Power Query "Expression.Error: Access to the resource is forbidden" when connecting to Exchange Mailbox on Excel Desktop client (Works fine on Web version).

Do not reconfigure Microsoft Graph tokens for the existing Excel Desktop connection: the current Microsoft Exchange connector uses EWS, and the immediate action is to identify the applicable tenant or mailbox EWS restriction while preparing affected workbooks for manual migration to the new Graph-based connectors.

A generic 403 Forbidden does not by itself confirm EWS retirement, an EWS policy block, or a Graph token-audience mismatch. The October 2026 milestone begins phased EWS disablement; EWS and the current Excel connector are scheduled for full retirement in April 2027.^1^

1. Determine which EWS control is blocking Excel Desktop

Run these checks in Exchange Online PowerShell using an account assigned the necessary Exchange administrative permissions:

Connect-ExchangeOnline

Get-OrganizationConfig |
    Format-List EwsEnabled,EwsApplicationAccessPolicy,EwsAllowList,EwsBlockList

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |
    Format-List EwsAllowedAppIDs

Get-CASMailbox -Identity [Email] |
    Format-List EwsEnabled,EwsApplicationAccessPolicy,EwsAllowList,EwsBlockList

These checks cover organization-wide enablement, application-ID restrictions, User-Agent policies, and mailbox-level restrictions.^2^

Interpret the results as follows:

• EwsEnabled is $false at organization level: mailbox-level enablement cannot override it.
• Mailbox EwsEnabled is $false: that mailbox is blocked even if EWS is allowed for the organization.
• EnforceAllowList: Excel’s exact EWS User-Agent must be present in EwsAllowList.
• EnforceBlockList: Excel’s User-Agent must not be present in EwsBlockList.
• EwsAllowedAppIDs is populated: the calling application must also satisfy that application-ID restriction. Passing the User-Agent policy does not bypass the application-ID policy.

If available from an HTTP capture or Microsoft support trace, inspect X-EWS-Policy-Reason:

• EWS is disabled for this user or tenant points to EwsEnabled.
• EWS is blocked by policy for this user or tenant points to the application-ID or User-Agent policies.

The built-in Power Query connector does not provide a documented UI method in the available guidance for displaying this response header. If the PowerShell state does not identify the block, open a Microsoft 365 support case with the failure timestamp, affected UPN, workbook/query, Excel version/build, and Power Query diagnostics. Ask support to return the EWS response headers and calling App ID/User-Agent; do not guess these identifiers.

2. Apply temporary EWS remediation only after confirming the block

These changes weaken an intentional access restriction, so obtain security approval and preserve existing allow-list entries.

If EWS was unintentionally disabled:

# Tenant-level correction
Set-OrganizationConfig -EwsEnabled $true

# Or mailbox-level correction, if only that mailbox is disabled
Set-CASMailbox -Identity [Email] -EwsEnabled $true

If EnforceAllowList is confirmed and support or trace data identifies the exact Excel User-Agent:

$excelUserAgent = "<exact-user-agent>"
$org = Get-OrganizationConfig
$newAllowList = @($org.EwsAllowList) + $excelUserAgent |
    Where-Object { $_ } | Sort-Object -Unique

Set-OrganizationConfig -EwsAllowList $newAllowList

For EnforceBlockList, remove only the confirmed value while preserving all others:

$excelUserAgent = "<exact-user-agent>"
$org = Get-OrganizationConfig
$newBlockList = @($org.EwsBlockList) |
    Where-Object { $_ -and $_ -ne $excelUserAgent }

Set-OrganizationConfig -EwsBlockList $newBlockList

Application-ID restrictions must likewise preserve existing IDs. Set-OrganizationConfig replaces the supplied list rather than safely merging it automatically.^3^ Policy changes can remain cached; EwsAllowedAppIDs changes can take up to 24 hours.^2^

To inventory usage, go to Microsoft 365 admin center → Reports → Usage → Exchange → EWS usage. This identifies applications, SOAP operations, and call volumes, but it might not provide every App ID or User-Agent needed for allow-listing.^4^

3. Migrate when the replacement connector is available

There is no tenant switch that converts the existing Exchange.Contents query to Graph:

1. Upgrade affected clients to Microsoft 365 Apps or Office 2024. Earlier Office versions will not receive the new connector.
2. Inventory workbooks using the existing Microsoft Exchange connector.
3. When the new Mail connector appears in Excel, create a new connection with it.
4. Reapply the existing query’s transformations and replace the old query/output after validation.
5. Do not expect automatic migration. Microsoft has not yet finalized replacement guidance for Calendar, Contacts, and Tasks.^5^

Avoid substituting Web.Contents or OData.Feed against Graph as a permanent workaround. Direct Microsoft Graph connectivity through Power Query’s generic Web/OData connectors is not supported or recommended because of authentication, compatibility, performance, and scalability limitations.^6^

If EWS policies are clear, review Microsoft Entra admin center → Monitoring & health → Sign-in logs at the exact failure time. A Conditional Access failure or insufficient_claims result is a separate authorization path; Graph can also return 403 for incorrect audience, permissions, licensing, or Conditional Access.^7^

References

1. Deprecation of Exchange Web Services in Exchange Online
2. Control access to EWS in Exchange
3. Set-OrganizationConfig-Description
4. Exchange Web Services (EWS) usage report
5. Changes to the Exchange Online connector in Excel Power Query | Microsoft Support
6. Lack of Support for Microsoft Graph in Power Query
7. Resolve Microsoft Graph authorization errors