (Json based API-calls).
Action plan:
- Get confirmation from Microsoft that we really have a correct understanding of their terminology, i.e. we are going to be affected by the EWS retirement, despite technically obtaining our permission token via the MS Graph API
- Yes, response from MS: we are going to be affected
- Determine whether there are any relevant scenarios (EWS on premises?) where we cannot rely on MS Graph API: Do we need to support both APIs / do we need an abstraction layer?
- Yes, response from MS: Exchange on premises will continue to support EWS-API, only.
- Determine which exact API calls we actually need (current EWS-based implementation seems to be based on 3rd-party code that seems to cover substantially more than what we need), and whether there exists a non-bloated library for that
- We actually need a smallish set of calls, only (see comment)
- Based on the above: Port our code
- Port is complete, but needs testing & review: work/tfry/apiabstraction
- Test / come up with a testing matrix for relevant setups