Register Now

Fix: ‘The HTTP Request Was Forbidden with Client Authentication Scheme Anonymous’ During VMOBACKUP Sign-up

2 min read

Updated on May 21, 2026

If your VMOBACKUP sign-up is failing with a “client authentication scheme Anonymous” error, the cause is on the Microsoft 365 side. A recent Exchange Online change now requires Exchange Web Services (EWS) to be explicitly enabled before VMOBACKUP can connect to your tenant. Here is what is happening and how to fix it.

TL;DR

Microsoft now requires EwsEnabled to be explicitly set to $true at both the organization and mailbox level in Exchange Online. Run the PowerShell block in Step 4, wait up to 24 hours for replication, then retry the VMOBACKUP sign-up.

The error #

When attempting to sign up for VMOBACKUP, the process fails with the following message:

ERROR
Connect to EWS: The HTTP request was forbidden with client authentication scheme 'Anonymous'.

This error is generated on the Microsoft 365 side and prevents the VMOBACKUP sign-up process from completing. It is not an issue with VMOBACKUP itself, and the fix is performed entirely within your Microsoft 365 tenant.

Why this happens #

Per Veeam KB4796, Microsoft recently corrected how Exchange Online enforces EWS access. Previously, some tenants could connect via EWS even when EwsEnabled was not explicitly set (the value was $null rather than $true). Microsoft has now closed that gap.

Going forward, EWS must be explicitly enabled at both the organization level and the individual mailbox level. If either is set to anything other than an explicit True, VMOBACKUP receives the “Anonymous” authentication error from Exchange Online and cannot complete sign-up.

How to fix it #

A Microsoft 365 Global Administrator account is required to complete the steps below. The fix is performed entirely through PowerShell against Exchange Online.

1. Open PowerShell #

Open PowerShell 7 x64 from the Start menu. If PowerShell 7 is not installed, Windows PowerShell 5.1 can also be used.

PowerShell does not need to be run as Administrator because the Exchange Online module is installed using -Scope CurrentUser.

2. Install and import the Exchange Online module #

Run the following commands:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force

Import-Module ExchangeOnlineManagement

If prompted to install the NuGet provider or trust the PowerShell Gallery repository, type Y and press Enter.

3. Connect to Exchange Online #

Connect to Exchange Online PowerShell using a Microsoft 365 Global Administrator account:

Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

Replace admin@yourdomain.com with the Global Administrator account that will be used to sign in. A Microsoft sign-in window will appear, including MFA if it is configured.

4. Enable EWS and verify #

Enable EWS at the organization level, enable it for any mailboxes where it is not already explicitly set, and then verify the result:

# Enable EWS at the organization level.
Set-OrganizationConfig -EwsEnabled $true

# Enable EWS for all mailboxes where it is not already explicitly enabled.
Get-CASMailbox -ResultSize Unlimited |
    Where-Object { $_.EwsEnabled -ne $true } |
    Set-CASMailbox -EwsEnabled $true

# Verify the organization-level setting.
Get-OrganizationConfig | Format-List EwsEnabled

# Confirm no mailboxes remain where EwsEnabled is not explicitly set to True.
Get-CASMailbox -ResultSize Unlimited |
    Where-Object { $_.EwsEnabled -ne $true } |
    Select-Object Identity, PrimarySmtpAddress, EwsEnabled

The final command should return no results if all mailboxes were updated successfully.

5. Disconnect from Exchange Online #

Disconnect-ExchangeOnline -Confirm:$false

6. Wait for replication, then retry sign-up #

The change may take up to 24 hours to fully replicate across Microsoft 365. After replication completes, return to the sign-up page and try again using a Microsoft 365 Global Administrator account.

Additional references #

Need help running these commands or have questions about the VMOBACKUP sign-up process? Email support@vmobackup.com to open a support request and an engineer will follow up.

Table of contents