'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Prepare for Exchange Online ApplicationImpersonation Retirement
Question details
The user needs to understand how to prepare for the retirement of Exchange Online ApplicationImpersonation, including assessing affected applications and planning remediation.
- Product
- Microsoft Exchange Online
- Device & OS
- not provided
- Scenario
- Preparing for Microsoft's deprecation of ApplicationImpersonation and RBAC in Exchange Online.
- Observed behavior
- Administrators need to identify affected applications within their tenant and migrate them to supported authentication methods like Microsoft Graph or EWS.AccessAsApp.
Ensure you have global administrator or Exchange administrator privileges in your Microsoft 365 tenant to run diagnostic scripts and review application permissions in Microsoft Entra ID.
Identify Affected Apps and Migrate to Supported Protocols
Follow these steps to find apps using ApplicationImpersonation and migrate them to Microsoft Graph or Exchange Online RBAC for Applications.
Microsoft is officially retiring the ApplicationImpersonation role in Exchange Online. Applications relying on this role for access must be updated to ensure continuous functionality.
Run the necessary assessment scripts provided by Microsoft to generate a report of service principals and apps currently utilizing the ApplicationImpersonation role.
Open the Microsoft Entra ID admin center. Use the application IDs gathered from your script reports to locate the specific affected applications within your tenant.
Whenever possible, update your applications to use the Microsoft Graph API, which provides a more modern and secure method for accessing Exchange Online data.
For scenarios where Microsoft Graph cannot be used and app-only access is supported, update the app to use EWS.AccessAsApp in conjunction with Exchange Online RBAC for Applications.
If you encounter complex dependencies or require tenant-specific guidance during the migration process, open a support ticket with Microsoft 365 support.
Try WPS Office for a Seamless Document Management Experience
While backend Exchange server updates require Microsoft 365 administrative tools, everyday document productivity doesn't have to be complicated. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for creating, editing, and managing your Word, Excel, and PowerPoint files.
- 1. Download and Install: Get the free WPS Office suite from the official website and install it on your device in minutes.
- 2. Open Your Documents: Seamlessly open your existing Word, Excel, and PowerPoint files with zero formatting loss.
- 3. Save and Share: Edit your documents and save them in standard Office formats to easily share with colleagues and clients.
Frequently Asked Questions
What is ApplicationImpersonation in Exchange Online?
ApplicationImpersonation is a management role in Exchange Online that allows an application to impersonate a user to perform operations on their behalf, such as accessing mailboxes, sending emails, or managing calendars.
Why is Microsoft retiring ApplicationImpersonation?
Microsoft is retiring this role to improve platform security and align with modern authentication standards. They strongly recommend using the more secure Microsoft Graph API or Exchange Online RBAC for Applications instead.
What happens if I don't migrate my applications?
Once the ApplicationImpersonation role is fully retired by Microsoft, any applications still relying on it will lose their ability to access Exchange Online data, resulting in immediate service disruptions and API failures.
How do I find out which apps use ApplicationImpersonation?
You can run Exchange Online PowerShell diagnostic scripts to generate a report of all service principals and apps currently using the role, then match the application IDs in the Microsoft Entra ID admin center.
