Veeam Backup for Microsoft 365: ready for the EWS shutdown?

Short answer: Veeam Backup for Microsoft 365 still backs up Exchange Online mailboxes over EWS; Veeam says it is waiting for Graph features such as delta sync. Keep Veeam's app on your EWS allow list, and watch Veeam KB4820 for the Graph release before 1 April 2027.

✖ Still needs EWS · vendor statements checked 26 Oct 2026

Deadline: Exchange Online blocks EWS by default from October 2026 (tenants are switched to EwsEnabled False, rollout to late April 2027) and turns it off for good on 1 April 2027, with no exceptions. Exchange Server on-premises is not affected.

Status

Still EWS (Veeam KB4820). Veeam registers its own app in each tenant, so the app ID is yours: find it in the usage report or with the free script (it matches the Entra app name).

This vendor registers its own app in each tenant, so the app ID is yours. Find it in the EWS usage report, or run the free script with -ResolveNames.

What to do

  1. Find the Veeam app ID: EWS usage report, or the script with -ResolveNames.
  2. Put it on the allow list now, merged with your other IDs. A missed backup app is the worst surprise: the job may fail quietly with 403.
  3. Check the job logs for HTTP 403 with X-EWS-Policy-Reason after any allow-list change (changes can take up to 24 hours).

More than one app? Run the free read-only script: it names every app still calling EWS in your tenant.

Allow-list it safely

Setting EwsAllowedAppIDs replaces the whole list, so adding one ID on its own removes every other app. Read the current list first, then write the merged list:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled,EwsAllowedAppIDs
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<current IDs>,<new ID>"

Changes to the list take up to 24 hours. A blocked call returns HTTP 403 with the header X-EWS-Policy-Reason. The free script prints the merged command for every app in use (it never runs it).

Sources

MSP or IT partner? The M365 Readiness Pack runs this EWS check, the SMTP AUTH check and SPF/DKIM/DMARC for every domain once per client tenant, and writes a client-ready report with your logo, next steps and an email to send the client. Read-only, works with GDAP.

See the pack (from $49)
Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other apps