Update Exchange Online EWS Settings for Microsoft Email Sync

Demandbase uses Exchange Web Services (EWS) to sync email activity from Exchange Online mailboxes.

Microsoft is retiring EWS for Exchange Online. Enforcement begins October 1, 2026 and will be phased by tenant, with full disablement by April 1, 2027. Microsoft is also blocking EWS earlier for some F1, F3, and Kiosk-licensed users beginning March 1, 2026.

To keep Demandbase email sync working after Microsoft begins enforcement for your tenant, your Exchange administrator must add the Demandbase Application (Client) ID to your tenant-level EWS allow list (EWSAllowedAppIDs) and set EWSEnabled to $true.

Demandbase is evaluating updates to support Microsoft’s newer Exchange Online requirements. In the meantime, Exchange administrators must complete the steps below to keep email sync working during Microsoft’s EWS retirement period.

Prerequisites for Updating Exchange Online EWS Settings

• You must have one of the following Microsoft 365 admin roles:
  • Exchange Administrator
  • Global Administrator
  • Member of the Organization Management role group
• You must have PowerShell with the Exchange Online Management module installed.

Important: These organization-level settings apply to your entire Microsoft 365 tenant. They are not configured per user.

One-Time Setup for Exchange Online PowerShell

Important: If you already installed PowerShell and the Exchange Online Management module, skip this section.

Install PowerShell on Mac

Important: Windows users can use the built-in PowerShell app and skip this step.

On Mac, run:
brew install --cask powershell

Install the Exchange Online Management Module

Open PowerShell and run:
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force

Add Demandbase to the Exchange Online EWS Allow List

1. Launch PowerShell.
   pwsh
2. Connect to Exchange Online.
   Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com
3. Check your current EWS settings.
   Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled, EwsAllowedAppIDs
   Important: The -RetrieveEwsOperationAccessPolicy flag is required to return the allow list. 
4. Copy the existing EwsAllowedAppIDs values.

5. Add the Demandbase Application (Client) ID 19eddf46-2f40-47aa-b9d8-a369f0c97547 to your allow list.

   • If Step 2 shows existing app IDs, run:
     Set-OrganizationConfig -EWSAllowedAppIDs "<existing-app-id-1>,<existing-app-id-2>,19eddf46-2f40-47aa-b9d8-a369f0c97547"
   • If Step 2 does not show any existing app IDs, run:
     Set-OrganizationConfig -EWSAllowedAppIDs "19eddf46-2f40-47aa-b9d8-a369f0c97547"

   Important: The -EWSAllowedAppIDs setting replaces the full list. Always include your existing app IDs and the Demandbase Application (Client) ID, separated by commas.

6. Enable EWS.
   Set-OrganizationConfig -EWSEnabled $true
7. Verify your updated EWS settings.
   Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled, EwsAllowedAppIDs
8. Confirm that EwsEnabled is True and the Demandbase Application (Client) ID appears in EwsAllowedAppIDs.

Outcome for Exchange Online EWS Allow List Updates

Demandbase email sync continues working after Microsoft begins EWS retirement enforcement for your tenant.

Per Microsoft, changes to EWSAllowedAppIDs can take up to 24 hours to take effect. If email sync still fails after 24 hours, contact Demandbase Support and include the output from the verification command.