Administration guide for existing EWS integrations

As of: September 17, 2026

Access to the existing Kyrok app at Microsoft Entra admin center → Entra ID → App registrations.
For the Graph admin consent: Global Administrator, Privileged Role Administrator, or a suitably privileged custom role. Application Administrator or Exchange Administrator alone is not sufficient for this consent.
For the Exchange configuration: an account with the required Exchange Online administration rights, usually Exchange Administrator / Organization Management.
The client ID of the Kyrok app and the addresses of the mailboxes to be made accessible.

2. Add Graph application permissions

Open the existing app, for example Kyrok EWS Integration.
Select API permissions → Add a permission → Microsoft Graph.
Select Application permissions, not Delegated permissions.
Add both permissions:

Permission	Purpose
`Mail.ReadWrite`	Read emails and attachments; manage messages and folders; create, edit, and delete drafts; prepare reply and forward drafts with attachments. In principle, this permission also allows emails to be deleted.
`Mail.Send`	Send emails and existing drafts from the authorized mailboxes. Included in preparation for the upcoming sending feature.

Select Grant admin consent for … and confirm.
Verify that both permissions show the status Granted for … and that the previous EWS permission full_access_as_app is still granted.

3. Connect to Exchange Online

Run the following commands in PowerShell. Replace the placeholders before running them.

# One time only, if the module is not yet installed:
Install-Module ExchangeOnlineManagement -Scope CurrentUser

Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName "<ADMIN_EMAIL>"

$appId = "<KYROK_CLIENT_ID>"

<KYROK_CLIENT_ID> is the Application (client) ID

4. Check the existing mailbox restriction

The application access policy from the earlier onboarding can continue to be used for the same app ID. Microsoft supports it both for EWS full_access_as_app and for Graph Mail.ReadWrite and Mail.Send.

Verify that the existing policy points to the intended mail-enabled security group and that this group contains only the desired mailboxes.