Microsoft is retiring Exchange Web Services (EWS) in Exchange Online. Vitaniums 365 Backup service uses Veeam Backup for Microsoft 365 which uses EWS for some Exchange Online backup functionality and is transitioning this functionality to Microsoft Graph.

Microsoft will begin enforcing changes to EWS access from 1 October 2026. Customers using the Vitanium Microsoft 365 Backup service should therefore make the changes described in this article before 1 October 2026 to prevent disruption to their Microsoft 365 backups.

The most important action before 1 October 2026 is to ensure that Exchange Web Services remains available to the Veeam backup application.

You will need the Veeam Application ID supplied by Vitanium for your Microsoft 365 organisation.

1. Open PowerShell

Open Windows PowerShell as an administrator on a computer where you can connect to Microsoft Exchange Online.

If the Exchange Online PowerShell module is not already installed, install it with:

Install-Module ExchangeOnlineManagement

2. Connect to Exchange Online

Run:

Connect-ExchangeOnline

Sign in using an account with sufficient Exchange Online administrative permissions.

3. Check the current EWS setting

Run:

Get-OrganizationConfig | Format-List EwsEnabled

For example, you may currently see:

EwsEnabled :

A blank value represents $null, which is the default for many Microsoft 365 tenants.

Microsoft plans to change tenants that remain at $null to $false as its October 2026 EWS enforcement is rolled out. This would block EWS and cause Veeam Exchange Online backups to fail.

We therefore recommends explicitly setting the value to $true.

Run:

Set-OrganizationConfig -EwsEnabled $true

Then confirm:

Get-OrganizationConfig | Format-List EwsEnabled

You should now see:

EwsEnabled : True

4. Check the existing EWS Application ID allow list

Next run:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |    Format-List EwsAllowedAppIDs

Do not overwrite any existing Application IDs.

Other applications in your Microsoft 365 tenant may also rely on EWS and therefore need to remain in the list.

5. Add the Veeam Application ID

Set the Veeam Application ID supplied by Vitanium:

$appId = "YOUR-VEEAM-APPLICATION-ID"

For example:

$appId = "a1234abc-e000-1234-asdf-asad33s8481e"

Then safely retrieve the existing list and add the Veeam application without removing any existing entries:

$current = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy).EwsAllowedAppIDs 
$updated = @($current) + $appId
$updated = $updated | Select-Object -Unique
Set-OrganizationConfig -EwsAllowedAppIDs ($updated -join ",")

Microsoft currently requires the complete allow list to be written back; there is no incremental “add one App ID” option. The commands above therefore preserve the existing entries before adding the Veeam Application ID.

6. Verify the configuration

Run:

Get-OrganizationConfig | Format-List EwsEnabled 
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |    Format-List EwsAllowedAppIDs

Confirm that:

EwsEnabled : True

and that the Veeam Application ID supplied by Vitanium appears in:

EwsAllowedAppIDs