Microsoft is retiring Exchange Web Services (EWS): what it means for your SysCloud backup

Applies to: SysCloud Backup for Microsoft 365 (Outlook / Exchange Online) Last updated: 12/08/2026

Summary

Your backups keep running. Mailbox, group mailbox, OneDrive, SharePoint, and Teams backup already use Microsoft Graph and are not affected.
Three things use EWS today: email restore, In-Place Archive backup, and Public Folder backup.
We recommend one action: add SysCloud to your tenant's EWS allow list before the end of August 2026. This keeps everything working while we complete our move to Microsoft Graph.

Timeline

Date	What happens
End of August 2026	Recommended deadline to allow-list SysCloud
October 1, 2026	Microsoft starts disabling EWS tenant by tenant
October 1, 2026	EWS blocked for Kiosk, F1, and F3 licensed mailboxes, this cannot be extended
April 1, 2027	EWS permanently disabled, no exceptions

What's affected

Microsoft is retiring Exchange Web Services (EWS), a legacy API that SysCloud uses for part of its Exchange Online protection. Microsoft begins disabling it on October 1, 2026 and shuts it down permanently on April 1, 2027.

This applies to Exchange Online only. On-premises Exchange is not affected.

SysCloud function	Status
Mailbox and group mailbox backup	Not affected, already on Microsoft Graph
OneDrive, SharePoint, Teams, other apps	Not affected
Email restore	Uses EWS. Moving to Microsoft Graph, in testing now.
In-Place Archive backup	Uses EWS. Microsoft has not released a Graph replacement.
Public Folder backup	Uses EWS. Microsoft does not plan to release a Graph replacement.

Action required

Add SysCloud to your EWS allow list

Complete this before the end of August 2026. This keeps email restore, In-Place Archive backup, and Public Folder backup working until April 2027.

SysCloud Application ID: 4a3afd06-fa56-4e64-a5a3-c3b728345247

Connect to Exchange Online PowerShell as a Global Administrator:
Connect-ExchangeOnline
Check for an existing allow list:
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled, EwsAllowed
Enable EWS and allow SysCloud:
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "4a3afd06-fa56-4e64-a5a3-c3b728345247"
Important: this replaces your allow list rather than adding to it. If step 2 showed existing app IDs, include them too, separated by commas.
Run the command from step 2 again to confirm.

Note: enabling EWS without an allow list will not work after October 1, 2026. Both settings are required.

If you use Kiosk, F1, or F3 licenses

Microsoft blocks EWS for these licenses from October 1, 2026, and the allow list will not override it.

No action is needed from you, backup for these mailboxes already uses Microsoft Graph, and we are releasing a Graph-based restore path for them before October 1.

If you do nothing

Data already backed up stays fully retained, searchable, and exportable in all cases.
From the point EWS is disabled in your tenant, email restore will fail, and In-Place Archive and Public Folder backup will pause.
You can enable EWS at any time up to April 1, 2027, including after a failure and normal operation resumes.

What SysCloud is doing

Email restore is moving to Microsoft Graph and will be released before October 1, 2026. A Global Administrator will need to reauthorize the SysCloud app when it ships, we will email you with instructions.
In-Place Archive backup will resume as soon as Microsoft provides a Graph API. We are tracking their roadmap.
Public Folders: Microsoft's guidance is to migrate public folder content to Microsoft 365 Groups, which SysCloud already backs up through Graph.

Need help?

Contact our support team.

Microsoft references