On Feb 5, 2026, Microsoft officially announced that EWS in Exchange Online is being deprecated. Starting Oct 1, 2026, Microsoft will begin turning off EWS usage unless it is explicitly extended via a setting. With a deliberate “Not yet!” (aka OrganizationConfig -EwsEnabled $true), EWS is expected to remain usable until Apr 2027—however, this is not a permanent setting, just a temporary extension.
So first…. What exactly is EWS?
EWS stands for Exchange Web Services and was built almost 20 years ago. For many years—and up to today—it has been used as an API interface. In general, this interface no longer meets today’s requirements for security, scalability, or reliability, which is why Microsoft developed the Microsoft Graph API.
By now, the Microsoft Graph interface provides near-complete functionality parity for most EWS scenarios. Microsoft’s own applications have either already migrated away from EWS or are close to finishing. Many third-party vendors have also already transitioned to Graph API or are actively doing so.
Retiring EWS allows Microsoft to reduce legacy attack surface, simplify platform behavior, and deliver a more consistent, modern experience for everyone.
How is EWS being turned off over time?
EWS is being disabled tenant by tenant using a setting (OrganizationConfig -EwsEnabled <value>). As of today, the setting supports three values that determine whether EWS is still active for the tenant and how long it can be used. In addition, since early 2025 there has been a new feature allowing admins to define an App-ID allowlist, so that only those apps can use EWS.
EwsEnabled | until 10/2026 | starting 10/2026 | until 4-2027 |
|---|---|---|---|
| True | All EWS access allowed | Only apps in the allowlist allowed | All EWS access blocked |
| False | All EWS access blocked | All EWS access blocked | All EWS access blocked |
| Null | All EWS access allowed | All EWS access blocked (auto-converted to False) | All EWS access blocked |
Any tenant where EWSEnabled is still set to Null on Oct 1, 2026 will be changed to False as the rollout progresses. This will block EWS for all applications in the tenant at that time.
If you proactively configure an allowlist and set EWSEnabled to True by the end of August 2026, your tenant will be excluded from the automatic Oct 1 change to EWSEnabled = False.
For customers who have not created an allowlist before September 2026, Microsoft will pre-populate/adjust the allowlist in advance based on the tenant’s actual usage.
Ok… ok…. ok….
“Fine, I’ll just use Graph API.”
In principle, that’s a good and correct decision—but… Graph API is not yet 100% feature-parity with EWS.
Microsoft maintains a dedicated “Parity Gaps” roadmap, i.e., what Graph is still missing compared to EWS:
Source: Microsoft Learn – Deprecation of EWS in Exchange Online
Examples of items that are not yet fully supported via Graph API (as of May 2026) include:
- Public Folders
- Microsoft 365 Group Mailboxes
- Archive Mailboxes
- Certain admin/management/discovery-related operations
- Sticky Notes / specific mailbox item types
What does this mean for Veeam (VDC M365 / VBM365)?
Veeam published a Knowledge Base Artikel and essentially states:
- Today, Exchange Online backup functionality is still implemented (also) via EWS.
- Moving to Graph is an ongoing process. Veeam is coordinating with Microsoft and will continuously expand functionality in VDC M365 and VBM365 in line with Graph API development. A lot of things at Veeam are already being backed up and restored via the Graph API, but there are still some areas that are accessed via EWS for now (but will change as soon as it is possible).
- A complete migration depends partly on when Microsoft delivers the missing Graph capabilities.
“Can’t I just disable EWS globally to force Graph?”
Technically: Yes, EWS can be disabled at the org level or mailbox level.
However, you should only do that if you are sure that all workloads/objects are fully covered via Graph API.
My recommendation
- If needed, set
EwsEnabled = $trueto keep EWS usable longer (per KB4820) in case Graph gaps are still relevant. - Veeam is working in parallel on changes in Veeam Data Cloud for Microsoft 365 (VDC M365) and Veeam Backup for Microsoft 365 (VBM365)—but Graph still cannot do everything EWS could (yet).
Further links
Microsoft announcement (Feb 5, 2026):
https://techcommunity.microsoft.com/blog/exchange/exchange-online-ews-your-time-is-almost-up/4492361
Microsoft parity gaps roadmap for EWS vs Graph:
https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-ews-exchange-online#roadmap-for-parity-gaps
Veeam KB4820 – Support Statement — EWS Deprecation:
https://www.veeam.com/kb4820
