[Outlook] Deprecate full_access_as_app permissions in favour of Graph API permissions for Outlook Cloud

[artem-shelkovnikov]

Problem

Outlook Cloud connector requires full_access_as_app permission, see our official docs: https://www.elastic.co/docs/reference/search-connectors/es-connectors-outlook#es-connectors-outlook-client-connect-to-office365-outlook-outlook-cloud

This permission / EWS path is being deprecated by Microsoft by 1st April 2027 with deprecation starting in October 2026: https://techcommunity.microsoft.com/blog/exchange/exchange-online-ews-your-time-is-almost-up/4492361

We need to adjust the connector to only use Graph API for Outlook Cloud. In practice this means separation into Outlook Cloud and Exchange Server connectors, because the systems differ.

Decision: create new service types for backwards compatibility — legacy outlook stays frozen; new types are outlook_cloud (Graph-only) and exchange_server (EWS + LDAP).

Target

Service type	Target	API
outlook (legacy)	Existing deployments	EWS (frozen / deprecate)
outlook_cloud (new)	Exchange Online / M365	Microsoft Graph only
exchange_server (new)	On-prem Exchange Server	EWS + LDAP

outlook_cloud v1 = full parity with current cloud sync: mail (4 folders) + calendar + contacts/DLs + tasks + attachments + DLS.

Sub-issues (execution order)

Phase 0 — Design

• [Outlook] Epic design: Graph migration, connector split, regression contract #4346 Epic design: Graph migration, connector split, regression contract

Phase 1 — Split / freeze (after design; can run in parallel)

• [Outlook] Extract exchange_server connector from legacy outlook (EWS, no behavior change) #4347 Extract exchange_server connector from legacy outlook (EWS, no behavior change)
• [Outlook] Freeze legacy outlook connector and document deprecation #4348 Freeze legacy outlook connector and document deprecation

Phase 2 — outlook_cloud foundation

• [Outlook] outlook_cloud: Graph client foundation + user enumeration + ping #4349 Graph client foundation + user enumeration + ping

Phase 3 — outlook_cloud data plane (sequential)

• [Outlook] outlook_cloud: Graph mail sync (inbox, sent, junk, archive) #4350 Graph mail sync (inbox, sent, junk, archive)
• [Outlook] outlook_cloud: Graph calendar sync (root + child calendars, birthdays) #4351 Graph calendar sync (root + child calendars, birthdays)
• [Outlook] outlook_cloud: Graph contacts + distribution lists #4352 Graph contacts + distribution lists
• [Outlook] outlook_cloud: Graph tasks sync (To Do API) #4353 Graph tasks sync (To Do API)
• [Outlook] outlook_cloud: Graph attachments (mail, calendar, task) #4354 Graph attachments (mail, calendar, task)
• [Outlook] outlook_cloud: DLS + access control sync #4355 DLS + access control sync
• [Outlook] outlook_cloud: Incremental sync via Graph delta/filter #4356 Incremental sync via Graph delta/filter

Phase 4 — Product integration

• [Kibana] Native connectors for outlook_cloud + exchange_server #4357 [Kibana] Native connectors for outlook_cloud + exchange_server
• [Outlook] Documentation + migration guide (outlook → outlook_cloud) #4358 Documentation + migration guide (outlook → outlook_cloud)

Phase 5 — Verification and release

• [Outlook] Manual E2E parity validation (M365 tenant) #4359 Manual E2E parity validation (M365 tenant)
• [Outlook] Release QA issue + backport planning #4360 Release QA issue + backport planning

Planning preferences (not confirmed — do not close related issues/PRs yet)

• Mailbox scoping (proposed): Prefer Microsoft Application Access Policy over an Elastic client_emails connector feature. Related: Enhancement: Allow Outlook Cloud connector to specify client emails instead of defaulting to all users #2843 / [Outlook] Feature: Office365 multi-user support #2844 remain open until product confirms.
• Legacy Kibana UX (proposed): Prefer hiding outlook from create flow once outlook_cloud / exchange_server ship. Existing legacy connectors would keep working.

Notes

• Graph does not replace EWS for on-prem Exchange Server mailboxes.
• Migrating legacy outlook → outlook_cloud will require a full resync (Graph _id ≠ EWS item.id).
• Connectors + Kibana native definitions must ship together for native UX.
• Scoped mailbox testing for customers can be documented as an Entra/Exchange admin setup if Application Access Policy is chosen.