[Outlook] Epic design: Graph migration, connector split, regression contract

[Jan-Kazlouski-elastic]

Parent

Part of #4264

Summary

Produce the design decisions and regression contract that unblock the outlook → outlook_cloud + exchange_server split. No code changes in this issue.

Scope

• Confirm service types: outlook_cloud (Graph-only), exchange_server (EWS + LDAP), legacy outlook freeze/deprecation policy
• Map EWS → Graph per data type using Microsoft EWS→Graph mapping
• Define required Entra app permissions: Users.Read.All, Mail.Read, Calendars.Read, Contacts.Read, Tasks.Read.All
• Decide mailbox-scoping approach for the “2–5 users” customer ask (see preferences below)
• Lock golden Elasticsearch document contract from existing Outlook tests (EXPECTED_RESPONSE, formatters, DLS, attachment rules)
• Note known migration risk: Graph _id values differ from EWS → full resync expected when moving to outlook_cloud

Planning preferences (not confirmed)

These are working preferences from epic planning. Do not close #2843 / #2844 (or other related work) until product confirms.

1. Mailbox scoping: Prefer Microsoft Application Access Policy (admin-side) over adding Elastic connector config such as client_emails. Related open work: Enhancement: Allow Outlook Cloud connector to specify client emails instead of defaulting to all users #2843 / [Outlook] Feature: Office365 multi-user support #2844.
2. Legacy outlook Kibana UX: Prefer hide from create flow on versions that ship outlook_cloud / exchange_server. Existing legacy deployments would keep working; new setups would not pick legacy outlook.
3. outlook_cloud v1 scope: Full parity — mail (4 folders) + calendar + contacts/DLs + tasks + attachments + DLS

Acceptance criteria

• Preferences above confirmed or revised by product/eng
• Golden document contract listed (doc types + key fields)
• Permission list (+ docs guidance for whatever scoping approach is chosen) drafted for later docs work
• Design summary posted back onto [Outlook] Deprecate full_access_as_app permissions in favour of Graph API permissions for Outlook Cloud #4264

Out of scope

• Implementation PRs
• Closing or merging Enhancement: Allow Outlook Cloud connector to specify client emails instead of defaulting to all users #2843 / [Outlook] Feature: Office365 multi-user support #2844 as part of this design issue alone