Table of Contents
App Developers Must Replace Exchange Admin API Permissions by November 30, 2026
In November 2025, Microsoft introduced the Exchange Online Admin API, a REST-based API designed to address some of the gaps encountered by developers migrating applications from Exchange Web Services (EWS). Microsoft began disabling EWS in Exchange Online in October 2026, with full retirement scheduled for April 2027.
The Exchange Online Admin API provides a REST-based, cmdlet-style interface for a limited set of Exchange administrative operations. Applications submit HTTP POST requests that specify the Exchange cmdlet and supported parameters to run, and the API returns the results. The API doesn’t expose the complete Exchange Online PowerShell cmdlet set. It I is a stop-gap feature intended to help ISVs migrate applications away from EWS when Microsoft Graph doesn’t provide the necessary Exchange functionality.
Microsoft’s documentation offers this guidance about when to use the Admin API or PowerShell:
- Admin API: Use when you need a REST-first, cmdlet-equivalent surface for the previously described scenarios (organization config, group membership, folder permissions, and delegation) only.
- Exchange Online PowerShell: Use when you require the full breadth of Exchange cmdlets, advanced operations, or existing PowerShell scripts and runbooks.
Exchange Admin API Still a Preview
A year after its introduction, the Exchange Online Admin API remains in preview, isn’t available in all organizations, and is subject to change. For more information about how to use the API, see this article. As we’ll get to, the permissions cited in the article are changing, but the code examples still work (with the new permissions).
In reality, Microsoft’s guidance can be boiled down to “if you’re migrating an app from EWS and need some Exchange functionality that’s unsupported by the Graph, maybe the Admin API can help…” For most new development, Microsoft Graph remains the preferred API when it supports the required Exchange functionality. Graph can manage many properties of user accounts, but Exchange-specific mailbox properties aren’t exposed through its user APIs. Mailbox and calendar items can also be worked with through Graph (including JSON batching), but group mailboxes are less well covered.
The Need for Change
All of which brings me to message center notification MC1540345 (5 November 2026). API permissions normally evolve by adding more granular permissions (like User.ReadBasic.All or Group.ReadBasic.All) or deprecating permissions over time. It’s unusual to see an API replace the permissions used to access it completely, which is what Microsoft is doing with the Exchange Online Admin API.
A year ago, Microsoft introduced the Exchange.ManageV2 delegated permission and the Exchange.ManageAsAppV2 application permission to access the Admin API. To be blunt, the permission names were confusing because the Exchange.ManageAsApp permission already existed to allow apps to run Exchange Online cmdlets as if they were a human administrator.
To solve the confusion (or perhaps cause some more), on November 1, 2026, Microsoft introduced the Exchange.AdminAPI.Manage permission for delegated access and the Exchange.AdminAPI.ManageAsApp permission for application-only access to replace the previous permissions. The new permissions don’t provide backward compatibility for applications configured with the old permissions. Applications must add the replacement permissions and obtain the necessary administrator consent before the old permissions are deprecated.
The previous permissions will be deprecated and stop working in commercial tenants from December 1, 2026, and in government tenants from January 1, 2027.
A month to update permissions for apps is a fast turnaround, but I assume that Microsoft has highlighted the requirement to the ISVs with apps known to be in customer use. I doubt that many Microsoft 365 tenants have developed their own applications using the Admin API, so the direct impact on tenant-developed applications might be limited. In that respect, MC1540345 might be aimed as much at making tenants aware of the change so that they can verify that ISVs supplying affected applications have made the necessary updates.
No Change in RBAC
Changing the API permissions doesn’t replace Exchange Online RBAC. Existing RBAC requirements continue to apply, and administrators must grant consent for the new permissions. The endpoints, API version, and supported operations aren’t changing. Only the authorization permissions used to access the Exchange Admin API are changing. All part of the great effort to eradicate EWS from Microsoft 365.
Learn how to use Exchange Online and to exploit the data available to Microsoft 365 tenant administrators through the Microsoft 365 for IT Pros eBook. We love figuring out how things work.