Update to EWS Access for Kiosk / Frontline Worker Licensed Users

Does this change in timeline for Kiosk licensed users have any bearing on the overall EWS retirement plan?

Yesterday afternoon / evening German time (UTC+1) our Exchange Online backup jobs reported failure for about 10 mailboxes across 3 different tenants (the rest of the 1500 mailboxes in those 3 tenants were okay and this didn't happen in the 5 other tenants we are responsible for). We realized that Get-CASMailbox -ResultSize unlimited | Where-Object {$_.EwsEnabled -ne $blank -and $_.EwsEnabled -ne $true} delivered excatly the mailboxes where the backup failed with 403 forbidden (The HTTP request was forbidden with client authentication scheme 'Anonymous'.) as described in the following Veeam KB article. After set-casmailbox -ewsenabled $true backup has been confirmed to return to normal for 3 mailboxes in one of the three tenants. The 10 mailboxes affected were mostly full on licenses like O365E1 or EXOP1. This behaviour cannot be explained by any announced changes of Microsoft, can it?

https://www.veeam.com/kb4796

Did someone already find out how to run the script with a secret?
I get the following error:

Cannot process argument transformation on parameter

'OAuthClientSecret'. Cannot convert the "XYZ" (value of secret) value of type "System.String" to

type "System.Security.SecureString".

Edit: I will check GitHub now, forgot about that.

This may be getting pushed back as the EWS report is not available to all tenants yet.  I have an active open ticket with Microsoft right now and have since this announcement was sent out.  They have not been able to make that report available.  I am GCC.

I'm trying to send mail in a workflow using Power Automate, but I can't connect to Office 365 Outlook. My license is Exchange Online Kiosk. Could the reason I can't connect be that I don't have an "Exchange Online Plan 1 or Plan 2" license? Or what could the problem be?

Hi . My customer has the following question. Can you confirm that they will not be impacted? 

We have employees with M365 F3 licenses, and using Exchange Webmail (OWA) with the 2GB storage limit. We want to make sure that the change below won't impact this use case. Could you please confirm and indicate if there is anything we should check in particular to confirm?

Is there are report or process I can use to determine if the change will impact our tenant? I am not sure which (if any) of our Exchange licenses are using EWS. We have many F3 licenses. I need a report or process I can use to gauge impact and communicate to the organization so they can decide if they want to upgrade to or more expensive license, deprecate or choose another path. Before the deadline I'd like to know the impact. If there is a way to get the info from Audit Logs or from the current "EWS Usage" report please help a brother out. I can open a support case if needed.  

Hello,

In Hybrid environments, for accounts where mailboxes are hosted on On-premise Exchange and which only use Teams on the M365 side (with a package like Microsoft Teams Essentials etc.), I believe the Exchange-Teams calendar synchronizations and Free/Busy availability status should not be affected by this EWS restriction, but I am not entirely sure about this. What do you think?

MS Teams has a 2GB mailbox in the background to process objects like the calendar, etc. This mailbox is not visible in Exchange Online, cannot be used directly as an email account by people, but it still exists; it must exist. As far as I know, this mailbox package does not have a plan equivalent (like F1, F3, Kiosk, Plan1/2 etc.). Microsoft explicitly defines this mailbox used by Teams as 'Teams uses a lightweight unlicensed Exchange mailbox for Calendar.'

Note: Microsoft says "that standalone Teams packages do not include Exchange Online". However, I once observed that due to an issue locally, the Exchange server was freshly installed, the Hybrid structure was broken during this process, and 2GB mailboxes were created for the users in Exchange Online.

Why couldn't mailbox access be bundled in the F1 license? Is moving our users to Teams Essentials an option?

Will this also affect access to these mailboxes as an app, i.e. when an app registration has EWS.AccessAsUser.All and/or full_access_as_app permissions on Exchange, will it still be able to get to those user's mailbox content after March 1st 2026?

This is important, since this will break some (if not all) third party mailbox migration tools that still (forcibly) rely on EWS in their backend to access user mailbox data. There's still no complete feature parity between Graph and EWS, especially for these usage scenario's. E.g. there's still no access to archive mailboxes, even using the import/export api (which is also still in preview so 'not supported in production').

The announcement from Sep 2023(!) stated 'we are working [on this] and will provide an updated timeline in the coming months.', but from what I can tell, over 2 years later we're still waiting on that timeline?