Excel Power Query Exchange Online connector: ready for the EWS shutdown?

Short answer: The Exchange Online connector in Excel Power Query uses EWS and is being retired: phased EWS disablement starts in October 2026 and the connector is planned to retire in April 2027. Microsoft is adding Graph-based connectors, the Mail connector first, in Microsoft 365 Apps and Office 2024 only. Workbooks don't move by themselves: owners must reconnect.

✖ Still needs EWS · vendor statements checked 26 Oct 2026

Deadline: Exchange Online blocks EWS by default from October 2026 (tenants are switched to EwsEnabled False, rollout to late April 2027) and turns it off for good on 1 April 2027, with no exceptions. Exchange Server on-premises is not affected.

Status

Microsoft names this ID "Microsoft Power Query for Excel". To keep the old connector working during the move, Microsoft says the Exchange admin should add it to EwsAllowedAppIDs. Guidance for Calendar, Contacts and Tasks is still pending; versions before Office 2024 won't get the new connector.

App ID in the EWS usage report:

What to do

  1. If users get Expression.Error: Access to the resource is forbidden in Excel desktop, check the tenant first: EwsEnabled True with a list that lacks a672d62c-fc7b-4e81-a576-e60dc46e951d blocks the connector.
  2. Add the ID to the allow list, merged with the IDs already there, while owners migrate.
  3. List the affected workbooks and their owners, check they run Microsoft 365 Apps or Office 2024, and rebuild each query on the new Mail connector when it shows up in Get Data.

More than one app? Run the free read-only script: it names every app still calling EWS in your tenant.

Allow-list it safely

Setting EwsAllowedAppIDs replaces the whole list, so adding one ID on its own removes every other app. Read the current list first, then write the merged list:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled,EwsAllowedAppIDs
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<current IDs>,<new ID>"

Changes to the list take up to 24 hours. A blocked call returns HTTP 403 with the header X-EWS-Policy-Reason. The free script prints the merged command for every app in use (it never runs it).

Sources

MSP or IT partner? The M365 Readiness Pack runs this EWS check, the SMTP AUTH check and SPF/DKIM/DMARC for every domain once per client tenant, and writes a client-ready report with your logo, next steps and an email to send the client. Read-only, works with GDAP.

See the pack (from $49)
Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other apps