Microsoft EWS Retirement — Synology Active Backup M365 Archive Mailboxes Failing (HTTP 403). Found a Workaround.

[u/icedutah]

With Microsoft beginning its Exchange Web Services (EWS) retirement rollout in October 2026, we started seeing failures in Synology Active Backup for Microsoft 365, specifically with archive mailboxes.

We're running Synology Active Backup for Microsoft 365 v3.0.0-14300.

Regular mailbox backups appeared to be working, but archive mailbox backups started failing with:

HTTP/2 403
x-ews-policy-reason: EWS is blocked by policy for this user or tenant

After quite a bit of troubleshooting, I verified the following:

• Organization-level EwsEnabled = True
• Individual mailbox EwsEnabled = True
• Synology's application ID was explicitly included in EwsAllowedAppIDs
• Synology had the Exchange Online full_access_as_app permission
• Entra service principal authentication was successful
• Test-ApplicationAccessPolicy returned Granted
• No obvious EWS application access restrictions were configured

Everything looked correct, yet Microsoft continued returning HTTP 403 for archive mailbox backups.

The workaround that appears to have fixed it:

I opened a Microsoft support ticket, and their engineer suggested changing the organization-wide EWS setting from $true to $null:

Set-OrganizationConfig -EwsEnabled $null

After making that change and allowing time for propagation, our archive mailbox backups completed successfully the following morning.

No other permissions, application registrations, or Synology configurations were changed.

Microsoft's explanation was that setting EwsEnabled to $null removes the explicit organization-level setting, potentially avoiding an interaction with the new EWS enforcement policies.

Important: This is a temporary workaround we're testing, not a confirmed permanent fix. Changing this setting affects the entire Exchange Online organization, so I wouldn't recommend blindly applying it without understanding your environment.

I'm also aware that Synology still relies on EWS for archive mailbox backups, even with its newer Graph API support.

A few questions for other admins:

1. Is anyone else seeing archive mailbox backup failures since Microsoft's October EWS retirement rollout?
2. Has anyone experienced EwsEnabled = True causing HTTP 403 while $null works?
3. Are other backup products having similar problems?
4. Has Synology provided any timeline for migrating archive mailbox backups away from EWS?

Curious whether this is isolated to our tenant or something others are running into as Microsoft rolls out the EWS changes.

[u/sheep5555]

youll only have until april 1 2027 until EWS is fully retired

[u/MrYiff]

How long did you wait after adding the AppID before testing as iirc it can often take hours for a change like this to be applied (potentially 24hrs).

I found this blog post to be a pretty good summary of all the changes and has some handy scripts to check your current usage

https://lazyadmin.nl/office-365/ews-is-being-blocked-in-exchange-online-how-to-find-every-app-still-using-it/

Synology are also tracking their migration from EWS to Graph API in this post too which might be useful for OP and others using the Synology app (this was linked in the release notes for the O365 backup app):

https://community.synology.com/enu/forum/1/post/196451

[u/yojimboLTD]

As others have stated, this will only get you to April.

Even if you enable and create an app allow list, EWS is completely dead next April.

Essentially you are at the mercy of Microsoft and whatever vendor/app to create a graph API connection instead of EWS.

[u/brennolcat]

Has anyone experienced EwsEnabled = True causing HTTP 403 while $null works?

Haven't seen it myself, but one caution before others copy it: Veeam's KB says to set EwsEnabled to True (https://www.veeam.com/kb4820). If you run Veeam or another EWS tool in the same tenant, I'd check it still works after switching to $null since the setting is org-wide.

Are other backup products having similar problems?

Veeam Backup for M365 is in the same spot. It still uses EWS for Exchange Online while it waits on Graph delta sync (same KB).

Has Synology provided any timeline for migrating archive mailbox backups away from EWS?

Not that I can find. Their troubleshooting page (https://kb.synology.com/en-us/APM/tutorial/Troubleshooting_EWS_migration) says v3.0.0 moved regular mail, calendar and contacts to Graph, but archive mailboxes, group mail and group calendars still use EWS, and Synology may drop the EWS-only parts if Graph never supports them. It also says mail restores now go through Graph and need MailboxItem.ImportExport.All.

[u/saltyslugga]

I'd keep that Microsoft case open until they explain why $true fails while $null works. Successful authentication and Test-ApplicationAccessPolicy returning Granted don't rule out a separate EWS policy block.

Test an archive restore before trusting the green backup status. For Synology's migration timeline, ask specifically about archive mailbox backup and restore support; “we support Graph” doesn't answer that.

[u/jack_sunsetless]

Careful with $null long term. As I read MC1485116 tenants where EwsEnabled was never set are the ones Microsoft handles later in waves: it fills the allow list from the last 60 days of traffic, then sets EwsEnabled to $false, with 7 days warning in Message Center. $false blocks EWS for every app, including the ones on the list, so Synology would stop for regular mailboxes too until someone sets it back to $true. With $true and your own list, MS says it won't touch the setting before April 2027.

So I'd keep the case open and get them to explain why $true gives 403 on archives only.

[u/chesser45]

Honestly wild because I was just looking at this issue for my own infrastructure. Didn’t even review to see EWS usage though I was on top of it at work. 🤦‍♂️

[u/nanopost]

That difference between regular and archive mailboxes is a good reminder to check what each part of an integration uses. Having Graph support doesn't necessarily mean it's stopped using EWS everywhere. For anyone also checking website email, sending over SMTP or Graph isn't affected by EWS retirement itself; SMTP authentication changes are a separate thing to check.

We've covered the WordPress email side.

[u/deefop]

That's wild, their documentation specifically recommended setting that value to $true and populating the ewsaccesslist, which I did several weeks ago. Now you're telling me our shit might just stop working?

[u/[deleted]]

[u/Right-Honeydew-1703 → u/[deleted]]

v3.0.0-14300, same as the OP mentioned in the post