EWS access for Data & More – on-premise Exchange setup

Exchange 2010 SP2 – 2019. We connect outbound over HTTPS to https://<host>/EWS/Exchange.asmx, authenticate as one service account, and impersonate the mailboxes in scope. No Autodiscover, no MAPI/RPC, no agent installed on your servers.

Prerequisites

Exchange Server 2016, 2019 or Subscription Edition (SE), on-premise
A mailbox-enabled AD service account we can authenticate as (§1)
ApplicationImpersonation and Mailbox Search roles on that account (§2)
The EWS virtual directory reachable from the internet with Basic or NTLM enabled (§3, §4)
A throttling policy for the account that a full scan will not exhaust (§5)
TCP 443 open from our egress IPs, valid TLS certificate (§6)

Sections 1–6 are the setup. Section 7 is the form to send back.

1. Service account

One dedicated AD account, mailbox-enabled (it authenticates as itself before impersonating), password set not to expire. No local admin, no interactive logon.

New-Mailbox -Name "svc-dataandmore" `
            -UserPrincipalName "svc-dataandmore@example.com" `
            -Password (Read-Host "Password" -AsSecureString)

2. Roles

Impersonation – one assignment covers every mailbox:

New-ManagementRoleAssignment -Name "DataAndMore-Impersonation" `
                             -Role "ApplicationImpersonation" `
                             -User "svc-dataandmore@example.com"

Scope it if only part of the organisation is in scope:

New-ManagementScope -Name "DataAndMore-Scope" `
                    -RecipientRoot "example.com/Company Users" `
                    -RecipientRestrictionFilter { RecipientType -eq "UserMailbox" }

New-ManagementRoleAssignment -Name "DataAndMore-Impersonation" `
                             -Role "ApplicationImpersonation" `
                             -User "svc-dataandmore@example.com" `
                             -CustomRecipientWriteScope "DataAndMore-Scope"

Mailbox discovery – we enumerate mailboxes with the EWS GetSearchableMailboxes operation, which requires the Mailbox Search role:

New-ManagementRoleAssignment -Name "DataAndMore-MailboxSearch" `
                             -Role "Mailbox Search" `
                             -User "svc-dataandmore@example.com"

Prefer this over the Discovery Management role group, which also grants Legal Hold. If you won't grant it, send us the mailbox list instead – only auto-discovery is lost.

Role changes are cached; allow an hour or recycle MSExchangeServicesAppPool.

Without impersonation: Add-MailboxPermission -AccessRights FullAccess -AutoMapping:$false per mailbox works too, but must be re-run for every new mailbox.

3. EWS endpoint

Get-WebServicesVirtualDirectory | fl Server,ExternalUrl,BasicAuthentication,WindowsAuthentication

Send us the externally reachable URL. Basic or NTLM must be enabled – Kerberos-only, certificate-only and OAuth/ADFS-only are not supported, and a pre-auth reverse proxy (WAP, F5 APM, NetScaler) must pass the service account through.

Set-WebServicesVirtualDirectory -Identity "EXCH01\EWS (Default Web Site)" -BasicAuthentication $true
iisreset /noforce

Version header values we accept: EXCHANGE_2007 … EXCHANGE_2013_SP1, EXCHANGE_2016. Exchange 2019 uses EXCHANGE_2016 – there is no separate value.

4. EWS access policy

Get-OrganizationConfig | fl EwsEnabled,EwsApplicationAccessPolicy,EwsAllowList,EwsBlockList
Get-CASMailbox svc-dataandmore | fl EwsEnabled,EwsApplicationAccessPolicy

EwsEnabled must not be $false. If the policy is EnforceAllowList, add our client – its User-Agent is JWebServices for Exchange 2.2.140, www.independentsoft.com:

Set-OrganizationConfig -EwsAllowList @{Add="JWebServices*"}

5. Throttling

Default EWS budgets are sized for interactive clients and will stall a full-mailbox scan. Assign a policy to the service account only (2013+):

New-ThrottlingPolicy -Name "DataAndMore-EWS" -ThrottlingPolicyScope Regular `
                     -EwsMaxConcurrency Unlimited -EwsMaxBurst Unlimited `
                     -EwsRechargeRate Unlimited -EwsCutoffBalance Unlimited

Set-ThrottlingPolicyAssociation -Identity "svc-dataandmore@example.com" `
                                -ThrottlingPolicy "DataAndMore-EWS"

Capped alternative: EwsMaxConcurrency 50, EwsMaxBurst 300000, EwsRechargeRate 900000, EwsCutoffBalance 600000. Tell us which you used – we match our concurrency to it. On 2010 SP2 the parameters are EWSMaxConcurrency, EWSPercentTimeInAD, EWSPercentTimeInCAS, EWSPercentTimeInMailboxRPC; set them to $null.

We run 3–8 parallel connections per source, back off automatically on 429 / "server cannot service this request right now", and can throttle during a business-hours window you choose.

6. Network and TLS

TCP 443 inbound to the EWS endpoint from our egress IPs (supplied separately). Nothing inbound to us.
Our read/connect timeout is 300 s – no firewall or load balancer may cut idle connections sooner.
TLS 1.2+, certificate valid for the host we connect to. Internal CA: send us the chain as PEM.
Host must resolve publicly, or give us hostname → IP and we map it in our runtime.

7. Send back

Credentials via password vault or another secure channel, not plain e-mail.

Field	Value
EWS URL	`https://mail.example.com/EWS/Exchange.asmx`
Exchange version	`EXCHANGE_2016`
Auth method	Basic / NTLM (+ NetBIOS domain if NTLM)
Service account	`svc-dataandmore@example.com` + password
Access model	Impersonation / Full Access
Mailbox Search granted	yes / no – if no, attach mailbox list
Archives in scope	yes / no
Test mailbox for our access check	`testuser@example.com`
Throttling policy values
Business-hours throttle window	e.g. 07:00–18:00 CET
Internal CA chain attached	yes / no / n-a
Firewall opened for our egress IPs	yes / no
Technical contact	name, e-mail, phone

Verify before sending:

Test-WebServicesConnectivity -ClientAccessServer EXCH01 `
    -MailboxCredential (Get-Credential example\svc-dataandmore) -TrustAnySSLCertificate

curl -sS -o /dev/null -w '%{http_code}\n' -u 'svc-dataandmore@example.com' \
     https://mail.example.com/EWS/Exchange.asmx      # 200 = ok, 401 = auth wrong

Impersonation itself we verify from our side against the test mailbox.

Enforcement (only if contracted)

With retention enforcement enabled we delete items that match a deletion policy you define and activate. Nothing is moved, copied or written into the mailbox. Impersonation already grants the delete right; nothing extra to configure. Say so if you want ingestion only.

EWS operations used

Operation	Purpose	Type
`GetSearchableMailboxes`	enumerate mailboxes	read
`FindFolder` / `GetFolder`	walk the folder tree, incl. archive root	read
`FindItem` / `GetItem`	list items, fetch message with body	read
`GetAttachment`	fetch attachment for analysis	read
`DeleteItem`	delete an item under a retention policy	write – enforcement only

No subscriptions, no SendItem, no UpdateItem, no MoveItem, no folders created in the mailbox, and no access outside the configured scope.

Errors

Message	Cause	Fix
401 Unauthorized	password wrong, Basic/NTLM off, pre-auth proxy	§3
The account does not have permission to impersonate the requested user.	role missing, cached, or mailbox outside the scope	§2
Access is denied on discovery	Mailbox Search missing	§2
429 / The server cannot service this request right now / Too many concurrent connections opened	throttling budget exhausted	§5
Read timed out / Connect timed out / Socket closed	idle timeout below 300 s, or endpoint unreachable	§6
PKIX / certificate errors	internal CA or host-name mismatch	§6
The SMTP address has no mailbox associated with it. / Mailbox does not exist.	mail-enabled user, or mailbox moved to cloud	expected, skipped
The defaultFolder cannot be created by XSO	archive requested, mailbox has none	expected, skipped
The message exceeds the maximum supported size.	item over the processing limit	expected, recorded as skipped