Use a Service Account to Connect an Exchange On-Premises Server to Einstein Activity Capture
If your company uses Microsoft Exchange 2019, 2016, or 2013 on-premises, you can connect to Einstein Activity Capture by using a service account. The Salesforce admin works with their Exchange admin to create a service account with the impersonation role and give Salesforce access to the service account user’s data. By using a service account, you can scope authentication to a specific set of users and set up all Einstein Activity Capture users at the same time.
Required Editions
| Available in: Lightning Experience |
| Available with Einstein Activity Capture Standard in Sales in Starter, Pro Suite, Professional, and Enterprise Editions |
| Available with Unlimited Edition, Einstein 1 Sales Edition, and Agentforce 1 Edition |
| Available with Einstein for Sales, which is included in Einstein 1 Sales Edition and available for an extra cost in Enterprise and Unlimited Editions |
| Available with Sales Engagement, which is included with Sales in Performance and Unlimited Editions, and available for an extra cost in Professional and Enterprise Editions |
| Available with Revenue Intelligence, which is available for an extra cost in Enterprise and Unlimited Editions |
Note We’re reorganizing the Einstein Activity Capture documentation. We’re
moving some information around, but we aren’t deleting anything.
| User Permissions Needed | |
|---|---|
| To connect Salesforce to a Microsoft Exchange server: | Customize Application or Modify All Data |
| To view the Einstein Activity Capture setup pages: |
View Setup and Configurations and Customize Application or Modify All Data |
Important In February 2025, Microsoft retired the ApplicationImpersonation role
in Exchange Online. As a result, Salesforce is retiring service account OAuth 2.0 access to
Microsoft Office 365. To continue activity data capture, upgrade to org-level OAuth 2.0
authentication in Einstein Activity Capture settings. During the upgrade process, you're
prompted to log in to your Microsoft Office 365 tenant. Make sure that you log in to the
same tenant you used when creating the connection. Otherwise, reset your Einstein Activity
Capture connection and start over. See EAC to MS Office 365: Service Account OAuth 2.0 Retirement and Upgrade Your Service Account Connections to Org-Level OAuth
2.0 Authentication.
- Make sure that your Exchange server is visible to Salesforce by allowing the necessary network access.
- Before you set up Einstein Activity Capture, work with your Exchange admin to set up the service account.
- From Setup, in the Quick Find box, enter Einstein Activity Capture, and then select Settings. If it’s your first time setting up Einstein Activity Capture, the setup flow guides you through the steps. If you already set up Einstein Activity Capture and want to change the authentication method, reset Einstein Activity Capture.
- Select Microsoft Exchange as the email and calendar application.
- Select Service Account as your authentication method.
-
To give Salesforce access to the Exchange service account, follow the steps.
- Enter the login credentials for your company’s Microsoft Exchange service account.
- If your sales reps have different email domains than your service account domain, enter the additional domains in a comma-separated list.
- To test that the Microsoft Exchange service account is set up properly, enter a user who the service account has access to.
- Follow the remaining Einstein Activity Capture setup steps, including creating a configuration and adding users to it.
Note When you use a service account, users who are in configurations with emails enabled are
prompted to accept the Einstein Activity Capture terms of service. Until they do so, email data
isn’t captured.