Microsoft 365 configuration
This page describes how to configure the connection to Microsoft 365 (Exchange Online) with EWS or Microsoft Graph. contentACCESS uses EWS to connect to Microsoft 365, but Microsoft has recently decided to shut down EWS access for M365 (starting in October 2026; see the official Microsoft announcement). The replacement of EWS is Microsoft Graph, which contentACCESS now supports for connecting to Microsoft 365 with some limitations. For more details about these limitations, see Switching Microsoft 365 from EWS to Microsoft Graph. Please note that the Graph access is currently in preview (Beta).
Before you begin with the configuration, make sure to create the Entra ID application as described here.
The Entra ID app can be registered by using this PowerShell script.
Configure M365 with EWS
To configure EWS for M365, select M365 with EWS as the Exchange server type.
Set Region to Global. Since Microsoft stopped supporting regions, it is no longer recommended to select a different region.
For M365, the Exchange server interface version is set to Exchange 2016 or higher by default.
Enter the EWS URL in the following format: https://servername/EWS/Exchange.asmx.
The EWS authentication mode still supports "Basic" authentication, but Microsoft blocks all Basic authentication requests on M365, so use "Modern" authentication instead.
Modern authentication uses the Entra ID app registration, and you need to enter the app registration details below:
- OAuth application ID is the ID of the app registration
- OAuth tenant ID is the ID of the M365 tenant (also present in the app registration)
- OAuth client secret is the secret key created for the app registration The option Use impersonation is always enabled and cannot be changed.
For PowerShell access, it is recommended to set PowerShell authentication to "Modern", which uses the same app registration as EWS.
It is recommended to test the connection after each change. Both the EWS and PowerShell connections are tested, and testing requires a valid email address. If the PowerShell connection is working, it automatically finds a random mailbox in the organization and uses it for the test. If that mailbox is not valid, the test might fail — in that case, enter the email address manually in the Email address to test field.
Configure M365 with Graph
To configure Microsoft Graph for M365, select M365 with Graph (Beta) as the Exchange server type.
Microsoft Graph requires an Entra ID app registration. You need to enter the app registration details below:
- OAuth application ID is the ID of the app registration
- OAuth tenant ID is the ID of the M365 tenant (also present in the app registration)
- OAuth client secret is the secret key created for the app registration
For PowerShell access, PowerShell authentication is set to "Modern" and uses the same app registration as Graph.
It is recommended to test the connection after each change. Both Graph and PowerShell connections are tested, and testing requires a valid email address. If the PowerShell connection is working, it automatically finds a random mailbox in the organization and uses it for the test. If that mailbox is not valid, the test might fail — in that case, enter the email address manually in the Email address to test field.
When working with M365 it is recommended to configure the "Microsoft 365" login provider in contentACCESS. The users will use the M365 authentication to log in to contentACCESS. The email archive will create the M365 logins for the users and will synchronize the permissions based on these M365 logins.