How to check and enable EWS per Microsoft 365 tenant or user

Problem:

You need to check if Exchange Web Services (EWS) is enabled for your Microsoft 365 tenant or specific users to troubleshoot problems with your CodeTwo software.

Solution:

Some CodeTwo products rely on EWS to perform the following tasks:

• CodeTwo Email Signatures 365 and CodeTwo Email Signatures On-prem: update emails in the Sent Items folder with signatures. 
• CodeTwo Office 365 Migration & CodeTwo Exchange Migration: connect to Microsoft 365 and perform migration jobs.
• CodeTwo Backup: connect to Microsoft 365 and perform backup and restore jobs.

Access to EWS must be enabled in your Microsoft 365 tenant for these features to work. Note that EWS can be blocked, for instance, as part of Baseline Security Mode (BSM) in the Microsoft 365 admin center (by enabling the Block access to ‎Exchange Web Services setting).

How to enable access to EWS

The only method to view and change the current access configuration for EWS is by using PowerShell. Here’s how to do this:

1. Open Windows PowerShell and connect to your Exchange Online organization by following these steps. 
2. Use the following cmdlet to check if EWS is enabled organization-wide:

   Get-OrganizationConfig | select EWSEnabled

   If the result is False or you don’t get any value (Null), go to the next step to enable EWS. 

   Important

   The Null value is treated as True until September 2026. Starting October 1, 2026, the Null value for this setting will automatically change to False.

3. To allow EWS for the entire organization, use the following cmdlet:

   Set-OrganizationConfig -EwsEnabled:$true

You can also check and enable EWS for a single user. However, the org-wide setting (Set-OrganizationConfig) will disable any per-user EWS overrides.

• To check EWS for a single user (e.g., [email protected]), use this cmdlet:

  Get-CASMailbox -Identity [email protected] | select EWSEnabled

• To enable EWS for that user, use this cmdlet:

  Set-CASMailbox -Identity [email protected] -EwsEnabled:$true