ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 272/272 feeds/APIs · 469/469 docs · 8/9 advisories · checked 09:15 UTC Customize Public modeDiscuss ChangeIntel on Discord
MC1477180 Plan for changeAdmin impactRetirement

Microsoft Defender for Cloud Apps: Retirement of EWS detections in App Governance

Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Microsoft Defender XDR
Microsoft 365 admin center

What the notice says

Microsoft’s text, with source markup removed
What and Why: As announced in 2023, Exchange Web Services (EWS) in Exchange Online is being retired. Phased disablement will begin on October 1, 2026. Starting October 15, 2026, Microsoft Defender for Cloud Apps app governance threat detections that rely on EWS activity signals will also be sunset. For full details on the EWS retirement, see the Learn documentation: Deprecation of Exchange Web Services in Exchange Online | Microsoft Learn Impact on your organization: Organizations that do not use EWS: No action is required. Microsoft Defender for Cloud Apps already provides threat protection for Microsoft Graph activity, and app governance detections that do not depend on EWS activity signals will continue to operate. Organizations that plan to keep using EWS between October 15, 2026 and April 2027: Microsoft Defender for Cloud Apps customers who choose to continue using EWS after October 15th 2026 will no longer see app governance alerts for suspicious app behavior observed through EWS activity. To maintain protection, we recommend that you adhere to the guidance from the Exchange Online team and migrate away from EWS. For the full details on EWS retirement please see the learn docs here. Learn more Exchange Online EWS, Your Time is Almost Up | Microsoft Community Hub Microsoft Defender for Cloud Apps app governance detections

What changed

Between archive captures, newest first

The archive supplies one version of this notice.

Linked documentation

Microsoft pages the notice links to

Both explicitly reference the same documentation; this does not confirm the same change, rollout or applicability (6 items)

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
  • 2 linked pages have not been read yet.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 26 Oct 09:15 UTC · 272 of 272 readable · 270 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.