Knowledge Base - Migrating from EWS to Microsoft Graph

Why Migrate?

Microsoft Graph is Microsoft's unified API gateway for accessing data across Microsoft 365 services — mail, calendar, contacts, files, Teams, and more — through a single REST endpoint (https://graph.microsoft.com).

Exchange Web Services (EWS) is the legacy SOAP-based API that communicates directly with Exchange Server. Microsoft has officially announced that EWS will no longer receive feature updates and will eventually be deprecated for Exchange Online. New OAuth application registrations for EWS-only access are already being restricted.

Microsoft's deprecation timeline: Microsoft is actively encouraging all integrations to move from EWS to Microsoft Graph. While EWS remains functional for existing applications, no new features are being added, and future access restrictions are expected. Migrating now ensures uninterrupted synchronization.

Key Differences

EWS Microsoft Graph
Protocol SOAP/XML REST/JSON
Endpoint Per-server (/EWS/Exchange.asmx) Unified (https://graph.microsoft.com)
Authentication Basic Auth (removed), OAuth OAuth 2.0 only
Scope Exchange mailbox only All Microsoft 365 services
Notifications Streaming/pull subscriptions Webhooks, change notifications
Status Maintenance mode, no new features Actively developed

From AESync's perspective the migration is straightforward — the sync engine handles both APIs transparently. You only need to switch the connection type and grant consent as described below.

Step 1: Revoke User Consent

Note: If you already have a profile working with EWS, you need to revoke the existing consent first. Otherwise, skip to Step 3.
  1. Sign in to the Azure Portal.
  2. Navigate to Azure Active Directory → Manage → Enterprise applications.
    Enterprise applications
  3. Find GrinMark Synchronizer in the list and select it.
    Select GrinMark Synchronizer
  4. On the left sidebar, choose Manage → Properties.
    Manage Properties
  5. Click the Delete button.
    Delete consent
  6. You should see an app-deleted confirmation:
    App deleted
  7. Refresh the app list — GrinMark Synchronizer should no longer appear:
    Refresh list
    App disappeared

Step 2: Restart Profile Manager

Close and reopen the AESync Profile Manager so it picks up the consent removal.

Step 3: Switch Api Type to Graph

  1. Select your profile and change the Api Type to Graph in the connection settings:
    Switch Api Type to Graph
  2. Click Test Connection. You will see a consent-required message:
    Consent error
    User consent is required to connect. A private browser window will be opened when you click OK. Please log in with the Exchange service account and grant the necessary permissions. Then re-test the connection.
  3. Click OK. A browser window opens — sign in with your Microsoft account:
    Log in to Microsoft
  4. Review and accept the requested permissions:
    Accept consent
  5. Close the browser and click Test Connection again. It should now succeed:
    Connection successful

Migration Best Practices

Important: Do not switch all sync profiles to Graph at once.
  • Start with a sandbox profile. Create or designate a test sync profile and migrate it to Graph first. Let it run for several days and verify that contacts, appointments, and other items synchronize correctly in your environment.
  • Migrate one profile at a time. Once the sandbox profile is confirmed working, enable Graph for production profiles one by one. Allow each profile to run for a reasonable period (at least a few sync cycles) before moving on to the next.
  • Monitor sync logs. After each migration, check the sync logs for warnings or errors before proceeding with additional profiles.

This gradual approach minimizes risk and makes it easy to isolate issues if they arise in a specific profile or configuration.