3830348 - Server Side Integration Migration To Microsoft Graph API

Microsoft Exchange Web Services (EWS) is being deprecated on October 1st, 2026. Organizations using EWS for Microsoft 365 mailbox synchronization must migrate to Microsoft Graph API.

 Images/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental." 

• SAP Cloud for Customer
• SAP Sales and Service Cloud Version 2

Migration Methods

Choose the authentication method that fits the organization:

• Migrate from EWS to MS Graph App-Only Access

Migrate using application-level permissions that allow centralized mailbox access without individual user authentication. A Microsoft 365 administrator grants consent to SAP Sales Cloud, and a Key User updates the Organization mailbox type within Groupware settings.

Migration to Microsoft Graph API

Removed line 36

Migrate using application-level permissions that allow centralized mailbox access without individual user authentication. A Microsoft 365 administrator grants consent to SAP Sales Cloud, and a Key User updates the Organization mailbox type within Groupware settings.

Before Begin

Microsoft Exchange Web Services (EWS) is being deprecated in October 2026. This guide explains how to migrate an Organization from EWS to Microsoft Graph API using App-Only access within the SAP Cloud for Customer Groupware settings page. 

App-Only access uses application-level permissions that allow mailbox synchronization without requiring individual user sign-ins. This authentication method is managed centrally by a Key User.

Prerequisites

Key User with access to Groupware settings in SAP Cloud for Customer

Microsoft 365 administrator privileges to grant admin consent

An existing Organization configured with Microsoft 365 OAuth (EWS API) - App-only sign-in mailbox type

Migration Steps

Step 1: Open the Organization to migrate

    1. Log in to SAP Cloud for Customer as a Key User.

    2. Navigate to System Settings > All Settings > Groupware.

    3. From the left navigation menu, select Administration > Organizations.

    4. Select the Organization to be migrated that is currently using the Microsoft 365 OAuth (EWS API) - App-only sign-in mailbox type.

Step 2: Change the Mailbox type

    1. In Email configuration, change the Mailbox type to Microsoft 365 OAuth (Graph API) - App-only sign-in.

    2. Select Connect Account.

    3. When prompted, sign in with your Microsoft 365 admin credentials.

    4. Review the requested permissions and select Accept.

 

5. When the connection is successful, the Email configuration section will show Connected.

Step 3: Check users' access

In Email configuration, select Check users' impersonated access.

Review the connection statuses for all users in the organization.

Step 4: Confirm successful migration

To confirm the changes have taken effect:

From the Organization details page, select the Users tab.

Check that each user's Mailbox access type shows Office instead of Exchange.

• Migrate from EWS to MS Graph Delegated Access

Migrate using user-level permissions where each end user authenticates with their Microsoft 365 credentials and grants individual consent.

Before Begin

Microsoft Exchange Web Services (EWS) is being deprecated in October 2026. This guide shows how to migrate an Organization from EWS to Microsoft Graph API using Delegated (end user) access from within SAP Cloud for Customer, Groupware settings page.

With Delegated access, each user authenticates individually with their Microsoft 365 credentials.

Prerequisites

Key User with access to Groupware settings in SAP Cloud for Customer

Microsoft 365 administrator privileges to grant tenant-wide consent

Configuration Steps

Step 1: Grant tenant-wide admin consent

To enable mailbox access, a Microsoft 365 administrator must grant tenant-wide consent to the SAP Cloud for Customer, server-side integration application. This one-time action allows users to connect their mailboxes during login using delegated permissions. If admin consent is not granted, users will see the following error when signing in:

 

It is possible to grant consent in one of three ways:

• Using a URL (recommended)

• Using the Microsoft Entra admin center

• During mailbox setup for synchronization in Groupware > Settings.

• Grant consent using a URL (recommended):

Use this method if the SAP Cloud for Customer, server-side integration app is not yet installed in your tenant, or if necessary to grant delegated permissions only.

1. Copy the following URL into a text editor:

   https://login.microsoftonline.com/{organization}/v2.0/adminconsent?client_id=b6a5e632-5250-4590-8952-27e5e7b8ce9f&redirect_uri=https://portal.azure.com/TokenAuthorize&scope=https://graph.microsoft.com/offline_access%20https://graph.microsoft.com/User.Read%20https://graph.microsoft.com/User.ReadBasic.All%20https://graph.microsoft.com/MailboxSettings.ReadWrite%20https://graph.microsoft.com/Mail.ReadWrite%20https://graph.microsoft.com/Calendars.ReadWrite

2. Replace {organization} with your Microsoft 365 tenant ID. To get the tenant ID, do the following:

   1. Navigate to Microsoft Entra admin center> Entra ID > Overview.

   2. Copy the tenant ID.

3. Paste the updated URL into your browser and open it with Microsoft 365 admin credentials.

4. Review the requested permissions and select Accept.

Completing this step will not display any response. If no errors occur, the admin can close the corresponding window.

• Grant consent in the Microsoft Entra admin center:

Use this method if the app is already registered in your Microsoft 365 environment. This approach grants both delegated and application permissions. After consenting will be possible to remove unused permissions.

1. Sign in to the Microsoft Entra admin center.

2. Navigate to Enterprise applications > All applications > SAP Cloud for Customer, server-side integration.

3. Select Permissions > Grant admin consent for {Organization Name}.

4. Sign in with your Microsoft 365 admin credentials and select Accept in the permissions dialog.

Grant admin consent during mailbox setup for synchronization in Groupware Settings:

Note
Attention: This method assumes that an Office 365 admin account is used as the mailbox for synchronization. If it is not in the plan to use it for ongoing synchronization, this ServerSync user should be removed after providing consent.

This method grants delegated permissions only.

1. Sign in to SAP Cloud for Customer as a Key User.

2. Navigate to System Settings > All Settings > Groupware.

3. From the left navigation menu, select Administration > Organizations.

4. Create a new Organization or select the Organization to migrate with the Microsoft 365 OAuth (Graph API) - End user sign-in mailbox type.

5. Provision new users or move some existing users to this Organization.

6. From Users > Email configuration, sign in with Office365. When prompted, sign in with your Microsoft 365 admin credentials.

7. Review the requested permissions and select Accept.

8. When the connection is successful, the Email configuration section will display as Connected.

9. If it is not the plan to use an admin mailbox for synchronization, delete this ServerSync user through the Force delete action. Alternatively, it is possible to change to another mailbox by selecting Sign out, then Sign in with Office 365.

Once completed, users can authorize their mailbox access individually during sign-in.

Step 2: Update mailbox connectivity settings

    1. Log in to SAP Cloud for Customer as a Key User.
    2. Navigate to System Settings > All Settings > Groupware.
    3. From the left navigation menu, select Administration > Organizations.
    4. Select the Organization to migrate that is currently using the Microsoft 365 OAuth (EWS API) - End user sign-in mailbox type.
    5. In Email configuration, change the Mailbox type to Microsoft 365 OAuth (Graph API) - End user sign-in and select Save.

Step 3: Ask users to reconnect their Microsoft 365 accounts

Once mailbox connectivity is updated in SAP Cloud for Customer, all users assigned to the affected organization need to reconnect their Microsoft 365 mailboxes:

    1. Log in to SAP Cloud for Customer as a user.
    2. Navigate to Groupware Settings > Users > Personal Settings > My Sync Status.
    3. In the Email configuration section, select Refresh or Change (both options are valid).
    4. Sign in using your Microsoft 365 credentials. No consent screen will appear if Step 1 (granting admin consent) has already been completed.
    5. Once the connection is successful, the Email configuration section will display as Connected.

Step 4: Confirm successful migration

To confirm the changes have taken effect:

From the Organization details page, select the Users tab.

Check that each user's Mailbox access type shows Office instead of Exchange.

Following the migration to Microsoft Graph, new users can no longer receive the add-in through the Admin UI. The add-in now needs to be deployed centrally by their Microsoft 365 administrator.
The customer’s Microsoft 365 administrator should:

    1. Go to Administration → Groupware Settings in the SAP tenant and export the Outlook add-in manifest.
    2. In the Microsoft 365 Admin Center, go to Settings → Integrated apps → Upload custom apps → Office Add-in and upload the manifest.
    3. Assign the affected users, a dedicated group, or preferably the entire organization, and complete the deployment.

Once deployed, the add-in usually becomes available much sooner, but it may take up to 24 hours to appear in Outlook.
If you follow this process, the add-in will be available to the newly provisioned users.

Other documentation:

• KBA 3798115 - Migration From Microsoft Microsoft Graph API on Server Side Integration (FAQ)
  
• KBA 3802369 - EWS Vs Graph - Feature, Behavior Differences And Limitations In Server Side Integration
• KBA 3831205 - Microsoft Graph API Permissions (Server Side Integration)

Migration Methods;EWS;Microsoft Exchange Web Services;Microsoft Graph API;App-Only Access;Delegated Access;Application-Level Permissions;User-Level Permissions;Microsoft 365;SAP Cloud for Customer;Groupware;Mailbox Migration;OAuth;Microsoft Entra ID;Admin Consent;Tenant-Wide Consent;Mailbox Type;Organization;Key User;Microsoft 365 Administrator;Email Configuration;Mailbox Synchronization;Impersonated Access;ServerSync;End User Sign-In;EWS Deprecation;October 2026;Microsoft Graph API Migration;Office 365;Mailbox Connectivity;User Reconnection;Migration Steps;Prerequisites;Enterprise Applications;Microsoft Graph Permissions;Delegated Permissions;Application Permissions;Tenant ID;Microsoft Entra Admin Center;Organization Settings;User Access;Mailbox Access Type;Exchange to Office Migration , KBA , LOD-CRM-GW-SCC , Invisible CRM - Smart Cloud Connect Solution , How To

SAP Cloud for Customer add-ins all versions ; SAP Cloud for Customer core applications 2608