Action Required for Exchange Online Users: Upgrade to NDC 5.7.12.1 NOW
Microsoft is disabling Exchange Web Services (EWS) by default on October 1, 2026. If you scan Exchange Online and don’t upgrade in time, your scans can start failing.
Want the full details and fix steps? Click the link below!
Exchange Source Graph Support
Microsoft is retiring Exchange Web Services (EWS) — the protocol Netwrix Data Classification currently uses to scan Exchange Online. As announced on the Exchange Team Blog:
- October 1, 2026 — Microsoft disables EWS by default across all Exchange Online tenants.
- April 1, 2027 — EWS is shut down permanently for Exchange Online, with no exceptions and no re-enablement.
Ahead of this retirement, the Exchange source types for Netwrix Data Classification have been updated to use Microsoft Graph — Microsoft’s supported replacement for EWS — to crawl Exchange mailboxes and tenancies. Two Exchange source types now exist: Exchange (EWS), for on-premises Exchange Server using Basic Authentication, and Exchange (Graph), for Exchange Online using Modern Authentication. Existing sources are automatically transitioned to the correct type during upgrade based on their configured authentication method — no manual recreation of sources is required.
If you upgrade to 5.7.12.1 before October 1, 2026
The only action required is to update the permissions on the Azure Application NDC uses to connect to Exchange Online. The new required permissions for crawling are the Microsoft Graph API permissions Mail.Read, Mail.ReadWrite, and User.Read.All. Once these permissions are configured, NDC will crawl your Exchange Online sources with no further changes needed.
If you have not upgraded by October 1, 2026
If you are still running 5.7.11 or earlier when Microsoft disables EWS, your Exchange Online source will stop working. Your first action should be to pause your Exchange source, or at least turn off reindexing. Three failed attempts to collect a document from the Exchange server during reindexing will cause that document to be marked Automatically Deleted — if this happens, you will need to contact Netwrix Support to revert the status change.
To restore functionality on 5.7.11 or earlier without upgrading yet:
- Set the EWSEnabled property to
Truefor each Exchange tenancy NDC crawls. - Confirm that the Azure Application NDC uses to crawl Exchange Online has been added to that tenancy’s AppID Allow List. Microsoft will have automatically populated this list, but you should verify the NDC application is present.
As soon as possible, upgrade to NDC 5.7.12.1 and update the Azure Application’s permissions as described above to move your Exchange Online sources onto the supported Graph-based collection.
Additional Fixes
- Fixed distribution lists being discovered during crawling. All Exchange sources now ignore distribution lists when crawling Exchange Servers and tenancies.
Need help with this update?
There are many different ways to get help with our products!
| Situation | Action |
|---|---|
| If you feel the product is broken and not working as intended… | Contact Support |
| If you have a question you’d like to ask other experts… | Create a discussion in the community: Data Classification > Discussions & Questions |
| If you have a feature request… | Let our product team know directly: Data Classification > Ideas |
| If you have something cool to show… | Show everyone what you built: Data Classification > Show & Tell |
What are your thoughts?
We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below!