MC1447678 - Microsoft Exchange Online: Prepare for Exchange Web Services retirement with EWSAllowedAppIDs

What and why

Exchange Web Services (EWS) in Exchange Online will begin retirement on October 1, 2026, with full retirement beginning April 1, 2027.

To help organizations prepare, Microsoft has released EWSAllowedAppIDs, a new Exchange Online configuration that allows administrators to create an allow list of application IDs that are permitted to use EWS.

This capability helps administrators identify remaining EWS dependencies, limit EWS access to approved applications, and reduce the risk of service disruption as EWS retirement enforcement begins.

This feature is available today.

Rollout schedule

General Availability (Worldwide): Available as of late July 2026

General Availability (GCC): Available as of late July 2026

Retirement milestones:

• October 1, 2026: Retirement enforcement begins in Exchange Online
• April 1, 2027: Full retirement begins

Impact on your organization

Who is affected

• Exchange Online administrators
• Organizations that continue to use applications or services that depend on EWS

Platforms and services

• Exchange Online
• Exchange Web Services (EWS)

What will happen

EWSAllowedAppIDs is a tenant-level allow list that enables administrators to explicitly specify which applications can continue using EWS.

Prior to October 2026:

• If EWSEnabled is not configured (Null), all EWS traffic is allowed.
• If EWSEnabled=True and no allow list is configured, all EWS traffic is allowed.
• If EWSEnabled=True and an allow list is configured, only applications included in the allow list can use EWS.
• If EWSEnabled=False, all EWS traffic is blocked.

Beginning in October 2026:

• If EWSEnabled=True and no allow list is configured, all EWS traffic will be blocked.
• If EWSEnabled=True and an allow list is configured, only applications included in the allow list can use EWS.
• If EWSEnabled=False, all EWS traffic will be blocked.
• Tenants with EWSEnabled not configured (Null) remain subject to Microsoft's phased retirement process and will have EWS disabled as part of that rollout.

The most important change administrators should understand is that, beginning with retirement enforcement, setting EWSEnabled=True without configuring EWSAllowedAppIDs will no longer permit unrestricted EWS access.

Organizations that require EWS after October 2026 should ensure an EWSAllowedAppIDs allow list is configured and validated before enforcement begins.

Organizations that have EWSEnabled=True and a configured EWSAllowedAppIDs allow list will not have their EWSEnabled setting modified by Microsoft before April 2027.

Action required and recommendations

We strongly recommend that Exchange Online administrators begin preparation immediately.

1. Inventory EWS usage

Identify applications and services currently using EWS in your organization.

• Review EWS usage reports in your tenant.
• Review Message center communications related to EWS usage and retirement.
• Use the guidance in the article Notes From the Field: Finding and Remediating EWS App Usage Before Retirement.

2. Create and validate an allow list

Create an EWSAllowedAppIDs allow list containing applications that must continue using EWS.

Important considerations:

• Applications appearing in EWS usage reports that you intend to continue using should be included in the allow list.
• Microsoft first-party applications that continue to rely on EWS must also be included if they appear in your usage reporting.
• Setting EWSAllowedAppIDs replaces the existing list. Ensure all required App IDs are included when updating the configuration.

Verify the configured allow list: Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

The use of RetrieveEwsOperationAccessPolicy is required for performance reasons. The EWSAllowedAppIDs list is only retrieved when explicitly requested. Changes to EWSAllowedAppIDs can take up to 24 hours to take effect. Allow sufficient time after updating the allow list before validating application access or troubleshooting connectivity issues.

3. Prepare for retirement enforcement

Before October 2026:

• Validate your EWS dependencies.
• Confirm required applications are included in EWSAllowedAppIDs.
• Enable EWS only if required for approved applications.

Organizations that complete this work before retirement enforcement begins are less likely to experience service disruption.

Learn more

• Exchange Online EWS, Your Time is Almost Up | Exchange Team Blog
• Introducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement | Exchange Team Blog
• Notes From the Field: Finding and Remediating EWS App Usage Before Retirement

Compliance considerations