---
schema_version: "1"
id: 70013d3bd7411a4195d21261d57918982bb572ed2e0e15a9834b7673854025b8
title: Microsoft Graph API
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/activity_capture_graph_api.md
canonical_url: https://help.salesforce.com/s/articleView?id=sales.activity_capture_graph_api.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: fec0dbbf6648bdf25adff3beba6b9d91313ac4286484677f8037ae80f9e64a16
description: Starting Spring ’26, Einstein Activity Capture configured to use Microsoft Office 365 is automatically authenticated by using Microsoft Graph. Microsoft is retiring Exchange Web Services in October 2026 for Microsoft Office 365, and Microsoft Graph API replaces Exchange Web Services as a more advanced, secure, and scalable solution. Microsoft Graph exposes REST APIs and client libraries to access data on Microsoft Office 365.
products:
  - Sales Cloud
  - Cross Cloud
  - Service Cloud Voice
release: "264"
---
# Microsoft Graph API

Starting Spring ’26, Einstein Activity Capture configured to use Microsoft Office 365 is automatically authenticated by using Microsoft Graph. Microsoft is retiring Exchange Web Services in October 2026 for Microsoft Office 365, and Microsoft Graph API replaces Exchange Web Services as a more advanced, secure, and scalable solution. Microsoft Graph exposes REST APIs and client libraries to access data on Microsoft Office 365.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Einstein Activity Capture Standard in Sales in <strong>Starter</strong>, <strong>Pro Suite</strong>, <strong>Professional</strong>, and <strong>Enterprise</strong> Editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with <strong>Unlimited </strong>Edition, <strong>Einstein 1 Sales Edition</strong>, and <strong>Agentforce 1 Edition</strong></td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Einstein for Sales, which is included in <strong>Einstein 1 Sales Edition</strong> and available for an extra cost in <strong>Enterprise</strong> and <strong>Unlimited</strong> Editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Sales Engagement, which is included with Sales in <strong>Performance</strong> and <strong>Unlimited</strong> Editions, and available for an extra cost in <strong>Professional</strong> and <strong>Enterprise</strong> Editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Revenue Intelligence, which is available for an extra cost in <strong>Enterprise</strong> and <strong>Unlimited</strong> Editions</td></tr></tbody></table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_note.png)

Note We’re reorganizing the Einstein Activity Capture documentation. We’re moving some information around, but we aren’t deleting anything.

## Authentication Levels

Einstein Activity Capture supports Microsoft 365 authentication in three ways, each with a specific purpose.

User-Level OAuth

This authentication method requires each Einstein Activity Capture user to connect to their own Microsoft Office 365 account.

Role-Based Access Control (RBAC) OAuth

This authentication method combines OAuth’s delegated authorization with role-based permissions. Users get access to resources not individually, but through predefined roles defined within an app. You can configure the authentication mode for all Einstein Activity Capture users at the same time. RBAC OAuth requires Azure setup as a prerequisite.

RBAC OAuth authentication method isn’t available as an option while upgrading Einstein Activity Capture to Microsoft Graph API. To use RBAC OAuth, follow [Change Microsoft Office 365 Authentication Level in Einstein Activity Capture](https://help.salesforce.com/s/articleView?id=sales.eac_microsoft365_switch_auth_method.htm&release=264.0.0&type=5 "Change the authentication level of Microsoft Office 365 from Application-Level to Role-Based Access Control (RBAC) and vice versa. To switch to User-Level OAuth or vice versa, reset Einstein Activity Capture.").

Application-Level OAuth

This authentication method provides a broad, admin-approved access to an entire service instance. You can configure the authentication mode for all Einstein Activity Capture users at the same time.

Einstein Activity Capture uses Client Credential Authentication flow as part of Microsoft Graph API authentication. Salesforce stores the certificate securely in a Salesforce managed vault and rotates it periodically.

**Org-Level Authentication Process Between Einstein Activity Capture and Microsoft Graph API**

![Authentication process between Einstein Activity Capture and Microsoft Graph API for application-level authentication.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/sales_productivity/images/aac/eac_graph_auth_process.png)

**Application-Level Authentication Sync Flow Between Einstein Activity Capture and Microsoft Graph API**

![Sync flow between Einstein Activity Capture and Microsoft Graph API for org-level authentication.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/sales_productivity/images/aac/eac_graph_auth_sync_flow.png)

## App ID for Microsoft Graph Authentication

Before you upgrade to Microsoft Graph, make sure that your Azure admin grants the application permissions required to proceed with the upgrade. We recommend that an Azure admin use the Admin Consent flow to automate scope authorization for your org. This flow prevents individual users from having to manually authorize the upgrade. Granting application permissions in advance simplifies the upgrade and prevents admin and user confusion by removing the need for additional authentication. To initiate the flow, Azure admins can use these links.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_note.png)

Note Einstein Activity Capture and Lightning Sync use the same app ID links for Microsoft Graph authentication.

 
| Authentication Level | App ID |
| --- | --- |
| Application-Level | [https://login.microsoftonline.com/common/adminconsent?client\_id=cbcb7087-72b9-4977-8dd7-aa803a5da602](https://login.microsoftonline.com/common/adminconsent?client_id=cbcb7087-72b9-4977-8dd7-aa803a5da602) |
| RBAC | [https://login.microsoftonline.com/common/adminconsent?client\_id=da3cd6f0-d438-40a4-8524-4cc3569a23b6](https://login.microsoftonline.com/common/adminconsent?client_id=da3cd6f0-d438-40a4-8524-4cc3569a23b6) |
| User-Level (Einstein Activity Capture and Inbox) | [https://login.microsoftonline.com/common/adminconsent?client\_id=e535e657-0666-4ad5-940a-c3cf6296a541](https://login.microsoftonline.com/common/adminconsent?client_id=e535e657-0666-4ad5-940a-c3cf6296a541) |

## Microsoft Graph API Calls

Salesforce makes these calls by using Microsoft Graph API to access emails, contacts, and events from Microsoft Office 365.

 
| Microsoft Graph API Call | Description |
| --- | --- |
| List messages | Fetches a list of email message IDs. |
| Get Message | Fetches detailed information about an email. |
| Create or Send draft message | Creates and sends an email. |
| List events | Accesses a list of calendar events. |
| Get event | Accesses information for a calendar event. |
| Create event | Creates an event in Microsoft Office 365. |
| Update event | Updates an event in Microsoft Office 365. |
| Delete event | Deletes an event in Microsoft Office 365. |
| Get contact | Accesses information for a contact. |
| Create contact | Creates a contact in Microsoft Office 365. |
| Update contact | Updates a contact in Microsoft Office 365. |
| Delete contact | Deletes a contact in Microsoft Office 365. |

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_note.png)

Note For details, see [Microsoft’s support website](https://learn.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0) and search for these calls. This list doesn't include every calls Salesforce makes.

## Microsoft Graph Scope/Permission

For Einstein Activity Capture or Inbox to access data in Microsoft Graph, the admin must grant the necessary permissions. Einstein Activity Capture uses these delegated and application permissions from Microsoft Graph.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" id="d137754e436">Authentication Level</th>
            <th scope="col" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" id="d137754e439">Scope/permission</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Authentication Level" class="slds-cell-wrap" rowspan="10" style="text-align:left;vertical-align:top;" headers="d137754e436 ">Application-Level</td>

            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">Calendars.Read Application</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">Calendars.ReadWrite Application</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">Contacts.Read Application</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">Contacts.ReadWrite Application</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">Mail.Read Application</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">Mail.ReadWrite Application</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">Mail.Send Application</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">RoleManagement.Read.Directory Delegated</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">User.Read Delegated</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">User.Read.All Application</td>

          </tr>
          <tr class="">
            <td data-label="Authentication Level" class="slds-cell-wrap" rowspan="2" style="text-align:left;vertical-align:top;" headers="d137754e436 ">RBAC</td>

            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">RoleManagement.Read.Directory Delegated</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">User.Read Delegated</td>

          </tr>
          <tr class="">
            <td data-label="Authentication Level" class="slds-cell-wrap" rowspan="9" style="text-align:left;vertical-align:top;" headers="d137754e436 ">User-Level</td>

            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">Calendars.ReadWrite</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">User.Read</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">openid</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">profile</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">offline_access</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">Contacts.ReadWrite</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">Mail.Read</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">email</td>

          </tr>
          <tr class="">
            <td data-label="Scope/permission" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d137754e439 ">Mail.Send</td>

          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_note.png)

Note For details, see [Microsoft’s support website](https://learn.microsoft.com/en-us/graph/permissions-reference) and search for these calls.

#### See Also

- [Exchange Web Services (EWS) to Microsoft Graph API mappings](https://learn.microsoft.com/en-gb/graph/migrate-exchange-web-services-api-mapping)