---
schema_version: "1"
id: cb8f1e33d51e871a8ad499588a0116cad279a644af724a5463693bac44a809f2
title: Service Account Connection for Microsoft Users
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/lightning_sync_admin_security_connection_svc_acct.md
canonical_url: https://help.salesforce.com/s/articleView?id=sales.lightning_sync_admin_security_connection_svc_acct.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 531430edd4a35ceb0315e0012b6d6443744e23a3ad8fc349accee83fdbcef25d
description: The service account connection method is available for Lightning Sync users working on Microsoft® Exchange 2019, 2016, and 2013 and on Microsoft Office 365® (Exchange Online). For Exchange Online customers, the service account connection method is no longer available starting October 1, 2022.
products:
  - Sales Cloud
  - Cross Cloud
  - Service Cloud Voice
release: "264"
---
# Service Account Connection for Microsoft Users

The service account connection method is available for Lightning Sync users working on Microsoft® Exchange 2019, 2016, and 2013 and on Microsoft Office 365® (Exchange Online). For Exchange Online customers, the service account connection method is no longer available starting October 1, 2022.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_important.png)

Important Where possible, we changed noninclusive terms to align with our company value of Equality. We maintained certain terms to avoid any effect on customer implementations.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_important.png)

Important Microsoft is retiring Basic Authentication for Exchange Online. When Microsoft blocks Basic Authentication in your Microsoft tenant, Lightning Sync can’t sync contacts and events for customers who have selected service account as their Lightning Sync connection method. See [Lightning Sync Service Account Connection Method Availability for Customers on Microsoft Office 365](https://help.salesforce.com/articleView?id=000351807&language=en_US&type=1&mode=1).

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
      <colgroup>
        <col style="width:33.33333333333333%">
        <col style="width:33.33333333333333%">
        <col style="width:33.33333333333333%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d29603e48">Requirement</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d29603e51">Why it’s required</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d29603e54">Benefit to you</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="Requirement" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e48 ">Exchange admins must enable Exchange Web Services (EWS) over a connection using TLS 1.2
            or higher.</td>

          <td data-label="Why it’s required" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e51 ">
            <p>EWS enabled over a TLS connection provides secure certificate authentication between
              Exchange and Salesforce. While EWS provides access to more objects in your email service,
              Lightning Sync can only read, write, and update contacts and events from users’ email
              services. Lightning Sync isn’t designed to discover or access other objects.</p>
            <p style="margin-bottom:0;"><a href="https://help.salesforce.com/articleView?id=productivity_sync_exchange_admin_exchange_server_permission.htm&amp;language=en_US" target="_blank">Learn
                More</a></p>
          </td>

          <td data-label="Benefit to you" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e54 ">
            <p>Lightning Sync was designed following the Microsoft-established best practices for the
              application of EWS.</p>
            <p>Lightning Sync uses the Exchange server’s certificate to authenticate
              over a TLS connection, confirming that Exchange isn’t interacting with a Salesforce
              impostor. You can control the scope by which Lightning Sync has access to your email
              service. To do so, limit which users are impersonated with your service account.</p>
            <p style="margin-bottom:0;"><a href="https://help.salesforce.com/articleView?id=exchange_sync_admin_set_up_service_acct.htm&amp;language=en_US" target="_blank">Learn More</a></p>
          </td>

        </tr>
        <tr class="">
          <td data-label="Requirement" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e48 ">Exchange admins must enable Auto Discovery.</td>

          <td data-label="Why it’s required" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e51 ">
            <p>Auto Discover lets Lightning Sync navigate to the Exchange service endpoint and
              identify individual users to sync.</p>
            <p style="margin-bottom:0;"><a href="https://help.salesforce.com/articleView?id=productivity_sync_exchange_admin_exchange_server_permission.htm&amp;language=en_US" target="_blank">Learn More</a></p>
          </td>

          <td data-label="Benefit to you" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e54 ">
            <p>Lightning Sync can identify all users set to sync from the scope of your service
              account and your sync configuration in Salesforce. Auto Discovery lets Lightning Sync
              identify even addresses that are part of a different domain.</p>
            <p>We limit Lightning Sync access
              to your email service by exploring only your primary email domain with Auto Discovery, which
              minimizes opportunities for data interception. You can include more domains to sync by
              adding them manually on the Lightning Sync Setup page in Salesforce. You can also control
              access by limiting which email service users are impersonated with your service
              account.</p>
            <p style="margin-bottom:0;"><a href="https://help.salesforce.com/articleView?id=exchange_sync_admin_set_up_service_acct.htm&amp;language=en_US" target="_blank">Learn More</a></p>
          </td>

        </tr>
        <tr class="">
          <td data-label="Requirement" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e48 ">Exchange admins must enable Basic Authentication or NTLM on your email server and on
            your autodiscover server.</td>

          <td data-label="Why it’s required" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e51 ">
            <p>Lightning Sync identifies itself to your email services using the authentication
              protocol you chose to enable on your Exchange server. Lightning Sync authenticates on every
              connection request Salesforce makes to Exchange. If Basic and NTLM are enabled, Lightning
              Sync gives connection preference to Basic. If you must run other authentication methods on
              your server, those methods don’t conflict with the Lightning Sync connection.</p>
            <p style="margin-bottom:0;"><a href="https://help.salesforce.com/articleView?id=productivity_sync_exchange_admin_exchange_server_permission.htm&amp;language=en_US" target="_blank">Learn More</a></p>
          </td>

          <td data-label="Benefit to you" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e54 ">Authentication is encrypted over a TLS 1.2 or higher connection to provide security
            between endpoints on every request to Exchange. You can control the scope by which Lightning
            Sync has access to your email service. To do so, limit which email service users are
            impersonated with your service account.</td>

        </tr>
        <tr class="">
          <td data-label="Requirement" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e48 ">Exchange admins must create a service account on your Exchange server to impersonate
            all syncing users.</td>

          <td data-label="Why it’s required" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e51 ">
            <p>Lightning Sync uses the service account to query for users’ Salesforce_Sync folders and
              their primary calendars. The service account also queries create, update, and read server
              content that users already have access to.</p>
            <p style="margin-bottom:0;"><a href="https://help.salesforce.com/articleView?id=exchange_sync_admin_set_up_service_acct.htm&amp;language=en_US" target="_blank">Learn More</a></p>
          </td>

          <td data-label="Benefit to you" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e54 ">
            <p>This design lets contacts and events sync without requiring users to log in to their
              individual Microsoft accounts. Such a design avoids time-outs to users’ login sessions,
              offering a more reliable connection between systems.</p>
            <p>You can control the scope by which
              Lightning Sync has access to your email service. To do so, limit which email service users
              are impersonated with your service account.</p>
            <p style="margin-bottom:0;"><a href="https://help.salesforce.com/articleView?id=exchange_sync_admin_set_up_service_acct.htm&amp;language=en_US" target="_blank">Learn More</a></p>
          </td>

        </tr>
        <tr class="">
          <td data-label="Requirement" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e48 ">Service Account credentials must be provided on the Outlook Integration and Sync page
            in Salesforce Setup.</td>

          <td data-label="Why it’s required" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e51 ">Salesforce encrypts the service account password field using 128-bit master keys, using
            the Advanced Encryption Standard (AES) algorithm. </td>

          <td data-label="Benefit to you" class="slds-cell-wrap" style="vertical-align:top;" headers="d29603e54 ">
            <p>Only Salesforce admins with the permissions to access the Outlook Integration and Sync
              page in Setup can see or change the service account address.</p>
            <p style="margin-bottom:0;">As the password is typed, it’s
              masked to prevent others from seeing it. The contents can’t be copied and pasted elsewhere.
              You can’t learn what the service account password is by revisiting the page
              later.</p>
          </td>

        </tr>
      </tbody>
    </table>

#### See Also

- [Lightning Sync System Requirements](https://help.salesforce.com/s/articleView?id=sales.exchange_sync_sys_req.htm&release=264.0.0&type=5 "Confirm that your Microsoft® Exchange-based server or Google Workspace account meet these system requirements before you set up your sales reps for Lightning Sync.")
- [See the Big Picture for Setting Up Lightning Sync for Microsoft® Exchange](https://help.salesforce.com/s/articleView?id=sales.exchange_sync_admin_implement_ex_sync.htm&release=264.0.0&type=5 "Salesforce admins can set up Lightning Sync so reps can sync contacts and events between Microsoft® Exchange and Salesforce. Salesforce admins and IT pros complete several steps, both on your Exchange server and in Salesforce.")