# Setting up Application Impersonation

> **WARNING:** In February 2025, `ApplicationImpersonation` was [deprecated by Microsoft](https://techcommunity.microsoft.com/blog/exchange/retirement-of-rbac-application-impersonation-in-exchange-online/4062671), which stopped EWS Service Accounts from successfully syncing M365 calendars. Free/Busy-only, Individual Connect, and on-premise Exchange connections are unaffected.

For existing Office 365 EWS connections, please refer to our documentation on [Migrating from EWS to Graph](/calendar-admins/faqs/ews-migration/index.md).

New Office 365 via Enterprise Connect connections should instead use [the Graph API connector](/calendar-admins/enterprise-connect-office365-graph/index.md).

When using Enterprise Connect with on-premise Exchange or Office 365, we recommend configuring access by using a service account that has been granted the `ApplicationImpersonation` role.

The `ApplicationImpersonation` role allows service accounts to manage events on behalf of rooms and users, with fully auditable logs.

### Step 1
Navigate to the [Exchange Admin portal](https://admin.exchange.microsoft.com/#/adminRoles).
![](/calendar-admins/enterprise-connect-office365-exchange/configuring-application-impersonation/Step1-Exchange-Roles.ccc4c3cccf0b0afd602843d22ed1182f56ee8c19896c1904ff5d4ecfb774b82d.png)

### Step 2
Click the 'Add role group' button.
![](/calendar-admins/enterprise-connect-office365-exchange/configuring-application-impersonation/Step2-Exchange-AddRole.1111319e49d9fb0f6f9a974eec0dac70f733ed77d39e08d0f94f3c1f1d0089d2.png)

### Step 3
Enter the information required

- Role name: ApplicationImpersonation

- Write scope: Default

Then click 'Next'.

![](/calendar-admins/enterprise-connect-office365-exchange/configuring-application-impersonation/Step3-Exchange-NameRole.406cdeeeb8aeca38870a4d026aa9f23cc3c4c76aa4375115c00050440cecec4c.png)
### Step 4
Search for `ApplicationImpersonation`, and check this Role from the list.
Then click 'Next'.
![](/calendar-admins/enterprise-connect-office365-exchange/configuring-application-impersonation/Step4-Exchange-AddRole.7987fd071700439e2b52a6b0c5392345f9c3a5fb718265142ac19123a04774e9.png)

### Step 5
Search for your service account. Select your service account from the list.
Then click 'Next'.
![](/calendar-admins/enterprise-connect-office365-exchange/configuring-application-impersonation/Step5-Exchange-AddMember.439c78244d4db8342234764411a9f70fba184517b975643f051a38348bd4fd4b.png)

### Step 6
Check the details are correct on the summary page.
Click on 'Add role group', and you're done!
![](/calendar-admins/enterprise-connect-office365-exchange/configuring-application-impersonation/Step6-Exchange-Summary.616063472880b453c2e588494574e3714d489d8d6d54fadf9092561725f88bfb.png)

#### Further information
More information on configuring `ApplicationImpersonation` from Microsoft can be found [here](https://docs.microsoft.com/en-us/exchange/client-developer/exchange-web-services/impersonation-and-ews-in-exchange?redirectedfrom=MSDN), and if you require any further help, feel free to contact us at [support@cronofy.com](mailto:support@cronofy.com).

Sometimes, Exchange might not apply the ApplicationImpersonation role automatically, which can be detected by using the [Microsoft Remote Connectivity Analyzer](/calendar-admins/enterprise-connect-office365-exchange/testing-configuration/index.md) tool. If this happened to your Service Account, running the following command will resolve this issue:

`New-ManagementRoleAssignment -name:impersonationAssignmentName -Role:ApplicationImpersonation -User:serviceAccount`


---
[Read in HTML](/calendar-admins/enterprise-connect-office365-exchange/configuring-application-impersonation/)