Exchange Web Services (EWS) retirement has started in Exchange Online. Businesses should check which applications still use EWS and whether permitted applications are correctly listed. Microsoft’s 1 October 2026 update introduces an app allow-list requirement from 10 October in its worldwide cloud. The practical risk is disruption to a connected business process, rather than loss of the mailbox itself.
Reviewed: 2 October 2026.
What is Exchange Web Services (EWS)?
Exchange Web Services is an application programming interface — usually referred to as an API — that allows applications to communicate with Microsoft Exchange.
It has been around for many years and has been used by software developers to connect applications to Exchange mailboxes.
For example, an application might use EWS to:
- access a mailbox;
- read or create calendar appointments;
- work with contacts;
- retrieve messages;
- send or process email; or
- synchronise information between Exchange and another business system.
The important distinction is that EWS isn't your mailbox itself.
A business could therefore be using Microsoft 365 perfectly normally while an application operating in the background is using EWS without the end user ever knowing.
Why is Microsoft switching EWS off?
Microsoft has been moving developers away from Exchange Web Services for several years.
Its preferred replacement is Microsoft Graph, Microsoft's modern API platform for accessing Microsoft 365 services and data.
Microsoft stopped introducing new EWS functionality some time ago and has encouraged developers to migrate applications to Microsoft Graph.
The retirement is therefore not a sudden decision, but October 2026 represents an important stage in Microsoft's enforcement of that retirement.
Ultimately, Microsoft plans to remove EWS access to Exchange Online completely.
What has changed in the EWS retirement timetable?
According to Microsoft’s 1 October announcement, enabling EWS alone will no longer be sufficient. Applications also need an entry in EWSAllowedAppIDs. The following dates apply to Microsoft’s worldwide multi-tenant cloud; Microsoft specifies Pacific Time for the first two deadlines.
| Date | What Microsoft will do |
|---|---|
| 2 October, end of day Pacific Time | Identify tenants with EWS enabled but no app allow list. |
| 8–9 October, end of day Pacific Time | Populate allow lists for those identified tenants using app IDs seen in the previous 60 days. |
| From 10 October | Require an app allow list where tenant EWS access is enabled. |
Microsoft will subsequently disable EWS for tenants with the unchanged, unset configuration and no app allow list. Selected tenants receive a seven-day Message Center warning. Allow-list changes take 24 hours; changes to the tenant enable setting take approximately one hour.
Which business systems should you check?
Start with applications that read email, process shared mailboxes, synchronise contacts or create appointments. Give each integration an owner and a vendor contact. These are practical places to investigate, not a statement that every product in these categories uses EWS. Confirm the connection method before deciding that a system is affected.
- CRM, document-management and specialist business applications.
- Mailbox processing, archiving and scheduling integrations.
- Older scripts and bespoke software connected to Exchange Online.
- Excel queries or reports that retrieve information from Exchange.
Microsoft recommends using its EWS usage reports to identify dependencies and working with software vendors to migrate them. Its EWS deprecation guidance identifies Microsoft Graph as the migration route for many scenarios, while noting that capability gaps remain.
What about printers and scanners?
This is an area where terminology can easily cause unnecessary concern.
A multifunction printer that simply uses Microsoft 365 to scan documents to email is not automatically using Exchange Web Services.
Many devices use SMTP or another method to send email.
However, more sophisticated document-management or workflow systems associated with scanners and multifunction devices could potentially interact with Exchange in other ways.
The correct approach is therefore not to assume every scanner will stop working.
Instead, identify which systems actually communicate with Exchange Online and how they do it.
Will Outlook stop working?
Your Microsoft 365 mailbox is not being removed, but specific Outlook dependencies still need checking. Microsoft recommends current Outlook for Windows builds. New Outlook for Mac is unaffected by this EWS change; users who still need Classic Outlook for Mac must have the Microsoft Office app ID permitted. Ask IT to check the client and configuration actually in use.
What should your IT provider do now?
Ask your IT provider to document the dependencies, confirm the required configuration and agree a migration plan with each affected software vendor. A temporary exception needs an owner and a replacement plan. For business-critical integrations, record the expected behaviour and test that behaviour after any approved changes.
- Review usage: identify application IDs and match them to systems your business recognises.
- Confirm ownership: establish who manages each integration and whether it is still required.
- Check permissions: review the tenant setting and app allow list together; investigate unfamiliar entries.
- Agree vendor action: obtain the supported replacement, required upgrade and migration date.
- Test business workflows: verify mailbox processing, appointments and synchronisation.
- Monitor notices: review Message Center for your tenant’s own disablement warning.
Keep a record of the checks rather than assuming that an integration is safe because it worked yesterday. Businesses sharing calendars with another organisation should also read our cross-organisation calendar-sharing guide.
What else do businesses ask about EWS retirement?
Does an allow list replace migration?
No. It controls permitted EWS access during the transition. Microsoft’s published roadmap still places full disablement in April 2027, so affected applications need a supported replacement.
Does this retire EWS on an on-premises Exchange server?
This retirement concerns Exchange Online. Hybrid deployments still need a separate review because connections to Exchange Online can be affected.
Should employees change anything themselves?
Employees should report failed integrations or calendar problems to IT. Tenant EWS settings and application permissions belong with the administrator, who can assess their wider effect.
Need help checking your Microsoft 365 integrations?
KES supports businesses with Microsoft 365 management, security and day-to-day IT. Contact KES or call 01622 721000 to discuss the applications your business depends on.
More Microsoft 365 Support & Advice
Microsoft 365 & IT Support
Find out how KES supports businesses with Microsoft 365, IT management, security and day-to-day technical support.
More IT Advice
Read more practical IT support, Microsoft 365 and cyber security guidance for businesses in the KES Learning Centre.
Need Help With Microsoft 365?
Unsure whether your applications or integrations could be affected by Microsoft's EWS retirement? Speak to the KES team.
