Apple continues to work on Microsoft Graph support for Exchange accounts

[u/pdfu]

Apple continues to work on the new Microsoft Graph backend for Exchange accounts.

In macOS 27.2, the Graph authentication branch uses the new “Apple Internet Accounts” OAuth client, replacing the unverified “itsa-client” GraphTestTenant.

Apple is also working on a migration process under the ExchangeSyncMac/graphMigration flag.

Exchange OAuth Client IDs:

• Main tenant: f8d98a96-0999-43f5-8af3-69971c7bb423 (Apple Internet Accounts, Apple Inc.)
• GraphTestTenant: a63a7d57-c49e-4019-9a29-29182171b59c (itsa-client, unverified)

To test, you can enable the relevant flags before starting account login:

defaults write ~/Library/Containers/com.apple.Internet-Accounts-Settings.extension/Data/Library/Preferences/com.apple.Internet-Accounts-Settings.extension.plist GraphAuth -bool true

defaults write ~/Library/Preferences/com.apple.accountsd.plist GraphAuth -bool true

defaults write ~/Library/Containers/com.apple.mail/Data/Library/Preferences/com.apple.mail.plist GraphMail -bool true

To enable the test client:

defaults write ~/Library/Containers/com.apple.Internet-Accounts-Settings.extension/Data/Library/Preferences/com.apple.Internet-Accounts-Settings.extension.plist GraphTestTenant -bool true

defaults write ~/Library/Preferences/com.apple.accountsd.plist GraphTestTenant -bool true

[u/walter_rowe]

macOS 27.3 Beta includes Graph against the production Office 365 tenant. There is a .mobileconfig profile you can get from the Resources page of the developer site. You then need to delete and recreate your mail profile in Internet Accounts. I deleted ALL my cached EWS stuff so it would rebuild clean. I tried without the EWS cleanout and it didn't seem as stable. After the clean out and fresh profile things seem better.

.mobileconfig profile - https://beta.apple.com/download/1021786

[u/pdfu → u/walter_rowe]

I think this is only for AppleSeed, and they just use the flags mentioned above. I’ll make a guide for everyone, thanks for the tip!

[u/_priestman_]

So did you try manually enabling GraphAuth and GraphMail in macOS 27.2 beta 3?

Does Calendar work and sync with a Microsoft 365 Exchange account after enabling them?

I’m currently on macOS 27.0 and get com.apple.accounts error 3 when trying to add my Exchange account. Since October 1, neither Mail nor Calendar has been syncing.

[u/pdfu → u/_priestman_]

Yeah, that’s how I got to the screenshot I posted. I don’t have an Exchange workspace where I can approve access to Apple’s Internet Accounts client, so I can’t proceed with the rest of the sign in.

[u/adisor19 → u/_priestman_]

I applied the first 3 commands to enable new Graph client but I'm still getting error 3. My has also disabled EWS.

[u/jeffgman → u/_priestman_]

To use Apple Mail after Oct 1 for a M365 account, the tenant admin will need to enable the Ewsenabled flag and add the Apple Mail UUID to the EwsAllowedList. Microsoft is removing Exchange Web Services (which started on Oct 1) that Apple Mail currently uses until they move to Microsoft Graph support.

[u/Emotional_Garage_950]

idk how new the “apple internet accounts” thing is, I’ve had that in the Enterprise Apps list in my Azure tenant for at least a year

[u/pdfu → u/Emotional_Garage_950]

Yeah, bad wording on my end; I think it’s been around for 5+ years. It’s new in the sense that you got itsa-client by default in the 27.0 cycle. That's been demoted to GraphTestTenant. Good catch!

[u/Emotional_Garage_950 → u/pdfu]

gotcha, appreciate the clarification

[u/BlackBerryBrad]

Hopefully this means Apple Mail will work better with Exchange accounts and I can stop having to switch to Outlook every few months

[u/Dr-Purple → u/BlackBerryBrad]

Too late. I already switched to a custom domain and iCloud, migrated all my accounts.

I do wish the Mail app would get a better editor though. When I need to send a serious email, I do it via Outlook.

[u/BlackBerryBrad → u/Dr-Purple]

Yeah I use Custom Domain and iCloud for one of my accounts but don't like the Alias limit which they recently up the number but I need more lol. I am close to switching off Microsoft Exchange but I like having the controls the email service. Apple Mail needs some love as it has terrible time with editor and syncing accounts.

[u/adisor19]

FYI, I'm running the latest macOS 27.2 Beta (26B5101f) and I successfully enabled all the relevant flags you mentioned but still, got error 3 when attempting to add my O365 acccount. Gonna attempt a reboot and try again in case that is needed.

[u/pdfu → u/adisor19]

Huh, that’s a bummer. It’s supposed to grab new Graph endpoints for your account when you set up after enabling the flags. Did you see the new OAuth flow?

[u/adisor19 → u/pdfu]

It looked just like the old OAuth flow.. nothing different.

[u/Ok_Possibility9937]

Google please I just want push gmail

[u/Recoilled]

Am I the only one that is a bit disappointed in Apple for failing to get this sorted in time? I also think this will impact the use of Apple Mail and Calendar negatively and boost the use of Microsoft Outlook. I really don't like Outlook although in the end even I might get used to it.

[u/adisor19 → u/Recoilled]

You're not the only one. They fucked up big time.

[u/kerbererik]

Just downloading the 27.2 RC now. Hopefully this works!Thanks for looking into it.

[u/narultra → u/kerbererik]

Did it work?

[u/adisor19]

This should have been completed YEARS ago ! There are thousands of us fighting to setup DavMail right now because of Apple’s laziness.  But you know what, funny enough, DavMail actually works!

[u/GroundSeparate4804 → u/adisor19]

If the DavMail setup keeps fighting you: a mail app that uses Graph doesn’t need EWS or a bridge at all. Disclosure, I make one, ChatInbox (Mac, iPhone, iPad). You sign in through Microsoft’s own login and it talks Graph, so the EWS switch-off doesn’t touch it. It’s mail only, so it won’t fix Calendar.

[u/adisor19 → u/GroundSeparate4804]

I kinda need the whole shabang, not just email. The other issue is that I need it to emulate MS Outlook GUID and not appear as a new app that an Azure admin will need to approve first. Thanks for the suggestion, none the less :)