As Microsoft has a plan to retire Exchange Web Services, many Office 365 tenants are migrating to their newer Graph API in the background.

To address this, some Graph specific permissions need to be added to the Azure Application that is set up in your tenant for Gold-Vision tracking purposes.

Can you arrange for the existing registered application in Azure to be modified as per the below instructions please.

Access the Azure AD portal and locate the Application that was created for email tracking and calendar sync.

Add the permissions

Entra ID (Azure AD) → App registrations → select the app

1. API permissions → Add a permission
2. Choose Microsoft Graph
3. Choose Application permissions
4. Search and tick each scope:
   1. Mail.ReadWrite
   2. Contacts.ReadWrite
   3. Calendars.ReadWrite
   4. Tasks.ReadWrite.All
   5. Mail.Send
   6. User.Read.All
   7. Click Add permissions

Note that this action will revoke the admin consent so that will need to be granted again.

Grant admin consent
•  Back on API permissions, click Grant admin consent for [tenant]
•  Requires Global Admin or Privileged Role Admin (or Application Administrator with the right delegation)
•  Without this, Application permissions simply won’t work — token requests will succeed but calls will 403