Elchi Studios

DE EN FR IT

Contact

Journal

Exchange Web Services is switching off: what breaks, what to check

Microsoft has begun switching off Exchange Web Services in Exchange Online. What changed on 10 October, what can break, and what to check this week.

Samuel Krauss, Founder 6 min read

Microsoft has started to switch off Exchange Web Services (EWS) in Exchange Online. EWS is the old interface through which mail apps and business software read and write mailboxes, calendars and contacts in Exchange. On 10 October 2026 the rules changed for organisations that had kept it on, and the rest are being switched off tenant by tenant. If your company's mail is in Microsoft 365, something in your office may already have stopped syncing, and the failure may not be obvious.

What happened

In July 2018 Microsoft announced that EWS in Exchange Online would get no more feature updates. In 2023 it set the switch-off for October 2026. Its documentation now gives two dates: in October 2026 "EWS starts to be disabled globally for all organizations", and in April 2027 "EWS is fully disabled". The change concerns Exchange Online only. An Exchange server a company runs itself keeps EWS.

The details are in a Message Center notice to administrators, MC1485116, published on 1 October 2026:

  • An organisation that had set EWSEnabled to true kept EWS until 10 October. From that day, true alone is no longer enough: the organisation also needs a list of the applications allowed to use EWS, EWSAllowedAppIDs. An application missing from the list may lose access.
  • For qualifying organisations that had EWS on but no list, Microsoft said it would fill one on 8 and 9 October from the EWS activity of the previous 60 days. Microsoft itself warns that applications used rarely may be missing.
  • Organisations that never touched the setting stay in the phased switch-off and lose EWS as it reaches them. Microsoft expects the rollout of this change to finish by early July 2027, but EWS itself is to be fully disabled in April 2027.
  • Each update replaces the whole list, so it has to name every application again. A change takes up to 24 hours to apply.

What breaks

Anything that still talks EWS to a mailbox in Microsoft 365. The notice names classic Outlook for Mac, which needs its Microsoft Office application ID on the list, as well as Excel Power Query, Power BI and hybrid setups with an Exchange server. Outlook for Windows should be on build 16.0.20430.20092 or later. The new Outlook for Mac is not affected.

Apple Mail and Calendar on the Mac still sync Microsoft 365 accounts over EWS, as MacRumors reported in early October, and Apple's deployment guide lists EWS as the Exchange protocol for Calendar on the Mac. Apple writes that it is "actively working with Microsoft" to move Mail, Calendar, Contacts, Notes and Reminders to Microsoft Graph in a future update to macOS 27. iPhone and iPad use Exchange ActiveSync instead and are not affected. Until that update ships, an organisation can keep EWS on for those users, with the apps on the allow list and until April 2027 at the latest, or move its Mac users to Outlook.

Then there is software that runs in the background. Veeam told customers of its Microsoft 365 backup products that EWS must stay reachable for Exchange Online backups to continue, because Microsoft Graph does not yet offer what Veeam needs, and that without action the mailbox backups would fail. A backup that fails quietly is worse than one that fails loudly: you find out on the day you need it.

The replacement Microsoft offers is Microsoft Graph. It covers most of what EWS did, but not everything. Microsoft lists generic read and write access to public folders and to Microsoft 365 group mailboxes, and access to discovery mailboxes, as capabilities that will not come to Graph. For the last two it points to other interfaces. It also warns that if a capability is not on its roadmap, you should not assume an equivalent will exist before EWS is gone.

What it means for a company or an administration

The work is not hard, but it lands on whoever administers Microsoft 365, which in a small company may be an outside IT partner with other clients to look after this month.

The risk sits in the rare jobs. A list built from 60 days of activity sees the daily sync and misses the export that runs at year end, the archive job that runs each quarter, the tool someone opens twice a year. Those break later, at a moment nobody connects with a change made in October.

There is also a security side worth taking. EWS integrations that run without a person signed in use the application permission full_access_as_app, which in Microsoft's own words lets an app "impersonate all the mailboxes within a customer's organization". An integration that still uses that permission for EWS now has to be named on a list. That is a good moment to ask whether it should still exist, and whether its replacement in Graph can make do with less.

Where Elchi Studios stands

For our own mail product the question does not come up in this form. EMX is not an Exchange server. Outlook, Apple Mail and the phone's own mail app connect to it over IMAP and SMTP with app passwords, and we do not offer Exchange ActiveSync. Software sends and reads mail through our API and webhooks. Messages are stored encrypted in Geneva, and a customer can export mailboxes at any time over IMAP or the API without asking us. EMX is in beta, and we wrote down what that means.

The lesson I take from EWS is not "leave Microsoft". For most companies Graph is the sensible next step, and moving your mail because an interface changed would be a large answer to a small question. The lesson is about interfaces. IMAP, the protocol mail apps use to read a mailbox, is an open standard published by the IETF as RFC 9051; no single vendor can switch it off. A vendor's own interface, ours included, lives as long as the vendor keeps it. Microsoft froze this one eight years ahead and named the switch-off month three years ahead. Ask any supplier, us too, how much notice you get before an interface you depend on goes away.

What to check this week

  1. Open the EWS usage report. It is in the Microsoft 365 admin center under the usage reports. It shows which application IDs still call EWS and how often.
  2. Check your setting and your list. In Exchange Online PowerShell, Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs shows the list. If Microsoft filled it on 8 or 9 October, compare it with what you know runs.
  3. Think in years, not weeks. Ask who runs anything once a quarter or once a year against a mailbox: archiving, exports, audits. Add what belongs on the list, and remember that every update replaces the whole list.
  4. Ask the vendors of your backup, archiving and CRM tools whether they still use EWS and when they move to Graph. Then check that last night's mailbox backup actually ran.
  5. Look at the Macs. Anyone using Apple Mail or Calendar with a Microsoft 365 account either moves to Outlook or Outlook on the web, or the administrator keeps EWS on for them, with the apps on the allow list, until Apple ships Graph support or April 2027, whichever comes first.
  6. Review every application holding full_access_as_app. Remove what nobody needs. For what stays, Microsoft's application access policies can limit an app to the mailboxes it actually works with.
  7. Plan for April 2027. The list buys time and nothing else. Each integration on it needs a move to Graph, or another way of working, before then.

Sources

  1. Deprecation of Exchange Web Services in Exchange Online, Microsoft Learn, read
  2. MC1485116: Exchange Web Services (EWS) enforcement update for EWSAllowedAppIDs, Microsoft 365 Message Center (mirror by merill.net), read
  3. Microsoft Tightens Exchange Online EWS Access on October 10, Windows Report, read
  4. Integrate Apple devices with Microsoft Exchange, Apple Platform Deployment, read
  5. PSA: Apple Mail on Mac May Stop Syncing Microsoft 365 Accounts, MacRumors, read
  6. KB4820: What Microsoft's EWS Retirement Means for Your Veeam Backups, Veeam, read
  7. After years of warnings, Microsoft is finally pulling the plug on EWS, Computerworld, read
  8. Application Access Policy Support Added to Exchange Web Services in Exchange Online, Microsoft 365 Developer Blog, read
  9. Nahendes Ende für Microsofts Exchange Web Services, Inside IT, read
  10. RFC 9051: Internet Message Access Protocol (IMAP), Version 4rev2, IETF, read
  11. EWS is Being Blocked in Exchange Online: How to Find every App still Using it, LazyAdmin, read

Written by Samuel Krauss, Founder. Filed under email, microsoft-365, exchange, security.

All posts This post as Markdown Atom feed