Migrating Mail Server Configuration from Legacy EWS to Microsoft Graph API
- Step 1: Configure OAuth
Creating a new OAuth provider for Microsoft Graph requires registering a new application in Azure with the Mail.Send permission. Follow the steps below to configure OAuth for Microsoft Graph integration.
Configuring OAuth for Microsoft Graph API
Follow these steps to register your application in Azure and configure OAuth for Graph API integration. - App Registration
- Log in to portal.azure.com.
- Navigate to App registrations → New registration.
- Enter a name for the application.
- Select the appropriate Supported account types.
- Redirect URI: * For Client Credentials: Leave this blank. - For Auth Code / Resource Owner Credentials: Select Web and paste your application's Redirect URL.
- Click Register.

- Capture Application Credential
On the Overview page, copy the Application (client) ID.

Click on Endpoints at the top.
Copy the OAuth 2.0 authorization endpoint (v2) and OAuth 2.0 token endpoint (v2). These values will be required when configuring OAuth in Applications Manager.

- Generate Client Secret
From the left panel, navigate to Certificates & secrets → New client secret.
Provide a Description and choose the Expiry period.
Click Add.

Important: Copy the Value of the client secret immediately and store it securely. This value will be required when configuring OAuth in Applications Manager.
- Configure API Permissions
Permissions must be assigned based on the selected OAuth grant type. - Navigate to API Permissions → Add a permission → Microsoft Graph.

Assign Permissions:
- For Authorization Code / ROPC: Choose Delegated permissions and search & select Mail.Send.
- For Client Credentials: Choose Application permissions and search & select Mail.Send.

Click Add permissions.
Important: Click Grant admin consent for [Organization Name] and confirm the action. Ensure the permission status displays a green check mark.
Integration in APM
Log in to Applications Manager, click on Add OAuth Provider, and enter the following details:
Applications Manager Field | Azure Value |
Client ID | Application (client) ID (from Overview) |
Client Secret | Value (from Certificates & secrets — NOT the ID) |
Authorization URL | Paste the copied OAuth 2.0 authorization endpoint (v2) |
Token URL | Paste the copied OAuth 2.0 token endpoint (v2) |
Token Request Method | Post Request Body |
Authenticated Request Method | Basic Authentication |
Grant Type | Scope Value |
Authorization Code | Mail.Send offline_access |
ROPC | Mail.Send offline_access |
Client Credentials | .default |

Click on
Add to save the Oauth configuration.
- Step 2: Update Mail Settings
Navigate to the Mail Settings page and select the Exchange (Microsoft Graph API) option.
- Step 3: Link & Test
Select the newly created OAuth provider from the dropdown list and click Test Connection.
- Step 4: Save
Click Save once the connection test is successful.
What happens after migration?
The Legacy EWS option will be removed for this server.
New to ADSelfService Plus?
Related Articles
Mail Server Monitor - Troubleshooting
Common Mail Server Monitor Errors and Troubleshooting Guide 1. Unknown Host Error Description: This error occurs when the mail client cannot resolve the hostname of the mail server to an IP address. The issue typically arises from DNS resolution ...
Microsoft Azure VM - Enabling Diagnostics extension for Windows & Linux VMs
Diagnostic Extension is now considered a legacy approach and it is limited to some server distributions. It is recommended to switch to Azure Monitor Agent (AMA). From Applications Manager v171400, Azure monitor agent is supported. Refer here to know ...
REST API Monitor Troubleshooting Guide
Whether you're adding a new REST API monitor or troubleshooting an existing one, the following steps can help resolve common issues. Troubleshooting 4xx Error Codes (e.g., 401, 403) Check Request Configuration: Verify that the correct HTTP method ...
Steps to troubleshoot Microsoft 365 Graph API responses via debug tools
From Applications Manager version 16310 onwards, Microsoft 365 monitor will use Microsoft Graph API as the primary mode of data collection. We have migrated from PowerShell to Graph API as Microsoft 365 PowerShell commands were taking more time to ...
REST API Monitor - FAQS
1. What to do when Basic Authentication fails in REST API monitor? When Basic Authentication fails in the REST API monitor, follow the below steps to troubleshoot the error. Ensure the credentials provided in Applications Manager (Username and ...