Skip to main content
Version: 7.3

Microsoft 365 configration

This section describes how to configure the connection to Microsoft 365 (Exchange Online). Before you begin with the configuration, make sure to create the Entra ID application as described here.

contentACCESS is using EWS to connect to M365, but recently Microsoft decided to shut down EWS access for M365 (starting in October 2026). The replacement of EWS is Microsoft Graph. contentACCESS now offers the possibility to connect to M365 using Microsoft Graph with some limitations. The Graph access is currently in preview (Beta).

Configure M365 with EWS

Select the Exchange server type as "M365 with EWS". Select the Region as Global. Microsoft stopped supporting regions and it is no longer recommended to select a different region. The Exchange server interface version is by default Exchange 2016 or higher for M365.

Enter the EWS url. The url is in format: https://servername/EWS/Exchange.asmx. The EWS authentication mode still support "Basic" authentication, but Microsoft is blocking all Basic authentication requests on M365. Use "Modern" authentication. The modern authentication is using the Entra Id app registration and it is necessary to enter the app registration details here:

  • OAuth applicatin ID is the id of the app registration
  • OAuth tenant ID is the identification of the M365 tenant (also present in the app registration)
  • OAuth client secret is the secret key created for the app registration The option Use impersonation is always enabled and can't be changed.

Configure PowerShell access: It is recommended to set PowerShell authentication to "Modern". The PowerShell access is using the same app registration used by EWS.

It is recommended to test the connection after each change. Both the EWS and PowerShell connections are tested. Testing the connection requires a valid email address. If the PowerShell connection is working, it finds a random mailbox in the organization and uses this email address to test the connection. If this mailbox is not a valid mailbox, the connection test might fail and it is recommended to enter the testing email address manually Email address to test.

Configure M365 with Graph

Select the Exchange server type as "M365 with Graph (Beta)".

Microsoft graph requires an Entra Id app registration and it is necessary to enter the app registration details here:

  • OAuth applicatin ID is the id of the app registration
  • OAuth tenant ID is the identification of the M365 tenant (also present in the app registration)
  • OAuth client secret is the secret key created for the app registration

The PowerShell authentication is set fixed to "Modern". The PowerShell access is using the same app registration used by Graph.

It is recommended to test the connection after each change. Both Graph and PowerShell connections are tested. Testing the connection requires a valid email address. If the PowerShell connection is working, it finds a random mailbox in the organization and uses this email address to test the connection. If this mailbox is not a valid mailbox, the connection test might fail and it is recommended to enter the testing email address manually Email address to test.

Note: When working with M365 it is recommended to configure the "Microsoft 365" login provider in contentACCESS. The users will use the M365 authentication to log in to contentACCESS. The email archive will create the M365 logins for the users and will synchronize the permissions based on these M365 logins.

::: Note

Note: The Entra ID app can be registered by using this PowerShell script

:::