Einstein Activity Capture Error "Service account doesn’t have required permissions"

This error occurs when a network firewall or IP allowlist blocks Salesforce's Hyperforce-specific IP addresses, which prevents the Einstein Activity Capture service account from authenticating with Microsoft Exchange Web Services (EWS) or Office 365 — most commonly after a recent EAC org migration.

## Resolution Steps

If your company practices IP allowlisting and uses Microsoft Exchange Web Services (EWS) or Office 365, add the new Hyperforce-specific IP addresses and/or domains to your inbound and outbound allowlists. Current IP address lists are available in the Einstein Activity Capture Security Guide and the Salesforce Email Integration Security Guide, both linked below in Additional Resources.