Microsoft 365: allow Exchange Web Services (EWS) for Exchange Online backup

Microsoft is gradually disabling Exchange Web Services (EWS) in Exchange Online. RG's Microsoft 365 backup solution (based on Veeam Backup for Microsoft 365) still uses EWS to back up mailboxes, until Microsoft Graph provides all the required features.

If you do nothing, your Exchange Online backups may fail. Mailboxes that are not backed up during the outage will have a gap in their restore history.

Veeam reference: KB4820

Key dates

Prerequisites

• An Exchange administrator (or Global administrator) account on your Microsoft 365 tenant
• For step 2 and option B: PowerShell 7 and the ExchangeOnlineManagement module

Install-Module ExchangeOnlineManagement -Scope CurrentUser

Step 1: enable EWS on your tenant

Choose one of the two options.

Option A: from the Microsoft 365 admin center

1. Sign in to the Microsoft 365 admin center.

2. Go to Settings > Org settings, Security & privacy tab.

3. Click Baseline security mode, then Open Baseline security mode.

   

    

4. In the list, open Block access to Exchange Web Services (Authentication category, Exchange service).

5. Make sure "Block your entire organization from using EWS" is unchecked, then click Apply change if you changed anything.

   

⚠️ The "At risk" status that Microsoft shows on this line is expected: it means EWS is allowed, which the backup requires.

⚠️ If you check "Automatically apply default policies", make sure blocking EWS is not one of them 

⚠️ The admin center does not let you manage the EWS allowed applications list. From October 1, 2026, step 2 (PowerShell) is still required.

Option B: with PowerShell

Connect-ExchangeOnline

# Check the current value
Get-OrganizationConfig | Format-List EwsEnabled

# If the value is not True
Set-OrganizationConfig -EwsEnabled $true

EwsEnabled must be True. An empty value ($null) will be switched to False by Microsoft from October 1, 2026.

Step 2: allow the RG Backup applications (required from October 1, 2026)

From October 1, 2026, only the applications in the EWSAllowedAppIDs list can use EWS, even when EWS is enabled.

2.1 Get the RG Backup application IDs

When the backup was set up, RG created one RG Backup application and several RG Backup (Auxiliary) applications in your tenant. All of them must be allowed.

• From the portal: Microsoft Entra admin center > Identity > Applications > App registrations > All applications, search for "RG Backup" and note the Application (client) ID of each one.
• With PowerShell:

Install-Module Microsoft.Graph.Applications -Scope CurrentUser
Connect-MgGraph -Scopes "Application.Read.All"
Get-MgApplication -Filter "startswith(displayName,'RG Backup')" | Select-Object DisplayName, AppId

2.2 Add the applications to the list

⚠️ Do not overwrite the list: if other applications in your organization use EWS, they must stay in it.

Connect-ExchangeOnline

# Current list
Get-OrganizationConfig | Format-List EwsEnabled, EWSAllowedAppIDs

# Add the RG Backup applications (IDs from step 2.1)
Set-OrganizationConfig -EWSAllowedAppIDs @{Add="<RG Backup AppId>","<RG Backup (Auxiliary) AppId 1>","..."}

Tip: the EWS usage report in the Microsoft 365 admin center shows the other applications in your tenant that use EWS.

Check

Get-OrganizationConfig | Format-List EwsEnabled, EWSAllowedAppIDs

• EwsEnabled: True
• EWSAllowedAppIDs: contains all the RG Backup IDs (in addition to any other applications you use)

Then check in the RG dashboard that the next Exchange Online backup completes successfully.