Microsoft Exchange Online: Exchange Web Services (EWS) enforcement update for EWSAllowedAppIDs

Starting October 10, 2026, Exchange Online tenants must configure EWSAllowedAppIDs to allow Exchange Web Services (EWS) access; EWSEnabled=True alone will no longer suffice. Microsoft will auto-populate allow lists for some tenants, but organizations must review, maintain, and migrate from EWS to Microsoft Graph. As previously communicated in MC1466860 and MC1447678, Microsoft is continuing the retirement of Exchange Web Services (EWS) in Exchange Online. Beginning October 10, 2026, setting EWSEnabled=True will no longer be sufficient to allow EWS access for affected Worldwide tenants. Organizations that require EWS must configure EWSAllowedAppIDs to specify which applications are permitted to access EWS. This change is part of the final phase of EWS retirement and is intended to help organizations identify EWS dependencies, reduce service disruption, and support migration planning. Rollout schedule Worldwide, GCC, GCC High, DoD: Beginning in early October 2026 and expected to complete by early July 2027 Key milestones for Worldwide tenants with EWSEnabled=True and no configured EWSAllowedAppIDs list: Date Milestone October 2, 2026 Microsoft identifies affected Worldwide tenants. After this date, tenants that enable EWS must configure EWSAllowedAppIDs themselves. October 8-9, 2026 Microsoft creates and populates EWSAllowedAppIDs for qualifying Worldwide tenants based on EWS activity observed during the previous 60 days. October 10, 2026 EWSAllowedAPPIDs becomes required when EWSEnabled=True. Applications note included in the allow list may lose access to EWS. Impact on your organization Who is affected Exchange Online administrators Organizations that continue to use applications or services that depend on EWS Tenants with EWSEnabled=True Platforms and services Exchange Online Exchange Web Services (EWS) What will happen Beginning October 10, 2026, affected Worldwide tenants with EWSEnabled=True must have a configured EWSAllowedAppIDs allow list. Applications not included in the allow list may lose access to EWS. For identified Worldwide tenants with EWSEnabled=True and no configured EWSAllowedAppIDs list on October 3 2026, Microsoft creates and populates an allow list using EWS activity observed during the previous 60 days. Infrequently used applications may not be identified. Cross-tenant organization relationships are not affected by the EWSAllowedAppIDs requirement. Organizations remain responsible for reviewing, validating, and maintaining EWSAllowedAppIDs. EWSAllowedAppIDs is a replacement list. Ensure all required […]

The post Microsoft Exchange Online: Exchange Web Services (EWS) enforcement update for EWSAllowedAppIDs appeared first on M365 Admin.