Update Exchange Online EWS Settings for Microsoft Email Sync

Demandbase uses Exchange Web Services (EWS) to sync email activity from Exchange Online mailboxes.

Microsoft is retiring EWS for Exchange Online. Enforcement begins October 1, 2026 and will be phased by tenant, with full disablement by April 1, 2027. Microsoft is also blocking EWS earlier for some F1, F3, and Kiosk-licensed users beginning March 1, 2026.

To maintain Demandbase email synchronization during the retirement period,administrators must add the Demandbase Application (Client) ID to the Exchange Online EWS allow list (EWSAllowedAppIDs) and set EWSEnabled to $true.

Demandbase is evaluating updates to support Microsoft's newer Exchange Online requirements.

Prerequisites to Update Exchange Online EWS Settings

• You must have one of the following Microsoft 365 admin roles:
  • Exchange Administrator
  • Global Administrator
  • Member of the Organization Management role group
• You must have PowerShell with the Exchange Online Management module installed.

Important: These settings apply to your entire Microsoft 365 tenant, not individual users.

Step 1: Set Up Exchange Online PowerShell

Install PowerShell and the Exchange Online Management module to manage your Exchange Online settings.

Important: If PowerShell and the Exchange Online Management module are already installed, skip to Step 2.

1. For Mac users, open Terminal and run the following command to install PowerShell. Windows users can use PowerShell without this step.
   brew install --cask powershell
2. Open PowerShell and run the following command to install the Exchange Online Management module.
   Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force

Step 2: Add Demandbase to the EWS Allow List

Add the Demandbase Application (Client) ID to your existing EWS allow list without removing other applications.

1. Open PowerShell. On Mac, run pwsh to launch PowerShell.
2. Connect to Exchange Online. Replace admin@yourdomain.com with your administrator email address.
   Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com
3. Check your current EWS settings.
   Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled, EwsAllowedAppIDs
   Important:The -RetrieveEwsOperationAccessPolicy parameter is required to retrieve the EWS allow list.
4. Copy the existing EwsAllowedAppIDs values, if any.

5. Add the Demandbase Application (Client) ID 19eddf46-2f40-47aa-b9d8-a369f0c97547 to the allow list.

   • If the allow list contains existing application IDs, include them with the Demandbase ID, separated by commas:
     Set-OrganizationConfig -EWSAllowedAppIDs "<existing-app-id-1>,<existing-app-id-2>,19eddf46-2f40-47aa-b9d8-a369f0c97547"
   • If the allow list is empty, add the Demandbase ID:
     Set-OrganizationConfig -EWSAllowedAppIDs "19eddf46-2f40-47aa-b9d8-a369f0c97547"

   Important: The -EWSAllowedAppIDs parameter replaces the entire allow list. Include all existing application IDs to avoid disrupting other integrations.

6. Enable EWS.
   Set-OrganizationConfig -EWSEnabled $true
7. Verify the updated settings.
   Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled, EwsAllowedAppIDs
8. Confirm that:
   • EwsEnabled is True.
   • EwsAllowedAppIDs includes the Demandbase Application (Client) ID.

Outcome of Updating Exchange Online EWS Settings

The Demandbase Application (Client) ID is added to your Exchange Online EWS allow list, and EWS is enabled for your tenant.

These settings help maintain Demandbase email synchronization during Microsoft's EWS retirement period but do not prevent the final EWS disablement.

Important: Changes to EwsAllowedAppIDs can take up to 24 hours to take effect. If email synchronization continues to fail after 24 hours, contact Demandbase Support and include the output from the verification command.