Exchange Online Admin API Apps Must Migrate to New Permissions

Microsoft is changing how applications authenticate to the Exchange Online Admin API v2.0, retiring the existing Exchange.ManageV2 and Exchange.ManageAsAppV2 permissions in favor of new, more specific permissions. Organizations that use custom scripts, automation tools, or third-party applications connected to the API must update their configurations before the November 30 deadline.

If administrators fail to make the switch, applications that rely on the retired permissions could lose access to the API once deprecation takes effect, which potentially disrupts Exchange Online management tasks and automated workflows. The API endpoints themselves are not changing, but authentication failures could cause administrative operations to stop working unexpectedly.

Organizations should begin planning the permission migration

To avoid disruption, Microsoft is introducing the new Exchange.AdminAPI.Manage and Exchange.AdminAPI.ManageAsApp* permissions. Organizations should identify affected applications, add the replacement permissions in Microsoft Entra, grant admin consent, verify required Exchange RBAC roles, test all integrations, and remove the old permissions after validation. Third-party application owners should also confirm that vendors have updated their products.

This change is relatively low impact because Microsoft is not retiring the Exchange Online Admin API v2.0 itself, nor changing its endpoints, supported operations, or API version. However, administrators must spend time auditing applications, updating permission assignments, and validating access controls. Organizations with extensive automation or older integrations may face additional testing and coordination work before completing the migration.