Microsoft 365 Message Center item MC1266896
MC1266896 - Changes to How Exchange Web Services (EWS) Is Controlled
Exchange Online now strictly enforces Exchange Web Services (EWS) access based on tenant and mailbox EWSEnabled settings. Disabled EWS blocks applications, while enabled or null settings allow access. Administrators should verify and manage these settings using PowerShell, Baseline Security Mode, or the Microsoft 365 admin center.
- Message Center ID
- MC1266896
- Category
- prevent Or Fix Issue
- Severity
- normal
- Services
- Exchange Online
- Tags
- Admin impact
- Published
- 2026-03-31
- Last updated
- 2026-03-31
- Expires
- 2026-06-30
[Introduction] To strengthen security and provide clearer administrative control, we have completed updates to strictly enforce Exchange Web Services (EWS) enablement policies in Exchange Online. These changes follow earlier guidance shared in MC1015893 and address initial implementation gaps to ensure tenant-level and mailbox-level EWS settings are consistently honored. [When this will happen:] This change has completed rollout and is now fully enforced. [How this affects your organization:] Who is affected: Exchange Online administrators Organizations using Exchange Web Services (EWS) What will happen: EWS access is strictly enforced based on tenant and mailbox EWSEnabled settings. If EWS is disabled at either level, EWS-based applications will be blocked. Tenants and mailboxes with EWSEnabled set to True or Null will continue to work. No action is required if you previously completed the recommended configuration. [What you can do to prepare:] Verify EWS is enabled at the tenant level (True or Null allows EWS). Verify EWS is enabled for required mailboxes. Use Exchange Online PowerShell, Baseline Security Mode, or Microsoft 365 admin center to manage settings. Review guidance: How to Control Access to EWS in Exchange [Compliance considerations:] Area ExplanationAccess to customer data Enforcement changes how EWS can access existing mailbox data based on admin configuration.Conditional Access / security controls EWS access is now strictly governed by tenant and mailbox EWSEnabled settings, strengthening security posture.Admin controls Admins control EWS access via Exchange Online PowerShell, Baseline Security Mode, and mailbox settings.