This article is Applicable for Cloud Backup for Microsoft 365; Exchange Online (Mail, Calendar, Contacts, Tasks, Archive Mailbox, Public Folder)
Summary
Microsoft is retiring Exchange Web Services (EWS) for Exchange Online. Take action by August 31, 2026 if your organization backs up Archive Mailboxes or Public Folders. Druva has migrated Mail, Calendar, Contacts, and Tasks backups to Microsoft Graph, but Archive Mailbox and Public Folder backups still require EWS.
Complete the required configuration by August 31, 2026 to avoid backup disruptions following Microsoft's October 1, 2026 enforcement and remain supported until the final EWS cutoff on April 1, 2027.
This article covers where Druva's Exchange Online integration stands today (July 2026), and the configuration required to keep the backups running through the transition.
Do you Need to Take Action?
Yes, only if any of these apply to you:
Your organization backs up Archive Mailboxes through Druva
Your organization backs up Public Folders through Druva
Any mailboxes you protect are licensed as Kiosk, F1, or F3
No, if you only back up:
Mail
Calendar
Contacts
Tasks
(These are already migrated to Microsoft Graph and require no action.)
Microsoft's Timeline
Date | What Happens |
By end of August 2026 | Recommended window to configure your tenant's EWS settings before Microsoft's automatic enforcement begins. |
October 1, 2026 | Microsoft begins phased EWS disablement. Tenants without EWS explicitly enabled are switched to |
October 1, 2026 | EWS is blocked for mailboxes licensed only as Exchange Online Kiosk, Microsoft 365/Office 365 F1, or Microsoft 365/Office 365 F3. No tenant configuration can override this. These license types do not carry EWS rights. |
October 1, 2026 | Microsoft restricts programmatic access to Public Folders to Outlook clients and bulk import/export only. No Graph API replacement exists. |
April 1, 2027 | EWS is fully and permanently disabled for all tenants. |
Druva's Migration Status
Druva is targeting October 1, 2026 (Microsoft's enforcement date) to complete migration of Cloud Backup for Microsoft 365's Exchange Online integration to Microsoft Graph, for every workload where a Graph equivalent exists.
Status | Workload |
Live on Microsoft Graph today |
|
In progress, on track for October 1, 2026 |
|
Blocked on Microsoft - no Graph API exists | Archive Mailbox backup and restore |
No Microsoft-supported path exists | Public Folder backup and restore |
Known Microsoft Graph Gaps
Microsoft 365 Group Mailboxes, Archive Mailboxes, and Public Folders
Microsoft Graph does not support Microsoft 365 Group mailboxes, archive mailboxes, or public folders. Microsoft has acknowledged these gaps on its EWS deprecation roadmap.
The roadmap states that mailbox import/export is in preview (except for Microsoft 365 Groups and Public Folder mailboxes) and identifies import and export for Microsoft 365 Groups and Public Folders as prioritized work that is still in progress.
This was confirmed when the Graph mailbox import/export APIs reached general availability, covering primary and shared mailboxes only and explicitly excluding archive mailboxes, public folders, and Group mailboxes.
Public Folders
Microsoft has confirmed that Microsoft Graph does not support Public Folders. There is currently no supported Graph API to list, synchronize, read, or create Public Folder items. This limitation is due to a gap in the Microsoft Graph platform, not Druva's migration to Microsoft Graph.
If protecting Public Folders is business-critical for your organization, plan your migration strategy accordingly. Microsoft recommends migrating legacy Public Folder content to Microsoft 365 Groups (Group Mailboxes) to ensure long-term support and access to modern Microsoft Graph APIs.
Benefits of Migration:
Full Support: Cloud Platform provides protection for Microsoft 365 Groups.
Modern API: Microsoft 365 Groups utilize the Microsoft Graph API.
Feature Parity: Groups offer collaborative features that replace the functionality of legacy Public Folders.
Archive Mailboxes
Microsoft has not released a Graph API for archive mailbox access. Druva is tracking Microsoft's roadmap and will migrate this workload as soon as it becomes available.
Both Archive Mailbox and Public Folder backups will continue to rely on EWS beyond October 1, 2026, because no alternative exists. If either applies to your organization, complete the configuration steps below before that date.
Configuration : Enable EWS for Your Tenant
Permissions needed: Microsoft 365 Global Administrator
Where to run: Exchange Online PowerShell
Step 1: Verify global EWS enablement
Check the current tenant-wide setting:
Get-OrganizationConfig | Select EwsEnabled
Expected result: True.
A blank value can be interpreted as False by Microsoft's enforcement, so an explicit True is recommended even if EWS currently appears to work.
Step 2: Enable EWS globally (if not already enabled)
Set-OrganizationConfig -EwsEnabled $true
Re-verify:
Get-OrganizationConfig | Select EwsEnabled
Expected result: True.
Step 3: Check whether your tenant enforces an EWS application allow list
Get-OrganizationConfig | Select EwsApplicationAccessPolicy
Value | Meaning |
| All applications are allowed except explicitly blocked ones. No further action needed unless Druva has been explicitly blocked. |
| Only applications explicitly listed are permitted. Continue to Step 4. |
Step 4: Add Druva to the allow list (only if EnforceAllowList is in effect)
Set-OrganizationConfig -EwsAllowedAppIDs `
"<Existing-App-ID-1>,<Existing-App-ID-2>,<Druva-App-ID>"
Replace <Druva-App-ID> with Druva's Microsoft Entra Application (Client) ID: [Druva Application ID to be inserted here]. Include any existing application IDs already on your allow list — this command replaces the full list rather than appending to it.
Verify the change:
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs
Confirm Druva's Application ID appears in the output.
Final Verification Checklist
Run:
Get-OrganizationConfig | Select EwsEnabled, EwsApplicationAccessPolicy
If your tenant uses an allow list, also run:
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs
Confirm both:
EwsEnabled = TrueDruva's Application ID appears in
EwsAllowedAppIDs(if an allow list is enforced)
Important Limitations
Kiosk, F1, and F3 licensed mailboxes lose EWS access on October 1, 2026 regardless of the configuration above. These license types do not carry EWS rights, and Microsoft returns an HTTP 403 error for any EWS request against them. If Druva backs up mailboxes on these licenses, move them to a license with EWS or Graph rights before October 1, 2026 to maintain backup coverage.
This configuration is a bridge, not a permanent solution. After April 1, 2027, EWS is disabled for every tenant with no override available. Complete your transition planning for Archive Mailbox and Public Folder well ahead of that date rather than relying on the extension until the last moment.
What Happens on April 1, 2027
On April 1, 2027, Microsoft will permanently disable EWS in Exchange Online. At that point:
EWSEnabled=Trueno longer restores access.EWSAllowedAppIDsno longer preserves access.Any remaining EWS-dependent operation will fail.
Because the EWS-to-Graph switch is not instantaneous and cannot resume an in-progress migration or initial backup mid-stream, waiting until close to this date risks failed or incomplete operations. Complete your cut-over by the end of February 2027.
Related Resources
Need Help?
Contact your Druva Customer Success Manager or open a case through the Druva Support Portal if you have questions about your specific environment or configuration.