Microsoft 365 backup tools (Datto, Barracuda, Hornetsecurity, NAKIVO, Commvault, Druva, Keepit, CloudAlly, SysCloud): ready for the EWS shutdown?

Short answer: Most Microsoft 365 backup tools have moved mailbox backup to Graph, often with a reauthorization step: Datto, Barracuda Cloud-to-Cloud, Hornetsecurity, NAKIVO 11.2.3+, Commvault 11.44, Keepit, CloudAlly. Archive and public folder mailboxes are the usual exception. Veeam is still on EWS.

⚠ Depends on the product or version · vendor statements checked 26 Oct 2026

Deadline: Exchange Online blocks EWS by default from October 2026 (tenants are switched to EwsEnabled False, rollout to late April 2027) and turns it off for good on 1 April 2027, with no exceptions. Exchange Server on-premises is not affected.

Status

Datto SaaS Protection: Graph, reauthorize. Barracuda Cloud-to-Cloud Backup: Graph, Reauthorize; Message Archiver still EWS. Hornetsecurity 365 Total Backup: Graph since the 15 Sep 2026 release (app ID above). NAKIVO: 11.2.3+, set system.o365.mailbox.api.mode=graphonly. Commvault: Graph from 11.44, public folders stay EWS. Druva: mail, calendar, contacts, tasks on Graph; archive and public folders EWS. Keepit: reauthenticate connectors created before 10.19; public folder backup stops. CloudAlly: Graph since May 2026, reauthorize. SysCloud: Graph for mailboxes, in-place archive pending. Veeam: still EWS, see the Veeam page.

App ID in the EWS usage report:

What to do

  1. Run the free script with -ResolveNames: it matches each backup app by name and shows the vendor's statement.
  2. Do the vendor's reauthorize / switch step, then run a test backup and a test restore of one mailbox.
  3. Keep a backup app on the allow list only for what still needs EWS (archive, public folders), and ask the vendor what happens to those after 1 April 2027.

More than one app? Run the free read-only script: it names every app still calling EWS in your tenant.

Allow-list it safely

Setting EwsAllowedAppIDs replaces the whole list, so adding one ID on its own removes every other app. Read the current list first, then write the merged list:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled,EwsAllowedAppIDs
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<current IDs>,<new ID>"

Changes to the list take up to 24 hours. A blocked call returns HTTP 403 with the header X-EWS-Policy-Reason. The free script prints the merged command for every app in use (it never runs it).

Sources

MSP or IT partner? The M365 Readiness Pack runs this EWS check, the SMTP AUTH check and SPF/DKIM/DMARC for every domain once per client tenant, and writes a client-ready report with your logo, next steps and an email to send the client. Read-only, works with GDAP.

See the pack (from $49)
Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other apps