Quick answer: Microsoft will start blocking Exchange Web Services (EWS) requests to Exchange Online on October 1, 2026, with full retirement by April 1, 2027, per Microsoft's Exchange Team announcement. Salesforce features that historically connected to Exchange through EWS — including Einstein Activity Capture, Salesforce Inbox, and Lightning Sync — must move to Microsoft Graph before the block takes effect, or email and calendar sync will stop working. The fix is a known, documented upgrade path, but it requires coordination between your Salesforce admin and your Microsoft 365 admin, so the time to start is now, not September.
Exchange Web Services is the legacy API that third-party applications — including CRM email integrations — have used for years to read mailboxes, sync calendars, and send email through Exchange. Microsoft has been steering developers toward its modern replacement, Microsoft Graph, and the transition now has hard dates.
Per Microsoft's Exchange Team announcement and Microsoft Learn documentation, the timeline is:
Two clarifications matter for planning. First, this applies to Exchange Online (Microsoft 365) — Microsoft has stated that on-premises Exchange Server is not affected by this retirement. Second, the October date is when blocking begins, not a soft deadline. Once your tenant is blocked, any integration still calling EWS simply stops functioning.
Salesforce's help documentation identifies three features that have used EWS-based connections to Microsoft Exchange and directs customers to upgrade their authentication to Microsoft Graph:
Because Salesforce adjusts its guidance as the deadline approaches, treat this list as a starting point and confirm your org's exposure against Salesforce's current documentation — specifically the help articles on upgrading the Microsoft 365 authentication method to Microsoft Graph. Newer EAC connections may already authenticate through Graph; older ones typically do not.
You cannot fix what you have not inventoried. A quick exposure check looks like this:
For Salesforce, the destination is a Microsoft Graph–based connection using modern OAuth authentication. The upgrade is well documented, but it is a cross-team effort:
Here is how the two connection types compare:
| Aspect | EWS (legacy) | Microsoft Graph (modern) |
|---|---|---|
| Status in Exchange Online | Blocking begins October 1, 2026; retired April 1, 2027 (per Microsoft) | Microsoft's supported, actively developed API |
| Authentication | Legacy authentication patterns | OAuth 2.0 with admin consent and conditional access support |
| Salesforce support | Being phased out; upgrade prompts in Setup | Required path for Einstein Activity Capture, Inbox, and related features |
| Admin effort | None — until it breaks | One-time coordinated upgrade, then business as usual |
A phased plan removes the drama. For most mid-market orgs this is weeks of elapsed time, not months — but the coordination points are real.
Three reasons. First, the failure mode is silent data loss: when EWS calls are blocked, activity capture just stops. Sellers keep working, but emails and meetings stop landing on records — and you cannot backfill relationship history you never captured.
Second, the bottleneck is not you. Azure admin consent, internal security reviews, and change-freeze calendars all sit outside the Salesforce team's control. Organizations that start in September are betting that every other team has capacity in the same crunch window as everyone else facing the deadline.
Third, this deadline is shared across your entire stack. Every vendor still on EWS is pushing customers through the same gate at once. Support queues — Microsoft's, Salesforce's, and every ISV's — will be at their worst in Q4 2026.
No. Per Microsoft's announcement, the retirement applies to Exchange Online (Microsoft 365) only. However, hybrid organizations should still review their setup, because mailboxes hosted in Exchange Online are affected regardless of how the rest of the environment is architected.
Do not assume so. Salesforce provides an upgrade path in Setup for EWS-based Einstein Activity Capture connections, but the upgrade requires Microsoft 365 admin consent on your side — something Salesforce cannot do for you. Verify your connection type and plan the upgrade deliberately, confirming steps against Salesforce's current help documentation.
No. Lightning Sync is being retired as a product, so the path forward is a migration to Einstein Activity Capture plus a Microsoft Graph connection. That is a bigger change than an authentication swap — it affects how activities are stored and reported — so budget more time for it.
Once Microsoft blocks EWS for your tenant, any Salesforce feature still using an EWS connection stops syncing email and calendar data. Microsoft has described a phased disablement process, but planning around the possibility of a grace period is not a strategy — the safe assumption is that October 1 is your deadline.
Yes. EWS is used by many enterprise tools beyond CRM — archiving, compliance capture, room booking, and telephony integrations are common examples. Ask your Microsoft 365 team to pull EWS usage reporting for the tenant so the full list is known early.
Migrations like this sit at the seam between two platforms — exactly where things get dropped. Vantage Point's system integration and data migration team runs EWS-to-Graph transitions end to end: exposure audit, Microsoft 365 coordination, sandbox validation, production cutover, and post-migration monitoring, including Lightning Sync to Einstein Activity Capture moves. Senior consultants only — no junior handoffs; the experts you meet are the experts who deliver. If your email integration is still on EWS, a short assessment now is far cheaper than a silent sync outage in October.