Salesforce EWS retirement: move Einstein Activity Capture and Lightning Sync to Microsoft Graph

If Outlook emails and meetings stopped appearing on Salesforce records sometime after 1 October 2026, the most likely cause is not Salesforce at all. Microsoft has started switching off Exchange Web Services (EWS) in Exchange Online, and any Salesforce email or calendar connection still using EWS loses access when its tenant is switched off.

The fix is to move the connection to Microsoft Graph. Salesforce has had an upgrade button in Setup for months. This guide covers how to tell whether you are affected, the exact steps for Einstein Activity Capture, Salesforce Inbox and Lightning Sync, and the traps that catch people part-way through.

The dates

Two scope notes. This affects Exchange Online (Microsoft 365) only; on-premises Exchange Server is not part of the retirement. And Google Workspace connections are unaffected.

Between now and April 2027, Microsoft 365 admins can keep specific apps on EWS with a tenant allow list (EWSAllowedAppIDs). Treat that as a way to buy time, not a plan: Microsoft advises against counting on any EWS access after 1 April 2027.

Which Salesforce features are affected

• Einstein Activity Capture (EAC) connections to Microsoft 365 created before Spring '26. From Spring '26 onwards, new EAC connections to Office 365 authenticate with Microsoft Graph automatically.
• Salesforce Inbox, which shares the Microsoft connection. Salesforce says the EAC upgrade also upgrades Inbox if Inbox has not been upgraded yet.
• Lightning Sync configurations that use EWS. Salesforce says these "won't sync data" after the retirement.

How to check whether you are still on EWS

1. Einstein Activity Capture: in Setup, search for Einstein Activity Capture and open Settings. If the Summary tab offers Upgrade to Microsoft Graph, the org-level connection has not been upgraded.
2. Lightning Sync: in Setup, search for Sync and open Outlook Integration and Sync. An Upgrade to Microsoft Graph button in the Lightning Sync section means you are still on EWS.
3. Ask your Microsoft 365 admin whether your tenant is already in Microsoft's blocking wave, and whether Salesforce's app is on the EWS allow list. That tells you whether sync has stopped yet or is about to.

Before you start: get the Microsoft side ready

This is the step that takes the longest in most organisations, so start it first.

• Your Azure (Entra ID) admin must grant org-wide Microsoft Graph API access to Salesforce's app. Salesforce Help links to the app IDs under App ID for Microsoft Graph Authentication. EAC and Lightning Sync use the same app IDs.
• The person who logs in to Microsoft during the upgrade needs one of these Entra directory roles: Global Administrator, Cloud Application Administrator or Application Administrator.
• On the Salesforce side you need Customize Application or Modify All Data (plus View Setup and Configuration) for EAC, or Manage Users and Manage Lightning Sync for Lightning Sync.

If your Salesforce admin and Microsoft admin are different people, book thirty minutes together. The upgrade is a short wizard, but it stops at the Microsoft login.

Upgrade Einstein Activity Capture to Microsoft Graph

The upgrade is one-way. Salesforce states that once it is complete you cannot roll back to EWS.

What happens next depends on whether your EAC connection is org-level (one service connection for everyone) or user-level (each user connected their own mailbox).

Org-level connections

1. In Setup, search for Einstein Activity Capture and select Settings.
2. On the Summary tab, click Upgrade to Microsoft Graph.
3. Review the authentication mapping.
4. Click Log In and sign in to Microsoft 365 as an administrator. Use the same tenant ID you used when you first set up org-level access. Using a different tenant means resetting EAC.
5. Optionally click Test, then Finish.

The whole org moves to Graph. Users do not need to do anything.

User-level connections

Steps 1 to 3 are the same. Instead of a Microsoft login, you consent to the fact that every user must reconnect their own account, then click Finish.

Users get a notification and a banner. Until each person reconnects, their account keeps using EWS, which means their email, event and contact sync stops once their tenant's EWS access is blocked. This is the most common reason sync "works for some people but not others" after an upgrade.

Plan for it:

• Tell users before you click Finish, with a screenshot of the banner and a one-line instruction.
• After a few days, chase the stragglers. The people who never reconnect tend to be the ones who rarely log in to Salesforce, which is exactly why their activity was being captured automatically.

Upgrade Lightning Sync, then move off it

Lightning Sync is being retired in 2027, so the goal is to get to Einstein Activity Capture. But order matters: you cannot migrate Lightning Sync to EAC while it still uses EWS.

1. In Setup, search for Sync and open Outlook Integration and Sync.
2. In the Lightning Sync section, click Upgrade to Microsoft Graph.
3. In Authentication Mapping, click Next.
4. In Connect Salesforce to Microsoft Office 365, click Log In and sign in. Your tenant ID fills in automatically.
5. Optionally test the connection, then click Finish.

The whole org is upgraded; users do nothing. Lightning Sync keeps working, and you can now use Salesforce's migration tool (Move from Lightning Sync to Einstein Activity Capture) when you are ready.

Before migrating, read Salesforce's Compare Einstein Activity Capture and Lightning Sync page. The two store activities differently, and that difference matters for reporting.

If sync already stopped

• Do the upgrade now. Once the Graph connection is in place (and, for user-level connections, once users reconnect), capture resumes going forward.
• Do not promise a backfill. Emails and events that were not captured while EWS was blocked may not appear retroactively. Set that expectation with sales leadership early.
• Ask for a temporary allow-list entry if the upgrade is blocked on Microsoft consent. Your Microsoft 365 admin can allow specific apps to keep using EWS until April 2027.
• Check reports and dashboards that count activities. A sudden drop in logged emails from 1 October is the same problem, not a change in rep behaviour.

Where orgadmin.ai helps

orgadmin.ai does not manage your Microsoft connection; that stays in Salesforce Setup. It helps with the work around it:

• Find the users who need chasing. User Management lists every user with last login and filters for people who are idle 30 or 90 days. Those are the users least likely to see the reconnect banner.
• Confirm who changed what. The Security Review covers integrations and connected apps, and checks who holds Modify All Data, which is one of the permissions this upgrade requires.
• Check what the upgrade will touch. AI Org Chat can run a live SOQL query against PermissionSet to list which profiles and permission sets grant Customize Application or Modify All Data, so you know who can start the EAC upgrade.

Checklist

• Confirm with your Microsoft 365 admin whether your tenant is already blocking EWS
• Azure/Entra admin grants org-wide Microsoft Graph access to Salesforce's app IDs
• Upgrade Einstein Activity Capture (org-level or user-level) to Microsoft Graph
• For user-level connections: tell users, then chase everyone who has not reconnected
• Upgrade Lightning Sync to Microsoft Graph, then plan the move to EAC before its 2027 retirement
• Check activity reports for a gap starting 1 October 2026 and tell stakeholders
• Ask Microsoft 365 for a tenant-wide report of other apps still using EWS

Last checked 14 October 2026 against Salesforce Help and Microsoft's published dates. Microsoft's rollout is tenant by tenant, so your org's actual cut-off may differ from the headline date.