Microsoft 365 Message Center item MC1447678

MC1447678 - (Updated) Microsoft Exchange Online: Prepare for Exchange Web Services retirement with EWSAllowedAppIDs

Exchange Web Services (EWS) in Exchange Online will retire starting October 1, 2026, with full retirement by April 1, 2027. Microsoft introduced EWSAllowedAppIDs, allowing admins to create an allow list of approved apps to use EWS, helping manage dependencies and prevent service disruption. Immediate preparation is recommended.

Message Center ID: MC1447678
Category: plan For Change
Severity: normal
Services: Exchange Online
Tags: Updated message, User impact, Admin impact, Retirement
Published: 2026-08-05
Last updated: 2026-08-13
Expires: 2027-05-01
Action required by: 2026-09-30

Updated August 13, 2026: We have updated the content. Thank you for your patience. [What and why]Exchange Web Services (EWS) in Exchange Online will begin retirement on October 1, 2026, with full retirement beginning April 1, 2027.To help organizations prepare, Microsoft has released EWSAllowedAppIDs, a new Exchange Online configuration that allows administrators to create an allow list of application IDs that are permitted to use EWS.This capability helps administrators identify remaining EWS dependencies, limit EWS access to approved applications, and reduce the risk of service disruption as EWS retirement enforcement begins.This feature is available today.[Rollout schedule]General Availability (Worldwide): Available as of late July 2026General Availability (GCC): Available as of late July 2026Retirement milestones:October 1, 2026: Retirement enforcement begins in Exchange OnlineApril 1, 2027: Full retirement begins[Impact on your organization]Who is affectedExchange Online administratorsOrganizations that continue to use applications or services that depend on EWSPlatforms and servicesExchange OnlineExchange Web Services (EWS)What will happenEWSAllowedAppIDs is a tenant-level allow list that enables administrators to explicitly specify which applications can continue using EWS.Prior to October 2026:If EWSEnabled is not configured (Null), all EWS traffic is allowed.If EWSEnabled=True and no allow list is configured, all EWS traffic is allowed.If EWSEnabled=True and an allow list is configured, only applications included in the allow list and Cross-tenant org relationships can use EWS.If EWSEnabled=False, all EWS traffic is blocked.Beginning in October 2026:If EWSEnabled=True and no allow list is configured, all EWS traffic except Cross-tenant org relationships will be blocked.If EWSEnabled=False, all EWS traffic will be blocked.Tenants with EWSEnabled not configured (Null) remain subject to Microsoft's phased retirement process and will have EWS disabled as part of that rollout.The most important change administrators should understand is that, beginning with retirement enforcement, setting EWSEnabled=True without configuring EWSAllowedAppIDs will no longer permit unrestricted EWS access.Organizations that require EWS after October 2026 should ensure an EWSAllowedAppIDs allow list is configured and validated before enforcement begins.Organizations that have EWSEnabled=True and a configured EWSAllowedAppIDs allow list will not have their EWSEnabled setting modified by Microsoft before April 2027.[Action required and recommendations]We strongly recommend that Exchange Online administrators begin preparation immediately.1. Inventory EWS usageIdentify applications and services currently using EWS in your organization.Review EWS usage reports in your tenant.Review Message center communications related to EWS usage and retirement.Use the guidance in the article Notes From the Field: Finding and Remediating EWS App Usage Before Retirement.2. Create and validate an allow listCreate an EWSAllowedAppIDs allow list containing applications that must continue using EWS.Important considerations:Applications appearing in EWS usage reports that you intend to continue using should be included in the allow list.Microsoft first-party applications that continue to rely on EWS must also be included if they appear in your usage reporting.Setting EWSAllowedAppIDs replaces the existing list. Ensure all required App IDs are included when updating the configuration.Verify the configured allow list: Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDsThe use of RetrieveEwsOperationAccessPolicy is required for performance reasons. The EWSAllowedAppIDs list is only retrieved when explicitly requested. Changes to EWSAllowedAppIDs can take up to 24 hours to take effect. Allow sufficient time after updating the allow list before validating application access or troubleshooting connectivity issues.3. Prepare for retirement enforcementBefore October 2026:Validate your EWS dependencies.Confirm required applications are included in EWSAllowedAppIDs.Enable EWS only if required for approved applications.Organizations that complete this work before retirement enforcement begins are less likely to experience service disruption.Learn moreExchange Online EWS, Your Time is Almost Up | Exchange Team BlogIntroducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement | Exchange Team BlogNotes From the Field: Finding and Remediating EWS App Usage Before Retirement[Compliance considerations]QuestionAnswerDoes this change include an admin control?Yes. EWSAllowedAppIDs introduces a new tenant-level administrative control that allows Exchange Online administrators to explicitly define which applications are permitted to access Exchange Web Services (EWS).Does this change alter how customer data is accessed?Yes. The change modifies how applications are authorized to access Exchange Online data through EWS by requiring administrators to explicitly allow approved application IDs as retirement enforcement begins.Does this change alter how admins monitor, manage, or demonstrate compliance-related activities?Yes. Administrators must identify EWS dependencies, configure and maintain an EWSAllowedAppIDs allow list, and validate application access as part of preparing for EWS retirement.