Table of Contents
Microsoft is retiring Exchange Web Services action is needed to keep your Microsoft 365 mailbox backups running.
Who this affects: every customer whose Microsoft 365 Exchange Online mailboxes we back up.
Deadline: 1 October 2026.
Time needed: about two minutes in the portal, with a Microsoft 365 Global Administrator.
What is changing
Microsoft is withdrawing Exchange Web Services (EWS), the interface that backup products use to read Exchange Online mailboxes. It is happening in two stages:
| Date | What happens |
| 1 October 2026 | Microsoft starts enforcing an application allow list and requiring EWS to explicitly be turned on. |
| 1 April 2027 | EWS is withdrawn completely. |
At this time, our backup platform still uses EWS to protect Exchange Online mailboxes, so until Veeam releases a build that completely retires EWS in favor of the Graph API, your tenant needs to permit it. This can be done after the 1 October deadline, however with a few caveats:
- The first backup job will perform a full sync, which is slower than a normal incremental run but uses the same amount of storage.
- Any mailboxes not backed up during the gap will have a missing coverage window in their restore history.
For more information, Veeam's own guidance on this change is here.
What happens if you do nothing
On 1 October 2026, backups of your Exchange Online mailboxes stop. Any attempts made by Veeam software to backup or restore the data will fail.
Why you have to do this, and not us
This is a tenant-wide Exchange setting. Changing it requires Global Administrator rights in your Microsoft 365 tenant and an interactive administrator sign-in — the kind with a password and MFA prompt. The application we use to back you up cannot perform that sign-in, and no arrangement we could make on our side would change that. It has to be a person with Global Administrator rights in your organization.
What we can do is drive it for you once you have signed in, and that is what the portal option below does.
⚠️ Read this before you run anything. ⚠️
`Set-OrganizationConfig -EwsAllowedAppIDs` replaces the entire list every time it is set. There is no "add" syntax. Whatever you pass becomes the complete list of applications permitted to use EWS in your tenant, and anything you leave out loses EWS access.
So first, read your current list:
Get-OrganizationConfig | Select-Object -ExpandProperty EwsAllowedAppIDsThen set the list to your existing entries plus ours:
Set-OrganizationConfig -EwsAllowedAppIDs "<your-existing-ids>,<our-ids>"If your current list comes back empty:
This is the common case, and it is the one to be careful with.
An empty list means your tenant does not restrict EWS by application at all today. The moment you set EwsAllowedAppIDs to anything, you create a restriction where none existed — and whatever you pass becomes the only thing permitted to use EWS in your tenant.
We cannot give you a command to paste for this one, and that is deliberate. We can only see our own applications. A command written by us would silently cut off every other application in your tenant that uses EWS.
Before you set anything, build the full list yourself: every application that uses EWS in your tenant, not only ours. The EWS usage report in the Microsoft 365 admin center shows you which those are. Then set EwsAllowedAppIDs to that complete list, with our IDs included.
Option 1 — Fix it in the portal (recommended)
This is the quickest route, and it is the safest one if your tenant already restricts EWS, because it reads your current settings live and adds to them rather than replacing them.
You will need: the sign-in details for a Global Administrator of your Microsoft 365 tenant.
Step 1 — Find your organization
Sign in to the portal, then go to Services → SaaS Backup & Recovery for Microsoft 365.
Each of your Microsoft 365 organizations appears as a card. Any organization that needs this change shows an amber Fix EWS access button.
If you do not see that button on an organization, that organization does not need anything done at this time.
Step 2 — Start the sign-in
Click Fix EWS access. The portal opens a sign-in with Microsoft and shows you a short code.
Open the link shown, enter the code, and sign in as a Global Administrator. The code is valid for about 15 minutes. You are signing in to Microsoft directly. We never see your password, and nothing is stored — the sign-in lives only as long as this window is open.
Step 3 — Review what will change
Come back to the portal and click Next. The portal reads your tenant's current EWS settings through the session you have just signed in to and shows you exactly what it proposes to do.
> [SCREENSHOT: step 2 of the modal — "Review and apply" — showing EWS enabled
> yes/no, the current allow list, and the IDs to be added]
You will see:
- whether EWS is currently enabled for your organization
- which applications are currently allowed to use EWS
- the application IDs we will add
Nothing has been written at this point. Read it, and if it looks right, click Apply.
Step 4 — Done
The change is made inside your own sign-in and the session is closed immediately. The Fix EWS access button disappears from the card once the change is confirmed. Allow-list changes can start applying straight away, and can take up to 24 hours to propagate fully across Microsoft's service.
Option 2 — Make the change yourself in PowerShell
If you would rather not sign in through the portal, you can make the same change directly. You will need the Exchange Online PowerShell module and a Global Administrator account.
Connect-ExchangeOnlineThere are two settings, and depending on your tenant you may need one or both. The email we sent you says which apply to your organization. If both apply, both are required — enabling EWS without allow-listing our applications, or allow-listing them without enabling EWS, still leaves your backups blocked after the deadline.
Setting 1 — Enable EWS for your organization
Set-OrganizationConfig -EwsEnabled $trueSetting 2 — Add our application IDs to your EWS allow list
The application IDs to add are listed in the email we sent you, and on the review screen in the portal. They are specific to your organization, so please use the ones you were sent rather than any you find elsewhere.
Questions
Why can't I see the button?
The Fix EWS access button only appears on organizations that currently need the change. If it is not there, either the settings are already correct, or we have not yet been able to read that tenant's configuration. We check every organization daily.
Does this affect my SharePoint, OneDrive or Teams backups?
This change is specific to how Exchange Online mailboxes are read. It is the mailbox backups that stop on 1 October 2026 if no action is taken.
Do you get our password, or keep access afterwards?
No. The sign-in happens directly with Microsoft. We never see the password, no token is stored, and the session is closed as soon as the change is applied — or when you close the window, whichever comes first.
Can I do this without giving anyone Global Administrator rights?
No. Changing an organization-wide Exchange setting requires Global Administrator. If the person driving the fix is not one, they can start the portal flow and hand the sign-in step to someone who is.
Someone else is already doing this — I got a "try again shortly" message
The portal handles a limited number of these sign-ins at once due to Microsoft API throttling. If you see that message, wait a minute and click Fix EWS access again.
I've made the change. How do I confirm it worked?
The Fix EWS access button disappears from the organization card. If you made the change in PowerShell rather than the portal, allow up to 24 hours for our next check to pick it up. If the configuration is not set properly, you will continue to receive daily email alerts about it from our system.
What happens after 1 April 2027?
EWS is withdrawn entirely on that date and the allow list stops existing. Before then, Exchange Online mailbox backups will have moved to Microsoft's replacement interface. The only action that will be needed from you is to go through the Edit Account Settings form for your organization to apply new Graph API permissions after an upcoming Veeam release — we will contact you if anything changes.
References