Fix Guides

Einstein Activity Capture, Inbox and Lightning Sync: EWS Retirement and the Microsoft Graph Upgrade

Updated 2026-11-10

Symptoms

These are what admins report when a connection is still on EWS or a user has not reconnected.

1. 1. Emails, events or contacts stop appearing on Salesforce records. Salesforce's help says that when an admin upgrades a user-level connection, each user must reconnect their account or their email, event and contact data stops syncing. Until the user reconnects, that account keeps using EWS, which Microsoft is retiring, so a user who ignored the banner is the first suspect.
2. 2. Lightning Sync stopped syncing. Per Salesforce's help, Lightning Sync configurations that use Microsoft Office 365 with EWS won't capture or sync data after EWS retires. If Lightning Sync is still on EWS, the retirement is the likely cause.
3. 3. Users see a banner or notification asking them to reconnect. Salesforce says a notification in the notification tray and a banner alert users when the admin changes the Microsoft connection method. That is the intended reconnect prompt, not an error.
4. 4. Lead Nurturing Agent email stops. Salesforce treats a Lead Nurturing Agent like a user with user-level authentication, and shows Lead Nurturing Agent Managers a banner asking them to reconnect the agent's email account.

What to Check

1. 1. Find out when each product was set up. Per Salesforce's help, Einstein Activity Capture and Salesforce Inbox configured for Microsoft Office 365 from Spring '26 are authenticated with Microsoft Graph automatically. Anything configured for Microsoft Office 365 before Spring '26 needs the manual upgrade. Ask who set each product up and when.
2. 2. Open the three settings pages in Setup. Salesforce's notice says to follow the banners shown at login or open the Salesforce Inbox, Lightning Sync and Einstein Activity Capture settings pages in Setup. For Einstein Activity Capture, the documented path is Setup, Quick Find “Einstein Activity Capture”, Settings, Summary tab, where the Upgrade to Microsoft Graph button starts the upgrade. We did not find a documented report that lists every EWS connection, so treat the presence of that button as the documented entry point, not as proof of a specific connection state.
3. 3. Work out whether the connections are org-level or user-level. Salesforce documents two procedures. Org-level connections upgrade for the whole org with no action from users. User-level connections need every user to reconnect. Which one you have decides how many people must act.
4. 4. Check Inbox and Lightning Sync separately. Per Salesforce's help, if Inbox and Einstein Activity Capture are both set up with EWS, upgrading either one upgrades the other. Lightning Sync is a separate upgrade in its own setup page.
5. 5. Ask your Microsoft 365 admin about their EWS settings. Microsoft's post says that if a tenant has EWSEnabled set to True, EWS will require an allowed app ID list. Salesforce's notice says tenants can use this to control their shutdown date, with a possible extension until April 1, 2027. Find out whether your tenant has done this, because it changes how urgent the work is.

How to Fix It

1. 1. Get the Microsoft side ready first. Per Salesforce's help, confirm that your Azure admin has granted org-wide Microsoft Graph API access and permissions. The admin who sets up the connection needs the Global Admin, Cloud Application Admin or Application Admin directory role. The Salesforce admin needs Customize Application or Modify All Data.
2. 2. Org-level Einstein Activity Capture. From Setup, search Einstein Activity Capture, open Settings, and on the Summary tab click Upgrade to Microsoft Graph. View the authentication mapping, click Log In with a global administrator account using the tenant ID from your original org-level setup, optionally click Test, then click Finish. Per Salesforce, the upgrade applies to the whole org and cannot be rolled back to EWS.
3. 3. User-level Einstein Activity Capture. Use the same Upgrade to Microsoft Graph button, then consent to the statement that every user must reconnect. After you click Finish, users are notified and each account keeps using EWS until that user reconnects. Chase the users who have not reconnected, because their data stops syncing otherwise.
4. 4. Salesforce Inbox. From Setup, search Inbox, open Setup Assistant, and in the Upgrade to Microsoft Graph section click Upgrade to Microsoft Graph. Users must reconnect their Microsoft accounts to finish. Salesforce documents that this also upgrades Einstein Activity Capture if that is still on EWS.
5. 5. Lightning Sync. From Setup, search Sync and open Outlook Integration and Sync. In the Lightning Sync section click Upgrade to Microsoft Graph, click Next in the Authentication Mapping window, log in to Microsoft, optionally test, then Finish. Salesforce notes you cannot migrate Lightning Sync to Einstein Activity Capture while it is on EWS, and that Lightning Sync is scheduled to retire in 2027.

Run the free health check on your org: the free health check is a short questionnaire that gives a peer-benchmarked score, with no account and no org connection.

If the Upgrade Button Is Missing

Salesforce's documentation does not cover this case directly. These are the documented options that are closest, and one suggestion of ours, labelled as such.

1. 1. Check your permissions. Salesforce lists the permissions needed to see the Einstein Activity Capture setup pages as View Setup and Configurations plus Customize Application or Modify All Data. Rule this out before anything else.
2. 2. Try the other product's entry point. Salesforce documents that upgrading Inbox also upgrades an Einstein Activity Capture connection that is still on EWS, and the reverse. If the button is missing in one place and Inbox is configured, check the other. This only applies when both products are set up.
3. 3. Use the Microsoft extension while you resolve it. Salesforce's notice says that if you hit issues migrating, you can use Microsoft's resources to extend the enforcement date for your tenant. Microsoft's post describes the EWSAllowedAppIDs allow list, and says a list you configure yourself stays authoritative. This buys time. It does not fix the connection.
4. 4. Open a Salesforce Support case. Salesforce's pages we reviewed do not describe a missing Upgrade to Microsoft Graph button or say why it might be hidden, and they do not document a workaround for it. Our suggestion, not a Salesforce instruction: contact Salesforce Support with your org ID and the Setup page where the button should be.

Sources: Salesforce Help 002630842, Microsoft Graph Authentication in Einstein Activity Capture, org-level upgrade, user-level upgrade, Inbox upgrade and Lightning Sync upgrade; Microsoft Tech Community Retirement of Exchange Web Services in Exchange Online and Take Control of Your ewsallowedappids List. Reviewed 2026-11-10. Dates and menu names can change, so confirm them in the live articles.

FAQ

Wrenk runs this kind of audit and the fixes that follow across every connected org as part of managed Salesforce operations.