Graph API Alternate for centralized contact administration

Microsoft now manages contacts in Alternate in another way. Beforehand, directors managed them utilizing EWS and PowerShell. At present, within the cloud, Microsoft depends on Microsoft Graph. EWS stays related just for on-premises Alternate servers. For contemporary automation and synchronization, like trade contacts sychronisation, Graph is the brand new customary.

Structure and interfaces

Alternate shops contacts in a consumer’s mailbox. These private contacts should not the identical as entries within the World Tackle Checklist (GAL).

• Directors handle GAL contacts centrally in Entra ID.
• Private contacts, in contrast, reside in the identical container as emails, calendar objects, or duties.

This separation additionally stays within the cloud.

Beforehand, private contacts have been accessed through EWS. EWS is a SOAP API and will do all the things: learn, create, modify, and delete contacts. Directors usually used it for scripts, migrations, or CRM integrations. With Microsoft 365, the focus has shifted to REST endpoints, which Microsoft consolidates in Graph.

Microsoft Graph is greater than a successor to EWS. It’s a unified platform for Microsoft 365, Entra ID, Groups, SharePoint, Intune, and Home windows providers. Graph gives entry to knowledge utilizing a constant authentication mannequin. The API relies on open requirements: OAuth 2.0 for authentication, OData for filtering, and JSON for knowledge trade. Because of this, it’s not restricted to Alternate.

Graph acts as a gateway to all cloud knowledge. Entry is offered through REST calls or by the Microsoft Graph PowerShell SDK. This enables directors to carry out the identical operations in PowerShell that purposes do when utilizing Graph.

Alternate on-premises and Entra Join

Managing contacts on on-premises Alternate servers nonetheless depends on EWS or PowerShell. The connection to the cloud is established by Microsoft Entra Join (previously Azure AD Join). This instrument synchronizes customers, teams, and contacts from on-premises Energetic Listing to the cloud, enabling Alternate On-line and Groups to make use of the information within the World Tackle Checklist.

Necessary: Mailbox contents should not synchronized robotically. Private contacts {that a} consumer creates in Outlook or OWA stay native. If these contacts must be introduced into the cloud, a customized interface is required—for instance, a script that reads through EWS and writes through Graph.

For hybrid organizations, this implies: so long as mailboxes are nonetheless on-premises, EWS is indispensable. Solely when all customers have been migrated to Alternate On-line can Microsoft Graph be used completely.

Alternate On-line and Unified Contacts

In Alternate On-line, Microsoft makes use of a unified contact mannequin. Outlook, Groups, and different providers share private contacts. If you create a contact in Outlook, Groups robotically shows it, permitting you to make use of it for calls or chats. This method, known as Unified Contacts, lets each purposes entry the identical mailbox object.

This unification impacts not solely how contacts are displayed, but in addition how they’re saved. Modifications in Outlook or Groups are synchronized through Microsoft Graph, stopping duplicate knowledge. This mannequin paves the way in which for the transition from EWS to Graph.

Entry through Graph at all times requires a sound OAuth token. Error messages similar to “Entry token is empty” point out that the token is lacking, expired, or that the HTTP header “Authorization” is absent. Graph solely accepts requests that embody:

Make sure the token isn’t empty or expired and that Microsoft points it for the useful resource “https://graph.microsoft.com”. When you name the API in a browser with out authenticating, the service at all times returns this error.

Getting began with Graph

Graph Explorer

In follow, it is suggested to begin with Graph Explorer, as authentication is dealt with robotically.

• Signal-in is automated utilizing the Microsoft account

• Permissions similar to Contacts.Learn or Contacts.ReadWrite could be granted immediately

• API calls could be examined instantly, for instance:

For automated scripts, the Microsoft Graph PowerShell SDK is an efficient selection. The next instructions set up a delegated connection that retrieves the signed-in consumer’s contacts utilizing Get-MgUserContact -UserId me.

App-only entry (with out a consumer)

If you want software tokens with out consumer context, use app-only authentication:

• Register an app in Entra ID
• Request an entry token through Entra ID utilizing a shopper ID, secret, or certificates
• You can’t use delegated endpoints similar to “/me” on this mode; as a substitute, specify the consumer explicitly:

• The token should embody the Software Permission "Contacts.ReadWrite", which should be authorized within the tenant beforehand.

Entry tokens are legitimate for one hour by default. Longer-running scripts require token renewal. Scripts also needs to deal with error codes similar to 401 (Unauthorized) or 429 (Price Restrict).

Sensible examples

The Graph PowerShell SDK gives cmdlets similar to Get-MgUserContact and New-MgUserContact to automate the creation, modification, or deletion of contacts.

The corresponding PowerShell module should be put in or imported:

Set up-Module Microsoft.Graph.PersonalContacts -Scope CurrentUser -AllowClobber

Import-Module Microsoft.Graph.PersonalContacts -Drive

Typical use instances embody:

• Importing centralized organizational contacts into all consumer mailboxes
• Studying contacts from Microsoft Lists or SharePoint
• Routinely populating new goal mailboxes with predefined contacts

A confirmed method is to robotically present a predefined contact checklist when creating new mailboxes, containing key contacts from HR, IT, or help. The related script checks whether or not a contact already exists earlier than inserting it, stopping duplicates. Authentication is dealt with through an software registered in Entra ID that makes use of a certificates and has the permissions "Customers.Learn.All" and "Contacts.ReadWrite". If contact knowledge comes from a Microsoft Checklist, "Websites.Handle.All" or "Websites.Learn.All" is moreover required to learn the information supply.

The article Managing teams in Microsoft 365 with Graph PowerShell gives additional sensible examples for managing Microsoft 365 teams with Graph PowerShell.

EWS decommissioning and useful gaps in Graph

Microsoft plans to completely block Alternate Net Providers (EWS) in Alternate On-line beginning October 1, 2026. Microsoft will proceed to supply EWS entry for on-premises Alternate servers, however it’ll now not develop it additional.

Graph nonetheless has some useful gaps that Microsoft plans to shut earlier than the shutdown date:

• Entry to archive mailboxes, that are at present solely accessible through EWS
• Folder Related Data and Person Configuration, i.e., mailbox metadata
• Superior administration options for Alternate On-line
• Programmatic entry to public folders, which will probably be restricted to Outlook shoppers sooner or later

After October 2026, Microsoft will solely enable studying and writing public folders for supported Outlook shoppers and for large-scale import or export eventualities. APIs for creating or modifying these folders will probably be eliminated completely.

Microsoft recommends that builders:

• assessment present integrations early,
• determine affected purposes,
• regularly exchange all EWS calls with Graph endpoints.

Safety, permissions, and automation

Microsoft Graph makes use of OAuth 2.0 to authenticate purposes. This offers directors granular management over which knowledge every software can learn or modify. The system points entry tokens that stay legitimate for less than a restricted time. Directors should retailer tokens securely and renew them recurrently.

For automated processes, there are two choices:

• App registrations in Entra ID utilizing secrets and techniques or certificates to generate tokens
• Managed Identities in Azure Features or Logic Apps, which get hold of tokens dynamically with out storing secrets and techniques in code

Providers similar to Logic Apps, Energy Automate, or Azure Automation additionally use Graph internally. This allows, for instance, the automated updating of central contacts immediately inside cloud workflows—with out guide steps.

Improvement atmosphere, entry instruments, and real-world integration

For directors and builders, selecting the best instruments is essential to utilizing Graph productively.

• Graph Explorer: Browser-based, permits direct testing of API calls, no code required.

• SDKs: Obtainable for .NET, JavaScript, Python, PHP—supreme for native improvement environments.

• PowerShell: The Microsoft Graph PowerShell SDK exposes all REST endpoints as cmdlets.

Join-MgGraph establishes the connection, both interactively with consumer sign-in or app-based through Entra ID.

In complicated enterprise eventualities, automation utilizing Azure Features, Logic Apps, or Energy Automate is frequent. These providers additionally depend on Graph connectors internally. When operating lengthy scripts, directors should think about entry token validity. By default, a token lasts one hour, however you may prolong it in sure eventualities by renewing the token. For error dealing with, Microsoft recommends responding to standing codes similar to 429 (Price Restrict) and implementing retry logic.

A significant benefit of Graph is that you may entry a number of knowledge providers by a single endpoint:

• Customers from Entra ID,
• Groups contacts,
• SharePoint lists, and
• Alternate mailboxes.

This makes it attainable to hyperlink details about folks, teams, gadgets, and safety occasions in shared workflows. For instance, you should use the Microsoft Graph Safety API to combination safety alerts from Defender, Sentinel, or third-party suppliers and set off automated responses through Logic Apps.

Migration and organizational impression

For organizations with hybrid or cloud-only environments, migration to Graph turns into obligatory. This transition impacts not solely purposes, but in addition permission fashions, audit processes, and safety insurance policies. Graph replaces many legacy APIs similar to ActiveSync, EWS, and MAPI/HTTP, bringing all Microsoft 365 providers beneath a unified safety mannequin.

Directors ought to assess early which inner instruments, scripts, or add-ins nonetheless depend on EWS. Notably affected are automations for contact upkeep, CRM synchronization, and helpdesk techniques. A profitable migration contains re-registering purposes in Entra ID, changing legacy endpoints with Graph calls, and reviewing all permissions.

From an organizational perspective, this additionally modifications the place contacts ought to be managed. Holding native mailboxes, cloud accounts, and hybrid eventualities in sync requires clearly outlined tasks. Many organizations transfer contact administration completely to the cloud to keep away from duplicate upkeep and to make the most of Unified Contacts between Outlook and Groups.

That is the place the my-IAM platform will help: it consolidates id and phone knowledge from Energetic Listing, Entra ID, HR, or CRM techniques and makes it accessible in actual time for Alternate On-line and Groups. If you change knowledge in a single supply, all linked techniques instantly mirror the replace, no scripts or guide reconciliation required. With PeopleConnect, you may show this knowledge centrally in Groups, Outlook, or within the browser.

Strategic outlook

The deprecation of EWS marks the transition to a new period of integration. Microsoft Graph unifies Alternate, Groups, SharePoint, and Entra ID right into a single platform that not solely delivers knowledge, but in addition integrates context, safety, and intelligence.

Directors can mix contact administration, automation, and compliance inside a constant system. The shift is greater than a technical change—it transforms how organizations mannequin their communication buildings. Contacts are now not remoted objects; they now kind a part of a linked cloud ecosystem.

The follow-up article “Contacts in Alternate on-premises and on-line: greatest practices for contemporary organizations” exhibits which fashions work greatest for centralized contact administration, explains how organizations can harmonize cloud and on-premises directories, and descriptions the governance buildings wanted to function the brand new structure sustainably.

Conclusion

Migration to Microsoft Graph is not only a technical change, however a possibility to make contact administration extra fashionable, safe, and automatic. With platforms like my-IAM, organizations can centrally handle inner and exterior contacts, automate workflows, and guarantee compliance.

Those that plan early, exchange legacy EWS integrations, and undertake Graph lay a strong basis for the long run and profit from Unified Contacts, dynamic teams, and real-time synchronization.

What subject ought to we cowl subsequent? Ship us your concepts, and we’ll decide them up in our upcoming articles.

Ship concepts

Artikel erstellt am: 09.02.2026