ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord
MC718754 Plan for changeMajor changeUser impactAdmin impactRetirement

Retirement of RBAC Application Impersonation in Exchange Online

From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Exchange Online
Message Center archive Open in your tenant

Action date

31 Jan 2025 653d ago Act by , as Microsoft's metadata states

Schedule dates changed in the text

Date phrases in schedule sentences differ between the versions we saw
  • Seen 27 Sep 2024 May 2024 → September 2024

Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.

What the notice says

Microsoft’s text, safely structured

Updated November 8, 2024: We are following up on our previous announcement regarding the retirement of the ApplicationImpersonation Role Based Access Control (RBAC) role in Exchange Online. As the February 2025 deprecation date is approaching, it is important to follow the guidance in this Message Center post and take action now to ensure applications in your tenant are not using this feature. After this date, applications using this feature that are not updated will no longer work. For additional information, please go to: https://aka.ms/applicationimpersonationdeprecation

We are announcing the retirement of the ApplicationImpersonation Role Based Access Control (RBAC) role in Exchange Online.

When this will happen

We will begin the retirement in September 2024 (previously May) and in February 2025 will remove this role and its feature set from Exchange Online.

How this will affect your organization

You are receiving this message because this RBAC role is commonly used with Exchange Web Services (EWS) to enable one-to-many mailbox access. We are removing this feature and will begin blocking the assignment of the ApplicationImpersonation (RBAC) role to accounts.

This will require all apps to have an App Registration, use Application permissions (not Delegated), and use a secure credential for access. Despite this change, if your app is granted the full_access_as_app Application permission, it will provide the same level of mailbox access as the ApplicationImpersonation RBAC role.

What you need to do to prepare

Review your current configuration and make changes as appropriate to minimize disruption to your service.

For more information, please see:

What changed

Between archive captures, newest first

  1. Updated September 27,November 8, 2024: We have updatedare following up on our previous announcement regarding the retirement of the ApplicationImpersonation Role Based Access Control (RBAC) role in Exchange Online. As the February 2025 deprecation date is approaching, it is important to follow the rollout timeline below. Thank you forguidance in this Message Center post and take action now to ensure applications in your patience. tenant are not using this feature. After this date, applications using this feature that are not updated will no longer work. For additional information, please go to: https://aka.ms/applicationimpersonationdeprecation  We are announcing the retirement of the ApplicationImpersonation Role Based Access Control …

  2. Updated September 27, 2024: We have updated the rollout timeline below. Thank you for your patience. We are announcing the retirement of the ApplicationImpersonation Role Based Access Control (RBAC) role in Exchange Online.  [WhenWhen this will happen:]happen: We will begin the retirement in MaySeptember 2024 (previously May) and in February 2025 will remove this role and its feature set from Exchange Online. [HowHow this will affect your organization:]organization: You are receiving this message because this RBAC role is commonly used … provide the same level of mailbox access as the ApplicationImpersonation RBAC role. [WhatWhat you need to do to prepare:]prepare: Review your current configuration and make changes as appropriate to minimize disruption …

  3. … of the ApplicationImpersonation Role Based Access Control (RBAC) role in Exchange Online.  When[When this will happen:happen:] We will begin the retirement in May 2024 and in February 2025 will remove this role and its feature set from Exchange Online. How[How this will affect your organization:organization:] You are receiving this message because this RBAC role is commonly used … provide the same level of mailbox access as the ApplicationImpersonation RBAC role. What[What you need to do to prepare:prepare:] Review your current configuration and make changes as appropriate to minimize disruption …

  4. · first version seen

Learn more

Links from the notice and their documentation checks

No related announcements were found in the saved public history. Check the source for newer announcements.

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
  • 2 linked pages have not been read yet.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 19:06 UTC · 254 of 275 readable · 250 fully read · documentation 468/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners.