Context
Microsoft is deprecating certain Exchange Web Services (EWS) API permissions, including the EWS.AccessAsUser.All scope, in favor of the newer Microsoft Graph API permissions (e.g., Mail.ReadWrite, Calendars.ReadWrite). As part of their ongoing modernization efforts, some administrators may receive alerts from Microsoft regarding applications still using EWS-based permissions.
Explanation
Virto Calendar primarily integrates with Microsoft 365 through the Microsoft Graph API, which serves as the main interface for all calendar operations—such as viewing events, creating meetings, and managing user and group calendars.
The only current exception is category management for Group Calendars, where Virto Calendar temporarily relies on the Exchange Web Services (EWS) API. This fallback exists because Microsoft Graph API does not yet provide an endpoint for managing categories in group mailboxes.
Microsoft has acknowledged this limitation and confirmed that category management support for group mailboxes is on their roadmap. The Virto team maintains an active support case with Microsoft and will update the integration as soon as the new Graph endpoint becomes available.
In short:
- The
EWS.AccessAsUser.Allpermission alert from Microsoft can be safely ignored. - No action is required from customers or tenants at this stage.
- Once Microsoft extends Graph API functionality to cover this feature, Virto Calendar will fully transition away from EWS permissions.