The HTTP request was forbidden with client authentication scheme
| KB ID: | 4796 |
| Product: |
Veeam Data Cloud
for Microsoft 365 Veeam Backup for Microsoft 365 |
| Published: | 2025-11-25 |
| Last Modified: | 2026-07-08 |
Oops! Something went wrong.
Please, try again later.
- July 2, 2026 | Veeam Customer Technical Support began observing an increase in cases reporting that jobs were failing with the same error documented in this article.
- July 3, 2026 | Microsoft engineering has implemented backend changes as part of the ongoing investigation into the issue. Customers are encouraged to retry failed operations. A detailed RCA is being discussed and is expected soon.
- July 7, 2026 | Root Cause: Microsoft engineering identified the issue with EWS access evaluation and reverted it, restoring access for the affected subset of tenants. No customer action is required.
Challenge
Microsoft 365 backups display the following error:
The HTTP request was forbidden with client authentication scheme 'Anonymous'.
This error typically occurs when specific mailboxes are accessed during backup jobs.
Cause
It was confirmed on March 27th, 2026, that Microsoft recently applied a patch to correct how Exchange Online enforces Exchange Web Services (EWS) access. Previously, some environments were able to access mailboxes via EWS even when it was not explicitly enabled (i.e., $Null status). After Microsoft corrected this behavior, EWS must now be explicitly enabled at both the organization and mailbox levels for backups to succeed.
For more information, please reference: The way to control EWS usage in Exchange Online is changing
For details about the occurrence of this issue from December 2025, please refer to the More Information section at the bottom of this article.
Solution
Microsoft Learning Center: Manage Exchange Online by using Windows PowerShell
To address the root cause of the problem, confirm and configure EWS access to be explicitly enabled at both the organization and mailbox levels:
Part 1: Set the EwsEnabled Flag at the Tenant (Organization) Level
- Review the EWS enablement status using the following PowerShell command:
- If the output is anything other than an explicit
$true, access via EWS must be enabled using the following command:
Part 2: Set the EwsEnabled Flag at the User (Mailbox) Level
- Review the list of mailboxes where the
EwsEnabledflag is not$trueusing the following PowerShell command:
- Any mailbox listed in the results from the previous step that needs to be backed up must have the
EwsEnabledflag set to$trueusing the following command:
EwsEnabled flag to $true for all mailboxes using the following PowerShell command:
Part 3: Wait and Verify Results
- Wait. The new values may take up to 24 hours to replicate and take effect.
- Re-check the backup job.
More Information
Similar Issue from December 2025
Challenge
Microsoft 365 backups display the following error:
The HTTP request was forbidden with client authentication scheme 'Anonymous'.
This error typically occurs when specific mailboxes are accessed during backup jobs.
Cause
Following a coordinated investigation with Microsoft, we have confirmed that certain subscription plans, such as Exchange Online Kiosk and similar limited-service SKUs, may not support the API required by Veeam Backup for Microsoft 365.
As a result, calls to the API return an HTTP 403 Forbidden error, causing backup jobs to fail.
Solution
Status: This issue is resolved as of December 2025.
Issue Root Cause: Mailboxes licensed with Exchange Online Kiosk, Microsoft 365, and Office 365 F1, and Microsoft 365 and Office 365 F3, were temporarily blocked from accessing the API used by Veeam for backup operations. The access has been restored, and the issue has been resolved.
For more information, please refer to the following Microsoft article: Update to EWS Access for Kiosk / Frontline Worker Licensed Users.
Veeam R&D continues to work closely with Microsoft on the upcoming deprecation of the EWS API. A future update will address these changes. A Veeam Support Statement regarding EWS deprecation is available on KB4820.
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
