Microsoft Exchange Online: Prepare for Exchange Web Services retirement with EWSAllowedAppIDs

Exchange Web Services (EWS) in Exchange Online will retire starting October 1, 2026, with full retirement by April 1, 2027. Microsoft introduced EWSAllowedAppIDs, allowing admins to create an allow list of approved apps to manage EWS access and reduce disruption. Immediate preparation is recommended. Exchange Web Services (EWS) in Exchange Online will begin retirement on October 1, 2026, with full retirement beginning April 1, 2027. To help organizations prepare, Microsoft has released EWSAllowedAppIDs, a new Exchange Online configuration that allows administrators to create an allow list of application IDs that are permitted to use EWS. This capability helps administrators identify remaining EWS dependencies, limit EWS access to approved applications, and reduce the risk of service disruption as EWS retirement enforcement begins. This feature is available today. Rollout schedule General Availability (Worldwide): Available as of late July 2026 General Availability (GCC): Available as of late July 2026 Retirement milestones: October 1, 2026: Retirement enforcement begins in Exchange Online April 1, 2027: Full retirement begins Impact on your organization Who is affected Exchange Online administrators Organizations that continue to use applications or services that depend on EWS Platforms and services Exchange Online Exchange Web Services (EWS) What will happen EWSAllowedAppIDs is a tenant-level allow list that enables administrators to explicitly specify which applications can continue using EWS. Prior to October 2026: If EWSEnabled is not configured (Null), all EWS traffic is allowed. If EWSEnabled=True and no allow list is configured, all EWS traffic is allowed. If EWSEnabled=True and an allow list is configured, only applications included in the allow list can use EWS. If EWSEnabled=False, all EWS traffic is blocked. Beginning in October 2026: If EWSEnabled=True and no allow list is configured, all EWS traffic will be blocked. If EWSEnabled=True and an allow list is configured, only applications included in the allow list can use EWS. If EWSEnabled=False, all EWS traffic will be blocked. Tenants with EWSEnabled not configured (Null) remain subject to Microsoft’s phased retirement process and will have EWS disabled as part of that rollout. The most important change administrators should understand is that, beginning with retirement enforcement, setting EWSEnabled=True […]

The post Microsoft Exchange Online: Prepare for Exchange Web Services retirement with EWSAllowedAppIDs appeared first on M365 Admin.