Action required: Update permissions for Exchange Online Admin API

[What and Why:]

Microsoft is updating the authorization model for Exchange Online Admin API v2.0 by introducing dedicated API permissions. This change provides a clearer permission model for applications accessing Exchange Online administrative endpoints and supports the ongoing modernization of Exchange Online administration, including migration from Exchange Web Services (EWS).

The Exchange Online Admin API v2.0 endpoints are not being retired. Only the permissions used to access them are changing:

• Exchange.ManageV2 is being replaced by Exchange.AdminAPI.Manage.
• Exchange.ManageAsAppV2 is being replaced by Exchange.AdminAPI.ManageAsApp.

Applications using the affected permissions must transition to the corresponding new permissions to maintain uninterrupted access.

[Rollout Schedule:]

• Worldwide: New permissions become available November 1, 2026. Complete migration by November 30, 2026. Existing permissions are deprecated December 1, 2026.
• GCC, GCC High, DoD: Rollout begins in November 2026, with existing permissions deprecated January 1, 2027.

[Impact on Your Organization:]

Who is affected:

This change affects organizations that develop, own, or manage applications accessing Exchange Online Admin API v2.0 using Exchange.ManageV2 for delegated access or Exchange.ManageAsAppV2 for application-only access. If your organization does not use either permission, no action is required.

Platforms/Services:

• Exchange Online
• Exchange Online Admin API v2.0
• Microsoft Entra application permission and consent configuration

What will happen:

• Applications must transition to Exchange.AdminAPI.Manage or Exchange.AdminAPI.ManageAsApp, as applicable.
• Administrators must grant consent to the new permissions where required.
• Existing Exchange Online RBAC requirements continue to apply.
• Exchange Online Admin API v2.0 endpoint URLs, API version, and supported operations are not changing as a result of this update.
• Applications relying exclusively on the retired permissions after the applicable deprecation date will no longer be able to access the APIs.

Action Required/Recommendations:

1. Identify affected applications. Review applications using Exchange.ManageV2 or Exchange.ManageAsAppV2.
2. Configure the new permissions. Add the corresponding Exchange.AdminAPI.Manage or Exchange.AdminAPI.ManageAsApp permission.
3. Grant administrator consent. Ensure the required new permissions are approved.
4. Verify Exchange RBAC assignments. Confirm that the application or delegated user has the necessary Exchange roles.
5. Validate API functionality. Test affected workflows using the new permissions before removing the existing permissions.
6. Remove the retired permissions. After successful validation, remove the old permissions from the application configuration.
7. Update explicit permission references. Update configurations, scripts, or consent workflows that reference the existing permission names.
8. Check third-party applications. Contact your application provider to determine whether an update is required.

For more information, see Authentication and authorization for the Exchange Online Admin API.

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.