The deprecation of EWS in Exchange Online starts today. This is a multi-step process, years in the making, and this post has lots of important information. We will keep this post updated if we have new information to add.
The first change, as previously announced, starting early October 2026, means setting EWSEnabled to True will no longer be sufficient on its own to keep EWS working in the tenant: an AppID allow list (EWSAllowedAppIDs) will be required to specify apps that you want to permit access to EWS.
What happens next
Customers in our multi-tenant (WW) cloud who have already set EWSEnabled = True but did not create EWSAllowedAppIDs (AppID allow list) will see a configuration change:
|
Date |
What happens |
Significance |
|
October 2, end of day (Pacific Time) |
Microsoft records a list of tenants (EWSEnabled = True and no EWSAllowedAppIDs). |
After this date, if you set EWSEnabled = true, you must populate EWSAllowedAppIDs by yourself. |
|
October 8-9, end of day (Pacific Time) |
Microsoft creates EWSAllowedAppIDs and populates it with EWS AppIDs used within previous 60 days if EWSAllowedAppIDs AppID allow list was not created. |
|
|
Starting October 10 |
Microsoft turns on the cloud setting to require EWSAllowedAppIDs to be present if EWSEnabled = True. |
Starting on this day, the AppID allow list (EWSAllowedAppIDs) will be required if tenant EWS is enabled (EWSEnabled = True) in our WW cloud. |
This behavior change will take place in the WW cloud first. Tenants in other clouds will see comms and timelines specific to them via Message Center in due course.
Once this above change has taken effect, we will move to the second phase, turning off EWS for customers in our multi-tenant (WW) cloud who did not modify EWSEnabled (so it is still Null) and did not create EWSAllowedAppIDs (AppID allow list):
- Tenants will get a 7-day warning in Message Center when they are selected.
- Once their EWSEnabled is set to False by us, if they need EWS use they will need to set EWSEnabled back to True. Microsoft will populate EWSAllowedAppIDs for these customers based on 60 days of usage shortly before setting EWSEabled to False.
Other Important Information
Changing Related EWS Settings
Please remember that:
- Changes to EWSAllowedAppIDs take 24 hours to take effect
- Changes to EWSEnabled take ~1 hour to take effect
- EWSAllowList property does not need to be configured and/or changed (it is not related to EWS deprecation). Please review this blog if unclear.
Microsoft Applications EWS Use
We know customers are still seeing traffic from some Microsoft applications. These applications (if they show up in the EWS usage report) still need to be added to the EWSAllowedAppIDs list to keep working.
The latest on each of these:
- Outlook for Windows: Customers should be on latest builds (August 2026 build 16.0.20430.20092 or higher). If customers see problems with EWS disabled, it may be due to customer forced configuration (see this example). We recommend testing to determine if blocking EWS for the Office client AppID is possible in your tenant, without impact. Microsoft successfully disabled EWS internally over a year ago.
- Outlook for Mac: Please update to the latest builds and switch to the new Outlook for Mac. If you are already using new Outlook, then this change will not affect you. If you still need to use Classic Outlook, ensure the “Microsoft Office” AppID is in your EWSAllowedAppIDs list.
- Excel Power Query: Please see https://aka.ms/xlewsretirement.
- PowerBI: we will provide an update soon.
- Exchange Server / Exchange hybrid: please see Impact of Exchange Online EWS Deprecation on Hybrid Rich Coexistence and Cross-org Sharing | Microsoft Community Hub.
The Exchange Team