Exchange Online EWS Retirement Has Started: How to Find What Still Uses EWS Before It Breaks

The EWS retirement in Exchange Online is no longer a future date. According to Microsoft’s Exchange Team, tenants that never set the EWSEnabled option now get a 7-day warning in Message Center, and then Microsoft turns Exchange Web Services off.

Exchange Web Services (EWS) is the older interface many add-ons use to read mailboxes and calendars. Backup tools, booking systems, CRM and membership email sync and older Mac mail clients may depend on it. For many tenants, the EWS retirement shows up first as a tool that stops syncing.

The short version: check your tenant’s EWSEnabled setting today, open the EWS usage report, and make sure every app you still need is on the allow list. If something already broke, a tenant admin can turn EWS back on in minutes. That fix only works until April 2027, when Microsoft says EWS shuts down for good with no exceptions.

This post covers where the EWS retirement stands, how to check your tenant, how to find apps that still use EWS, how to re-enable it if a sync breaks, and what changes on April 1, 2027. Facts are as of November 2, 2026.

Where the EWS retirement stands right now

The Exchange Team’s post "EWS Deprecation Is Here" went up on October 1, 2026. It has been revised several times since. We read version 11.0, updated October 26, 2026.

Microsoft sorts tenants by two settings. EWSEnabled is the on or off switch for the whole tenant. EWSAllowedAppIDs is a new allow list of app IDs. Since early October, setting EWSEnabled to True is no longer enough on its own in Microsoft’s worldwide cloud. The tenant also needs an allow list.

Microsoft says sovereign clouds will get their own EWS retirement timeline later. This post covers the worldwide cloud.

Which tools still depend on EWS

Microsoft’s companion post, "Exchange Online EWS application stopped working? Do this.", lists the kinds of software it sees using EWS:

• Apple Mail and Calendar on macOS
• Classic Outlook on macOS
• Some Outlook desktop add-ins
• Outdated versions of Outlook on Windows
• Third-party products such as backup applications

For our readers, the list is usually longer. Any outside system that syncs mail, contacts or calendars with Microsoft 365 might use EWS: association management systems, donor and CRM platforms, booking tools and archiving products. Ask each vendor whether their connector uses EWS or Microsoft Graph, and get the answer in writing.

Microsoft says these apps fail in different ways. Some keep asking for a password. Others say EWS is not available.

Step 1: check your EWSEnabled setting

The fastest check is in Exchange Online PowerShell. Connect as a tenant admin and run:

Get-OrganizationConfig | Format-List EwsEnabled

If the result is blank, your tenant is in the Null group and is in line for the switch-off. If it says False, EWS is already off. If it says True, read your allow list next:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

Both commands come from Microsoft’s own pages. Then search Message Center for two subjects Microsoft names: "Action may be required: EWS will be disabled in your tenant in 7 days" and "EWS has been disabled in your tenant." Those posts give your tenant’s dates.

Agencies managing client tenants should run the check in each one. Each tenant gets its own date.

Step 2: read the EWS usage report

The usage report shows which apps called EWS in your tenant. Microsoft’s EWS usage report documentation gives the path: in the Microsoft 365 admin center, go to Reports, then Usage, select Exchange, and open the EWS usage tab.

You can filter by the last 7, 30 or 90 days and export to CSV. One limit matters here. Microsoft says usage data is collected weekly and can take up to 10 days to show. A tool that runs once a month, such as a quarterly export, may not appear. Ask the people who run those jobs.

If an Application ID is not a Microsoft app, Microsoft suggests looking it up in Enterprise Applications in Microsoft Entra ID.

Step 3: set the allow list for EWS retirement

The allow list decides which apps can still call EWS until the final cutoff. Microsoft already filled it for many tenants from 60 days of usage. It can include apps you no longer want and miss apps that ran rarely.

You can edit the list two ways. In the Microsoft 365 admin center, Baseline Security Mode has a "Block access to Exchange Web Services" setting with an option to exclude specific apps. In PowerShell, the setting is EwsAllowedAppIDs on Set-OrganizationConfig.

Mind the timing. According to the Exchange Team, allow list changes take 24 hours to apply. EWSEnabled changes usually apply in under an hour, but can take up to 4 hours.

One setting causes confusion. Microsoft says the older EWSAllowList property is not part of this change and does not need to be touched. Use EWSAllowedAppIDs.

If a sync broke: turn EWS back on

Microsoft is clear that its support staff cannot do this for you. In its words, "Only the tenant administrator can follow these steps and re-enable EWS."

Option 1, the admin center. Open the Baseline Security Mode page and select "Block access to Exchange Web Services." Microsoft’s steps are to clear the "Block your entire organization from using EWS" box and apply, then check it again and apply again. Microsoft admits this is confusing. After those two steps, the tenant is set to allow EWS for the apps on your allow list.

Option 2, PowerShell. Run:

Set-OrganizationConfig -EWSEnabled $true

Microsoft says apps usually work again within an hour, rarely up to 4 hours. An app missing from the allow list will still fail.

Microsoft’s own apps and the EWS retirement

Some of the EWS traffic Microsoft sees comes from its own software. The Exchange Team gives this guidance as of the October 26 version:

The Mac line is the one most likely to hit small offices during the EWS retirement.

What changes on April 1, 2027

Microsoft’s February post, "Exchange Online EWS, Your Time is Almost Up", sets the final date. Starting April 1, 2027, EWS will be fully and permanently disabled, and tenant admins lose the ability to control EWSEnabled. The FAQ in that post is blunt: "There will be no exceptions past April 2027."

The replacement is Microsoft Graph. Microsoft’s EWS deprecation page on Microsoft Learn tracks the remaining gaps between EWS and Graph. It also warns that some EWS features, such as public folder access, will not get a Graph version.

The EWS retirement applies to Exchange Online only. Microsoft says there are no changes to EWS in on-premises Exchange Server. In hybrid setups, on-premises mailboxes can keep EWS, but cloud mailboxes must move to Graph. If you run Exchange Server, our post on the Exchange Server October update issue covers a separate problem worth checking.

Microsoft is not the only platform closing old mail doors this season. Google is ending Gmailify, POP fetch and Send As in Gmail in January 2027, which we covered in what nonprofit staff using Gmail should change. Microsoft is also retiring older sign-in methods, covered in our post on the Microsoft SMS MFA retirement.

An EWS retirement plan for the next five months

For a small IT team or an agency, this order works:

1. This week, check EWSEnabled and Message Center in every tenant.
2. Export 90 days from the EWS usage report and match every app ID to a vendor.
3. Ask each vendor for its Graph migration date. Record the answer.
4. Trim the allow list to apps you still need, and add any rare jobs the report missed.
5. Put April 1, 2027 on the calendar with a check-in each month.

If you keep a software inventory, add a "uses EWS" column; our guide to IT asset management basics covers the setup. In-house integrations need the same review. Our explainer on Microsoft Power Platform helps if you are not sure what staff have built.

Frequently Asked Questions