Einstein Activity Capture Error "Service account doesn’t have required permissions"

This article answers the question: why does Einstein Activity Capture (EAC) show the error "Service account doesn't have required permissions" and fail to reconnect through Office 365, and how do you fix it? This error occurs when a network firewall or IP allowlist blocks Salesforce's Hyperforce-specific IP addresses. This prevents the Einstein Activity Capture service account from authenticating with Microsoft Exchange Web Services (EWS) or Office 365, most commonly after a recent EAC org migration.

Resolution Steps

If your company practices IP allowlisting and uses Microsoft Exchange Web Services (EWS) or Office 365, add the new Hyperforce-specific IP addresses and/or domains to your inbound and outbound allowlists. Current IP address lists are available in the Einstein Activity Capture Security Guide and the Salesforce Email Integration Security Guide, both linked in the Additional Resources section.