This step keeps your current sync working when Microsoft's enforcement begins on 1 October 2026, so the migration can complete safely — including the automatic fallback to EWS if an event migration fails.

1a — Locate the existing app registration

Go to: Azure Portal > Microsoft Entra ID > App registrations.

Find the app matching the Client ID you already gave Rise Up during calendar sync setup. This is the same app — nothing new to create, and your existing secret stays valid.

1b — Add the Rise Up Client ID to the EWS allow list

Action: Run the following in Exchange Online PowerShell:

# Read the current allow list first (this is a full REPLACE, not an add)
$current = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Select-Object -ExpandProperty EwsAllowedAppIDs)

# Add the Rise Up Client ID to the existing list
$updated = @($current, "<YOUR_CLIENT_ID>")

# Write the combined list back
Set-OrganizationConfig -EwsAllowedAppIDs ($updated -join ",")

# Enable EWS
Set-OrganizationConfig -EwsEnabled $true

Replace <YOUR_CLIENT_ID> with the Client ID you originally gave Rise Up.

Result: Confirm the change took effect:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

 Verify EwsEnabled is True, not Null. Leaving EwsEnabled set to Null means Microsoft will eventually auto-disable EWS for your tenant on a rolling schedule you don't control. Explicitly setting it to True, with the allow list populated, puts you in control of the timeline.

Perform these steps in the same app registration used in Step 1a.

2a — Add the permissions

Go to: in the app registration, open API permissions in the left-hand menu.

1. Click Add a permission > Microsoft Graph > Application permissions.
2. Search for and check each permission listed below.
3. Click Add permissions.

Result: The permissions appear with status "Not granted for [Tenant]" — declared, but not yet approved.

2b — Grant admin consent

1. Click Grant admin consent for [Company Name] at the top of the API permissions list.
2. In the confirmation dialog, click Yes.

Result:  The Status column shows a green checkmark reading "Granted for [Company Name]" next to each permission.

Under EWS, impersonation already limited Rise Up to the service-account mailbox. Under Graph, Calendars.ReadWrite as an application permission defaults to every mailbox in the tenant unless scoped down.

Action: Run the following in Exchange Online PowerShell (not the portal):

Connect-ExchangeOnline
New-ApplicationAccessPolicy -AppId <ClientID> -PolicyScopeGroupId <ServiceAccountEmail> -AccessRight RestrictAccess -Description "Restrict to booking mailbox"

Replace <ClientID> and <ServiceAccountEmail> with the same values already on file with Rise Up. This ensures Rise Up can access only the dedicated service mailbox — never employee or unrelated mailboxes.

Result: Verify the policy applies:

Test-ApplicationAccessPolicy -Identity <ServiceAccountEmail> -AppId <ClientID>
Test-ApplicationAccessPolicy -Identity <SomeOtherMailbox> -AppId <ClientID>

 The first command should return Granted, the second Denied.

1. Go to: Settings > Developer > Calendar synchronisation.
2. Confirm with your Microsoft 365 administrator that Steps 1 and 2 are complete.
3. Click Verify permissions and start migration. Rise Up checks Calendars.ReadWrite, Place.Read.All, and User.Read.All in your Microsoft tenant.

Your existing Tenant ID, Client ID, secret, and service account are reused as-is — nothing to re-enter. What happens next depends on the result of the check:

Result:  A confirmation appears, together with the legacy EWS authorisations you can remove after 1 November 2026 (Section V). Your sync now runs fully on Microsoft Graph.

As soon as the migration is complete, you can remove the temporary User.Read.All permission from the app registration (API permissions > User.Read.All > Remove permission).

After 1 November 2026, the remaining EWS authorisations can be removed:

1. Remove full_access_as_app: in the app registration, open API permissions, locate full_access_as_app (Office 365 Exchange Online), and select Remove permission.
2. Remove the Rise Up entry from the EWS allow list in Exchange Online PowerShell:

# Read the current allow list
$current = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Select-Object -ExpandProperty EwsAllowedAppIDs)

# Keep everything except the Rise Up Client ID
$updated = $current | Where-Object { $_ -ne "<YOUR_CLIENT_ID>" }

# Write the list back (full REPLACE — other allow-listed apps are preserved by $updated)
Set-OrganizationConfig -EwsAllowedAppIDs ($updated -join ",")