MC1485116
Stay informedUser impactAdmin impactRetirement
Microsoft Exchange Online: Exchange Web Services (EWS) enforcement update for EWSAllowedAppIDs
Versions captured by this deployment. Earlier versions and notices may be missing; first observed is not first published.
Action date
Microsoft tags this a retirement but gives no action date in the notice metadata. Any date is in the text below.
- Microsoft's start date
- 1 Oct 2026
- Last changed by Microsoft
- 1 Oct 2026
- First seen here
- 19 Oct 2026
- Versions seen
- 1
What the notice says
Microsoft's text, with its sections, lists and tables; source markup removedWhat and why
As previously communicated in MC1466860 and MC1447678, Microsoft is continuing the retirement of Exchange Web Services (EWS) in Exchange Online.
Beginning October 10, 2026, setting EWSEnabled=True will no longer be sufficient to allow EWS access for affected Worldwide tenants. Organizations that require EWS must configure EWSAllowedAppIDs to specify which applications are permitted to access EWS.
This change is part of the final phase of EWS retirement and is intended to help organizations identify EWS dependencies, reduce service disruption, and support migration planning.
Rollout schedule
- Worldwide, GCC, GCC High, DoD: Beginning in early October 2026 and expected to complete by early July 2027
Key milestones for Worldwide tenants with EWSEnabled=True and no configured EWSAllowedAppIDs list:
| Date | Milestone |
|---|---|
| October 2, 2026 | Microsoft identifies affected Worldwide tenants. After this date, tenants that enable EWS must configure EWSAllowedAppIDs themselves. |
| October 8-9, 2026 | Microsoft creates and populates EWSAllowedAppIDs for qualifying Worldwide tenants based on EWS activity observed during the previous 60 days. |
| October 10, 2026 | EWSAllowedAPPIDs becomes required when EWSEnabled=True. Applications note included in the allow list may lose access to EWS. |
Impact on your organization
Who is affected
- Exchange Online administrators
- Organizations that continue to use applications or services that depend on EWS
- Tenants with EWSEnabled=True
Platforms and services
- Exchange Online
- Exchange Web Services (EWS)
What will happen
- Beginning October 10, 2026, affected Worldwide tenants with EWSEnabled=True must have a configured EWSAllowedAppIDs allow list. Applications not included in the allow list may lose access to EWS.
- For identified Worldwide tenants with EWSEnabled=True and no configured EWSAllowedAppIDs list on October 3 2026, Microsoft creates and populates an allow list using EWS activity observed during the previous 60 days. Infrequently used applications may not be identified.
- Cross-tenant organization relationships are not affected by the EWSAllowedAppIDs requirement.
- Organizations remain responsible for reviewing, validating, and maintaining EWSAllowedAppIDs.
- EWSAllowedAppIDs is a replacement list. Ensure all required AppIDs are included whenever the configuration is updated.
- Microsoft applications and scenarios that may generate EWS traffic include Outlook for Windows, Classic Outlook for Mac, Excel Power Query, Power BI, and Exchange Server hybrid scenarios.
- Outlook for Windows customers should be on August 2026 build 16.0.20430.20092 or later. If EWS-related issues continue after disabling EWS, the cause may be customer-forced configuration. Test whether blocking EWS for the Office client AppID is possible without impact.
- New Outlook for Mac is not affected. If your organization continues to use Classic Outlook for Mac, ensure the Microsoft Office AppID is included in EWSAllowedAppIDs.
- Tenants with EWSEnabled not configured (Null) remain subject to Microsoft's phased EWS retirement process and will have EWS disabled as part of that rollout.
- Organizations with EWSEnabled=True and a configured EWSAllowedAppIDs allow list will not have their EWSEnabled setting modified by Microsoft before April 2027.
Action required and recommendations
If your organization relies on EWS:
- Review EWS usage reports and identify applications and services that require continued EWS access.
- Configure and validate an EWSAllowedAppIDs allow list before October 10, 2026.
- Include Microsoft first-party applications that continue to rely on EWS if they appear in your usage reporting.
- Ensure all required AppIDs are included whenever EWSAllowedAppIDs is updated.
- Keep the allow list current as applications are added, removed, or migrated away from EWS.
- Enable EWS only when required for approved applications.
- Continue planning migration from EWS to Microsoft Graph where possible.
To verify the configured allow list: Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs
Allow up to 24 hours for EWSAllowedAppIDs changes to take effect and approximately one hour for EWSEnabled changes.
Important: EWSAllowList is unrelated to EWS retirement and does not replace EWSAllowedAppIDs.
Learn more
- Exchange Online EWS, Your Time is Almost Up | Microsoft Community Hub
- How to revert the Outlook Desktop WebView based Room Finder to the legacy Room Finder | Microsoft Support
- Impact of Exchange Online EWS Deprecation on Hybrid Rich Coexistence and Cross-org Sharing | Microsoft Community Hub
- Notes from the field: testing EWSAllowedAppIDs safely | Microsoft Community Hub
Compliance considerations
| Question | Answer |
|---|---|
| Does this change include an admin control? | Yes. EWSAllowedAppIDs introduces a tenant-level administrative control that allows Exchange Online administrators to explicitly define which applications are permitted to access EWS. |
| Does this change alter how existing customer data is accessed? | Yes. The change modifies how applications are authorized to access Exchange Online data through EWS by requiring administrators to explicitly allow approved application IDs as retirement enforcement begins. |
| Does this change alter how admins monitor, manage, or demonstrate compliance-related activities? | Yes. Administrators must identify EWS dependencies, configure and maintain an EWSAllowedAppIDs allow list, and validate application access as part of preparing for EWS retirement. |
- Exchange Online EWS, Your Time is Almost Up | Microsoft Community Hub
- How to revert the Outlook Desktop WebView based Room Finder to the legacy Room Finder | Microsoft Support
- Impact of Exchange Online EWS Deprecation on Hybrid Rich Coexistence and Cross-org Sharing | Microsoft Community Hub
- Notes from the field: testing EWSAllowedAppIDs safely | Microsoft Community Hub
What changed
Between the versions this installation saw, newest firstThis installation has seen one version of this notice, first on 19 Oct 2026. Later changes will show here.
Linked documentation
Microsoft pages the notice links to- https://techcommunity.microsoft.com/blog/exchange/exchange-online-ews-your-time-is-almost-up/4492361Not read yet
- https://techcommunity.microsoft.com/blog/exchange/impact-of-exchange-online-ews-deprecation-on-hybrid-rich-coexistence-and-cross-o/4561161Not read yet
- https://techcommunity.microsoft.com/blog/exchange/notes-from-the-field-testing-ewsallowedappids-safely/4548568Not read yet
Notices it cites
Other posts named in this one- MC1447678 · (Updated) Microsoft Exchange Online: Prepare for Exchange Web Services retirement with EWSAllowedAppIDs Plan for change · changed 24 Aug 2026
Not confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
- Versions before 19 Oct 2026: this installation first saw the notice after Microsoft posted it.
- Cites MC1466860, which is not in this installation's export.
- 3 linked pages have not been read yet.