Update to Exchange callback tokens for Outlook add-ins

Akhilesh Shah

Learn how to prepare for the upcoming change to Exchange callback tokens and avoid any disruptions in your Outlook add-ins. 

What is changing and why? 

We’re updating Exchange callback tokens used by Outlook add-ins to call REST APIs or Exchange Web Services (EWS). Specifically, these callback tokens are returned by the getCallbackTokenAsync(options, callback) and getCallbackTokenAsync(callback, userContext) methods. The update is part of continual improvements to maintain a more secure environment for Exchange users and resources such as mailbox and calendar. 

If your Outlook add-in doesn’t rely on the token format, and it just uses the token to access Exchange resources, it will not be affected by this change. If your add-in parses the token, or relies on anything inside the token string, it might be impacted.  

The change will take effect on January 1, 2024. After that date, any Outlook add-ins that rely on the internal format of the token will be affected. It is important that you update your add-ins to avoid any dependency on the token format before that date. 

Recommended action 

The token format is opaque, and your Outlook add-in should not parse or rely on anything inside the token string. The format might change again in the future. We recommend that you check your Outlook add-in to make sure that it doesn’t parse or rely on the content of the token string. 

Thank you.

Akhilesh Shah

Follow