What's happening
Microsoft is disabling Exchange Web Services (EWS) in Exchange Online by default on October 1, 2026, with permanent shutdown on April 1, 2027.
What Veeam is doing
Veeam is actively transitioning Exchange backup from EWS to Microsoft Graph. However, Microsoft has not yet completed all the Graph API capabilities required for incremental backup. Until that gap is closed, EWS must remain accessible for Exchange Online backups to continue. An updated product release supporting the full transition is in development.
What you need to do before October 1, 2026
Most tenants have EWSEnabled at its default value of $null. This is not the same as $true — on October 1, Microsoft will automatically flip $null to $false, blocking EWS for all apps. You need to explicitly set it to $true before that happens.
Review EWS usage in the Microsoft 365 Admin Center and add your Veeam app IDs to EWSAllowedAppIDs. Microsoft may pre-populate this list, but you are responsible for validating it.
Grant the required Microsoft Graph permissions to your Veeam app registrations in Entra ID.
Upgrade to the updated product release when available.
What happens if you miss October 1
EWS will be automatically disabled for your tenant and your backups will start failing. You can re-enable EWS after the fact — but you will have a backup gap, and the first backup after re-enabling will be a full sync instead of incremental.
More information
For full instructions, see KB4820
If i understand correctly, this version only handles the Graph permission settings required after EWS is deprecated? We still have to enable EWS on tenant level and check the EWS App ID allow list?
I’d like to join the question and clarify the point: with Veeam Backup for Microsoft 365 8.6, is full support for the EWS deprecation and the transition to Microsoft Graph now provided?
Or do we still need to manually enable EWS on the tenant level and configure the Veeam App IDs in the EWS allow list until EWS is fully retired?
v8.6 only handles the permission settings which will be required to transition to Graph APIs.
It still uses EWS for mailbox backup, and you need to enable EWS access manually and check the EWS app ID allow list.
I believe the KB (https://www.veeam.com/kb4820) still needs to be updated to reflect the recent changes regarding the automatic assignment of the new Microsoft Graph API permissions.
I would also appreciate a clearer statement that, even though the new Graph API permissions are already being created and assigned, the product still appears to rely on EWS for the Exchange Online backup/restore operations. At least that's my current understanding, but the documentation/KBs is not entirely clear on this point.
Without that clarification, it's easy to assume that once the Graph permissions are in place, EWS is no longer required, while in reality EWS access may still be necessary until the migration is fully completed.
Although I kind of understand the confusion about the api permissions being needed, there are numerous lines in KB4820 that make very clear that EWS is still needed, some quotes:
<quote>EWS must remain accessible for Exchange Online backups to continue.</quote>
<quote>Keep EWS enabled in your tenant</quote>
<quote>Ensure Veeam's App IDs are on the allow list.</quote>
<quote>Ensure EWS access is enabled</quote>
<quote>An updated product release supporting the full EWS-to-Graph transition is in development. You will need to upgrade to that release when it becomes available.</quote>
<quote>Once EWS access is blocked for your tenant, Exchange Online mailbox backups will fail</quote>
Personally I don't quite get why Veeam is pushing so hard to get these permissions already in place. Once you upgrade, to whatever version eventually will have backup using graph, that will be the moment to update api permissions. Perhaps functionally might not even be 100% the same, you'd probably have to communicate anyway with your customers. But that's just my line of thinking. The advance push just creates confusion, as apparent in the forums last few months.