How do I migrate my add-in to use the Graph-based getCallbackTokenAsync to bypass these legacy EWS blocks while maintaining shared mailbox support?

Djeumala Leutner 40 Reputation points
2026-04-13T02:02:43.73+00:00

"403 Forbidden" when my add-in attempts to call makeEwsRequestAsync on mailboxes tagged with the new 2026 "Restricted Access" policy. Even though the add-in manifest has ReadWriteMailbox permissions, the backend is rejecting the SOAP request because the app-only token is being superseded by the user’s conditional access policy, which now specifically blocks legacy EWS calls in favor of Graph-only traffic.

Microsoft 365 and Office | Development | Office JavaScript API
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Steven-N 25,315 Reputation points Microsoft External Staff Moderator
    2026-04-13T03:24:29.4766667+00:00

    Hi Djeumala Leutner

    Thank you for reaching out to Microsoft Q&A forum

    Based on your requirement, I have conducted some research and found the best approach in this situation is using nested app authentication method, it allows your client-side JavaScript to leverage the authentication session of the native Outlook host to securely and silently request Microsoft Graph tokens directly. Because it uses modern OAuth 2.0 bound to the user's active Office session, it inherently satisfies Conditional Access policies (including Continuous Access Evaluation) that legacy EWS tokens fail against.

    1. Configure Entra ID (Azure AD): Update your existing App Registration by adding a Single-page application (SPA) platform. Set the redirect URI to brk-multihub://<your-add-in-domain>
    2. Grant Graph Permissions: Request the necessary Microsoft Graph API permissions in the Entra ID portal and grant admin consent.
    3. Install MSAL: Add the @azure/msal-browser package to your frontend project.
    4. Initialize the Nestable Client: In your add-in's initialization logic, initialize MSAL using the createNestablePublicClientApplication method rather than a standard client.
    5. Acquire Graph Tokens Client-Side: Use MSAL's acquireTokenSilent (with a fallback to acquireTokenPopup for MFA/consent prompts) to request a token scoped to Microsoft Graph. This natively satisfies Conditional Access through the Outlook host.
    6. Replace EWS with REST: Remove all instances of makeEwsRequestAsync and SOAP envelopes. Use the access token you just acquired to make standard REST calls (or use the @microsoft/microsoft-graph-client SDK) to the applicable endpoints.

     Hope my answer will help you

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.