---
title: "Fix: ‘The HTTP Request Was Forbidden with Client Authentication Scheme Anonymous’ During VMOBACKUP Sign-up"
description: "If your VMOBACKUP sign-up is failing with a “client authentication scheme Anonymous” error, the cause is on the Microsoft 365 side. A recent Exchange Online change now requires Exchange Web Services (EWS) to be explicitly enabled before VMOBACKUP can connect…"
url: "https://www.vmobackup.com/docs/fix-the-http-request-was-forbidden-with-client-authentication-scheme-anonymous-during-vmobackup-sign-up/"
updated: "2026-05-21"
category: Getting Started
---

# Fix: ‘The HTTP Request Was Forbidden with Client Authentication Scheme Anonymous’ During VMOBACKUP Sign-up

If your VMOBACKUP sign-up is failing with a “client authentication scheme Anonymous” error, the cause is on the Microsoft 365 side. A recent Exchange Online change now requires Exchange Web Services (EWS) to be explicitly enabled before VMOBACKUP can connect to your tenant. Here is what is happening and how to fix it.

> **TL;DR**
>
> Microsoft now requires `EwsEnabled` to be explicitly set to `$true` at both the organization and mailbox level in Exchange Online. Run the PowerShell block in [Step 4](https://www.vmobackup.com/docs/fix-the-http-request-was-forbidden-with-client-authentication-scheme-anonymous-during-vmobackup-sign-up/#6-toc-title), wait up to 24 hours for replication, then retry the VMOBACKUP sign-up.

## The error

When attempting to sign up for VMOBACKUP, the process fails with the following message:

```
ERROR
Connect to EWS: The HTTP request was forbidden with client authentication scheme 'Anonymous'.
```

This error is generated on the Microsoft 365 side and prevents the VMOBACKUP sign-up process from completing. It is not an issue with VMOBACKUP itself, and the fix is performed entirely within your Microsoft 365 tenant.

## Why this happens

Per [Veeam KB4796](https://www.veeam.com/kb4796), Microsoft recently corrected how Exchange Online enforces EWS access. Previously, some tenants could connect via EWS even when `EwsEnabled` was not explicitly set (the value was `$null` rather than `$true`). Microsoft has now closed that gap.

Going forward, EWS must be explicitly enabled at **both** the organization level and the individual mailbox level. If either is set to anything other than an explicit `True`, VMOBACKUP receives the “Anonymous” authentication error from Exchange Online and cannot complete sign-up.

## How to fix it

A Microsoft 365 **Global Administrator** account is required to complete the steps below. The fix is performed entirely through PowerShell against Exchange Online.

### 1. Open PowerShell

Open **PowerShell 7 x64** from the Start menu. If PowerShell 7 is not installed, Windows PowerShell 5.1 can also be used.

PowerShell does not need to be run as Administrator because the Exchange Online module is installed using `-Scope CurrentUser`.

### 2. Install and import the Exchange Online module

Run the following commands:

```
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force

Import-Module ExchangeOnlineManagement
```

If prompted to install the NuGet provider or trust the PowerShell Gallery repository, type `Y` and press Enter.

### 3. Connect to Exchange Online

Connect to Exchange Online PowerShell using a Microsoft 365 Global Administrator account:

```
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com
```

Replace `admin@yourdomain.com` with the Global Administrator account that will be used to sign in. A Microsoft sign-in window will appear, including MFA if it is configured.

### 4. Enable EWS and verify

Enable EWS at the organization level, enable it for any mailboxes where it is not already explicitly set, and then verify the result:

```
# Enable EWS at the organization level.
Set-OrganizationConfig -EwsEnabled $true

# Enable EWS for all mailboxes where it is not already explicitly enabled.
Get-CASMailbox -ResultSize Unlimited |
    Where-Object { $_.EwsEnabled -ne $true } |
    Set-CASMailbox -EwsEnabled $true

# Verify the organization-level setting.
Get-OrganizationConfig | Format-List EwsEnabled

# Confirm no mailboxes remain where EwsEnabled is not explicitly set to True.
Get-CASMailbox -ResultSize Unlimited |
    Where-Object { $_.EwsEnabled -ne $true } |
    Select-Object Identity, PrimarySmtpAddress, EwsEnabled
```

The final command should return no results if all mailboxes were updated successfully.

### 5. Disconnect from Exchange Online

```
Disconnect-ExchangeOnline -Confirm:$false
```

### 6. Wait for replication, then retry sign-up

The change may take up to 24 hours to fully replicate across Microsoft 365. After replication completes, return to the sign-up page and try again using a Microsoft 365 Global Administrator account.

## Additional references

- [Veeam KB4796 — EWS “Anonymous” authentication error](https://www.veeam.com/kb4796)
- [Veeam KB4820 — Veeam Support Statement on EWS deprecation](https://www.veeam.com/kb4820)
- [Microsoft Learn — Manage Exchange Online with PowerShell](https://learn.microsoft.com/en-us/powershell/exchange/exchange-online-powershell)

Need help running these commands or have questions about the VMOBACKUP sign-up process? Email [support@vmobackup.com](mailto:support@vmobackup.com) to open a support request and an engineer will follow up.