Exchange Online EWS shutdown: which apps stop on 1 April 2027?

Short answer: Microsoft is retiring Exchange Web Services (EWS) in Exchange Online. Tenants are being switched to EWS blocked from October 2026, and on 1 April 2027 EWS is turned off for everyone. Every mail client, backup tool, migration tool, signature tool or connector that still talks EWS stops then, unless its vendor has moved it to Microsoft Graph.

Deadline: Exchange Online blocks EWS by default from October 2026 (tenants are switched to EwsEnabled False, rollout to late April 2027) and turns it off for good on 1 April 2027, with no exceptions. Exchange Server on-premises is not affected.

Which apps in your tenant still call EWS? Free read-only PowerShell script: reads your EWS settings and allow list, names every app from the admin center EWS usage export, and gives a verdict for now and for 1 April 2027, with the vendor's own statement.

App by app

App	For 1 April 2027
Apple Mail and Calendar on macOS	✖ Still needs EWS
Outlook for Windows, Outlook for Mac and Outlook add-ins	⚠ Depends on the product or version
Microsoft Teams Rooms, Teams phones and panels	✔ Has a Microsoft Graph version
Excel Power Query Exchange Online connector	✖ Still needs EWS
Veeam Backup for Microsoft 365	✖ Still needs EWS
Mimecast (Sync & Recover, Continuity)	✖ Still needs EWS
AvePoint Cloud Backup and Fly	⚠ Depends on the product or version
BitTitan MigrationWiz	✖ Still needs EWS
Quest On Demand Migration	✖ Still needs EWS
CodeTwo (Email Signatures 365, Office 365 Migration, Backup)	✔ Has a Microsoft Graph version
Exclaimer email signatures	✔ Has a Microsoft Graph version
Salesforce (Einstein Activity Capture, Lightning Sync)	⚠ Depends on the product or version
Cisco Unity Connection (unified messaging)	✖ Still needs EWS
eM Client and Thunderbird	✔ Has a Microsoft Graph version
Skype for Business Server hybrid	✖ Still needs EWS
Microsoft 365 backup tools (Datto, Barracuda, Hornetsecurity, NAKIVO, Commvault, Druva, Keepit, CloudAlly, SysCloud)	⚠ Depends on the product or version

What the tenant settings mean

`EwsEnabled` empty (Null)	EWS works for every app until Microsoft switches your tenant to False. The allow list has no effect yet.
False	EWS is blocked for every app. A mailbox set to True no longer overrides it (since 31 Mar 2026).
True, empty list	Every EWS app is blocked: since 10 Oct 2026 the allow list is required when EwsEnabled is True.
True + list	Only the listed Entra app IDs can use EWS, until 1 April 2027.

Find the apps without a script

Microsoft 365 admin center → Reports → Usage → Exchange → EWS usage (7, 30 or 90 days, up to 10 days behind) shows app IDs, SOAP actions and call volume, and exports to CSV. Microsoft's Message center also sends "Action Required: Update active Exchange Web Services Applications" posts with app IDs. Microsoft pre-fills an allow list from the last 60 days if you have none, so a job that runs less than every two months can be missed.

Allow-list it safely

Setting EwsAllowedAppIDs replaces the whole list, so adding one ID on its own removes every other app. Read the current list first, then write the merged list:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled,EwsAllowedAppIDs
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<current IDs>,<new ID>"

Changes to the list take up to 24 hours. A blocked call returns HTTP 403 with the header X-EWS-Policy-Reason. The free script prints the merged command for every app in use (it never runs it).

Sources

MSP or IT partner? The M365 Readiness Pack runs this EWS check, the SMTP AUTH check and SPF/DKIM/DMARC for every domain once per client tenant, and writes a client-ready report with your logo, next steps and an email to send the client. Read-only, works with GDAP.

See the pack (from $49)

Did this fix it?