KB4820 - EWSAllowedAppID clarify

[adam900331]

Hello!

I want to make sure, that the Exchange Online backup will work after October 1. I checked the KB4820, but I want to ask some clarification about EWSAllowedAppID. The KB say: "However, Microsoft recommends that admins create and validate their own list rather than relying on automatic population. The automatically populated list may include apps you are no longer aware of or wish to permit, and you, the admin, are responsible for ensuring the list is correct."

What do I have to do to add the AppId to the EWSAllowedAppID? What doeat it meean? I checked this command Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy and the EWSAllowedAppID parameter is empty. There is an app in our tenant: Veeam_Backup_for_Microsoft_365_App

Note, I have already set EwsEnabled to True.

Please help me.

Thanks,
Adam

[DaStivi]

You need to check the EWS Usage Report in the M365 Admin Portal.
There you’ll find the AppIds that are using EWS (it might be more than just Veeam Backup that still relies on EWS).

With those AppIds, you can then search in the Entra Admin Center for the corresponding app names. Be aware, though: the search box there doesn’t work directly with AppIds, so you’ll need to filter manually – another little catch.

Also, after setting the parameters via Exchange Online PowerShell, it can take up to 24 hours for the AppIds to be reflected when you check with a Get-OrganizationConfig PowerShell cmdlet.

Code: Select all

Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "AppID1,AppID2,..." 

#wait 24-hours:
Get-OrganizationConfig | fl ewsenabled,ewsallowedAppIDs

When you only enable the EwsEnable parameter, Microsoft may populate the AppIds automatically. However, this can result in EWS-related application permissions being granted that you no longer want to allow.

[adam900331]

Hy DaStivi!

I checked the EWS Usage Report in the M365 Admin Portal. I see many AppIds (not only the Veeam App). Do I have to add all of the AppIds?

Thanks.

[DaStivi]

Hi, yes, absolutely!

You need to add all App IDs from the list. I would recommend double-checking which application is associated with each App ID, as these applications should be migrated to Microsoft Graph API by April 2027, based on Microsoft's current guidance.

For example, I also found the first-party application Microsoft Outlook in that list. It does not appear under the tenant's App Registrations because first-party Microsoft applications are typically represented only by their App IDs. However, you can find public lists of Microsoft first-party App IDs online to identify them.

Another example I came across was a Teams/calling presence application that uses EWS to read calendar and presence-related status information. In this case, the vendor of the telephony system needs to take action and migrate their solution away from EWS before Microsoft's deadline.

Finding these App IDs is a good opportunity to identify third-party products that still rely on EWS and to engage the respective vendors early, rather than waiting until the service is eventually retired.

Microsoft also explicitly states in the article that even first-party applications must be added manually. Once you enable the EWSEnabled flag and configure the EWSAllowedAppIds list, only the applications included in that allow list will be permitted to use EWS.

This means that first-party Microsoft applications are not automatically exempt. If a first-party application still relies on EWS, its App ID must also be added to the allow list, as documented by Microsoft.

https://techcommunity.microsoft.com/blo ... nt/4529471

[adam900331]

Hello,

I added all of the AppIds that uses EWS on Monday. I run the Get-OrganizationConfig | fl ewsenabled,ewsallowedAppIDs command and the EwsAllowedAppIDs paramter is empty. EwsEnabled is True.

Why can not see the AppIDs?

But now, all of the mailboxes got the following warning: Processing mailbox completed with warning: The HTTP request was forbidden with client authentication scheme 'Anonymous'. Total count of failed items: 1 (mailbox: ) :: 0:00:05

I checked this KB: https://www.veeam.com/kb4796

The EWSEnabled paramter is ture on the tenant level and also the mailbox level.

Thanks.