Microsoft EWS Deprecation: What It Means for Your Microsoft 365 Backups
Microsoft is retiring Exchange Web Services (EWS), a legacy interface that applications have relied on for years to reach Exchange Online data. This is a Microsoft-driven change on a fixed timeline, and it affects every backup vendor whose Microsoft 365 protection depends on EWS, not any single product.
NAKIVO Backup & Replication currently uses EWS to back up Microsoft 365 mailboxes. If you protect Microsoft 365 with NAKIVO, the change applies to you, but the response is a single, one-time step. This post explains what is changing, why, who is affected and exactly what to do to keep your mailbox backups running.
Key Takeaways
- Configure the Microsoft EWS allow list before the end of August 2026 to keep your mailbox backups running without interruption.
- Microsoft begins blocking EWS on October 1, 2026, and removes it permanently on April 1, 2027.
- Because administrators have been able to disable EWS since 2025, some tenants may already be affected. Check your recent Exchange Online backup jobs.
- Only mailbox and group-mailbox backups are affected — OneDrive, SharePoint Online and Microsoft Teams backups are not.
What Is EWS, and Why Is Microsoft Retiring It?
Exchange Web Services is an application programming interface (API) that Microsoft launched almost two decades ago to let external applications read and write Exchange data such as mail, calendars and contacts. Backup tools have long relied on it to protect Exchange Online mailboxes.
Microsoft is retiring EWS because the aging protocol no longer meets modern requirements for security, scalability and reliability. It is being replaced by the Microsoft Graph API, the current unified way to reach Microsoft 365 data. Microsoft set the disablement date back in 2023 and has been moving its own products off EWS since. You can read Microsoft’s official deprecation notice for the full background.
The change applies only to Exchange Online. On-premises Exchange Server is not affected.
Microsoft’s EWS Deprecation Timeline
Microsoft has published a phased timeline. The most important date for customers using NAKIVO Backup for Microsoft 365 is the end of August 2026: Acting before then means a clean transition with no service interruption.
|
Date |
What happens |
|
Since 2025 |
Microsoft 365 administrators can already disable EWS for a tenant, so some environments may be affected today. Check now whether your Exchange Online backups are still completing. |
|
End of August 2026 |
Microsoft’s recommended deadline to configure the EWS allow list for NAKIVO Backup & Replication. Microsoft excludes these tenants from the automatic blocking in October, so your backups continue with no interruption. |
|
September 2026 |
For tenants that have not configured an allow list, Microsoft pre-populates one based on detected usage. You remain responsible for verifying it includes your instance of NAKIVO Backup & Replication. |
|
October 1, 2026 |
Microsoft begins phased blocking of EWS. Tenants left unconfigured have EwsEnabled set to false and affected mailbox backups stop. Re-enabling EWS is possible but requires admin action and causes a service interruption. |
|
April 1, 2027 |
Microsoft removes EWS permanently for all tenants, with no exceptions. |
What You Need to Do
To keep your mailbox backups running, add your instance of NAKIVO Backup & Replication to the Microsoft EWS allow list. The main steps are:
- Find your Azure Client ID in NAKIVO Backup & Replication. Go to Settings > Inventory, select your Microsoft 365 account and click Edit.
- In the Azure portal, verify that the application has the full_access_as_app permission from Office 365 Exchange Online, granted with admin consent. Microsoft Graph permissions alone do not keep EWS working.
- With PowerShell, read the current allow list of your tenant.
- With PowerShell, write the allow list again. Include the application IDs that are already in the list, and add your Azure Client ID. In the same command, set EWS to enabled.
Important: The Microsoft cmdlet replaces the full allow list. There is no command to add one application ID. If you write only your Azure Client ID, Exchange Online blocks every other EWS application in your tenant.
For the full step-by-step instructions, including the exact PowerShell commands, see the Help Center guide: Everything You Should Know About NAKIVO and EWS API Deprecation.
The allow list is a temporary bridge. The permanent solution is a new version of NAKIVO Backup & Replication that uses the Microsoft Graph API, which is currently in development.
Once it is released, updating removes your dependence on EWS entirely, so the April 2027 removal does not affect your backups. Watch for the release announcement on our channels.
Conclusion
The retirement of EWS is a broad change across Microsoft 365, but for NAKIVO customers the response is small and clear: Configure the EWS allow list before the end of August 2026, then move to the Graph-based version when it is released. Taking the interim step now keeps your backups running without disruption. For the complete instructions, see the Help Center guide on EWS API deprecation.
FAQ
Will my Microsoft 365 backups stop working on October 1, 2026?
Your mailbox backups in NAKIVO Backup & Replication keep running if you configure the EWS allow list before the end of August 2026. Microsoft begins blocking EWS on October 1, 2026, but tenants that have added their instance of the NAKIVO solution to the allow list are unaffected and continue without interruption.
Does this affect my OneDrive, SharePoint, or Teams backups?
No. Only Exchange Online mailbox and group-mailbox backups rely on EWS. OneDrive for Business, SharePoint Online and Microsoft Teams backups are not affected.
What happens if I do nothing before the deadline?
On October 1, 2026, Microsoft begins blocking EWS for tenants that have not acted, and affected mailbox backup jobs will stop working. Re-enabling EWS afterward causes a service interruption, so acting early is the cleaner path.
