What breaks when EWS is turned off
Exchange Online itself keeps working, and so do current Outlook clients. What fails is any integration that still reads or writes mailboxes, calendars or contacts through EWS. Common examples:
- Line-of-business, CRM and ticketing systems that file or send email
- Room booking, scheduling and calendar sync tools
- Email signature, archiving, journaling and backup products
- Migration utilities and older admin scripts
- Custom apps and service accounts built years ago that nobody owns today
- Hybrid Exchange features, which Microsoft is moving from EWS to Microsoft Graph
Microsoft says it is also removing EWS from its own products, including Outlook, Office, Teams and Dynamics 365. Third-party and in-house integrations are the usual gap.
Microsoft's published timeline
| Date | What Microsoft says happens | What it means for you |
|---|---|---|
| 2018 | EWS stops receiving feature updates | New integrations should already use Microsoft Graph |
| 2023 | October 2026 set as the EWS disablement date for Exchange Online | Vendors have had notice; ask them for a dated plan |
| October 2026 (from Oct 1) | Phased, tenant-by-tenant EWS disablement begins | Undiscovered or unapproved EWS integrations can fail now |
| April 2027 | EWS is fully disabled in Exchange Online | The allow list stops being a fallback; every integration must be off EWS |
Dates come from Microsoft Learn and the Microsoft Exchange Team blog (sources below). Microsoft can change them, so we check the current guidance at the start of every engagement.
How we build the inventory
- Export the EWS usage report. In the Microsoft 365 admin center under Reports, Usage, Exchange, EWS usage. It shows the application ID, the EWS SOAP actions called, call volume and last activity over 7, 30 or 90 days. Microsoft aggregates the data weekly, so we treat it as a starting point.
- Match application IDs to real products. Using Microsoft Entra enterprise applications and app registrations, sign-in evidence, vendor documentation and internal records.
- Name an owner and a business process for each one. What fails if it stops, who can test it, which mailboxes and data it touches.
- Check code we can see. For in-house apps and scripts, Microsoft's EWS Analyzer and the EWS-to-Graph API mapping show which calls need a new path.
- Record a decision and a date. Every item ends up as update, migrate, temporarily allow or retire, with an owner and a target date ahead of April 2027.
Remediation options for each dependency
| Type of dependency | Usual fix | What we do |
|---|---|---|
| Packaged product or SaaS | Vendor update to a version that uses Microsoft Graph | Get a supported version, upgrade steps and date from the vendor, then confirm in the usage report that EWS calls stop |
| In-house app or script | Rewrite the EWS calls against Microsoft Graph | Map each SOAP action to Graph, set least-privilege permissions, and test throttling, notifications and recurrence |
| Feature with no Graph equivalent | Redesign or replace | Check Microsoft's parity roadmap; Microsoft says generic public folder access, generic Microsoft 365 Group mailbox access and Discovery Mailbox access will not come to Graph |
| Unknown or dormant app | Retire or block | Investigate before allowing; if it maps to no valid process, remove its access |
| Needed temporarily | Add to the EWSAllowedAppIDs allow list | Only with a named owner and an exit date, never as a parking lot |
Moving to Microsoft Graph is also a chance to shrink access. Many EWS integrations had broad mailbox rights. Graph supports narrower permissions, and we document why each app needs what it has.
What is in scope, and what is not
Usually in scope
- EWS usage report export, application ID mapping and an owned inventory
- Allow list design and testing, including a deliberate test that an unapproved app is blocked
- Vendor follow-up for supported versions and dates
- Microsoft Graph permission design and app registration cleanup
- An incident runbook for EWS-related failures during the phased shutdown
- Re-checking the usage report until EWS calls reach zero
Handled separately or agreed during discovery
- Rewriting in-house applications. We scope the Graph migration; the code changes are quoted separately or done by your developers with our guidance.
- Changes inside vendor products, which only the vendor can make
- Exchange Server on-premises, which this retirement does not affect. Hybrid updates are covered in our Exchange SE hybrid case study.
What we need from you
- Microsoft 365 admin access with permission to view usage reports and Entra enterprise applications
- Contacts for the vendors and internal teams that own integrations
- Developer access to in-house code, if Graph migration is in scope
- A change approver for allow list and permission changes
Related proof
Updating hybrid coexistence without breaking the calendar: about 460 mailboxes, 2 Exchange SE servers, the hybrid application moved to the required Microsoft Graph permissions, 3 coexistence features tested, 4 weeks from assessment to handoff. For the full background and an admin checklist, read our EWS retirement guide.