Exchange Online EWS Retirement: What Admins Must Do Now That Disablement Has Started

Microsoft is in the final phase of retiring Exchange Web Services (EWS) in Exchange Online. Enforcement started in October 2026. Tenants that left EWS at its default setting are now being switched off in batches. On April 1, 2027, EWS is turned off for good and admins lose the ability to change the EWSEnabled setting.

Exchange Online itself isn’t going anywhere. The risk is that an older app, add-in, backup tool, scheduling system, or custom script still uses EWS behind the scenes. Once your tenant’s turn comes, that app stops working. Users might see repeated password prompts or a clear “EWS not available” error.

Why this matters for small and mid-sized businesses

Smaller organizations rarely keep a list of what connects to their mailboxes. EWS dependencies tend to sit in products bought years ago and set up once:

• Backup and archive tools that read mailboxes through EWS.
• CRM, ticketing, and scheduling systems that sync calendars or file email.
• Mac users on classic Outlook for Mac or Apple Mail/Calendar, which Microsoft lists among the apps that use EWS.
• Outlook desktop add-ins and outdated Outlook for Windows builds.
• Excel Power Query and Power BI reports that use the Exchange connector.
• Exchange hybrid setups that keep mailboxes on-premises with archives in Exchange Online.

If you do nothing, you won’t get a slow decline. One day a backup quietly stops capturing mail, a booking system stops updating calendars, or a group of Mac users can’t connect. Turning EWS back on is quick, but Microsoft notes there’s a service interruption until you do. And after April 1, 2027, there is no fallback.

Where your tenant stands right now

For tenants in the multi-tenant (worldwide) cloud, Microsoft lists how each combination of settings behaves now:

For GCC, GCC High, DoD, and other sovereign clouds, Microsoft hasn’t published a detailed timeline yet and says more is coming. The retirement covers Exchange Online only. EWS in on-premises Exchange Server isn’t changing.

Licensing and prerequisites

Step-by-step: check, stabilize, and shrink your EWS footprint

1. Find out whether Microsoft has already acted on your tenant

1. Go to Microsoft 365 admin center > Health > Message center.
2. Search for EWS. Look for “Action may be required: EWS will be disabled in your tenant in 7 days” or “EWS has been disabled in your tenant.”
3. Confirm the current values in PowerShell:

Connect-ExchangeOnline
Get-OrganizationConfig | Format-List EwsEnabled
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

The allow list only shows up when you add -RetrieveEwsOperationAccessPolicy. Microsoft hides it by default for performance reasons.

2. Pull the EWS usage report

1. Go to Microsoft 365 admin center > Reports > Usage. If Reports isn’t visible, select Show all first.
2. Under Reports, select Exchange, then the EWS usage tab.
3. Set the window to 90 days and select Export.

The report lists each Application ID, SOAP Action, Call Volume, and Last Activity date (UTC). It counts successful calls only. Data is collected weekly, and new activity can take up to 10 days to show up.

3. Turn app IDs into named, owned apps

To match Microsoft’s own apps, use Microsoft’s list of commonly used first-party app IDs. For everything else, check Microsoft Entra admin center > Entra ID > Enterprise apps, or look the IDs up in PowerShell:

Connect-MgGraph -Scopes 'Application.Read.All'
$ids = Import-Csv .\EWSUsage.csv | Select-Object -ExpandProperty 'Application ID' -Unique
foreach ($id in $ids) {
  Get-MgServicePrincipal -Filter "appId eq '$id'" | Select-Object AppId, DisplayName, PublisherName
}

Change the column name to match the header in your CSV export. For each app, write down the vendor, the business process it supports, the person who owns it, what mailbox data it touches, and how it will move off EWS: a vendor update, a Graph rewrite, a replacement, or retirement.

4. If something broke, re-enable EWS (temporary)

Only a tenant admin can do this. Microsoft support can’t do it for you.

Option A, the portal:

1. Go to Microsoft 365 admin center > Settings > Org settings > Security & privacy > Baseline Security Mode.
2. Open the Exchange Web Services setting (“Block access to Exchange Web Services”).
3. Clear Block your entire organization from using EWS and select Apply change.
4. Select the same checkbox again and select Apply change again. Microsoft documents this two-pass sequence. The result is EWSEnabled=True with your allow list enforced. The list appears under Scope summary, and Exclude specific apps lets you edit it.

Option B, PowerShell:

Set-OrganizationConfig -EwsEnabled $true

EWS usually works again within an hour, and in rare cases up to 4 hours. Microsoft will have already built an allow list from the last 60 days of usage, so check it right away (step 5).

5. Make the allow list match what you actually approve

Set-OrganizationConfig replaces the whole list each time. There’s no add or remove for a single ID, so read the current list, change it, and write all of it back:

# Add one app ID
$current = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Select-Object -ExpandProperty EwsAllowedAppIDs)
$newAppId = "99999999-8888-7777-6666-555555555555"
$updated = @($current, $newAppId)
Set-OrganizationConfig -EwsAllowedAppIDs ($updated -join ",")

# Remove one app ID
$current = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Select-Object -ExpandProperty EwsAllowedAppIDs)
$removeAppId = "99999999-8888-7777-6666-555555555555"
$updated = ($current -split ",") | Where-Object { $_ -ne $removeAppId }
Set-OrganizationConfig -EwsAllowedAppIDs ($updated -join ",")

Remove anything you can’t tie to an owner and a business need. Leave Microsoft first-party apps that still show in the usage report on the list until they stop appearing, for example the “Microsoft Office” app ID for classic Outlook for Mac users.

6. Migrate before April 1, 2027

• Packaged or vendor apps: ask the vendor for a specific version without EWS, with instructions and a date. Then watch the usage report to confirm the app ID drops off.
• Custom apps: start from the SOAP actions in the usage report and map them to Microsoft Graph with Microsoft’s EWS-to-Graph mapping. Graph uses OAuth with narrower permission scopes, so request only what the app needs.
• Known gaps: Microsoft lists Graph features still in progress, with targets in Q3/Q4 2026 (for example archive, public folder, and group mailbox import/export, and the Exchange Admin API). It also lists features Graph will never support: generic public folder CRUD, generic Microsoft 365 Group mailbox CRUD, and Discovery Mailbox access. If your app depends on one of those, it needs a redesign, not a port.

Gotchas

• EWSAllowList is a different setting. It’s the older user-agent filter that is part of EwsApplicationAccessPolicy, and it has nothing to do with the retirement. If you use both, a request has to pass both checks.
• Changes take time to apply. Allow list changes take up to 24 hours. EWSEnabled changes usually take under an hour, but can take up to 4.
• The Baseline Security Mode checkbox reads backwards. With “Block” checked after the two-pass re-enable, the tenant is actually set to EWSEnabled=True with your allow list.
• Microsoft’s automatic list includes whatever it saw. It may contain apps nobody knew about. That’s useful for discovery, but it doesn’t mean anyone approved them.
• Microsoft’s own apps still need to be on the list if they appear in the report. Microsoft names classic Outlook for Mac, Excel Power Query, and Power BI. Outlook for Windows should be on current builds.
• Hybrid with online archives: if you have on-premises mailboxes with archives in Exchange Online, keep EWSEnabled=True and add your dedicated hybrid app to the allow list. Graph doesn’t fully support that setup yet.
• On-premises orgs that share free/busy with your tenant through an organization relationship need your tenant to keep EWSEnabled=True.
• The usage report lags. It counts successful calls only, aggregates weekly, and can be up to 10 days behind. An app that is already blocked won’t show up as a new successful caller.
• April 1, 2027 is final. Admins lose control of EWSEnabled, and Microsoft says there will be no extensions.

How to verify it worked

• Portal: In Microsoft 365 admin center > Settings > Org settings > Security & privacy > Baseline Security Mode, open the EWS setting and check that the Scope summary lists only the apps you approved.
• PowerShell: Confirm both values:

  Get-OrganizationConfig | Format-List EwsEnabled
  Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

• Functional test: 24 hours after any list change, test every approved app. Deliberately try one app that isn’t approved too, so the help desk knows what the failure looks like.
• Trend: Re-export the EWS usage report every two weeks. As vendor updates and Graph migrations land, the number of active apps should fall toward zero.

Frequently Asked Questions

Has Exchange Online started disabling EWS? Yes. Enforcement began October 1, 2026. Tenants with EWS left at the default (Null) are being switched off in batches, each after a 7-day Message Center warning. EWS is fully and permanently disabled starting April 1, 2027.

Our EWS app stopped working. How do we turn it back on? A tenant admin can re-enable it in Microsoft 365 admin center Baseline Security Mode or by running Set-OrganizationConfig -EwsEnabled $true. Only apps on EWSAllowedAppIDs will work. Microsoft support can’t do this for you, and the option goes away in April 2027.

Does this affect on-premises Exchange Server? No. The retirement applies to Exchange Online only. Hybrid setups can still be affected, for example on-premises mailboxes with archives in Exchange Online.

How do we find apps that still use EWS? Use the EWS usage report in the Microsoft 365 admin center under Reports, Usage, Exchange, EWS usage. It lists the application ID, SOAP action, call volume, and last activity date for the last 7, 30, or 90 days.

Is the allow list a permanent alternative to migrating? No. EWSAllowedAppIDs only works until April 1, 2027. After that, EWS is off for every tenant, and Microsoft says there will be no exceptions.

Should we add app IDs to EWSAllowList? No. EWSAllowList is an older user-agent filter with no connection to the retirement. The allow list that matters is EWSAllowedAppIDs.