Support Statement — Exchange Web Services Deprecation
| KB ID: | 4820 |
| Product: |
Veeam Data Cloud
for Microsoft 365 Veeam Backup for Microsoft 365 |
| Published: | 2026-03-25 |
| Last Modified: | 2026-06-12 |
Oops! Something went wrong.
Please, try again later.
Challenge
Microsoft has announced the deprecation of Exchange Web Services (EWS) in Exchange Online, with the initial phase-out target of October 1, 2026.
Veeam Backup for Microsoft 365 and Veeam Data Cloud for Microsoft 365 currently leverage EWS for Exchange Online backup functionality.
Note: This article previously stated, "Starting July 1, 2026, Microsoft will begin blocking EWS access for Frontline Worker mailbox types (Kiosk, F1, and F3) as the first enforcement step of the EWS deprecation." However, on June 11, Microsoft updated the blog post titled "Update to EWS Access for Kiosk / Frontline Worker Licensed Users" to change that deadline to October 1, 2026.
Solution
Veeam software that currently uses EWS will be transitioned to the Microsoft Graph API to ensure continued compatibility and data protection capabilities.
As part of this transition, permission changes are required for all Veeam customers protecting Microsoft 365 data.
- For Veeam Data Cloud for Microsoft 365 customers, the application logic will be updated in the service. Performing app reauthorization will assign the permissions necessary.
- For Veeam Backup for Microsoft 365, an upcoming release will provide support for the transition from EWS to Microsoft Graph.
Preparing for the October 1, 2026 EWS Retirement
Although EWS remains available today, administrators can prepare now so that backups continue without interruption once EWS access is retired. Complete the applicable steps below for your Veeam product.
Veeam Data Cloud for Microsoft 365 — Required Action
To prepare for the retirement of EWS access, a Microsoft 365 Global Admin must reauthorize the Veeam Data Cloud application:
- Log in to the Veeam Data Cloud portal.
- Go to Settings → Microsoft 365 → Reauthorize Veeam Data Cloud.
- Click Reauthorize existing app registration.
Veeam Backup for Microsoft 365 — Required Action
To prepare for the retirement of EWS access, add the following Microsoft Graph permissions to the backup app registrations in Microsoft Entra ID.
For Backup Operations
| Permission | Type |
User.Read.All |
Application |
MailboxItem.ImportExport.All |
Application |
MailboxItem.Read.All |
Application |
MailboxFolder.ReadWrite.All |
Application |
Note: User.Read.All (Application) is already present in your backup app registration if you are protecting SharePoint Online. No action is needed for this permission in that case.
For Restore Operations
| Permission | Type |
User.Read.All |
Delegated |
MailboxItem.ImportExport |
Delegated |
MailboxItem.Read |
Delegated |
MailboxFolder.ReadWrite |
Delegated |
What happens if permissions are not added before the EWS deprecation?
Once Microsoft retires EWS access, backups will fail until the required permissions are added. You can add the permissions at any time and backups will resume; however, the first backup afterward will be a full sync backup, and a coverage gap will exist during the period the permissions were missing.
Veeam Backup for Microsoft 365 customers will also need to upgrade to the upcoming release once it becomes available.
Known Issues
Exchange protection via Microsoft Graph has the following limitations:
- Archive mailboxes are not supported. Backup jobs will complete successfully, but archive data will be skipped.
- Restore to Non-IPM folders (system folders outside the standard mailbox tree, such as Recoverable Items, Audits, and Calendar Logging) is not supported. The export or save operations may be used as an alternative.
More Information
Should you find that EWS has been turned off for your Microsoft 365 organization before the expected Microsoft EWS phase-out date, you can manually configure EWS access with PowerShell (see Control access to EWS in Exchange).
Note: The default value for Get-OrganizationConfig -EwsEnabled is $null. We recommend you set this to Set-OrganizationConfig -EwsEnabled $true until the phase-out period to avoid possible service interruptions.
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
Spelling error in text
Thank you!
Your feedback has been received and will be reviewed.
KB Feedback/Suggestion
This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
Thank you!
Your feedback has been received and will be reviewed.
Oops! Something went wrong.
Please, try again later.