Step 2: Manage your EWS App ID allow list
Microsoft has introduced EWSAllowedAppIDs, an allow list that controls which Entra ID app registrations are permitted to use EWS. The allow list takes effect as soon as it contains at least one entry. When EwsEnabled is set to $true and the list is populated, only the applications on that list can make EWS calls.
What changes starting October 1, 2026? An empty EWSAllowedAppIDs list will cause all EWS access to be blocked, even if EwsEnabled is set to $true.
Veeam's App IDs must therefore be included the first time the allow list is populated. Populating the list without them will block Veeam backups immediately, before October 1, 2026.
Will Microsoft populate this list for me?
Yes — Microsoft will automatically pre-populate the EWSAllowedAppIDs allow list based on each tenant's observed EWS usage, but only for tenants where the list has not already been configured. Note that this applies whether your current EwsEnabled value is $null or $true.
However, Microsoft recommends that admins create and validate their own list rather than relying on automatic population. The automatically populated list may include apps you are no longer aware of or wish to permit, and you, the admin, are responsible for ensuring the list is correct.
Microsoft's guidance: “Configure or validate the EWSAllowedAppIDs allow list (remember, we said we would populate this for tenants who have not done so, but the admin owns ensuring it's correct).”
What you need to do
- Review EWS usage in your tenant.
- For Veeam Backup for Microsoft 365, open the Organizations view, right-click the Microsoft 365 organization, and select Edit Organization. The Application ID is listed in the application settings. For details, review Using Existing Microsoft Entra Application.
- For Veeam Data Cloud
for Microsoft 365 use the EWS Usage Reports in Microsoft 365 Admin Center to identify App IDs currently making EWS calls.
Note: For Veeam Data Cloud
for Microsoft 365 customers, an automated way to enable EWS access is available. See Step 3.
- Ensure Veeam's App IDs are on the allow list. Veeam app registrations must be included so that backups can continue using EWS during the period before the Microsoft Graph transition is complete.
- Review and remove any app IDs you no longer need. This is a good opportunity to clean up stale registrations.
The allow list is configured in Exchange Online and is documented by Microsoft. Before making any changes, review Introducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement, which provides the commands for viewing and setting the list, how to add an entry without discarding the entries already there, and how long a change takes to apply.
