restowbackup
Try demoBuy license

← Blog

On this page
  1. What is Microsoft changing, and when?
  2. Which backup tools are affected?
  3. Why are Graph-based tools unaffected?
  4. Is Restow affected?
  5. What should you check with your current backup tool?
  6. Frequently asked
  7. Sources

EWS retirement in Exchange Online: what backup tools need now

Lucas Flores By , IT Systeme Flores UG. Last updated

Illustration: blocks waiting in front of a closed barrier at an old gate, while other blocks pass through a wide open archway along a green path.

Microsoft began switching off Exchange Web Services (EWS) in Exchange Online on 1 October 2026 and will remove it for good on 1 April 2027. Backup tools that still read or restore mailboxes through EWS fail once a tenant has not allow-listed them; tools built on Microsoft Graph, Microsoft's replacement, are not affected. Restow reads Exchange Online only through Microsoft Graph, so nothing changes for it. Status 22 October 2026; the sources are listed at the end.

What is Microsoft changing, and when?

EWS is the older SOAP interface for Exchange data. Microsoft stopped investing in it for Exchange Online in 2018 and recommends Microsoft Graph instead. The retirement has four dates:

  • 19 September 2023: Microsoft announced on its Microsoft 365 developer blog that it would start blocking EWS requests from non-Microsoft apps to Exchange Online on 1 October 2026. [1]
  • 5 February 2026: the Message Center post MC1227454 set the timeline: the phased shutdown begins on 1 October 2026, and on 1 April 2027 EWS access is permanently removed with no re-enablement. Without admin action, Microsoft sets EWSEnabled to false and EWS apps stop working. [2]
  • 5 August 2026, updated on 24 August: MC1447678 describes the tenant allow list EWSAllowedAppIDs, generally available since late July 2026. From October 2026, a tenant with EWS enabled but no allow list blocks all EWS traffic except cross-tenant organization relationships. Tenants where EWSEnabled was never configured stay in Microsoft's phased process and are switched off as it reaches them. Microsoft asked admins to act by 30 September 2026. [3]
  • October 2026, updated on 21 October: the Exchange Team Blog says the change started in early October. For worldwide tenants with EWS enabled, Microsoft filled in the allow list from each tenant's recent EWS use on 10 and 11 October; after that, an admin who enables EWS has to maintain the list. Tenants where EWSEnabled was never set get a Message Center warning seven days ahead before Microsoft sets up their list and turns EWS off. On 21 October Microsoft updated its post to say that EWS disablements have started, and that re-enabling EWS will stop working in April 2027. [6][7]

Microsoft Learn gives the two outer dates in one sentence: phased disablement begins on 1 October 2026, with permanent retirement on 1 April 2027. The Exchange Team's posts of 21 October name only the month, April 2027. [8]

The change concerns Exchange Online only. EWS in Exchange Server on premises stays as it is. Because Microsoft rolls it out in phases, the day your tenant is affected is not fixed.

Which backup tools are affected?

Those that still use EWS for any part of their work: reading mailboxes, writing restored items back, or reaching archive mailboxes and public folders. Older tools and some individual functions of newer ones fall into this group. In its 2023 announcement Microsoft listed archive mailboxes, user configuration and public folders as areas where Graph had no equivalent yet; it was working on some and reviewing others. Check whether that is still true for what you rely on. One backup vendor's published guide from October 2026 says that archive-mailbox and public-folder backup in its product still need EWS and the tenant allow list. [1][5]

Why are Graph-based tools unaffected?

Because the retirement removes one interface, not the data behind it. Microsoft Graph is the interface Microsoft names as the replacement, with narrower OAuth permissions than EWS's all-or-nothing access, a REST design and one endpoint. A tool that never calls EWS has nothing to lose when EWS goes. The allow list, the EWSEnabled setting and the dates above concern EWS requests only. [4]

Is Restow affected?

No. Restow reads Exchange Online mail, calendar and contacts, OneDrive and, since 0.4.0, SharePoint Online sites through Microsoft Graph, and has never used EWS; the app registration your tenant administrator consents to carries Graph application permissions only (SharePoint backup needs one added permission and a new consent per tenant). That holds for every release so far. Exchange public folders are not part of Restow's scope. There is nothing to allow-list and no setting in your tenant that Restow needs. Restow does have its own limits, which the Roadmap and the comparison pages state openly.

What should you check with your current backup tool?

Six things, in this order. None of them needs a change in your tenant until you know the answers.

  1. Ask the vendor in writing which interface each function uses (mailbox backup, restore, archive mailboxes, public folders, import and export) and whether anything still depends on EWS.
  2. Look at your own tenant: the EWS usage reports in the Microsoft 365 admin center, or Microsoft's published scripts, show which apps still call EWS. In Exchange Online PowerShell, Get-OrganizationConfig returns the EwsEnabled setting; Microsoft's posts describe how to read and set the allow list. Read them before you change anything.
  3. Look at the job history since 1 October: failed or partial mailbox jobs with an authorization or access error are a likely first sign.
  4. Restore something from a recent backup into a separate target and compare it with the original. A backup that ran is not the same as one that restores; see how to prove that a backup can be restored.
  5. If the vendor asks you to put its app on the allow list, ask for how long: the allow list ends with EWS on 1 April 2027.
  6. Ask for the date of the Graph-based version and plan the switch well before April 2027, with a test restore on each side of it.

Frequently asked

When exactly does EWS stop working in Exchange Online?

Microsoft's phased shutdown began in early October 2026 and reaches tenants one by one: EWS requests are blocked unless the tenant has EWS enabled and an allow list of approved apps, and tenants that configured nothing are switched off after a seven-day warning in the Message Center. The permanent retirement is on 1 April 2027 according to Microsoft Learn, after which Microsoft says EWS access is removed with no re-enablement; Microsoft's latest blog posts say only "April 2027". Which day your tenant is hit is not fixed, so check it instead of waiting for an error.

Does the EWS retirement affect backup tools that use Microsoft Graph?

No. Microsoft Graph is the replacement Microsoft recommends for EWS in Exchange Online, and the retirement concerns EWS only. A tool that reads and restores mailboxes through Graph does not need EWS and is not touched by the allow list. What it still depends on are the Graph permissions and Microsoft's throttling, which have nothing to do with this change.

Does the change affect Exchange Server on premises?

No. Microsoft states that the change concerns Exchange Online only and that EWS in Exchange Server is not changed.

How do I find out whether my backup tool uses EWS?

Ask the vendor in writing which API each function uses: mailbox backup, restore, archive mailboxes, public folders, import and export. Check your own tenant too: Microsoft points admins to the EWS usage reports in the Microsoft 365 admin center and to published scripts that list which apps still call EWS.

Can I simply allow my old backup tool and carry on?

Only for a while. An admin can put an app on the tenant's allow list and keep EWS enabled until the permanent retirement on 1 April 2027. After that date nothing helps: EWS is gone. A tool that needs the allow list today needs a Graph-based version before then, so ask the vendor for the date.

Sources

Read on 14 October 2026, except sources 6 to 8, read on 22 October 2026. Message Center posts are visible to tenant administrators; the links lead to a public mirror of the post text.

  1. Microsoft 365 Developer Blog: Retirement of Exchange Web Services in Exchange Online, 19 September 2023.
  2. Microsoft 365 Message Center MC1227454: Exchange Web Services (EWS) retirement update, 5 February 2026.
  3. Microsoft 365 Message Center MC1447678: Prepare for Exchange Web Services retirement with EWSAllowedAppIDs, 5 August 2026, updated 24 August 2026.
  4. Microsoft Learn: Migrate Exchange Web Services (EWS) apps to Microsoft Graph.
  5. Druva: Exchange Online EWS retirement, status and configuration guide, a backup vendor's own account of what its product still needs EWS for.
  6. Exchange Team Blog: EWS Deprecation Is Here: What This Means To You, 21 October 2026.
  7. Exchange Team Blog: Exchange Online EWS application stopped working? Do this., 21 October 2026.
  8. Microsoft Learn: Exchange Online service description, page updated 17 February 2026.

Microsoft 365 and IMAP backup in Restow · Restow compared with 14 vendors

Read more in Learn: does Microsoft 365 back up your data? →