Use this path to temporarily retain EWS access while you transition eligible Exchange Online workloads to Microsoft Graph.
Extending EWS keeps your current backups running until March 31, 2027. Choose this path if any of the following applies:
-
You protect public folders (limited support, expected EOL early 2027).
-
You run Commvault Software and protect Microsoft 365 Group mailboxes, which need release 11.44 on October 6, 2026 -- after Microsoft begins blocking EWS.
-
You cannot assign the required Graph permissions and Exchange roles before October 1, 2026.
-
You need time to test Graph protection before you rely on it.
Important
Extending EWS delays the block. It does not remove it.
Extend EWS Access
Extending EWS takes three commands. Run them in Exchange Online PowerShell.
Connect-ExchangeOnline
1. Check Your Current Setting
EWSEnabled has three values. Find yours before you change anything.
Get-OrganizationConfig | Format-List EWSEnabled
| Your Current Value | What Happens on October 1, 2026 |
|---|---|
| Null (the default -- most tenants) | Microsoft changes it to False. EWS is blocked for every application in your tenant. |
| True | EWS stays enabled, but only for the applications on your allow list. |
| False | EWS stays blocked. |
2. Set EWSEnabled to True
Set-OrganizationConfig -EwsEnabled $true
Setting this explicitly protects your tenant from the automatic change on October 1.
3. Add Commvault to Your Allow List
View your current list.
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |
Format-List EwsAllowedAppIDs
The -RetrieveEwsOperationAccessPolicy switch is required because Exchange returns the list only when you ask for it.
Set the list.
Set-OrganizationConfig -EwsAllowedAppIDs "commvault-app-id,your-other-app-ids"
Important
This command replaces the entire list. There is no incremental add, so include every application ID you want to keep, not only Commvault's.
For the Commvault application IDs, see Transitioning to the Microsoft Graph API for M365 - Exchange Online.
Changes can take up to 24 hours to take effect. Wait before you test or troubleshoot.
If You Have Not Configured a List
Microsoft pre-populates the allow list for tenants that have not configured one, based on the EWS activity it observes. This is a safety net, not a plan. The generated list can include applications you no longer want to permit, and you remain responsible for it being correct. Review it and set your own.
Extending EWS delays the block. It does not remove it.