Apple Mail and Calendar on macOS: ready for the EWS shutdown?

Short answer: Apple Mail, Calendar and Contacts on macOS still connect to Exchange Online over EWS. Apple says Microsoft Graph support comes in a future update to macOS 27. Until then they work only while your tenant allows EWS for Apple's app ID, and they stop on 1 April 2027 if that update is not out and installed.

✖ Still needs EWS · vendor statements checked 26 Oct 2026

Deadline: Exchange Online blocks EWS by default from October 2026 (tenants are switched to EwsEnabled False, rollout to late April 2027) and turns it off for good on 1 April 2027, with no exceptions. Exchange Server on-premises is not affected.

Status

Still EWS. Apple's deployment guide says Graph support is planned for a future macOS 27 update. iPhone and iPad Mail use Exchange ActiveSync, not EWS, so this page is about the Mac only.

App ID in the EWS usage report:

What to do

  1. Look for app ID f8d98a96-0999-43f5-8af3-69971c7bb423 in the EWS usage report (or run the free script, which names it for you).
  2. If your tenant is blocking EWS already (EwsEnabled False, or True with a list), put this ID on the allow list, merged with the IDs already there.
  3. Plan for 1 April 2027: either the macOS 27 update with Graph is out and installed on every Mac, or move those users to the new Outlook for Mac now.

More than one app? Run the free read-only script: it names every app still calling EWS in your tenant.

Allow-list it safely

Setting EwsAllowedAppIDs replaces the whole list, so adding one ID on its own removes every other app. Read the current list first, then write the merged list:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled,EwsAllowedAppIDs
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<current IDs>,<new ID>"

Changes to the list take up to 24 hours. A blocked call returns HTTP 403 with the header X-EWS-Policy-Reason. The free script prints the merged command for every app in use (it never runs it).

Sources

MSP or IT partner? The M365 Readiness Pack runs this EWS check, the SMTP AUTH check and SPF/DKIM/DMARC for every domain once per client tenant, and writes a client-ready report with your logo, next steps and an email to send the client. Read-only, works with GDAP.

See the pack (from $49)
Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other apps