What you need to know
Microsoft’s EWS deprecation page says Exchange Web Services starts to be disabled globally in Exchange Online in October 2026 and is fully disabled in April 2027. Under enforcement, setting EWSEnabled to True without an EWSAllowedAppIDs list blocks all EWS traffic, and tenants left unset will have EWS disabled.
Potentially affected
Microsoft 365 organizations with applications that read or write Exchange Online mailboxes through EWS, such as backup, archiving, CRM, scheduling and line-of-business tools, and the vendors that build them.
DSE recommendation
DSE recommends running the EWS usage reports now, listing every application that still needs EWS, and setting EWSAllowedAppIDs to only those App IDs as phased disablement begins.
Microsoft’s EWS deprecation page says Exchange Web Services starts to be disabled globally in Exchange Online in October 2026 and is fully disabled in April 2027. Under enforcement, setting EWSEnabled to True without an EWSAllowedAppIDs list blocks all EWS traffic, and tenants left unset will have EWS disabled.
Source facts
Microsoft’s EWS deprecation page for Exchange Online, last updated September 4, 2026, says EWS starts to be disabled globally for all organizations in October 2026 and is fully disabled in April 2027. It says the January 2024 Midnight Blizzard incident involved EWS and widened the effort to include Microsoft’s own applications, and that capabilities not on its roadmap should not be expected in Microsoft Graph or the Exchange Admin API before EWS is fully disabled.
The Exchange Team’s June 19, 2026 post introduced EWSAllowedAppIDs, a tenant-level allow list of App IDs permitted to use EWS when EWSEnabled is True. Starting October 2026, EWSEnabled set to True with no allow list blocks all EWS traffic, and tenants left unset will have EWSEnabled set to False as part of the phased rollout.
The post says Microsoft first-party apps such as Office and Power Query for Excel must be on the list if they appear in usage reports and are still needed, that list changes can take up to 24 hours to take effect, and that setting the property replaces the full list. Microsoft recommends inventorying EWS use with its usage reports and working with vendors that still rely on EWS.
Applicability
Use this for Exchange Online tenants. Microsoft’s pages carry the current timeline and rollout details, which can change; check them and the Message Center before each step.
DSE recommendation
DSE recommends running the EWS usage reports now, listing every application that still needs EWS, and setting EWSAllowedAppIDs to only those App IDs as phased disablement begins. Ask each vendor for its Microsoft Graph migration date, retire unused integrations, read the current list before every change so no entry is lost, and set EWSEnabled to True only once the list is complete.
Verification
After each change, wait 24 hours, confirm the list with Get-OrganizationConfig, test each allowed application, and review usage reports for blocked apps that were missed.
Official references
Microsoft Learn — Deprecation of Exchange Web Services in Exchange Online. Microsoft Exchange Team Blog — Introducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement (June 19, 2026). Reviewed October 18, 2026.
Review the official source
Microsoft Learn — Deprecation of Exchange Web Services in Exchange Online · Verified October 18, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE