Retirement of RBAC Application Impersonation in Exchange Online

It's a bit unclear what this announcement is about. So you are going to be deprecating the built-in ApplicationImpersonation role, correct? And the recommendation is to use the "full_access_as_app" permissions, which covers the application permissions model? Then what about the delegate permissions model, will the "EWS.AccessAsUser.All" permissions continue to be supported or?

And the recommendation to use Graph makes no sense, as there is no impersonation permission therein (for the application permissions model). Both examples from the documentation still use the Exchange Online API resource ("00000002-0000-0ff1-ce00-000000000000"), not Graph.

This is a major deprecation to have such a short notification period of only 2 months. It will require significant changes to adjust the way our customers configure and setup our application to adapt to this change. These types of infrastructure and application changes need time to develop, test and deploy, and this notification period is simply not sufficient.

And I'll reiterate, as I have on the previous EWS deprecation notices, that the Graph API simply is not production ready to replace EWS. It is fraught with performance and functional issues, and Microsoft does not appear to be making any progress on solving them.

ajanes-arc, not helpful as EWS is not going away until at least 2026 and the retirement of RBAC Application Impersonation is going to happen way sooner. Therefore it is extremely relevant to know how to handle this in the meantime. Also, Graph is currently not in a state where it can replace EWS in all scenarios (see comments on https://techcommunity.microsoft.com/t5/exchange-team-blog/ews-exchange-web-services-to-microsoft-graph-migration-guide/ba-p/3957158 and https://techcommunity.microsoft.com/t5/exchange-team-blog/retirement-of-exchange-web-services-in-exchange-online/ba-p/3924440)...

Xavier: Yes and yes.

Does anyone know if this is also going to affect ResourceImpersonation? I am also trying to determine in the Unified Audit Log how to search the account usages.

According to the Unified Audit Logging article for Mailbox Auditing

You cannot Search for Activity on a Resource mailbox. 
Unfortunately, this is exactly what I am trying to investigate.

We use a service to synchronize Rooms Reservations to Android tablets mounted on the walls.
If the change does not impact ResourceImpersonation and is ONLY applicable to ApplicationIMpersonation then I may have wasted half my day.

Further reading, and no doubt the inspiration for this change:

https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/

Vasil: Yes, all correct in your first paragraph. Regarding the recommendation to use Microsoft Graph, this is due to the fact that EWS will be retired in Exchange Online in October 2026, and migrating to Microsoft Graph is strongly encouraged.

Thomas: Regarding the deprecation of the ApplicationImpersonation RBAC role, you can use RBAC for Apps.

Hans: You can use the Delegated permissions model and associated OAuth flows when appropriate (e.g.: one-to-one, one-to-few mailbox access). One-to-many/app-only scenarios should use RBAC for Applications to scope access.

The_Exchange_Teamfollowing up on kousuke 's comment/question re. impersonation: ApplicationImpersonation is currently used to handle/prevent throttling when having a service scenario where a single service account is used to access many mailboxes. When ApplicationImpersonation now goes away, what are the recommendations to handle/prevent throttling issues in such a scenario?