Overview

Microsoft is retiring Exchange Web Services (EWS) in Exchange Online. Veeam Backup for Microsoft 365 currently uses EWS for some Exchange Online backup functionality and is transitioning this functionality to Microsoft Graph.


Microsoft will begin enforcing changes to EWS access from 1 October 2026. Customers using the Vitanium Microsoft 365 Backup service should therefore make the changes described in this article before 1 October 2026 to prevent disruption to their Microsoft 365 backups.


There are two parts to the change:

  1. Immediate action – before 1 October 2026: Configure Microsoft Exchange Online so that the Veeam application is explicitly permitted to continue using EWS during Microsoft's transition period.
  2. Preparation for the permanent solution: Ensure the Veeam application has the required Microsoft Graph permissions so that it is ready for Veeam's transition away from EWS.


What is changing?

Exchange Web Services is a Microsoft API which has historically been used by applications to interact with Exchange Online.


Microsoft is retiring EWS and moving applications towards newer APIs, principally Microsoft Graph.


Veeam Backup for Microsoft 365 currently uses EWS for Exchange Online backup functionality. Veeam has confirmed that its software is being transitioned from EWS to Microsoft Graph.


This is therefore a Microsoft-driven change rather than a change to the Vitanium Microsoft 365 Backup service.


Important dates

Before 1 October 2026

Customers should:

  • Explicitly enable EWS temporarily using EwsEnabled.
  • Add the Veeam Microsoft Entra Application ID to the new EwsAllowedAppIDs list.
  • Add the required Microsoft Graph permissions to the Veeam application.
  • Grant administrator consent to those permissions.

We recommend completing these changes no later than 30 September 2026.


From 1 October 2026

Microsoft begins its phased EWS retirement enforcement.


This is particularly important because the behaviour of EwsEnabled changes.


Before October, setting:

Set-OrganizationConfig -EwsEnabled $true


without an AppID allow list permits EWS.


From October 2026, EwsEnabled = $true without an AppID allow list will no longer permit unrestricted EWS access.

To continue allowing Veeam to use EWS during the transition, the Veeam application must be explicitly included in


EwsAllowedAppIDs.


To continue allowing Veeam to use EWS during the transition, the Veeam application must be explicitly included in 


EwsAllowedAppIDs.


April 2027

Microsoft plans to complete the retirement of EWS in Exchange Online.


The temporary EWS configuration described below therefore does not provide a permanent workaround.


Veeam is transitioning the affected functionality to Microsoft Graph, and Vitanium will upgrade its Microsoft 365 Backup platform accordingly.

Action required before 1 October 2026

The first priority is to ensure that Veeam can continue to access EWS while the transition to Microsoft Graph is completed.

Step 1 – Identify the Veeam Application ID


Sign in to the Microsoft Entra admin centre and locate the application registration used for your Vitanium/Veeam Microsoft 365 backup.


Go to:

Microsoft Entra ID → App registrations → [Veeam application] → Overview


Make a note of:


Application (client) ID


This is a GUID similar to:

aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee


This is the value that must be added to the Exchange Online EWS AppID allow list.

Step 2 – Connect to Exchange Online PowerShell

Connect to Exchange Online:

Connect-ExchangeOnline

You will need an account with sufficient Exchange Online administrative privileges.

Step 3 – Check your existing EWS configuration

Before making any changes, run:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |    Format-List EwsEnabled,EwsAllowedAppIDs


It is important to check the existing configuration before changing it.


In particular, do not replace an existing EwsAllowedAppIDs list without checking its contents, as other applications in your organisation may also require EWS.

Step 4 – Explicitly enable EWS

Veeam currently recommends explicitly setting EWS to enabled during the transition period:

Set-OrganizationConfig -EwsEnabled $true


This avoids relying on the current default $null behaviour.


However, this setting alone will not be sufficient once Microsoft's October 2026 enforcement begins.

The Veeam application must also be included in EwsAllowedAppIDs.

Step 5 – Add the Veeam application to EwsAllowedAppIDs

Configure the AppID allow list so that the Veeam application is explicitly permitted to continue using EWS.

For example:

Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"

Replace the example GUID with the Application (client) ID of your Veeam application.

Important

EwsAllowedAppIDs is an organisation-wide EWS allow list.


If your organisation has other applications which still use EWS, their Application IDs must also be included.


Do not simply overwrite an existing list containing other applications.


After configuring the setting, verify it using:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |    Format-List EwsEnabled,EwsAllowedAppIDs

You should confirm:

EwsEnabled       : True EwsAllowedAppIDs : {your Veeam application ID ...}

Preparing the Veeam application for Microsoft Graph

The EWS configuration above is a temporary measure to maintain backup functionality while Veeam completes its transition to Microsoft Graph.


The permanent solution is for Veeam Backup for Microsoft 365 to use Microsoft Graph for the affected functionality.


Customers should therefore also update the Microsoft Entra application permissions now.

Go to:

Microsoft Entra ID → App registrations → [Veeam application] → API permissions


Compare the application's existing permissions with Veeam's current requirements for Microsoft 365 backup.

Veeam's current permissions documentation is available here:


Backup permissions:
https://helpcenter.veeam.com/docs/vbo365/guide/ad_app_permissions_sd.html#permissions-for-backup


The required Microsoft Graph permissions for Exchange Online backup currently include permissions such as:

  • Directory.Read.All
  • Group.Read.All
  • User.Read.All
  • MailboxItem.ImportExport.All
  • MailboxFolder.ReadWrite.All
  • MailboxItem.Read.All

Always use Veeam's current permissions table when making the change, as requirements can change as the Graph functionality is developed.


After adding the permissions, select:


Grant admin consent for [organisation]


The permissions must show as having administrator consent.

Restore permissions

Veeam also has separate permissions requirements for restore operations.

These should be reviewed against:

https://helpcenter.veeam.com/docs/vbo365/guide/ad_app_permissions_sd.html#permissions-for-restore

The exact requirements can depend on the authentication and restore method being used.

Vitanium can assist customers in identifying the appropriate application and permissions.

Why are we enabling EWS if Microsoft is retiring it?

The configuration may initially seem contradictory: Microsoft is retiring EWS, but we are asking customers to explicitly enable it.

This is because the migration is happening in stages.

The expected process is:

Current Veeam platform
↓
Some Exchange backup functionality still requires EWS
↓
Before 1 October 2026
Explicitly permit the Veeam application using EwsAllowedAppIDs
↓
Add the required Microsoft Graph permissions
↓
Microsoft begins EWS enforcement
Veeam can continue using its explicitly authorised EWS access during the transition
↓
Veeam releases the required Microsoft Graph functionality
↓
Vitanium upgrades the Microsoft 365 Backup platform
↓
Remaining EWS dependencies are removed
↓
Microsoft completes EWS retirement

The EWS allow list therefore provides a controlled bridge between the existing Veeam implementation and the new Microsoft Graph implementation.

It is not intended as a permanent workaround for EWS retirement.

What happens if I don't make the change before 1 October?

There is a risk that Microsoft will block EWS access for the Veeam application as EWS retirement enforcement is rolled out.


If Veeam still requires EWS for a particular backup operation, this could result in Microsoft 365 backup jobs failing or being unable to protect some Exchange Online data.


Veeam advises customers to prepare their environments before Microsoft's enforcement begins.


We therefore strongly recommend making the required changes before 1 October 2026.

What does Vitanium need customers to do?

Before 1 October 2026, please:

  1. Locate the Microsoft Entra application used by your Vitanium/Veeam Microsoft 365 Backup service.
  2. Check your current EwsEnabled and EwsAllowedAppIDs configuration.
  3. Set EwsEnabled to $true for the transition period.
  4. Add the Veeam Application (client) ID to EwsAllowedAppIDs.
  5. Ensure any other legitimate applications requiring EWS are retained in the allow list.
  6. Add the Microsoft Graph permissions currently required by Veeam.
  7. Grant administrator consent to the new permissions.
  8. Confirm the changes to Vitanium so that we can monitor your backup service.

Vitanium will manage the required changes to the backup platform itself.

Need assistance?

If you are unsure which Microsoft Entra application is used by your backup service, which permissions are required, or how to make the Exchange Online changes, please contact Vitanium Support.


We can help identify the Veeam application and verify the required configuration.