Microsoft Gives Exchange Online Admins Another Warning Before EWS Retirement Begins

Microsoft has issued another warning for Exchange Online admins ahead of a major change to Exchange Web Services. The initial warning came in 2023, however, the company warned admins about it earlier this year, too. In case you are unaware, EWS retirement will kick off on October 1, 2026, and Microsoft has introduced a new EWSAllowedAppIDs setting that lets organizations control which applications can continue using the service.

Exchange Online EWS access retirement begins October 1

Microsoft has been preparing customers for the retirement of EWS for several years, but the next phase is now close. Starting October 1, Exchange Online will begin enforcing the retirement, with full EWS retirement scheduled to complete by April 1, 2027.

The warning is handy for organizations that still have applications or services relying on EWS. Microsoft says EWSAllowedAppIDs provides a tenant-level allow list where administrators can specify the application IDs that should continue to have EWS access during the transition.

The important change is how EWSEnabled will behave once enforcement begins. Microsoft says that before October, setting EWSEnabled to True without an allow list permits EWS traffic. From October onward, that configuration will no longer provide unrestricted access. Approved applications need to be identified through the App ID allow list. In an admin center message, Microsoft confirmed that when EWSEnabled is enabled, admins can use EWSAllowedAppIDs to specify which application IDs are permitted to access EWS.

Admins need to check their EWS dependencies now

Microsoft recommends that organizations first identify applications still using EWS, then create and validate an allow list containing the applications that need continued access. The company says changes to the EWSAllowedAppIDs configuration can take up to 24 hours to take effect, so administrators should not leave this work until the last minute.

Microsoft has also published additional guidance in September specifically telling administrators to take control of their EWSAllowedAppIDs configuration before the access changes begin. For organizations that have already configured EWSEnabled=True and an App ID allow list, Microsoft says the setting will not be modified before April 2027.

For now, Exchange Online administrators should inventory their EWS usage, identify applications that still depend on it and make sure the required App IDs are included before October 1.