Everything You Should Know About NAKIVO and EWS API Deprecation

Microsoft is retiring the Exchange Web Services (EWS) API for Exchange Online in favor of the Microsoft Graph API. NAKIVO Backup & Replication currently uses the EWS API to back up and recover Exchange Online data as part of Microsoft 365 backup. This article explains what is changing, how the change affects your backups, and the two actions you can take to avoid an interruption in your data protection.

This is a Microsoft-driven change. It affects every application and backup vendor that uses the EWS API, not just NAKIVO Backup & Replication.

What Is Happening

Microsoft has announced the following EWS retirement timeline:

  • Since 2025: Microsoft 365 administrators can manually disable EWS for their tenant. Some tenants may already be affected today.

  • September 2026: Microsoft pre-populates the EWS allow list (EwsAllowedAppIDs) for tenants that have not configured it, based on detected usage. Administrators remain responsible for verifying that the list is correct.

  • October 2026: Microsoft begins the phased disablement of EWS. From this point, enabling EWS without a configured allow list no longer works: an empty allow list blocks all EWS traffic. As part of the staged shutdown, Microsoft also sets EwsEnabled to False for tenants that have not taken action.

  • April 1, 2027: Microsoft removes EWS permanently for all tenants, with no exceptions. The allow-list workaround stops working on this date.

For details, refer to Microsoft's Deprecation of Exchange Web Services in Exchange Online and Introducing EWSAllowedAppIDs.

How This Affects Your Backups

NAKIVO Backup & Replication uses the EWS API to protect Exchange Online mailboxes and group mailboxes. Once EWS is disabled for your Microsoft 365 tenant, backup and recovery jobs for Exchange Online items stop working until you take action.

A job can fail without you noticing: the job continues running for OneDrive, SharePoint Online, and Teams items, while Exchange Online items fail. Make sure job alerts and email notifications are enabled so that failures do not go undetected.

To stay protected, take the following two actions:

  1. Interim: add the NAKIVO application to Microsoft's EWS allow list to keep current backups running.

  2. Permanent: update to the version of NAKIVO Backup & Replication that supports Microsoft Graph API once it is released.

Checking Whether You Are Already Affected

Because administrators have been able to disable EWS since 2025, your tenant may already be affected. Check the following:

  • In NAKIVO Backup & Replication, open the Activities page and check recent Microsoft 365 backup job runs. If EWS is disabled for your tenant, Exchange Online items (mailboxes and group mailboxes) fail with authentication or authorization errors, for example, "403 Forbidden". OneDrive for Business, SharePoint Online, and Teams items are not affected.

  • In Exchange Online PowerShell, check the current EWS configuration of your tenant:

    Get-OrganizationConfig | Format-List EwsEnabled
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

If EwsEnabled is False, or if the allow list is populated and does not include NAKIVO Backup & Replication, Exchange Online backups cannot run. Follow the steps below to restore access.

Keeping Current Backups Running Until You Update

As an interim measure, your Microsoft 365 administrator can allow the NAKIVO application to continue using EWS. NAKIVO recommends completing these steps before the end of August 2026, before Microsoft pre-populates allow lists in September and begins disabling EWS in October.

Step 1: Find Your Azure Client ID

NAKIVO Backup & Replication connects to your Microsoft 365 tenant through an Azure AD application registered in your own tenant. This application is unique to your organization, and there is no universal NAKIVO application ID.

To find the ID:

  1. In NAKIVO Backup & Replication, go to Settings > Inventory.

  2. Locate your Microsoft 365 account and click Edit.

  3. Copy the value of the Azure Client ID field.

This value is the same as the Application (client) ID shown in Microsoft Entra admin center under App registrations. If NAKIVO Backup & Replication registered the application automatically during setup, the ID is also available in the downloadable <application name>.txt file offered at that time.

For details on how the application is registered, refer to Adding Microsoft 365 Accounts.

Step 2: Verify Application Permissions

The application must keep the full_access_as_app permission from Office 365 Exchange Online, granted with admin consent.

Important

Microsoft Graph permissions alone do not keep EWS working, even if the application is added to the allow list. Do not remove the full_access_as_app permission until you have updated to the Microsoft Graph-based version of NAKIVO Backup & Replication.

To verify, open Microsoft Entra admin center > App registrations > your NAKIVO application > API permissions, and confirm that Office 365 Exchange Online > full_access_as_app is listed with admin consent granted.

Step 3: Add the Application to the EWS Allow List

In Exchange Online PowerShell:

  1. Read the current allow list:

    Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

  2. Write the full list back, keeping all existing IDs and adding your NAKIVO Azure Client ID:

    Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<existing IDs>,<NAKIVO Azure Client ID>"

Notes

  • The Set-OrganizationConfig cmdlet replaces the entire list. There is no incremental add. Always read the current list first and include every existing ID in the new value.

  • Once the allow list is populated, Exchange Online blocks every EWS application that is not on it. Include all other EWS-based applications your organization still uses.

  • Only Microsoft 365 accounts that back up mailboxes or group mailboxes use EWS. Accounts that protect only OneDrive for Business, SharePoint Online, or Teams do not require these steps.

  • NAKIVO Backup & Replication connects to the legacy host ps.outlook.com. If your network or DNS configuration blocks this host, Exchange Online backups fail regardless of the allow list.

Updating to the Microsoft Graph-Based Version

A version of NAKIVO Backup & Replication that supports Microsoft Graph API is currently in development. This article is updated once the version is available.

A detailed migration guide is published together with the release.

See Also