Microsoft has started switching off Exchange Web Services (EWS) in Exchange Online, one tenant at a time. EWS is an old interface that apps use to work with mail, calendars and contacts in Microsoft 365. On April 1, 2027, Microsoft turns it off for good, and the Exchange team says there will be no exceptions.
Tony Redmond flagged it on October 23, pointing to a new Exchange team post for admins whose EWS apps have already stopped working. It is a helpful list that shows what breaks and how to buy time.
The critical part for a small business is understanding what still uses EWS in your own environment. For me, it was limited to our Synology Active Backup for Microsoft 365 client. Synology recently released version 3 of the client, which migrates some of those backup services to the Graph API, but they still have more work to do before the deadline to keep the product working as it does today. That means I have to plan now just in case those critical backups stop working.
What Microsoft is doing
- Tenants that never set EWS either way get a Message Center notice titled “Action may be required: EWS will be disabled in your tenant in 7 days.” A second notice, “EWS has been disabled in your tenant,” follows when it happens.
- Before it switches EWS off, Microsoft fills in an allow list with the apps it saw using EWS in your tenant over the last 60 days.
- Until April 1, 2027, an admin can turn EWS back on for the apps on that list. After that date, the setting goes away.
- Exchange Server on premises isn’t affected. Only Exchange Online is.
What breaks
The Exchange team lists these as apps that use EWS:
- Apple Mail and Calendar on a Mac
- Classic Outlook for Mac
- Some Outlook add-ins
- Outdated versions of Outlook for Windows. Microsoft says to be on the August 2026 build (16.0.20430.20092) or later.
- Backup tools and other apps bought from software vendors
Microsoft is also still removing EWS from some of its own tools, including the Exchange connector in Excel’s Power Query and in Power BI.
Microsoft says the failures vary. Some apps keep asking for a username and password. Others give a clear error that EWS isn’t available. So expect the help desk call to sound like a password problem.
iPhones and iPads aren’t on the list. Apple’s documentation shows them connecting to Exchange Online through Exchange ActiveSync.
The Mac problem
Apple Mail on a Mac is the one most small offices will trip over. Apple’s own deployment guide says Apple is “actively working with Microsoft to update Mail, Calendar, Contacts, Notes, and Reminders to use the Graph API in a future update to macOS 27,” but it gives no date.
For Outlook on a Mac, Microsoft’s advice is to switch to the new Outlook for Mac, which this change doesn’t affect. If someone has to stay on classic Outlook for Mac for now, the “Microsoft Office” app ID must be on your allow list.
For a small office, I’d move Mac users to the new Outlook for Mac now rather than wait on a macOS update with no date. If someone won’t give up Apple Mail, keep EWS on for it in the meantime. Microsoft built your allow list from the apps it saw, so if your Macs have been using Apple Mail, it should already be there. Check, and remember that if Apple’s update doesn’t arrive before April 1, Apple Mail stops working with Microsoft 365 anyway.
If something already stopped working
Start in Message Center in the Microsoft 365 admin center. Search for “EWS” to find the two notices above and the date EWS was turned off in your tenant.
Then turn it back on, one of two ways. Both come from the Exchange team’s post.
In the admin center
- In the Microsoft 365 admin center, go to Settings > Org settings > Security and privacy > Baseline Security Mode.
- Select Block access to Exchange Web Services.
- Clear Block your entire organization from using EWS and select Apply change.
- Select the same box again and select Apply change again.
Yes, you turn EWS back on by ticking “Block.” Microsoft says this leaves EWS on for the apps on your allow list and blocks everything else. The Scope Summary on that page lists the apps that are allowed.
In PowerShell
In Exchange Online PowerShell, signed in as an Exchange Administrator:
Set-OrganizationConfig -EwsEnabled $trueMicrosoft says either change usually takes effect within an hour, and occasionally takes up to four. Microsoft support can’t make the change for you. A tenant admin has to do it.
You may also see advice to set EwsEnabled to $null instead, which lets every app in with no allow list. Microsoft’s newest instructions use $true and the allow list, and that’s what I recommend following, but the $null option is available if you are seeing things break already and need more time to troubleshoot.
Watch the allow list
The list Microsoft filled in only covers apps it saw in the last 60 days. A tool you run once a quarter, like a backup restore, a mailbox migration or a year-end export, may not be on it.
Adding an app is awkward. Set-OrganizationConfig replaces the whole list, so you have to read it, add to it and write it back. Microsoft says changes to the list can take up to 24 hours to apply. This changes your tenant, so carefully check the app ID before you run it:
# This changes your tenant. Run it as an Exchange Administrator.
# Replace the placeholder with the app ID you want to allow.
$newAppId = '00000000-0000-0000-0000-000000000000'
# Read the current list, add the new ID, and write the whole list back.
$current = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy).EwsAllowedAppIDs
$updated = @(@($current) -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ }) + $newAppId |
Select-Object -Unique
Set-OrganizationConfig -EwsAllowedAppIDs ($updated -join ',')Check your tenant
This read-only script shows where your tenant stands. It explains your EwsEnabled setting in plain English, lists the apps on the allow list (with their names, if you ask), mentions the older User-Agent filter if one is set, and lists any mailboxes where EWS was turned off one by one. It changes nothing.
What you need:
- PowerShell 7. I run it on Ubuntu. Learn says the current ExchangeOnlineManagement module (3.10.0 or later) needs PowerShell 7.6 or later.
- An account with read access to Exchange Online. Global Reader should be enough, since Exchange maps it to its View-Only Organization Management role group. If any part is refused, run it as an Exchange Administrator.
- For app names only: the Microsoft.Graph.Applications module and the
Application.Read.Allpermission. An admin has to consent to that permission the first time.
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Install-Module Microsoft.Graph.Applications -Scope CurrentUserSave the script as Get-EwsStatus.ps1 and run it with ./Get-EwsStatus.ps1 -ResolveNames -UseDeviceCode. Leave off -ResolveNames to skip the Graph sign-in. The -UseDeviceCode switch lets you sign in from a terminal or an SSH session.
<#
.SYNOPSIS
Shows whether Exchange Web Services (EWS) is on in your Exchange Online tenant, which
apps are on the EWS allow list, and which mailboxes have EWS turned off.
.DESCRIPTION
Read-only. Microsoft retires EWS in Exchange Online on April 1, 2027, and is turning it
off tenant by tenant before then. This script shows where your tenant stands:
- The tenant-wide EwsEnabled setting: True, False or Not set.
- The EwsAllowedAppIDs allow list. While EwsEnabled is True, only these apps can use
EWS. With -ResolveNames, each app ID is looked up in Microsoft Entra ID.
- The older User-Agent filter (EwsApplicationAccessPolicy), if one is set.
- Mailboxes that have EWS turned off one by one.
Nothing in your tenant is changed.
Requires PowerShell 7.2 or later and the ExchangeOnlineManagement module 3.0.0 or later.
Read access to Exchange Online is enough (for example, the Global Reader role). With
-ResolveNames, it also needs the Microsoft.Graph.Applications module and the
Application.Read.All permission, which an administrator must consent to once.
.PARAMETER ResolveNames
Look up the name of each app on the allow list in Microsoft Entra ID.
.PARAMETER UseDeviceCode
Sign in with a device code instead of a browser window. Useful over SSH or on a
machine without a desktop.
.EXAMPLE
./Get-EwsStatus.ps1 -ResolveNames -UseDeviceCode
#>
#Requires -Version 7.2
#Requires -Modules @{ ModuleName = 'ExchangeOnlineManagement'; ModuleVersion = '3.0.0' }
[CmdletBinding()]
param(
[switch]$ResolveNames,
[switch]$UseDeviceCode
)
$ErrorActionPreference = 'Stop'
# Check for the Graph module before signing in to anything.
if ($ResolveNames -and -not (Get-Module -ListAvailable -Name 'Microsoft.Graph.Applications')) {
throw 'The -ResolveNames switch needs the Microsoft.Graph.Applications module. Install it with: Install-Module Microsoft.Graph.Applications -Scope CurrentUser'
}
# Sign in. With -UseDeviceCode, you get a code to enter at https://microsoft.com/devicelogin.
if ($UseDeviceCode) {
Connect-ExchangeOnline -Device -ShowBanner:$false
}
else {
Connect-ExchangeOnline -ShowBanner:$false
}
$graphConnected = $false
try {
if ($ResolveNames) {
$graphParams = @{ Scopes = 'Application.Read.All'; NoWelcome = $true }
if ($UseDeviceCode) { $graphParams.UseDeviceCode = $true }
Connect-MgGraph @graphParams
$graphConnected = $true
}
$org = Get-OrganizationConfig
# The allow list is only returned when you ask for it. It can come back as one
# comma-separated string or as a list, so handle both.
$allowRaw = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy).EwsAllowedAppIDs
$allowList = @(@($allowRaw) -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
# EwsEnabled can be True, False or empty (not set). Compare as text so it works either way.
$enabled = "$($org.EwsEnabled)"
if ($enabled -eq '') {
$state = 'Not set'
$meaning = 'Every app can use EWS for now, but Microsoft is turning EWS off in tenants left like this, after a 7-day warning in Message Center.'
}
elseif ($enabled -eq 'False') {
$state = 'False'
$meaning = 'EWS is off for the whole tenant. Every app that uses it will fail.'
}
elseif ($allowList.Count -eq 0) {
$state = 'True'
$meaning = 'EWS is on, but the allow list is empty, so every EWS app is blocked.'
}
else {
$state = 'True'
$meaning = "EWS is on for the $($allowList.Count) app(s) on the allow list. Every other app is blocked."
}
Write-Host "`nTenant setting" -ForegroundColor Cyan
Write-Host "EwsEnabled: $state"
Write-Host $meaning
if ($org.EwsApplicationAccessPolicy) {
Write-Host "EwsApplicationAccessPolicy: $($org.EwsApplicationAccessPolicy). An older User-Agent filter is also on, and an app must pass both checks."
}
Write-Host "`nApps on the EWS allow list (EwsAllowedAppIDs)" -ForegroundColor Cyan
if ($allowList.Count -eq 0) {
Write-Host 'The list is empty.'
}
elseif ($ResolveNames) {
$allowList | ForEach-Object {
$appId = $_
if ($appId -notmatch '^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$') {
$name = '(not a valid app ID)'
}
else {
$sp = Get-MgServicePrincipal -Filter "appId eq '$appId'" -Property AppId, DisplayName
$name = if ($sp) { @($sp.DisplayName) -join ', ' } else { '(not found in your tenant)' }
}
[pscustomobject]@{ AppId = $appId; Name = $name }
} | Format-Table -AutoSize
}
else {
$allowList | ForEach-Object { [pscustomobject]@{ AppId = $_ } } | Format-Table -AutoSize
}
# A mailbox set to False can't use EWS even when the tenant allows it.
Write-Host "`nMailboxes with EWS turned off one by one" -ForegroundColor Cyan
$blocked = @(Get-EXOCASMailbox -ResultSize Unlimited |
Where-Object { "$($_.EwsEnabled)" -eq 'False' } |
Sort-Object DisplayName)
if ($blocked.Count -eq 0) {
Write-Host 'None.'
}
else {
$blocked | Select-Object DisplayName, PrimarySmtpAddress | Format-Table -AutoSize
}
Write-Host "`nNext, compare the allow list with the EWS usage report:"
Write-Host 'https://admin.cloud.microsoft/#/reportsUsage/EWSWeeklyUsage'
}
finally {
if ($graphConnected) { Disconnect-MgGraph | Out-Null }
Disconnect-ExchangeOnline -Confirm:$false
}The output looks like this:
Tenant setting
EwsEnabled: True
EWS is on for the 2 app(s) on the allow list. Every other app is blocked.
Apps on the EWS allow list (EwsAllowedAppIDs)
AppId Name
----- ----
11111111-2222-3333-4444-555555555555 Contoso Backup
aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee (not found in your tenant)
Mailboxes with EWS turned off one by one
DisplayName PrimarySmtpAddress
----------- ------------------
Pat Example pat@contoso.example
Next, compare the allow list with the EWS usage report:
https://admin.cloud.microsoft/#/reportsUsage/EWSWeeklyUsageHow to read the first line:
- Not set: you’re in line for the 7-day notice. Decide now whether anything needs EWS.
- False: EWS is off. If nobody has complained, Microsoft says you can simply leave it that way.
- True: only the apps on the allow list can use EWS. Make sure every app you need is on it, and nothing you don’t.
Put names to the app IDs
The EWS usage report shows what has actually been calling EWS. In the Microsoft 365 admin center, go to Reports > Usage, select Exchange, then the EWS usage tab. It lists each app ID, the EWS actions it used, how many calls it made and the last date it was active, over the last 7, 30 or 90 days. Microsoft collects the data weekly, so it can lag by up to 10 days. You need a role such as Reports Reader to see it.
To match an ID to a product, look it up under Enterprise applications in the Microsoft Entra admin center, or check Microsoft’s list of its own app IDs.
What I’d do this week
- Search Message Center for “EWS” and note any dates.
- Run the script and save the output.
- Open the EWS usage report and give every app ID a name and an owner.
- Ask each vendor, in writing, when their product stops using EWS. “Soon” isn’t a date.
- Move Mac users to the new Outlook for Mac, or plan for the day Apple Mail stops working.
- Put a reminder on your calendar for early March 2027 to check again.
After April 1, 2027, there’s no setting left to change. Whatever still uses EWS that morning stops working.
