Exchange Web Services API Permissions – No Longer Required

Check Point Email Security now protects Microsoft 365 mail without the Exchange Web Services (EWS) full access permission.

Microsoft is retiring EWS for Exchange Online at the beginning of October 2026. Over the past months, Check Point Email Security has carefully deprecated its use of the “Use Exchange Web Services with full access to all mailboxes (full_access_as_app)” API permission. Testing and the required product changes are complete, and this permission is no longer needed.

The result is a smaller set of API permissions and no dependency on an interface Microsoft is retiring, with no change to protection, policy, or any other capability of the product.

Removing the Permission from the Check Point Application

New customers do not see full_access_as_app in the permission set requested when Microsoft 365 Mail is authorized, and nothing needs to be done.

For existing customers, the permission stays granted until it is removed, and removing it is optional – full functionality is maintained either way. Administrators who want to remove it have two options. Remove the permission directly from the Check Point Azure application, or navigate to Security Settings > SaaS Applications > Microsoft 365 Mail > Configure and select “Re-authorize app” so the updated permission list is applied. Existing configurations and policies stay unchanged.