How AskCody integrates with Microsoft Exchange Server (EWS)

If your organization runs Microsoft Exchange Server, either fully on-premises or as the on-premises side of a hybrid setup, AskCody connects to it through Exchange Web Services (EWS). This article is written for the IT Admin who wants to understand how that connection works: what EWS is, what the service account does, how AskCody handles the credentials, and how access to mailboxes is controlled.

 

How the EWS integration works

Exchange Web Services (EWS) is the API that is a native part of Microsoft Exchange Server. An API is code that allows two software programs to communicate with each other and share data. For Exchange Server, AskCody connects as an EWS application, using the Exchange Web Services Managed API to read and update the calendars you connect to the AskCody Platform: calendar events for the meeting rooms, desks, and resources you manage with AskCody.

The connection is authenticated with a service account using Basic Authentication.

Note: On Exchange Server, Basic Authentication with a service account is the only authentication method available for the AskCody integration. Modern Authentication (OAuth) only ever applied to Exchange Online, where it has since been superseded by Microsoft Graph. See the section at the end of this article.

The service account and Basic Authentication

Basic Authentication means that the integration uses the username and password of an Exchange service account that you create and administer. You enter the service account's email address and password in the AskCody Management Portal when setting up the integration.

To keep this step secure, the AskCody Platform stores the credentials encrypted in Microsoft Azure Key Vault. The credentials are encrypted both at rest and in transit and never appear in plain text in any AskCody system or database. They are used solely by the AskCody Platform to log in via EWS and access the meeting data in the calendars you have connected.

If you are not familiar with how to create a service account and provision it with the right permissions, follow Create a service account using PowerShell.

How access to mailboxes is controlled

The service account gets access to the relevant mailboxes through the ApplicationImpersonation role in Exchange Server. This role lets the service account act on behalf of the room, desk, and resource mailboxes connected to AskCody, which is what allows AskCody to show and update meetings in those calendars. You can read why this role is needed in Why Basic Authentication requires Application Impersonation.

If your organization wants to limit which mailboxes the service account can impersonate, you can scope the role with a management scope. Read Limit application access when using Application Impersonation.

Note: This permission model applies to Exchange Server only. On Exchange Online, AskCody connects through Microsoft Graph with scoped application permissions, and there is no service account and no full mailbox access. The permissions used there are documented in Permissions used and required connecting AskCody with MS Graph and Entra ID.

What happened to Basic Authentication vs Modern Authentication?

This article previously compared Basic Authentication and Modern Authentication as the two ways to connect AskCody to Exchange. That comparison only ever applied to Exchange Online, and both methods have since been superseded there.

Modern Authentication was an Exchange Online method where a Global Administrator granted the AskCody EWS application access through an OAuth 2.0 flow instead of sharing service account credentials. Microsoft has retired Basic Authentication in Exchange Online, and Microsoft now EWS in Exchange Online as well: since October 1, 2026, Microsoft began blocking EWS requests in Exchange Online, and as of April 1, 2027, EWS is permanently removed. This timeline is set by Microsoft and applies to every application using EWS with Exchange Online, not just AskCody.

For Microsoft Exchange Online, AskCody therefore connects through Microsoft Graph, the API Microsoft provides for working with Microsoft 365 data. Your Microsoft 365 administrator grants consent to the AskCody enterprise application once, and no service account, password, or EWS URL is stored or shared with AskCody. 

Exchange Server (on-premises and hybrid setups) is not affected by this retirement and continues to connect through EWS as described in this article.

Hybrid setups

If your organization runs a hybrid setup, the two sides of your environment connect to AskCody in two different ways: the Exchange Online side through Microsoft Graph, and the on-premises Exchange Server side through EWS with a service account, as described in this article. Read How to handle Hybrid Exchange Setups for how to set up and run both integrations side by side.