agent's EWS connection broke when agent tried to fetch eml attachments

TL;DR

EWS attachment fetches break agents for predictable reasons: the agent holds a streaming connection while doing slow analysis, the attachment exceeds a size or time limit on the request, or the connection is reused after the server closed it. Fetch the attachment in a dedicated short call, stream it to disk rather than memory, and get a fresh EWS connection for each batch instead of nursing one long-lived connection.

agent's EWS connection broke when agent tried to fetch eml attachments

Use this when

• EWS item fetches succeed but attachment downloads drop the connection.
• Failures cluster on large or nested eml attachments.

Not for this skill when

• All EWS calls fail including simple folder binds. That is auth or service discovery, not attachments.
• The agent uses Graph, not EWS. Apply Graph attachment handling instead.

Steps

1. Log the EWS error and the attachment size and type for failing items over one run. Verify: failures correlate with size, nesting or elapsed time, and the pattern is named.
2. Split the workflow: first fetch item metadata for the batch, then download each attachment in its own request with its own timeout. Verify: one bad attachment no longer kills the batch connection.
3. Stream downloads to local files and analyse from disk, imposing a sensible size ceiling with oversized items routed to manual handling. Verify: memory use stays flat on the largest test attachment.
4. Add connection hygiene: dispose and recreate the EWS service object after any transport error rather than retrying on a dead connection. Verify: a forced disconnect in testing recovers on the next item.
5. Re-run the failing mailbox set. Verify: every attachment is either analysed or explicitly routed to manual review, with none silently skipped.

Variant phrasings

ews attachment download connection failure agent

The EWS attachment variant.

exchange web services fetch eml attachment streaming

The streaming variant.

Compatibility: Exchange Web Services managed API patterns, Exchange Online and on-premises Exchange.

Why it happens

EWS was designed for interactive clients that fetch one item at a time. An agent batch job stresses it differently: long operations, big attachments and stale connections, so patterns that work in Outlook add-ins fail at sweep scale.

Edge cases / pitfalls

• EWS is in maintenance at Microsoft; new agent builds should plan a Graph path even while fixing EWS today.
• Nested eml attachments need recursive handling with a depth limit, or an attacker message can recurse the agent.
• Autodiscover results can differ per mailbox. Cache per mailbox, not globally.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_R9FOeygZguhjpGVKqCKerQ