---
schema_version: "1"
id: c7239b913ac95e3f3139424777a90865b8cad1fc4bb51e3573364eb0af7547f9
title: Microsoft Graph Authentication in Einstein Activity Capture
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/eac_graph_migration.md
canonical_url: https://help.salesforce.com/s/articleView?id=sales.eac_graph_migration.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7e655568155052213673d929322be53e8124abae282907afec0a17a2fd3b04cb
description: Starting Spring ’26, Einstein Activity Capture configured to use Microsoft Office 365 is automatically authenticated by using Microsoft Graph. If you set up Einstein Activity Capture to use Microsoft Office 365 before Spring ’26, upgrade to Microsoft Graph by October 1, 2026 to avoid service disruption.
products:
  - Sales Cloud
  - Cross Cloud
  - Service Cloud Voice
release: "264"
---
# Microsoft Graph Authentication in Einstein Activity Capture

Starting Spring ’26, Einstein Activity Capture configured to use Microsoft Office 365 is automatically authenticated by using Microsoft Graph. If you set up Einstein Activity Capture to use Microsoft Office 365 before Spring ’26, upgrade to Microsoft Graph by October 1, 2026 to avoid service disruption.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Einstein Activity Capture Standard in Sales in <strong>Starter</strong>, <strong>Pro Suite</strong>, <strong>Professional</strong>, and <strong>Enterprise</strong> Editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with <strong>Unlimited </strong>Edition, <strong>Einstein 1 Sales Edition</strong>, and <strong>Agentforce 1 Edition</strong></td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Einstein for Sales, which is included in <strong>Einstein 1 Sales Edition</strong> and available for an extra cost in <strong>Enterprise</strong> and <strong>Unlimited</strong> Editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Sales Engagement, which is included with Sales in <strong>Performance</strong> and <strong>Unlimited</strong> Editions, and available for an extra cost in <strong>Professional</strong> and <strong>Enterprise</strong> Editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Revenue Intelligence, which is available for an extra cost in <strong>Enterprise</strong> and <strong>Unlimited</strong> Editions</td></tr></tbody></table>

## Authentication Levels

Einstein Activity Capture supports user-level, role-based access control, and application-level authentication methods for Microsoft 365. For details, see [Microsoft Graph API](https://help.salesforce.com/s/articleView?id=sales.activity_capture_graph_api.htm&release=264.0.0&type=5 "Starting Spring ’26, Einstein Activity Capture configured to use Microsoft Office 365 is automatically authenticated by using Microsoft Graph. Microsoft is retiring Exchange Web Services in October 2026 for Microsoft Office 365, and Microsoft Graph API replaces Exchange Web Services as a more advanced, secure, and scalable solution. Microsoft Graph exposes REST APIs and client libraries to access data on Microsoft Office 365.").

## Compare Authentication Methods

Comparison of authentication methods between Exchange Web Services (EWS) and Microsoft Graph API.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:23.43096234309624%">
          <col style="width:25.52301255230126%">
          <col style="width:20.92050209205021%">
          <col style="width:30.125523012552303%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="vertical-align:top;" id="d37561e158">Authentication Method</th>
            <th scope="col" class="slds-cell-wrap" rowspan="2" style="vertical-align:top;" id="d37561e161">Azure Access Setup Required</th>
            <th scope="col" class="slds-cell-wrap" rowspan="2" style="vertical-align:top;" id="d37561e164">Access Rights</th>
          </tr>
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d37561e170">Exchange Web Services</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d37561e173">Microsoft Graph</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Exchange Web Services" class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e158 d37561e170 ">User-Level OAuth</td>

            <td data-label="Microsoft Graph" class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e158 d37561e173 ">User-Level OAuth</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e161 ">Optional</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e164 ">Azure-managed access control</td>

          </tr>
          <tr class="">
            <td data-label="Exchange Web Services" class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e158 d37561e170 ">Org-Level OAuth</td>

            <td data-label="Microsoft Graph" class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e158 d37561e173 ">RBAC OAuth</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e161 ">Yes</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e164 ">Access based on user roles, ensuring granular control</td>

          </tr>
          <tr class="">
            <td data-label="Exchange Web Services" class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e158 d37561e170 ">Org-Level OAuth</td>

            <td data-label="Microsoft Graph" class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e158 d37561e173 ">Application-Level OAuth</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e161 ">Optional</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d37561e164 ">Org-wide access to only what’s necessary: emails, events, and contacts</td>

          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_note.png)

Note You can change the authentication method to RBAC OAuth from Application-level OAuth, after Einstein Activity Capture's authentication method is upgraded to Microsoft Graph. For more information, see [Change Microsoft Office 365 Authentication Level in Einstein Activity Capture](https://help.salesforce.com/s/articleView?id=sales.eac_microsoft365_switch_auth_method.htm&release=264.0.0&type=5 "Change the authentication level of Microsoft Office 365 from Application-Level to Role-Based Access Control (RBAC) and vice versa. To switch to User-Level OAuth or vice versa, reset Einstein Activity Capture.").

## Impact on Other Areas

Changing the authentication method from EWS to Microsoft Graph impacts other areas.

Salesforce Inbox

- If Salesforce Inbox and Einstein Activity Capture are set up for Microsoft Office 365 with EWS authentication, upgrading either one to Microsoft Graph automatically upgrades the other.
- If Einstein Activity Capture isn't set up and you upgrade Salesforce Inbox to Microsoft Graph, any future setup of Einstein Activity Capture with Microsoft 365 uses Microsoft Graph automatically. See [Upgrade Microsoft Office 365 Authentication Method to Microsoft Graph in Inbox](https://help.salesforce.com/s/articleView?id=sales.inbox_graph_migration.htm&release=264.0.0&type=5 "Microsoft is retiring Exchange Web Services (EWS) in October 2026. Microsoft Graph API replaces EWS and is more advanced, secure, and scalable. Reauthenticate Inbox to use Microsoft Graph with Microsoft Office 365 by October 1, 2026 to continue working without sync disruption.")

Lightning Sync

Lightning Sync configurations that use Microsoft Office 365 with EWS won't capture or sync data after EWS retires in October 2026. To avoid service disruption, upgrade your Lightning Sync connection from EWS to Microsoft Graph. When you’re done, you can continue to use Lightning Sync, but we recommend migrating to Einstein Activity Capture. Lightning Sync is scheduled to retire in 2027.

Lead Nurturing Agent

Salesforce treats a Lead Nurturing Agent the same as a user with a user-level authentication. When you upgrade user-level authentication of Einstein Activity Capture or Inbox to Microsoft Graph, Salesforce shows a banner prompting Lead Nurturing Agent Managers to [reconnect the agent's email account](https://help.salesforce.com/s/articleView?id=sales.sales_agent_sdr_reconnect_email.htm&type=5&language=en_US).

## What to Expect When Upgrading to Microsoft Graph

Keep these considerations in mind when upgrading to Microsoft Graph.

- If your org is eligible for Microsoft Graph upgrade and you reset Einstein Activity Capture before upgrading, new Einstein Activity Capture configurations with Microsoft Office 365 automatically use Microsoft Graph API.
- If you upgrade Einstein Activity Capture and Inbox with User-Level OAuth to Microsoft Graph, banner messages notify your users to reconnect their Microsoft account. Einstein Activity Capture and Inbox continue to sync events and emails through EWS until users reconnect their individual accounts. After a user reconnects to their Microsoft account, their individual connection switches to Microsoft Graph.

#### See Also

- [Microsoft Graph API](https://help.salesforce.com/s/articleView?id=sales.activity_capture_graph_api.htm&release=264.0.0&type=5 "Starting Spring ’26, Einstein Activity Capture configured to use Microsoft Office 365 is automatically authenticated by using Microsoft Graph. Microsoft is retiring Exchange Web Services in October 2026 for Microsoft Office 365, and Microsoft Graph API replaces Exchange Web Services as a more advanced, secure, and scalable solution. Microsoft Graph exposes REST APIs and client libraries to access data on Microsoft Office 365.")