EWS Retirement Begins in 2026: What IT Admins Need to Do Now

Microsoft has confirmed the shutdown of Exchange Web Services in Exchange Online and reminded customers about the upcoming retirement. As reported by Neowin, the company has now shared more details about how the phase-out will unfold.

Phased retirement of EWS begins in 2026

The phased retirement of Exchange Web Services in Exchange Online will begin in October 2026. Full shutdown across Microsoft 365 and Exchange Online will follow in 2027.

EWS in on-premises Exchange Server will not be affected. The changes apply only to Exchange Online in Microsoft 365.

Microsoft will manage the transition on a tenant-by-tenant basis using the EWSEnabled policy starting October 1, 2026. Until that date, EWS access will remain allowed regardless of the EWSEnabled value.

From October 2026 onward, if EWSEnabled is set to True, only applications on a newly introduced AppID Allow List will retain access. If it is set to False, all EWS access will be blocked. When EWSEnabled is left as Null, EWS access will remain allowed and the Allow List will be ignored.

Allow List, deadlines, and final shutdown

IT administrators will manage the AppID Allow List through Exchange Online PowerShell. If EWSEnabled is set to True but no Allow List is configured, Microsoft will automatically generate one.

If admins configure EWSEnabled as True before September 2026, Microsoft will not automatically switch it to False in October. Even if Microsoft sets it to False during the phased period, admins can manually re-enable it until April 1, 2027.

After April 1, 2027, admins will no longer be able to modify EWSEnabled. At that point, EWS in Exchange Online will be permanently disabled, with no exceptions or extensions granted.

Microsoft also plans to run temporary “scream tests” by disabling EWS to help organizations identify dependencies. Tenants with EWSEnabled set to True will not be included in these tests.

The company strongly advises IT admins to audit current EWS usage, configure the Allow List if required, and migrate applications to Microsoft Graph as soon as possible, which offers near feature parity and a modern API experience.

In related news, Microsoft recently investigated an Exchange Online incident that incorrectly flagged legitimate emails as phishing. The company has also warned administrators against using local mailbox moves in Exchange Online.