Find every app still using EWS in Exchange Online (free script)

One read-only PowerShell script shows which apps still call Exchange Web Services in your tenant, which of them are blocked right now, and which stop working when Microsoft turns EWS off on 1 April 2027.

Download Find-EwsApps.ps1 Free · read-only · Windows PowerShell 5.1 or PowerShell 7 · version 1.0.0 (26 Oct 2026) · MIT

Deadline: Exchange Online blocks EWS by default from October 2026 (tenants are switched to EwsEnabled False, rollout to late April 2027) and turns it off for good on 1 April 2027, with no exceptions. Exchange Server on-premises is not affected.

What it reads

Source	What you learn	Needs
Tenant settings (always)	`EwsEnabled`, the `EwsAllowedAppIDs` allow list, the older user-agent policy, mailboxes with EWS off	`ExchangeOnlineManagement` (recent version), a role that can read the organization config
EWS usage export (`-UsageCsv`)	Every app that called EWS: calls, SOAP actions, last activity	Microsoft 365 admin center → Reports → Usage → Exchange → EWS usage → Export (90 days)
Entra app names (`-ResolveNames`)	Name and publisher of each app ID, so per-tenant apps (Veeam, Mimecast, MigrationWiz…) are recognised	`Microsoft.Graph.Authentication`, Application.Read.All

How to run it

Install the modules once: Install-Module ExchangeOnlineManagement -Scope CurrentUser and, for names, Install-Module Microsoft.Graph.Authentication -Scope CurrentUser.
Download the script above, read it (it only runs Get-* cmdlets and Graph GET requests), then unblock it: Unblock-File .\Find-EwsApps.ps1. If PowerShell refuses to run scripts, allow it for that window only: Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass.
Settings and allow list only: .\Find-EwsApps.ps1
Everything: .\Find-EwsApps.ps1 -UsageCsv .\EWSWeeklyUsage.csv -ResolveNames
Open EwsApps-<date>.html (a CSV is written next to it).

What the verdicts mean

BLOCKED NOW: the app calls EWS but your tenant blocks it (EWS off, empty list, or not on the list).
BREAKS when Microsoft sets EwsEnabled to False: your tenant is still Null; allow-list the app before Microsoft flips it.
Allowed for now / On the allow list but no calls: the second is a candidate to remove (check jobs that run less than monthly).
For 1 April 2027: Vendor has a Graph version (update or reauthorize), STOPS: no Graph version yet (plan the replacement now) or STOPS unless it moves to Graph (no vendor statement: ask the vendor).

It also prints one Set-OrganizationConfig -EwsAllowedAppIDs "…" command that merges your current list with every app in use. The script never runs it. It flags SOAP actions that map to Graph features Microsoft still lists as gaps (import/export, user configuration objects, Mark All Items As Read).

Tested with sample data on 26 Oct 2026; it changes nothing in your tenant. If it fails on yours, tell us with the 👎 button below (with the error message) and we'll fix it.

Then fix each app

App-by-app readiness for 1 April 2027: Apple Mail, Outlook for Mac, Teams Rooms, Veeam, Mimecast, MigrationWiz, CodeTwo, Exclaimer, Salesforce and more.

Also from us: Find SMTP AUTH senders for the Microsoft 365 SMTP AUTH Basic auth change at the end of December 2026.

MSP or IT partner? The M365 Readiness Pack runs this EWS check, the SMTP AUTH check and SPF/DKIM/DMARC for every domain once per client tenant, and writes a client-ready report with your logo, next steps and an email to send the client. Read-only, works with GDAP.

See the pack (from $49)

Did this fix it?