Sync & Recover - Migrating Connectors

This article explains how to migrate your Sync & Recover connector from Microsoft Exchange Web Services (EWS) to Microsoft Graph ahead of Microsoft's retirement of EWS.

Migration is a phased process managed jointly by you and Mimecast. This article covers what changes at each phase, what action is required from you, and what to expect in between.

Key dates:

• Phase 1 Migrate is available in the Mimecast Administration Console until March 31st, 2027.
• Microsoft begins disabling EWS on tenants from October 2026 (default). Tenants that have opted to keep EWS enabled retain it until Microsoft's hard shutdown in April 2027.
• Run Phase 1 before EWS is disabled on your tenant. If EWS is already disabled. Sync & Recover cannot fetch data and jobs will fail.

If you see a dialog in the Mimecast Administration Console prompting you to migrate one or more connectors, follow the steps in Phase 1 below.

How the migration works

Migration happens in three phases. Only Phase 1 and Phase 3 require action from you in the Administration Console. Phase 2 is handled automatically by Mimecast.

Phase 1: Add Graph permissions (available now)

When you run Migrate, Mimecast adds Microsoft Graph API permissions to the Azure app used by your Sync & Recover connector. Your existing EWS permissions remain in place.

This is deliberate. EWS continues to fetch data from your Microsoft 365 tenant while Mimecast converts your existing synced data into a Graph-readable format in the background. Your Sync & Recover service is uninterrupted throughout Phase 1.

Action required: Run the Migrate workflow (steps below) for each connector shown in the migration dialog.

Phase 2: Switchover to Graph (handled by Mimecast)

Once background data conversion completes for your tenant, Mimecast switches your connector over to use Graph for data fetching. EWS permissions remain on the Azure app but are not actively used any longer.

Action required: None. This happens in the background on Mimecast's side and can take several days to several weeks to complete per tenant.

Phase 3: Remove EWS permissions (from April 1st, 2027)

From April 1st, 2027, Mimecast will roll out a second migration workflow to remove the now-stale EWS permissions from your Azure app. You will be prompted in the Administration Console when this is required, similar to the Phase 1 dialog.

Action required: Run the Phase 3 workflow when prompted. Full instructions will be added to this article closer to the date.

Timeline

When	What happens	Who acts
Now - March 31st, 2027	Phase 1 Migrate available in the Administration Console. Run it as early as possible.	Customer
Ongoing after Phase 1	Background data conversion. Takes days to weeks per tenant. EWS continues to fetch.	Mimecast
Post-conversion, per tenant	Phase 2 switchover to Graph.	Mimecast
October 1st, 2026	Microsoft begins default EWS shutdown. Tenants that have not opted to keep EWS on will lose EWS from this point.	__
April 1st, 2027	Microsoft EWS hard shutdown. All tenants lose EWS regardless of opt-in status.	__
	Phase 3 workflow available to remove stale EWS permissions.	Customer

Before you start

To complete Phase 1, you will need:

1. A Mimecast administrator account with edit permissions for Integrations | Connectors.
2. A Microsoft Azure administrator account with permission to grant consent to applications on your tenant.

The Graph permissions requested during Phase 1 are: full_access_as_app, MailboxFolder.Read.All, MailboxItem.Read.All, Calendars.Read, User.Read.All, Tasks.Read.All, Mail.Read, Contacts.Read.

These are added alongside, not in place of, the EWS permissions already granted to the Sync & Recover Azure app.

Phase 1: Running the Migrate workflow

1. Log in to the Mimecast Administration Console.
2. Navigate to Integrations | Connectors and select the Migrate tab.
3. Locate your existing Sync & Recover connector and click Migrate.

4. Click Log In and authenticate with your Azure administrator account.
5. Review the requested Graph permissions and grant consent.

6. Review the Name and Description for the connector.
7. Click Next.
8. Review the summary and click Migrate.
9. On successful completion, you will be redirected to the Cloud Connectors tab with a 'Connector Updated' success toast message.
10. Repeat for each connector listed on the Migrate tab. Once all connectors are migrated, no more Sync & Recover connectors should be visible under the Migrate tab.

Verifying Phase 1 completed successfully

After running Migrate, confirm the following:

• The migrated connector no longer appears under the Migrate tab. This is the definitive indicator that Phase 1 has completed for that connector.
• The connector appears in the Connectors tab with status as Configured/Connected.
• In your Azure portal, the Sync & Recover Enterprise Application shows both the original EWS permissions and the newly granted Graph permissions.
• Your existing Sync & Recover jobs continue to run on their normal schedule.

Note that the dates shown on the connector do not change as a result of Phase 1. These fields reflect the connector's operational lifecycle, not the migration event.

Frequently Asked Questions

Will Phase 1 migration disrupt my existing Sync & Recover service?

No. Phase 1 is purely additive, Graph permissions are added to your Azure app alongside your existing EWS permissions. EWS continues to fetch data throughout Phase 1 and into the background conversion period.

Why are my EWS permissions still on the Azure app after I've migrated?

They are retained deliberately. During Phase 1 and the background data conversion, EWS continues to fetch data while Mimecast prepares your synced data for Graph. EWS permissions are removed in Phase 3 from April 1st, 2027.

When does my connector actually start using Graph instead of EWS?

At Phase 2, once background data conversion has completed for your tenant. This is handled by Mimecast and can take several days to several weeks depending on the volume of synced data. No action is required from you, and no notification is sent when it completes. Your Sync & Recover service continues to operate normally throughout.

Do I need to run a separate Graph connector in parallel with my EWS connector to validate the migration?

No. Because Phase 1 is additive rather than replacive, there is no cutover event to validate against. Your existing connector simply gains Graph capability. Running a second connector in parallel provides no risk mitigation and is not recommended.

Is there any difference between running Migrate and manually creating a new Graph connector?

The Graph permissions granted are the same in both cases. However, Migrate preserves your existing connector's configuration and enrolls it in the background data conversion (Phase 2). Manually creating a new connector does neither, so you would lose configuration continuity and would not benefit from automatic data conversion. Migrate is the supported and recommended path.

After migrating, I still see the Enterprise Application in Azure making EWS calls for Sync & Recover. Is it safe to delete?

No. Do not delete the Sync & Recover Enterprise Application from Azure at any phase. There is a single Azure app for Sync & Recover, and it will continue to make EWS calls after Phase 1 until background data conversion completes and Phase 2 switchover to Graph occurs, which can take several days to several weeks per tenant. EWS permissions are removed in Phase 3, starting April 1st, 2027 via a Mimecast-provided workflow, not by deleting the Azure app.

After migrating, the dates shown on my connector did not update to the migration date. is this expected?

Yes. Migrate preserves your existing connector's configuration and history, including its creation date and last-sync date. These dates reflect the connector's operational lifecycle, not the Phase 1 migration event. To confirm a connector has been migrated, check that it no longer appears under the Migrate tab in Integrations | Connectors.

What Azure permissions are being granted in Phase 1?

full_access_as_app, MailboxFolder.Read.All, MailboxItem.Read.All, Calendars.Read, User.Read.All, Tasks.Read.All, Mail.Read, Contacts.Read.

What happens if my tenant's EWS is disabled before I've run Phase 1 Migrate?

Sync & Recover will lose the ability to fetch data from your Microsoft 365 tenant and jobs will fail. Microsoft begins disabling EWS from October 2026, though tenants that have opted to keep EWS enabled retain it until April 2027. Run Phase 1 as early as possible to avoid a service gap.

My tenant has opted to keep EWS enabled until April 2027, Do I still need to run Phase 1?

Yes. Phase 1 Migrate is available until March 31st, 2027, and you must run it before Microsoft's hard shutdown in April 2027. Keeping EWS enabled buys time, but it does not remove the need to migrate.

What do I need to do on April 1st, 2027?

Mimecast will prompt you in the Administration Console to run the Phase 3 workflow, which removes the stale EWS permissions from your Azure app. Detailed instructions will be added to this article closer to the date.

Is rollback to EWS supported after I've run Migrate?

Rollback is not needed. Phase 1 does not remove EWS permissions or change how EWS is used. Your existing EWS-based operations continue exactly as before.

After migrating, I see multiple Enterprise Applications for Sync & Recover in Entra. Which one is being used, and can I delete the others?

Seeing multiple applications is expected. Mimecast maintains a pool of Sync & Recover Azure applications, and each consent attempt may direct you to a different one. Retries and multiple connector creations can also result in additional applications appearing.

Only one application is actively used per tenant at any time, the most recent successful consent wins, and it does not change unless you create a new connector or re-trigger consent.

To identify the active application, wait a few days after migration, then use Microsoft Entra sign-in logs or Access Reviews to check which application has recent service principal sign-in activity. Once verified, you may delete the inactive applications. Do not delete any application before verifying, as deleting the active one will cause authentication failures.

If you're unable to run this verification, contact Mimecast Support with your account code and connector name.

I clicked Migrate but the workflow appeared to fail, and now I'm being prompted to migrate again. What should I do?

Check the Migrate tab in Integrations | Connectors. If your connector no longer appears there, migration has completed successfully and the earlier prompt can be safely ignored. If the connector still appears despite a prior attempt, retry the Migrate workflow. If the issue persists, contact Mimecast Support with your account code and connector name.

I have multiple Sync & Recover connectors configured (for example, one per group). Do I need to run Migrate for each?

Yes. The Migrate tab lists every connector eligible for migration, and each must be migrated individually. Once all are migrated, the Migrate tab will no longer list any Sync & Recover connectors.

See Also...

• Microsoft Exchange Web Services (EWS) Retirement - Frequently Asked Questions