MC1422057 - Update Exchange Web Services (EWS) allow list configuration for calendar

What and Why:

Microsoft is making backend changes to the calendar services that support the Microsoft Teams mobile calendar experience. To help maintain uninterrupted calendar functionality in Teams, organizations that use Exchange Web Services (EWS) application access policies may need to update their EWS allow list or block list configuration. This change helps ensure continued calendar access in Teams as service dependencies are updated.

Rollout Schedule:

• General Availability (Worldwide): Rollout begins in early August 2026 and is expected to complete by early August 2026.
• General Availability (GCC, GCC High, DoD): Rollout begins in mid-August 2026 and is expected to complete by mid-August 2026.

Impact on Your Organization:

Who is affected:

• Admins who manage Exchange Online organization configuration and Microsoft Teams calendar access.
• Organizations that use EWS application access policies such as AllowList or EnforceBlockList.

Platforms/Services:

• Microsoft Teams mobile calendar
• Exchange Online
• Exchange Web Services (EWS)
• PowerShell administration

What will happen:

• Microsoft Teams calendar functionality will depend on updated backend support that uses Exchange.
• If your organization uses EWS access controls and the required Teams user agents are not configured correctly, Teams mobile calendar functionality may be affected.
• No end-user setting changes are required.
• Admin action may be required before rollout to avoid calendar disruptions.
• This change is not user-configurable and is managed at the tenant level by admins.

Action Required/Recommendations:

Action is required. Review your EWS application access configuration before rollout begins in early August 2026.

• Check your current configuration:

Get-OrganizationConfig | Select Ews*

• If EwsApplicationAccessPolicy = EnforceBlocklist, ensure the following user agents are not present in EwsBlockList:
  • Microsoft%20Teams/*
  • okhttp/*
• If EwsApplicationAccessPolicy = AllowList, ensure the following user agents are included in EwsAllowList:
  • Microsoft%20Teams/* (iOS)
  • okhttp/* (Android)
• If needed, add the required user agents:

Set-OrganizationConfig -EwsAllowList @{add="okhttp/*"}
Set-OrganizationConfig -EwsAllowList @{add="Microsoft%20Teams/*"}

• Admins can also scope EWS access policies to individual mailboxes or groups as needed. For example:

  Set-CasMailbox -Identity "[email protected]" -EwsAllowList @{add="Microsoft%20Teams/*"}

  To review mailbox-level configuration:

  Get-CasMailbox -Identity "[email protected]"

• Complete validation before the August 2026 rollout.
• Notify helpdesk teams of potential Teams mobile calendar impact if configuration is not updated.
• Update internal documentation as needed.

Compliance considerations:

Compliance question	Explanation
Does the change alter how existing customer data is processed, stored, or accessed?	Calendar data continues to be stored in Exchange Online. However, in certain scenarios, Microsoft Teams mobile will access this data directly through Exchange Web Services (EWS), instead of via the Teams middle-tier service. There is no change to where the data is stored, only to the access path. Telemetry data processing is unchanged.
Does the change include an admin control and can it be controlled through Entra ID group membership?	Admins can control access using Exchange Web Services application access policies, which can be scoped to users or groups.