Microsoft Warns Exchange Online Admins to Update API Permissions Before December 1

Microsoft is introducing new permissions for Exchange Online Admin API v2.0, requiring organizations to update affected applications before December 1, 2026.

According to Microsoft 365 Message Center MC1540345, two existing API permissions will be retired. Organizations must complete the migration by November 30 to avoid potential disruptions to automated Exchange Online administrative tasks.

Microsoft is replacing two Exchange Online API permissions

Microsoft is replacing two permissions that applications use to authenticate and access Exchange Online administrative endpoints.

The company is replacing Exchange.ManageV2 with Exchange.AdminAPI.Manage for delegated access and Exchange.ManageAsAppV2 with Exchange.AdminAPI.ManageAsApp for application-only access.

Applications that continue relying exclusively on the old permissions could lose access to affected Exchange Online APIs once Microsoft retires them.

Organizations that do not use these permissions do not need to make changes.

Exchange Online administrators have until November 30 to migrate

Microsoft began rolling out the new permissions worldwide on November 1, 2026, giving organizations until November 30 to complete the transition.

The existing permissions will begin deprecation on December 1, 2026, for worldwide environments.

Government cloud customers have more time, with deprecation scheduled to begin on January 1, 2027, for GCC, GCC High, and DoD environments.

What administrators need to do

Administrators should identify applications that use Exchange.ManageV2 or Exchange.ManageAsAppV2 and update their Microsoft Entra application registrations with the replacement permissions.

They must also grant administrator consent, verify existing Exchange Online role-based access control (RBAC) assignments, and test affected applications before removing the old permissions.

Scripts and configurations that reference the retired permissions may also require updates.

Microsoft notes that the new API permissions do not replace Exchange Online RBAC requirements. Applications without the appropriate roles can still receive 403 Forbidden errors, even when they have valid access tokens.

Organizations that rely on automated Exchange Online administration should complete testing and migration before the November 30 deadline.

In other news, Microsoft ended security updates for Exchange and Skype for Business servers. Microsoft is also retiring Office 365 A1 and removing 100 TB of free storage for schools.

Separately, Canada’s time zone changes have caused Microsoft 365 login issues, although a temporary workaround is available.

Via Neowin