Customer reports the Splunk SOAR Cloud “EWS for office 365” app has recently begun returning HTTP 403 errors when attempting to parse logs, despite successful Azure authentication and access token retrieval.
In the $PHANTOM_HOME/var/logs/phantom/spawn.log.
Found the following error:
'EWS is blocked by policy for this user or tenant'
On Oct 1st to block EWS.
Details are at https://techcommunity.microsoft.com/blog/exchange/exchange-online-ews-your-time-is-almost-up/4492361
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
14-Oct-2026
|
Initial Release |