Why is Quest adding more permissions to the Mailbox Migration application?
Microsoft announced the deprecation of EWS for October 2026, and we are currently working on transitioning all EWS operations to Graph. The recently added permissions are needed to keep access to mailboxes via Graph.
What permission will be added?
The following permissions will be added:
Additional permission for Quest On Demand - Migration - Mailbox Migration - Minimal
| Permission name | Type | Description |
| Calendars.Read | Application | Read calendars |
| Domain.Read.All | Application | Read domains |
| Mail.Read | Application | Read mail in all mailboxes |
| MailboxFolder.Read.All | Application | Read all the users' mailbox folders |
| MailboxItem.ImportExport.All | Application | Allows the app to perform backup and restore for all mailbox items |
| MailboxItem.Read.All | Application |
Read all the users' mailbox items |
| MailboxSettings.Read | Application | Read all user mailbox settings |
| User.Read.All | Application | Read all users' full profiles |
| Tasks.Read.All | Application | Read all users’ tasks and tasklist |
Additional permission for Quest On Demand - Migration - Mailbox Migration - Full
| Permission name | Type | Description |
| Calendars.ReadWrite | Application | Read and write calendars in all mailboxes |
| Mail.ReadWrite | Application | Read and write mail in all mailboxes |
| MailboxFolder.ReadWrite.All | Application |
Read and write all the users' mailbox folders |
| MailboxItem.ImportExport.All | Application | Allows the app to perform backup and restore for all mailbox items |
| MailboxItem.Read.All | Application | Read all the users' mailbox items |
| MailboxSettings.ReadWrite | Application | Read and write all user mailbox settings |
| User.Read.All | Application | Read all users' full profiles |
| Tasks.ReadWrite.All | Application | Allows the app to create, read, update and delete all users' tasks and task lists in your organization, without a signed-in user (needed for mailbox reset only) |
| Contacts.ReadWrite | Application | Allows the app to create, read, update, and delete all contacts in all mailboxes without a signed-in user. (needed for mailbox reset only) |
When will mail migrations in On Demand Migration start using Graph instead of EWS?
We are currently preparing the transition to Graph and plan to switch the first operations at the beginning of 2026 to Graph.
Will the migration jobs fail if I do not grant the new permissions immediately?
No, the mail migration tasks will continue to function using EWS. We are adding these permissions now to prepare for the transition to Graph. We will reach out to customers again when we are ready to make the switch to Graph.
Does RBAC for Exchange also work with Graph to limit access to specific mailboxes?
Yes, RBAC is also supported with Graph.
