MC1227454: Exchange Web Services (EWS) retirement update

[Introduction]

We're updating the timeline and process for the retirement of Exchange Web Services (EWS) in Exchange Online. As previously announced, EWS will be retired in favor of Microsoft Graph, which offers improved security, modern authentication, and broader capability support. A phased disablement begins October 1, 2026, with permanent shutdown starting April 1, 2027.

[When this will happen:]

• Phased EWS disablement begins: October 1, 2026
• Full and permanent EWS retirement: April 1, 2027
• EWS App AllowList feature availability: Coming soon (before retirement milestones)

[How this affects your organization:]

Who is affected:

• Organizations using custom or vendor applications that rely on EWS
• Workflows involving mail, calendar, or integrations that use EWS
• This change only impacts Exchange Online; Exchange Server (on-premises) is not affected

What will happen:

• Beginning October 1, 2026, EWS will be blocked unless the tenant configures an AppID AllowList and sets EWSEnabled=True.
• Without admin action, Microsoft will set EWSEnabled=False and EWS apps will stop working. Tenant admins will be able to re-enable EWS if necessary. 
• Temporary “scream tests” may occur before October 2026 to help identify dependencies.
• After April 1, 2027, EWS access will be permanently removed with no re-enablement.
• No changes are being made to EWS in Exchange Server (on-premises).

[What you can do to prepare:]

• Review EWS usage in the Microsoft 365 admin center or using published scripts to identify dependent applications.
• Begin migrating any remaining EWS-based workflows to Microsoft Graph, which provides near-complete API parity.
• If EWS is required after October 2026, configure an AppID AllowList and set EWSEnabled=True before end of August 2026.
• Communicate these changes internally and update documentation.

Learn more:

• Deprecation of Exchange Web Services in Exchange Online
• EWS Retirement Process overview

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.