Summary
- Exchange Online is changing how the EWSAllowedAppIDs setting is enforced as part of the EWS retirement process.
- Organizations that still use Exchange Web Services should review and maintain their own allow list for apps that need EWS access.
- If EWSEnabled is True, EWS will require a configured EWSAllowedAppIDs list; Microsoft will not overwrite tenant-managed lists.
- If no tenant-managed list exists, Microsoft may generate one from recent EWS usage to reduce disruption, but infrequent apps may be missed.
- Admins should validate EWS usage, configure the allow list, keep it current, and plan migration from EWS to Microsoft Graph.
Microsoft is updating how EWSAllowedAppIDs is applied in Exchange Online as part of EWS retirement starting October 1, 2026. Organizations using EWS must review and configure their EWSAllowedAppIDs list to avoid service disruption and plan to migrate to Microsoft Graph before retirement completes.
Microsoft 365 Message Center ID: MC1469960
Primary Service: Exchange
Admin Impact: High
User Impact: Low
Release Start: 01 Oct 2026
Release End: 01 Oct 2026
Last Modified: September 10, 2026
Category: Prevent or Fix Issue
Tags: New feature
Status: Launched
Products & Platforms: Exchange Online
History
9/9/2026 Item Added to Message Center
Microsoft Message
As part of the final phase of Exchange Web Services (EWS) retirement, Microsoft is updating how the EWSAllowedAppIDs setting is applied in Exchange Online. This change is designed to help organizations identify and manage applications that still require EWS access while reducing the risk of unexpected service disruption.
Organizations that continue to use EWS should review and maintain their own EWSAllowedAppIDs list. If a tenant administrator has already configured this list, Microsoft will not overwrite or modify it.
Beginning on October 1, 2026, Microsoft will start enabling this updated behavior by cloud as part of the EWS retirement rollout.
Rollout schedule
- Worldwide, GCC, GCC High, DoD: Beginning in early October 2026 and expected to complete by late June 2027
The updated behavior will apply when the rollout reaches your cloud.
Impact on your organization
Who is affected
- Organizations that continue to use Exchange Web Services (EWS)
- Exchange Online administrators responsible for managing EWS access
- Tenants with EWSEnabled set to True or Null
Platforms and services
- Exchange Online
- Exchange Web Services (EWS)
What will happen
After the updated behavior is enabled in a cloud:
- EWS will require a configured EWSAllowedAppIDs list when EWSEnabled is set to True.
- Before enabling the change, Microsoft will ensure that tenants with EWSEnabled already set to True have an EWSAllowedAppIDs list.
- If a customer-managed list does not exist, Microsoft will generate a list based on EWS application usage observed during the previous 60 days to help reduce the risk of service interruption.
- Microsoft-generated lists may omit applications that run infrequently and may include applications that no longer require EWS access.
- If EWSEnabled remains Null, Microsoft will populate EWSAllowedAppIDs only when a customer-managed list does not already exist. This will occur shortly before Microsoft updates EWSEnabled to False as part of the retirement rollout.
- Microsoft will not modify an EWSAllowedAppIDs list that has already been configured by a tenant administrator.
Action required and recommendations
If your organization still relies on EWS, we recommend taking the following actions as soon as possible:
- Review EWS usage from the previous 60 days and identify all applications that require continued EWS access, including applications with infrequent usage patterns.
- Configure and validate your EWSAllowedAppIDs list before the rollout reaches your cloud.
- Ensure EWSEnabled is set to True if continued EWS access is required.
- Keep the EWSAllowedAppIDs list current as applications are added, removed, or migrated away from EWS.
- Plan for up to a 24-hour propagation delay after changes are made to the EWSAllowedAppIDs list.
Microsoft’s safeguard helps reduce the risk of service disruption but does not replace customer review and validation of EWSAllowedAppIDs.
We also recommend continuing plans to migrate applications from EWS to Microsoft Graph before EWS retirement is completed.
Learn more
- Deprecation of Exchange Web Services in Exchange Online | Microsoft Learn
Compliance considerations
No compliance considerations identified, review as appropriate for your organization.