---
schema_version: "1"
id: 311d2b1f09238c4d72ed54d84da3fc4c8a1d3ab269119599dd4f068de043650e
title: Authentication and Data Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/activity_capture_data_flow.md
canonical_url: https://help.salesforce.com/s/articleView?id=sales.activity_capture_data_flow.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 32c0b3245728fee81072c3c4d836a89d79f3e61c9fbb59b3440adeee22254c7a
description: Einstein Activity Capture uses secure authentication and data flow to protect sensitive data, such as emails, calendar events, and contacts.
products:
  - Sales Cloud
  - Cross Cloud
  - Service Cloud Voice
release: "264"
---
# Authentication and Data Flow

Einstein Activity Capture uses secure authentication and data flow to protect sensitive data, such as emails, calendar events, and contacts.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Einstein Activity Capture Standard in Sales in <strong>Starter</strong>, <strong>Pro Suite</strong>, <strong>Professional</strong>, and <strong>Enterprise</strong> Editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with <strong>Unlimited </strong>Edition, <strong>Einstein 1 Sales Edition</strong>, and <strong>Agentforce 1 Edition</strong></td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Einstein for Sales, which is included in <strong>Einstein 1 Sales Edition</strong> and available for an extra cost in <strong>Enterprise</strong> and <strong>Unlimited</strong> Editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Sales Engagement, which is included with Sales in <strong>Performance</strong> and <strong>Unlimited</strong> Editions, and available for an extra cost in <strong>Professional</strong> and <strong>Enterprise</strong> Editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Revenue Intelligence, which is available for an extra cost in <strong>Enterprise</strong> and <strong>Unlimited</strong> Editions</td></tr></tbody></table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_note.png)

Note We’re reorganizing the Einstein Activity Capture documentation. We’re moving some information around, but we aren’t deleting anything.

Einstein Activity Capture uses secure OAuth 2.0 flows to connect to email accounts in Microsoft Office 365 and Google. Users or admins grant Salesforce limited access to their mailboxes. Authentication occurs at two levels.

- Org-level or application-level authentication: An admin authenticates all users in the org.
- User-level authentication: Users connect their own accounts.

Einstein Activity Capture supports these connected accounts.

- Microsoft Office 365: When admins configure Einstein Activity Capture to use Microsoft Office 365, Salesforce redirects them to the Microsoft login page. Salesforce admins work with Azure admins to authorize Einstein Activity Capture to get the required permissions to consent the connection. After admins give consent, Einstein Activity Capture receives an OAuth token to access the mailbox. Salesforce stores the OAuth refresh token, not the user’s password. Einstein Activity Capture authenticates Microsoft 365 connections through the Microsoft Graph API.
    
    ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_important.png)
    
    Important
    
    Microsoft is retiring Exchange Web Services (EWS) for Microsoft Office 365 in October 2026. Upgrade your Microsoft Office 365 authentication to Microsoft Graph. See [Upgrade Microsoft Office 365 Authentication Method to Microsoft Graph](https://help.salesforce.com/s/articleView?id=sales.eac_ews_graph.htm&release=264.0.0&type=5 "Microsoft is retiring Exchange Web Services (EWS) for Microsoft Office 365 in October 2026. Microsoft Graph API replaces EWS. Upgrade the authentication method of Einstein Activity Capture, Inbox, and Lightning Sync to use Microsoft Graph to avoid service disruption.").
- Google Gmail
    - Google’s OAuth: The user or admin consents to scopes such as Gmail read-only, Calendar read, and Contacts, if applicable. Salesforce stores a token.
    - Marketplace app: Limited ‌data access to the application level, such as emails, events, and contact.
- Microsoft On-Prem Exchange: If your org uses on-premises Exchange, authentication routes through Microsoft Entra ID (formerly Azure AD) or certificate-based authentication via a service account. It also supports user-level authentication. Basic authentication with a username and password isn’t used.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_note.png)
    
    Note Hybrid deployments aren’t supported.

All connections use token-based authentication with the email provider, except for Microsoft On-Prem Exchange. Users or admins can revoke these tokens at any time.

Connection and authentication methods depend on which email and calendar applications you use. For details, see [Connect Email and Calendar Accounts to Einstein Activity Capture](https://help.salesforce.com/s/articleView?id=sales.aac_connection_parent.htm&release=264.0.0&type=5 "Before Einstein Activity Capture can access users’ email and calendar data, connect Salesforce to your email account. The choices of how to connect and authenticate users depend on which email and calendar application you use.").

The connection grants Salesforce access to read, send, delete, and manage emails and to manage contacts and calendars. Salesforce also views files in Google Drive, if applicable.

## Data Flow

Data retrieval: After they’re connected, Einstein Activity Capture subscribes to mailbox events.

- Exchange and Microsoft 365: Einstein Activity Capture uses the Microsoft Graph API for Microsoft 365 and EWS for Exchange to detect when new emails or events arrive in the user’s mailbox. These notifications trigger Einstein Activity Capture to retrieve the new item’s details.
- Gmail: Einstein Activity Capture uses Gmail push notifications or periodic polling to detect new emails and the Google Calendar API for events.

Firewall considerations: If your company restricts outbound connections, make sure that the Einstein Activity Capture webhook endpoints are a part of the allowlist. Einstein Activity Capture uses specific endpoints to receive change notifications from Microsoft or Google. For a list of endpoint URLs to allowlist, see the Salesforce documentation.

When contacts or events move only from Salesforce to the connected account, the Activity Platform Hyperforce servers don’t store any data.

![Flow of data from your users' connected accounts to Salesforce and vice versa.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/sales_productivity/images/aac/eac_architecture_w_e2c.png)

#### See Also

- [Network Connection](https://help.salesforce.com/s/articleView?id=sales.aac_setup_allow_access.htm&release=264.0.0&type=5 "When setting up Einstein Activity Capture with a Microsoft Exchange on-premises server (2019, 2016, or 2013) or Microsoft Office 365, make sure that you allow the necessary network access.")
- [Exchange Web Services (EWS)](https://help.salesforce.com/s/articleView?id=sales.activity_capture_ews_api.htm&release=264.0.0&type=5 "To access emails, events, and contacts from Exchange, Salesforce makes these calls via Exchange Web Services (EWS).")
- [Microsoft Graph API](https://help.salesforce.com/s/articleView?id=sales.activity_capture_graph_api.htm&release=264.0.0&type=5 "Starting Spring ’26, Einstein Activity Capture configured to use Microsoft Office 365 is automatically authenticated by using Microsoft Graph. Microsoft is retiring Exchange Web Services in October 2026 for Microsoft Office 365, and Microsoft Graph API replaces Exchange Web Services as a more advanced, secure, and scalable solution. Microsoft Graph exposes REST APIs and client libraries to access data on Microsoft Office 365.")