EWS Access
Enable Exchange Web Services (EWS) access to mailbox. This allows consented third party Apps to access mailbox data.
Adding a baselineConfigure it
This baseline applies per user, through a user-level scheme or an Azure group rather than to the tenant as a whole.
-
Add it directly to a user or an Azure group (Adding a baseline), or bundle it into a user-level scheme and deploy that to many users or groups at once (Deploying a scheme). See Groups and priority for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.
-
Leave EWS access set to On. It’s the only setting on this baseline, and it controls whether the mailbox accepts Exchange Web Services connections: the API used to read the mailbox by Outlook for Mac, older Outlook builds and any third-party app the user has consented to.
-
Save. With Auto-remediation on, Octiga switches EWS access back on whenever it’s disabled for a user the baseline applies to, and any app or client relying on it regains access without anyone having to notice or ask.
Check it worked
Passing means EWS access is enabled for the mailbox. Microsoft exposes this setting only
through Exchange Online PowerShell (Get-CASMailbox and Set-CASMailbox), which is how
Octiga reads and writes it; there’s no admin-centre page for it. To check it yourself, run
Get-CASMailbox -Identity <user> | Format-List EwsEnabled. On the user roster or a group’s
member list, Passing shows as a green dot for this baseline; Deviated (red) means it’s
currently off; Excluded (grey) means the user or tenant isn’t licensed for Exchange Online.
When access is off, any EWS-dependent app (Outlook for Mac, an older Outlook build, or a
consented third-party integration) loses access to the mailbox, while Outlook on the web and
Outlook desktop over MAPI keep working.
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.