MC1540345 - Action required: Update permissions for Exchange Online Admin API

Microsoft 365 Message Center announcement MC1540345.

MS Message Center's Summary

Microsoft is replacing the Exchange Online Admin API v2.0 permissions with new specific identifiers starting in November 2026. Administrators must identify custom tools using the legacy permissions, update application registrations, grant fresh consent, and verify role assignments before the deprecation deadline. Thorough testing is advised to prevent administrative workflow disruption.

Administrator impact
Administrators must update application registrations with the new API permissions and grant consent before the deprecation date.
End user impact
No direct end user impact is expected unless administrative management tools fail due to unupdated application permissions.
Importance
8/10: This change requires active administrative intervention to update application permissions, or integrations using the legacy model will lose access.

Authentication and authorization for the Exchange Online Admin API

Microsoft Summary

Microsoft is updating Exchange Online Admin API v2.0 permissions, replacing Exchange.ManageV2 and Exchange.ManageAsAppV2 with new permissions by November 2026. Affected applications must transition, obtain admin consent, verify RBAC roles, test, and remove old permissions to maintain access. No endpoint changes occur.

Message Center ID
MC1540345
Category
plan For Change
Severity
normal
Services
Exchange Online
Tags
Admin impact, Retirement
Published
2026-11-05
Last updated
2026-11-05
Expires
2027-01-25

[What and Why:] Microsoft is updating the authorization model for Exchange Online Admin API v2.0 by introducing dedicated API permissions. This change provides a clearer permission model for applications accessing Exchange Online administrative endpoints and supports the ongoing modernization of Exchange Online administration, including migration from Exchange Web Services (EWS). The Exchange Online Admin API v2.0 endpoints are not being retired. Only the permissions used to access them are changing: Exchange.ManageV2 is being replaced by Exchange.AdminAPI.Manage. Exchange.ManageAsAppV2 is being replaced by Exchange.AdminAPI.ManageAsApp. Applications using the affected permissions must transition to the corresponding new permissions to maintain uninterrupted access. [Rollout Schedule:] Worldwide: New permissions become available November 1, 2026. Complete migration by November 30, 2026. Existing permissions are deprecated December 1, 2026. GCC, GCC High, DoD: Rollout begins in November 2026, with existing permissions deprecated January 1, 2027. [Impact on Your Organization:] Who is affected: This change affects organizations that develop, own, or manage applications accessing Exchange Online Admin API v2.0 using Exchange.ManageV2 for delegated access or Exchange.ManageAsAppV2 for application-only access. If your organization does not use either permission, no action is required. Platforms/Services: Exchange Online Exchange Online Admin API v2.0 Microsoft Entra application permission and consent configuration What will happen: Applications must transition to Exchange.AdminAPI.Manage or Exchange.AdminAPI.ManageAsApp, as applicable. Administrators must grant consent to the new permissions where required. Existing Exchange Online RBAC requirements continue to apply. Exchange Online Admin API v2.0 endpoint URLs, API version, and supported operations are not changing as a result of this update. Applications relying exclusively on the retired permissions after the applicable deprecation date will no longer be able to access the APIs. Action Required/Recommendations: Identify affected applications. Review applications using Exchange.ManageV2 or Exchange.ManageAsAppV2. Configure the new permissions. Add the corresponding Exchange.AdminAPI.Manage or Exchange.AdminAPI.ManageAsApp permission. Grant administrator consent. Ensure the required new permissions are approved. Verify Exchange RBAC assignments. Confirm that the application or delegated user has the necessary Exchange roles. Validate API functionality. Test affected workflows using the new permissions before removing the existing permissions. Remove the retired permissions. After successful validation, remove the old permissions from the application configuration. Update explicit permission references. Update configurations, scripts, or consent workflows that reference the existing permission names. Check third-party applications. Contact your application provider to determine whether an update is required. For more information, see Authentication and authorization for the Exchange Online Admin API . [Compliance considerations:] No compliance considerations identified, review as appropriate for your organization.