This guide is for administrators who already have a Microsoft Entra (Azure AD) app registration and a working Rise Up calendar sync running over Exchange Web Services (EWS). Nothing new needs to be created — you are migrating that same app registration to Microsoft Graph.
Before you start, you need:
- A Microsoft Entra ID account holding the Global Administrator or Privileged Role Administrator role. A regular user or a lesser admin role (e.g. Helpdesk Administrator) will not see the consent button.
- Access to Exchange Online PowerShell.
- The Client ID of the app registration you originally gave Rise Up during calendar sync setup (visible in your Rise Up calendar synchronisation settings).
Setting up for the first time? If you have nothing configured on the Azure side yet, this article is not for you — follow "Outlook Integration: Setup & Room Management" instead, which configures Microsoft Graph directly from scratch.
Microsoft is retiring Exchange Web Services (EWS) for Exchange Online. If your Rise Up calendar sync currently runs over EWS, it must be migrated to Microsoft Graph using the same app registration, Tenant ID, Client ID, client secret, and service-account mailbox you already gave Rise Up.
| Date | What happens |
|---|---|
| 1 October 2026 | EWS enforcement begins — EWS access is blocked by default unless your tenant has explicitly allow-listed the application. |
| 1 April 2027 | EWS is fully removed. No allow-list or workaround will keep an EWS integration running. |
One-way transition: once migrated to Graph, you do not switch back to EWS.
- App registration: the same Microsoft Entra app you already gave Rise Up — reused for Graph, never recreated.
- EWS allow list: a tenant-level setting that keeps a specific app authorised to use EWS after enforcement begins.
- Graph application permissions: Calendars.ReadWrite, Place.Read.All, and User.Read.All, added and consented on the app registration.
- Admin consent: the approval step, performable only by a Global Administrator or Privileged Role Administrator, that activates the declared Graph permissions.
- Application Access Policy: an Exchange Online PowerShell policy that restricts the Graph app permission to the Rise Up service-account mailbox only.
- Event ID translation: the process the Rise Up Care team runs to let events created under EWS continue to be updated and cancelled under Graph.
I — Part A: Keep EWS alive until you migrate
Complete this section only if you will not finish the Graph migration before 1 October 2026. If you are migrating to Graph now, skip directly to Section II.
Locate the existing app registration
Go to: Azure Portal > Microsoft Entra ID > App registrations.
Find the app matching the Client ID you already gave Rise Up during calendar sync setup. This is the same app — nothing new to create, and your existing secret stays valid.
Add the Rise Up app to the EWS allow list
Action: Run the following in Exchange Online PowerShell:
# Read the current allow list first (this is a full REPLACE, not an add)
$current = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Select-Object -ExpandProperty EwsAllowedAppIDs)
# Add the Rise Up Client ID to the existing list
$updated = @($current, "<YOUR_CLIENT_ID>")
# Write the combined list back
Set-OrganizationConfig -EwsAllowedAppIDs ($updated -join ",")
# Enable EWS
Set-OrganizationConfig -EwsEnabled $trueReplace <YOUR_CLIENT_ID> with the Client ID you originally gave Rise Up.
$current first, as shown above, does this for you.
Result: Confirm the change took effect:
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDsVerify EwsEnabled is True, not Null
Leaving EwsEnabled set to Null means Microsoft will eventually auto-disable EWS for your tenant on a rolling schedule you don't control. Explicitly setting it to True, with the allow list populated, puts you in control of the timeline.
II — Part B: Migrate to Microsoft Graph
Perform these steps in the same app registration used in Section I.
Add the Microsoft Graph permissions
Go to: Azure Portal > Microsoft Entra ID > App registrations > open the app matching the Client ID on file with Rise Up > API permissions.
- Click Add a permission > Microsoft Graph > Application permissions.
- Search for and check each permission listed below.
- Click Add permissions.
| Permission | Why it is needed |
|---|---|
| Calendars.ReadWrite | Create, update, read, and cancel calendar events. |
| Place.Read.All | Room-list lookups (only if you use the room management feature). |
| User.Read.All | Event ID translation during migration — temporary. |
User.Read.All — temporary: only needed for event ID translation during migration. It can be removed once configuration is complete and Graph mode is fully available.
Result: The permissions appear with status "Not granted for [Tenant]" — declared, but not yet approved.
Grant admin consent
- Click Grant admin consent for [Company Name] at the top of the API permissions list.
- In the confirmation dialog, click Yes.
Result: The Status column shows a green checkmark reading "Granted for [Company Name]" next to each permission.
full_access_as_app permission is an Exchange Online EWS permission. It does not grant any Microsoft Graph permission and must not be used for Graph access — EWS and Graph are separate authorization boundaries. Leave it in place for as long as your sync still runs over EWS.
Restrict the app to the correct mailbox
Under EWS, impersonation already limited Rise Up to the service-account mailbox. Under Graph, Calendars.ReadWrite as an application permission defaults to every mailbox in the tenant unless scoped down.
Action: Run the following in Exchange Online PowerShell (not the portal):
Connect-ExchangeOnline
New-ApplicationAccessPolicy -AppId <ClientID> -PolicyScopeGroupId <ServiceAccountEmail> -AccessRight RestrictAccess -Description "Restrict to booking mailbox"
Replace <ClientID> and <ServiceAccountEmail> with the same values already on file with Rise Up. This ensures Rise Up can access only the dedicated service mailbox — never employee or unrelated mailboxes.
Result: Verify the policy applies:
Test-ApplicationAccessPolicy -Identity <ServiceAccountEmail> -AppId <ClientID>
Test-ApplicationAccessPolicy -Identity <SomeOtherMailbox> -AppId <ClientID>The first command should return Granted, the second Denied.
III — Part C: Switch over in Rise Up
- Choose Graph mode: in the Rise Up Microsoft Office calendar sync settings, select Graph as your connection mode. Your existing Tenant ID, Client ID, secret, and service account stay the same.
- Test session creation: create a real training session and confirm it syncs to Outlook under the new Graph configuration.
- Validate the result: check that the session appears correctly in Outlook.
- Contact the Care team: if the test works, reach out via Zendesk to request migration of your existing (EWS-created) calendar events to Graph.
- Migration completed by the team: once requested, Rise Up runs the event ID translation for your account, after which you are fully switched to Graph.
Result: Calendar sync runs entirely over Microsoft Graph, including events originally created under EWS.
User.Read.All permission can be removed from the app registration.
FAQ & Troubleshooting
-
Issue: The "Grant admin consent" button is missing or greyed out.
Solution: The signed-in account is not a Global Administrator or Privileged Role Administrator. Sign in with an account holding one of these roles, or ask your tenant's Global Administrator to complete the consent step.
Issue: A newly created or updated room list does not appear in calendar sync.
Solution: This is expected — Microsoft Graph can take up to 48 hours to propagate room-list changes. Wait, then check again.
Issue: Test-ApplicationAccessPolicy returns Granted for a mailbox other than the service account.
Solution: The Application Access Policy was not created, or was scoped to the wrong group or mailbox. Re-run New-ApplicationAccessPolicy with the correct AppId and PolicyScopeGroupId, then re-test.
Issue: Other EWS applications stopped working after updating the allow list.
Solution: Set-OrganizationConfig -EwsAllowedAppIDs replaces the entire list rather than appending to it. Re-run the command including all previously allow-listed app IDs alongside the Rise Up Client ID.
-
Do I need a new app registration, secret, or service account?
— No. You migrate the same app registration you already use — your existing Tenant ID, Client ID, client secret, and service-account mailbox all stay the same.
What happens to calendar events created before the migration?
— Events created over EWS keep working, but they carry EWS event IDs. After you validate Graph mode and contact the Care team via Zendesk, Rise Up runs an event ID translation so those existing events can continue to be updated and cancelled under Graph.
Can I switch back to EWS afterwards?
— No. The migration is a one-way transition.
What happens if I do nothing?
— From 1 October 2026, Microsoft blocks EWS by default unless your tenant has allow-listed the application. From 1 April 2027, EWS is fully removed and your calendar sync will stop working. The allow-list is a bridge, not a solution — plan the Graph migration before then.
Who can perform the consent steps?
— Only a Global Administrator or Privileged Role Administrator in your Microsoft Entra ID. Lesser admin roles will not see the "Grant admin consent" button.
When can I remove the User.Read.All permission?
— Once the configuration is complete and Graph mode is fully available. It is only needed for the event ID translation during migration.
Is there any downtime during the migration?
— Switching the connection mode to Graph takes effect immediately, and your existing Tenant ID, Client ID, secret, and service account keep working. If you have questions about the timing for your account, mention them in your Zendesk request. -
Contact Support
Outlook Integration: Setup & Room Management
Managing Room Lists for Calendar Sync
Understanding Application Access Policies in Exchange Online