Summary
- Microsoft Defender for Cloud Apps app governance detections that rely on Exchange Web Services (EWS) signals are being retired.
- This impacts organizations still using EWS integrations; detections and alerts based on EWS activity will no longer be available.
- Organizations that have already migrated away from EWS do not need to take action.
- Customers still using EWS should migrate affected applications to Microsoft Graph or another supported API to maintain app governance protection.
Primary Service: Defender XDR
Admin Impact: Medium
User Impact: Low
Release Start: 15 Oct 2026
Release End: 15 Oct 2026
Services: Defender XDR, Exchange
Category: Plan for change
Tags: Admin Action, Retirement
History
9/22/2026 Item Added to Message Center
Microsoft Message
As announced in 2023, Exchange Web Services (EWS) in Exchange Online is being retired. Phased disablement will begin on October 1, 2026.
Starting October 15, 2026, Microsoft Defender for Cloud Apps app governance threat detections that rely on EWS activity signals will also be sunset.
For full details on the EWS retirement, see the Learn documentation: Deprecation of Exchange Web Services in Exchange Online | Microsoft Learn
Impact on your organization
Organizations that do not use EWS: No action is required. Microsoft Defender for Cloud Apps already provides threat protection for Microsoft Graph activity, and app governance detections that do not depend on EWS activity signals will continue to operate.
Organizations that plan to keep using EWS between October 15, 2026 and April 2027: Microsoft Defender for Cloud Apps customers who choose to continue using EWS after October 15th 2026 will no longer see app governance alerts for suspicious app behavior observed through EWS activity. To maintain protection, we recommend that you adhere to the guidance from the Exchange Online team and migrate away from EWS. For the full details on EWS retirement please see the learn docs here.
Learn more
- Exchange Online EWS, Your Time is Almost Up | Microsoft Community Hub
- Microsoft Defender for Cloud Apps app governance detections