Microsoft Exchange Online: Upcoming secure-by-default changes for Exchange APIs

Starting June 2026, Microsoft will update the default user consent policy for Microsoft Graph to require admin consent for additional Exchange-related permissions. Users cannot grant consent for these unless apps are approved in the Mail client policy. Existing consents and custom policies remain unaffected. As part of the Microsoft Secure Future Initiative (SFI), and in alignment with the Secure by Default principle, we’re updating the Microsoft‑managed default user consent policy for Microsoft Graph. This change increases administrator control over third‑party application access to Exchange data and aligns default consent behavior with industry best practices for protecting email and related content. When this will happen General Availability (Worldwide): We will begin rolling out in early June 2026 and expect to complete by early July 2026. How this affects your organization Who is affected Microsoft 365 tenants using the Microsoft‑managed default user consent policy Admins managing Exchange Online and Microsoft Graph app access Organizations that allow third‑party applications to access Exchange data via delegated permissions What will happen The following Microsoft Graph delegated permissions will be added to the Microsoft recommended user consent policy: Contacts.ReadWrite Contacts.Read.Shared People.Read Tasks.ReadWrite.Shared Tasks.ReadWrite Tasks.Read.Shared Tasks.Read Contacts.ReadWrite.Shared These changes will be reflected as an update to the Microsoft‑managed default user consent policy. With this change, any organization using the Microsoft‑managed user consent policy will require admin consent for these additional permissions to access Exchange mail data. Learn more about Graph permissions. By default, admin consent will be required for third‑party apps requesting these permissions to access Exchange data. Users will no longer be able to grant consent for these permissions unless the app is included in the Mail client policy. The Mail client policy will continue to allow users to consent to approved, popular mail applications for the permissions included in the recommended user consent policy. Existing approved apps and existing user consents are not impacted and will continue to work. Tenants using custom user consent policies are not affected. No additional licensing is required. What you can do to prepare Review third‑party apps that access Exchange data using Microsoft Graph. Review permissions granted to enterprise applications […]

The post Microsoft Exchange Online: Upcoming secure-by-default changes for Exchange APIs appeared first on M365 Admin.