Microsoft Tightens Exchange Online EWS Access on October 10

Microsoft is tightening Exchange Online EWS access starting October 10, 2026, requiring applications to appear in EWSAllowedAppIDs to keep connecting.

According to Microsoft 365 Message Center MC1485116, setting EWSEnabled=True alone will no longer provide access to Exchange Web Services.

Apps that are not included in EWSAllowedAppIDs may lose connectivity, which could lead to silent connection failures or service disruption.

Microsoft will enforce EWSAllowedAppIDs

The policy change affects Worldwide, GCC, GCC High, and DoD tenants.

Microsoft plans to begin enforcement on October 10, while the wider rollout will continue through July 2027.

Organizations that rely on EWS-based applications will need to make sure each required application ID appears in the allow list before enforcement begins.

Microsoft will automatically populate the allow list

For qualifying Worldwide tenants, Microsoft will automatically add application IDs to EWSAllowedAppIDs on October 8 and October 9.

The company will use EWS activity from the previous 60 days to determine which applications should appear in the list.

However, applications that connect only occasionally may not appear automatically. Administrators will need to identify and add those application IDs manually.

Potentially affected software includes Classic Outlook for Mac, Excel Power Query, Power BI, and hybrid connectors that still depend on EWS.

Admins should check their EWS configuration now

Microsoft recommends checking the current EWSAllowedAppIDs configuration before October 10.

Administrators can run the following PowerShell command:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

Microsoft warns that configuration changes can take up to 24 hours to propagate, so organizations should avoid waiting until enforcement begins.

The company continues to encourage customers to migrate applications from legacy EWS integrations to Microsoft Graph as it moves toward broader EWS retirement.

In other Microsoft news, Windows 11 File Explorer gets an AppData shortcut, while Warlock ransomware uses SharePoint flaws. Microsoft has also set an October 5 Teams Live Chat deadline.

Via Neowin