Exchange Online EWS Retirement 2026: Why Apps Stopped Working and How to Fix (EWSAllowedAppIDs)

Quick answer: Microsoft is retiring Exchange Web Services (EWS) in Exchange Online. From 10 October 2026, tenants that have EwsEnabled set to True must also have an EWSAllowedAppIDs allow list, otherwise EWS apps are blocked. Tenants that never configured EWS will have it disabled in a later phase, and on 1 April 2027 EWS in Exchange Online is switched off permanently.

If an app stopped working: find its Microsoft Entra application (client) ID, add it to EwsAllowedAppIDs (without removing existing entries), wait up to 24 hours, and plan the move to Microsoft Graph before April 2027. On-premises Exchange Server is not affected.

Last updated: 29 October 2026. Based on Microsoft's Exchange Team blog and Message Center notices (see sources).

If your backup tool, CRM, archiving software, scanner-to-email workflow or an old script that talks to mailboxes suddenly stopped working in October 2026, there is a good chance it was using EWS (Exchange Web Services). Microsoft has started the final phase of retiring EWS in Microsoft 365, and the rules changed in a way that surprised many admins.

This guide explains in simple language what EWS is, the exact timeline, why apps are breaking, how to unblock them temporarily with EWSAllowedAppIDs, and how to plan the permanent fix.

Table of contents

1. What is EWS and why is Microsoft retiring it?
2. EWS retirement timeline (2026 to 2027)
3. How EwsEnabled and EWSAllowedAppIDs work now
4. Symptoms: how to know EWS is the problem
5. How to fix a blocked EWS app (step by step)
6. Microsoft apps that still use EWS
7. Permanent fix: move to Microsoft Graph
8. Admin checklist before April 2027
9. FAQ
10. Sources

What is EWS and why is Microsoft retiring it?

Exchange Web Services (EWS) is an old API (it dates back to Exchange Server 2007) that lets applications read and write mailbox data: emails, calendars, contacts and tasks. For years, many third-party products used it: backup and archiving tools, CRMs, help desk tools, migration tools, room booking systems and custom scripts.

Microsoft announced back in 2023 that EWS in Exchange Online would be retired, and it reportedly sped up the plan after the Midnight Blizzard security incident. The modern replacement is Microsoft Graph, which Microsoft says covers the vast majority of EWS scenarios with better security and permissions.

Important: this retirement is only for Exchange Online (Microsoft 365). Microsoft says there are no EWS changes planned for on-premises Exchange Server.

EWS retirement timeline (2026 to 2027)

Date	What happens
2023	Microsoft announces EWS retirement in Exchange Online.
August 2026	Deadline Microsoft gave admins to set EwsEnabled to True and build an allow list if they still need EWS.
2 October 2026	Microsoft takes a snapshot of worldwide tenants that have EwsEnabled set to True.
8 to 9 October 2026	Microsoft auto-populates allow lists for qualifying tenants using EWS activity from the previous 60 days.
10 October 2026	Allow-list enforcement starts: with EwsEnabled = True, only apps listed in EWSAllowedAppIDs can use EWS.
Later phase	Tenants that never configured EwsEnabled (Null) get EWS disabled, with seven days' Message Center notice.
1 April 2027	EWS in Exchange Online is permanently disabled. No exceptions.

How EwsEnabled and EWSAllowedAppIDs work now

This is the part that changed and caught people off guard. Before October 2026, setting EwsEnabled to True simply allowed all EWS traffic. Now it works like this:

EwsEnabled value	Behaviour after enforcement
True + allow list	Only apps whose AppID is in EWSAllowedAppIDs can use EWS (until April 2027).
True + no allow list	All EWS traffic is blocked (except cross-tenant organization relationships).
False	All EWS traffic is blocked.
Null (never configured)	Will be disabled in the phased retirement.

Two things to remember:

• EWSAllowedAppIDs is a replacement list: when you set it, the new value replaces the old one completely. Always include every app you still need.
• The older EwsAllowList setting is a different thing (it is based on user agents). It is unrelated to the retirement and does not replace EWSAllowedAppIDs.

Symptoms: how to know EWS is the problem

• A third-party tool (backup, archiving, CRM, ticketing, room booking, migration) that connects to mailboxes suddenly fails with authentication or "access denied" type errors since October 2026.
• Scripts using the EWS Managed API stop working.
• Jobs that run rarely (quarterly exports, year-end archives, DR scripts) fail, because they did not appear in the 60 days of activity Microsoft used to auto-build allow lists.
• Classic Outlook for Mac or older Outlook builds show connection problems for some features.

How to fix a blocked EWS app (step by step)

You need the Exchange Online PowerShell module and an Exchange administrator account.

Step 1: Check your current settings

Connect-ExchangeOnline

# Is EWS enabled for the tenant?
Get-OrganizationConfig | Format-List EwsEnabled, EwsApplicationAccessPolicy

# Which apps are on the allow list?
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

Step 2: Find the AppID of the app that is failing

The allow list uses the Microsoft Entra application (client) ID of the app, not its name or user agent. Ways to find it:

• Microsoft Entra admin center > Identity > Applications > Enterprise applications: search for the vendor's app and copy its Application ID.
• Sign-in logs: in Microsoft Entra sign-in logs (including service principal sign-ins), filter by the resource Office 365 Exchange Online and look at the application name and ID.
• Microsoft's EWS usage reports mentioned in the Message Center notices.
• Ask the vendor: most vendors have published their AppID and their Graph migration status.

Step 3: Add the AppID without removing existing ones

Because the list is replaced every time you set it, read the current list first, add the new ID, then write the combined list. A safe pattern:

# Current list
$current = @((Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy).EwsAllowedAppIDs)

# AppID(s) to add (replace with your real application IDs)
$toAdd = @("00000000-0000-0000-0000-000000000000")

$newList = @($current + $toAdd | Where-Object { $_ } | Sort-Object -Unique)
$newList   # review before applying

Set-OrganizationConfig -EwsEnabled:$true -EwsAllowedAppIDs $newList

Tip: copy the output of $current into a text file before you change anything, so you can roll back. Always confirm the exact parameter format against Microsoft's latest Exchange Team blog post, because Microsoft may update the cmdlets during the retirement.

Step 4: Wait and test

• Allow-list changes can take up to 24 hours to apply.
• Changes to EwsEnabled take about 1 hour.
• Run the check commands from Step 1 again, then test the app.

Step 5: Do not just "turn EWS back on"

Setting EwsEnabled to True on its own no longer allows traffic, and Microsoft warns that flipping EWS on and off can cause service interruptions. Treat the allow list as a temporary bridge until April 2027, not a fix.

Microsoft apps that still use EWS

Microsoft's own apps are not automatically exempt. Scenarios Microsoft has listed as EWS-dependent include:

• Outlook for Windows (classic): keep it on build 16.0.20430.20092 (August 2026) or later.
• Classic Outlook for Mac: needs the Microsoft Office AppID on the allow list. New Outlook for Mac is not affected.
• Excel Power Query and Power BI connections to Exchange.
• Exchange hybrid scenarios.
• Skype for Business client and hybrid server (Microsoft has published specific AppIDs and an update requirement before April 2027).

If any Microsoft app shows up in your EWS usage reports, add it to the allow list too.

Permanent fix: move to Microsoft Graph

The allow list stops working on 1 April 2027. After that, every app must use Microsoft Graph (or another supported method). What to do:

1. Make an inventory of every app and script that uses EWS (from the allow list, usage reports and sign-in logs).
2. Contact each vendor and ask: "Do you support Microsoft Graph? Which version? What permissions does it need?" Upgrade to the Graph-based version.
3. Rewrite in-house scripts with the Microsoft Graph PowerShell SDK or Graph API. For example, mail can be read with Get-MgUserMessage and sent with Send-MgUserMail.
4. Use least-privilege permissions in Graph (for example, application access policies or RBAC for Applications to limit which mailboxes an app can access).
5. Remove AppIDs from the EWS allow list as each app moves to Graph.

Admin checklist before April 2027

• ☐ Check EwsEnabled and EwsAllowedAppIDs in your tenant.
• ☐ Review EWS usage reports and Entra sign-in logs for EWS apps.
• ☐ Add only the apps you really need to the allow list, and keep a backup of the list.
• ☐ Test rarely-used jobs (quarterly, yearly, DR) now, not in March 2027.
• ☐ Update Outlook for Windows to build 16.0.20430.20092 or later; move Mac users to new Outlook for Mac.
• ☐ Get a Graph migration date from every vendor.
• ☐ Rewrite internal EWS scripts to Microsoft Graph.
• ☐ Communicate to users that some old integrations will stop on 1 April 2027.

FAQ

Is EWS being removed from Exchange Server on-premises too?

No. Microsoft says the retirement applies to Exchange Online only. There are no EWS changes planned for on-premises Exchange Server.

Why did my app stop working even though EwsEnabled is True?

Since the October 2026 enforcement, EwsEnabled = True only allows apps listed in EWSAllowedAppIDs. If your app's AppID is not on the list, it is blocked.

How long does it take for allow list changes to work?

Up to 24 hours for EWSAllowedAppIDs changes, and about an hour for EwsEnabled changes.

Can I keep using EWS after April 2027?

No. Microsoft has said EWS in Exchange Online will be permanently disabled on 1 April 2027, with no further postponement.

Is EWSAllowedAppIDs the same as EwsAllowList?

No. EwsAllowList is an older, user-agent based setting unrelated to the retirement. The retirement uses EWSAllowedAppIDs (application IDs).

Does this affect normal Outlook users?

Most users of new Outlook, Outlook on the web and mobile apps will not notice anything. Keep classic Outlook for Windows updated, and move classic Outlook for Mac users to new Outlook for Mac.

Final words

The EWS retirement is a hard deadline. Use the allow list to keep critical apps running for now, but treat 1 April 2027 as the real date: by then every mailbox integration should be on Microsoft Graph. Start the inventory today; the rarely used jobs are the ones that will surprise you.

Related guides: Microsoft 365 sign-in error codes and fixes, Outlook not receiving emails? 10 fixes and PowerShell automation scripts for IT admins.

Sources

• Microsoft Exchange Team: EWS Deprecation Is Here – What This Means To You
• Microsoft Exchange Team: Exchange Online EWS application stopped working? Do this.
• Microsoft Exchange Team: Introducing EWSAllowedAppIDs
• Message Center MC1485116: EWS enforcement update for EWSAllowedAppIDs
• Windows Central: Microsoft EWS retirement timeline
• WindowsForum: EWS shutdown begins, configure AppID allow lists

Techyami is not affiliated with Microsoft. Test changes in your tenant carefully and always check Microsoft's latest Message Center posts, as dates and cmdlets can change.