---
schema_version: "1"
id: 59701ab4f05d0aed10750d992ebbff85eed7867c5b226179603090ef7faa023d
title: Set Up a Microsoft Exchange Service Account to Communicate with Lightning Sync
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/exchange_sync_admin_set_up_service_acct.md
canonical_url: https://help.salesforce.com/s/articleView?id=sales.exchange_sync_admin_set_up_service_acct.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 0fd6ab0cb7e5871ce5cfc3ec275aaad25d613be294a5dde2815ee48be7a17c3d
description: To set up Lightning Sync using a service account, create an Exchange service account with impersonation rights for the mailbox of each Lightning Sync user.
products:
  - Sales Cloud
  - Cross Cloud
  - Service Cloud Voice
release: "264"
---
# Set Up a Microsoft Exchange Service Account to Communicate with Lightning Sync

To set up Lightning Sync using a service account, create an Exchange service account with impersonation rights for the mailbox of each Lightning Sync user.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available to sync records from: Salesforce Classic, Lightning Experience, and the Salesforce mobile app</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available to set up from: Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions with Sales Cloud, Service Cloud, and Lightning Platform</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d94353e81">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="" id="exchange_sync_admin_set_up_service_acct__ex_sync_server_permission">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d94353e81 ">To set up a service account to communicate with Lightning Sync:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d94353e81 ">Administrative access to your company’s Exchange server</td>

          </tr>
        </tbody>
      </table>

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_important.png)

Important

Starting in Winter ‘21, [Lightning Sync isn’t available](https://help.salesforce.com/apex/HTViewSolution?urlname=Lightning-Sync-End-of-Sale&language=en_US) to new Salesforce customers. Use Einstein Activity Capture to sync events, contacts, and emails between your connected account and Salesforce.

If you have Lightning Sync, use the [migration tool](https://help.salesforce.com/s/articleView?id=sales.lightning_sync_move_parent.htm&type=5&language=en_US) to move to [Einstein Activity Capture](https://help.salesforce.com/articleView?id=einstein_sales_aac.htm&language=en_US) before Lightning Sync retires in 2027. Before you migrate, review [Compare Einstein Activity Capture and Lightning Sync](https://help.salesforce.com/s/articleView?id=sales.email_integration_admin_eac_vs_lightning_sync.htm&language=en_US) to understand what to expect when you migrate.

If your org is exempt from migration because of a licensing issue or if your org doesn’t support Einstein Activity Capture, you won’t see the migration tool in Lightning Sync.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_important.png)

Important Microsoft is retiring Basic Authentication for Exchange Online. When Microsoft blocks Basic Authentication in your Microsoft tenant, Lightning Sync can’t sync contacts and events for customers who have selected service account as their Lightning Sync connection method. See [Lightning Sync Service Account Connection Method Availability for Customers on Microsoft Office 365](https://help.salesforce.com/articleView?id=000351807&language=en_US&type=1&mode=1).

Before setting up an Exchange Service account, make sure you’ve [enabled the appropriate Exchange server settings to set up Lightning Sync](https://help.salesforce.com/s/articleView?id=sales.productivity_sync_exchange_admin_exchange_server_permission.htm&release=264.0.0&type=5 "To set up Lightning Sync using the service account connection method, enable these settings on your Microsoft® Exchange server: Exchange Web Services, Exchange Autodiscover Service, and Basic or NTLM authentication.").

To set up an Exchange service account, work with your Exchange admin to complete these steps on your Exchange server.

Watch a Demo:

- [![Watch Video Demo](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/resources-global/_corporate/images/play_btn.png) Set Up a Microsoft® Exchange Service Account to Sync with Salesforce (for administrators using Office 365™ Admin Center)](https://salesforce.vidyard.com/watch/Ufe4uKH5eBeKNKWdyPC-sA) (English only)
- [![Watch Video Demo](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/resources-global/_corporate/images/play_btn.png) Set Up a Microsoft® Exchange Service Account to Sync with Salesforce (for administrators using command shell)](https://salesforce.vidyard.com/watch/UkqihTWJnGCm7DyVHPBNEw) (English only)

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_note.png)

Note For more support, visit Microsoft®’s support website, search for the keywords mentioned here, and follow the instructions intended for your Exchange version.

1. Create an Exchange user with a mailbox that acts as the service account. You use this email address later to configure Exchange impersonation for the service account.
2. Using Exchange Management Shell, enter the commands that enable service account impersonation for your version of Exchange. If you receive a pipeline error message, wait a few minutes and reenter the command to let your server process the requests.
    
    If you’re using Exchange 2019, 2016, or 2013, complete these extra steps.
    
    1. Enable the Active Directory extended permission for `ms-Exch-EPI-Impersonation` on all Client Access servers.
        
        ```
        Get-ExchangeServer | where {$_IsClientAccessServer -eq $TRUE} | ForEach-Object {Add-ADPermission -Identity $_.distinguishedname -User (Get-User -Identity <EnterExchangeSyncServiceAccountEmailAddress> | select-object).identity -extendedRight ms-Exch-EPI-Impersonation}
        ```
    2. Enable the Active Directory extended rights for `ms-Exch-EPI-May-Impersonate` to let your service account impersonate all accounts on your Exchange server. Set a filter later that lets you limit the users the service account syncs with Salesforce.
        
        ```
        Get-MailboxDatabase | ForEach-Object {Add-ADPermission -Identity $_.distinguishedname -User <EnterExchangeSyncServiceAccountAddress> -ExtendedRights ms-Exch-EPI-May-Impersonate}
        ```
3. Using Exchange Management Shell, enter these commands to configure your service account to impersonate the group of users who you want to sync with Lightning Sync.
    1. Create a management scope to define a filter that groups the Exchange users who sync with Lightning Sync. For example, if you want only sales reps to sync, and their Exchange mailboxes have the same value Sales for the filterable property Department, enter Department -eq 'Sales' in place of <ChooseRecipientFilter>.
        
        ```
        New-ManagementScope -Name:<ChooseExchangeSyncScopeName> -RecipientRestrictionFilter:{<ChooseRecipientFilter>}
        ```
    2. Create a management role assignment that restricts the service account to impersonate only the users you defined in the management scope.
        
        ```
        New-ManagementRoleAssignment -Name:<ChooseExchangeSyncRoleAssignmentName> -Role:ApplicationImpersonation -User:<EnterExchangeSyncServiceAccountAddress> -CustomRecipientWriteScope:<EnterExchangeSyncScopeName>
        ```