Microsoft on October 1, 2026, begins rolling out changes that start switching off Exchange Web Services (EWS) in Exchange Online, the hosted email service in Microsoft 365. The rollout reaches tenants one by one, and EWS is due to be fully disabled in April 2027, leaving organizations that still depend on it a narrowing window to migrate.

EWS is a long-standing programming interface for accessing Exchange mailboxes. In a September 2023 post on the Microsoft 365 Developer Blog, Microsoft said that “on October 1, 2026, we will start blocking EWS requests from non-Microsoft apps to Exchange Online.” The same post said there were no changes to EWS in the on-premises Exchange Server product, noted that EWS had stopped receiving feature updates in 2018, and urged developers to move to Microsoft Graph. A later Exchange Team post confirmed that EWS in Exchange Online “will begin phased disablement in October 2026 and will be fully disabled in April 2027.”

How the switch-off works

The mechanics rest on two tenant-level settings. In a September 4 post on the Exchange Team Blog, Microsoft explained that once the new logic reaches a tenant, setting EWSEnabled to True is no longer enough on its own. EWS will work only for applications listed in a second setting, EWSAllowedAppIDs, an allow list of application IDs. “Beginning October 1, 2026, Microsoft will start enabling the updated behavior,” the post said, adding that the exact timing for each tenant depends on when the change reaches its environment.

What happens next depends on how a tenant is configured, according to the post:

  • EWSEnabled set to True, no allow list: Microsoft will build a list from the previous 60 days of EWS usage, shortly before the logic change. The company warned that such a list may miss applications that run infrequently and may include applications the customer no longer wants.
  • EWSEnabled never changed from Null: Microsoft will create a list only if none exists, a few days before it sets EWSEnabled to False as part of that tenant’s rollout. Some of these tenants could have no allow list “until later in October,” the post said.
  • Allow list already configured by an administrator: Microsoft will not overwrite or change it. “The customer-managed list remains authoritative,” the Exchange team wrote.

Microsoft’s advice is direct. “We strongly recommend that every customer review EWS usage and configure EWSAllowedAppIDs themselves,” the post said. Organizations that still need EWS should add only the applications that must keep using it to the allow list, then set EWSEnabled to True, and plan to move those applications to Microsoft Graph before EWS is retired.

Hybrid Exchange needs attention too

The 2023 announcement framed the change around non-Microsoft apps, but Microsoft’s own hybrid features also depend on EWS. In a September 30 Exchange Team post, Microsoft said EWS is not being deprecated on premises, and that rich coexistence features between on-premises and cloud users, such as free/busy lookups and MailTips, can use Microsoft Graph instead of EWS. Only Exchange Server Subscription Edition (SE) at the May 2026 update or later can do this.

One scenario is not yet covered by the Graph route: on-premises mailboxes whose archive mailboxes sit in Exchange Online. Microsoft said this is “not fully supported yet” and that “We expect this to be enabled in following months.” Until then, affected customers should not remove EWS permissions from their on-premises Exchange SE servers, should confirm that EWSEnabled is True in the tenant, and should add their dedicated Exchange hybrid application to the EWSAllowedAppIDs list. Hybrid organizations with no on-premises mailboxes, or whose on-premises mailboxes do not use online archiving, are not affected by this issue.

A second case involves an on-premises organization that shares free/busy, MailTips and calendar information with a separate Exchange Online organization through an organization relationship. Because the on-premises server uses EWS to reach the other tenant, that cloud tenant must keep EWSEnabled set to True “until we have a solution which does not use EWS from on-premises,” Microsoft wrote. Organizations sharing between two Exchange Online tenants are being moved to Cross-Tenant Access Policy instead.

Why it matters

For IT teams, the more immediate risk is the tenant-by-tenant rollout that starts now rather than the April 2027 end date. A tenant left at the Null setting will have EWSEnabled set to False by Microsoft after an automatically generated allow list is created, and that list reflects only 60 days of observed usage. By Microsoft’s own description, integrations that run infrequently may not be on it.

The 2023 post also cautioned that Microsoft Graph does not match EWS feature for feature. It listed gaps including archive mailbox access, folder associated information and user configuration, Exchange Online management and public folder access, and said some functionality may never reach Graph. Organizations relying on those capabilities, whether in in-house code or third-party products, are the ones with the most migration work ahead.

What to watch

Microsoft has not published per-tenant dates, so changes to the EWSEnabled and EWSAllowedAppIDs settings will arrive at different times through October. Graph support for the hybrid archive scenario is expected in the following months, and full disablement follows in April 2027.

The caveats

The timeline and tenant behavior described here come from Microsoft’s own blog posts, and its guidance on the hybrid archive scenario describes work that is not yet complete.

Corrections and tips: email the editor using the address on the Contact page.