Everything You Should Know About NAKIVO and EWS API Deprecation

Microsoft is retiring the Exchange Web Services (EWS) API for Exchange Online in favor of the Microsoft Graph API. NAKIVO Backup & Replication currently uses the EWS API to back up and recover Exchange Online data as part of Microsoft 365 backup. This article explains what is changing, how the change affects your backups, and the two actions you can take to avoid an interruption in your data protection.

This is a Microsoft-driven change. It affects every application and backup vendor that uses the EWS API, not just NAKIVO Backup & Replication.

What Is Happening

Microsoft has announced the following EWS retirement timeline:

  • Since 2025: Microsoft 365 administrators can manually disable EWS for their tenant. Some tenants may already be affected today.

  • September 2026: Microsoft pre-populates the EWS allow list (EwsAllowedAppIDs) for tenants that have not configured it, based on detected usage. Administrators remain responsible for verifying that the list is correct.

  • October 2026: Microsoft begins the phased disablement of EWS. From this point, enabling EWS without a configured allow list no longer works: an empty allow list blocks all EWS traffic. As part of the staged shutdown, Microsoft also sets EwsEnabled to False for tenants that have not taken action.

  • April 1, 2027: Microsoft removes EWS permanently for all tenants, with no exceptions. The allow-list workaround stops working on this date.

For details, refer to Microsoft's Deprecation of Exchange Web Services in Exchange Online and Introducing EWSAllowedAppIDs.

How This Affects Your Backups

NAKIVO Backup & Replication uses the EWS API to protect Exchange Online mailboxes and group mailboxes. Once EWS is disabled for your Microsoft 365 tenant, backup and recovery jobs for Exchange Online items stop working until you take action.

A job can fail without you noticing: the job continues running for OneDrive, SharePoint Online, and Teams items, while Exchange Online items fail. Make sure job alerts and email notifications are enabled so that failures do not go undetected.

To stay protected, take the following two actions:

  1. Interim: add the NAKIVO application to Microsoft's EWS allow list to keep current backups running.

  2. Permanent: update to NAKIVO Backup & Replication v11.2.3 or later, which uses the Microsoft Graph API.

Checking Whether You Are Already Affected

Because administrators have been able to disable EWS since 2025, your tenant may already be affected. Check the following:

  • In NAKIVO Backup & Replication, open the Activities page and check recent Microsoft 365 backup job runs. If EWS is disabled for your tenant, Exchange Online items (mailboxes and group mailboxes) fail with authentication or authorization errors, for example, "403 Forbidden". OneDrive for Business, SharePoint Online, and Teams items are not affected.

  • In Exchange Online PowerShell, check the current EWS configuration of your tenant:

    Get-OrganizationConfig | Format-List EwsEnabled
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

If EwsEnabled is False, or if the allow list is populated and does not include NAKIVO Backup & Replication, Exchange Online backups cannot run. Follow the steps below to restore access.

Keeping Current Backups Running Until You Update

As an interim measure, your Microsoft 365 administrator can allow the NAKIVO application to continue using EWS. NAKIVO recommends completing these steps before the end of August 2026, before Microsoft pre-populates allow lists in September and begins disabling EWS in October.

Step 1: Find Your Azure Client ID

NAKIVO Backup & Replication connects to your Microsoft 365 tenant through an Azure AD application registered in your own tenant. This application is unique to your organization, and there is no universal NAKIVO application ID.

To find the ID:

  1. In NAKIVO Backup & Replication, go to Settings > Inventory.

  2. Locate your Microsoft 365 account and click Edit.

  3. Copy the value of the Azure Client ID field.

This value is the same as the Application (client) ID shown in Microsoft Entra admin center under App registrations. If NAKIVO Backup & Replication registered the application automatically during setup, the ID is also available in the downloadable <application name>.txt file offered at that time.

For details on how the application is registered, refer to Adding Microsoft 365 Accounts.

Step 2: Verify Application Permissions

The application must keep the full_access_as_app permission from Office 365 Exchange Online, granted with admin consent.

Important

Microsoft Graph permissions alone do not keep EWS working, even if the application is added to the allow list. Do not remove the full_access_as_app permission until you have updated to the Microsoft Graph-based version of NAKIVO Backup & Replication.

To verify, open Microsoft Entra admin center > App registrations > your NAKIVO application > API permissions, and confirm that Office 365 Exchange Online > full_access_as_app is listed with admin consent granted.

Step 3: Add the Application to the EWS Allow List

In Exchange Online PowerShell:

  1. Read the current allow list:

    Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

  2. Write the full list back, keeping all existing IDs and adding your NAKIVO Azure Client ID:

    Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<existing IDs>,<NAKIVO Azure Client ID>"

Notes

  • The Set-OrganizationConfig cmdlet replaces the entire list. There is no incremental add. Always read the current list first and include every existing ID in the new value.

  • Once the allow list is populated, Exchange Online blocks every EWS application that is not on it. Include all other EWS-based applications your organization still uses.

  • Only Microsoft 365 accounts that back up mailboxes or group mailboxes use EWS. Accounts that protect only OneDrive for Business, SharePoint Online, or Teams do not require these steps.

  • NAKIVO Backup & Replication connects to the legacy host ps.outlook.com. If your network or DNS configuration blocks this host, Exchange Online backups fail regardless of the allow list.

Updating to the Microsoft Graph-Based Version

The permanent solution is to update to NAKIVO Backup & Replication v11.2.3 or later. After the update, the product uses the Microsoft Graph API for Exchange Online operations and no longer needs the EWS allow list. Read What Changes in Microsoft Graph Mode before you update.

The expert setting system.o365.mailbox.api.mode controls which connection method the product uses for Exchange Online discovery, backup, and recovery:

Value

Behavior

graphonly (default)

The product uses the Microsoft Graph API for all Exchange Online operations.

ews

The product uses EWS for Exchange Online operations, while EWS is available.

What Changes in Microsoft Graph Mode

The product backs up mail, mail folders, mail attachments, contacts, calendar events, and calendar attachments exactly as before. The following table lists only the object types that behave differently. Every other object type is unchanged.

Object type

EWS mode

Microsoft Graph mode

Public Folders

Backed up

Not backed up

In-Place Archive

Backed up

Not backed up

Contact Lists (Outlook distribution lists)

Backed up

Not backed up

Litigation Hold content

All item types in the container are backed up

Email items and their attachments only

In-Place Hold content

All item types in the container are backed up

Email items and their attachments only

Important

After the switch to Microsoft Graph mode, the first run of each Exchange Online backup object is a full backup that starts a new recovery point chain. This run takes longer than a regular incremental run. Plan your backup schedule accordingly before switching.

Frequently Asked Questions

Is my existing backup data safe after the update?

Yes. Every recovery point created before the update stays available for recovery. The product starts a new recovery point chain and does not change the old one.

The first backup after the update takes much longer than usual. Is something wrong?

No. The first run of each Exchange Online object is a full backup on a new chain. Later runs use the configured run type again.

Can I go back to EWS after the product ran in Microsoft Graph mode?

Yes, while Microsoft still supports EWS. Set system.o365.mailbox.api.mode to ews. The change causes one more full backup for each Exchange Online object. Microsoft removes EWS permanently on April 1, 2027.

Why can I not back up Public Folders, the In-Place Archive, or Contact Lists anymore?

The Microsoft Graph API has no operation for this content. This limitation comes from Microsoft and applies to all backup vendors.

Where does the product recover Public Folder, In-Place Archive, or Contact List content?

Into the Recovered Legacy Items folder of the mailbox that you select for the recovery.

Do I have to update immediately?

No. You can keep using EWS with the allow-list workaround until April 1, 2027. Updating to v11.2.3 or later is the permanent solution and does not require any workaround.

See Also