Outlook for Windows, Outlook for Mac and Outlook add-ins: ready for the EWS shutdown?

Short answer: Outlook for Windows is ready from build 16.0.20430.20092. Classic (legacy) Outlook for Mac still needs the Microsoft Office app ID on your EWS allow list and does not survive the April 2027 shutdown: move Mac users to the new Outlook for Mac. Outlook add-ins that call EWS need their own Graph update from the add-in vendor.

⚠ Depends on the product or version · vendor statements checked 26 Oct 2026

Deadline: Exchange Online blocks EWS by default from October 2026 (tenants are switched to EwsEnabled False, rollout to late April 2027) and turns it off for good on 1 April 2027, with no exceptions. Exchange Server on-premises is not affected.

Status

Microsoft Office (one app ID for Outlook desktop, add-ins, classic Outlook for Mac and Skype for Business hybrid). Ready for Outlook for Windows from 16.0.20430.20092; classic Outlook for Mac needs the ID on the list (MC1485116).

App ID in the EWS usage report:

What to do

  1. Update Outlook for Windows to 16.0.20430.20092 or later (Microsoft 365 Apps update channel).
  2. Find Macs still on classic Outlook and switch them to the new Outlook for Mac.
  3. While you still run classic Outlook for Mac or Skype for Business hybrid, keep d3590ed6-52b3-4102-aeff-aad2292ab01c on the allow list.
  4. For each add-in that reads mail or calendars, ask its vendor for the Graph version date.

More than one app? Run the free read-only script: it names every app still calling EWS in your tenant.

Allow-list it safely

Setting EwsAllowedAppIDs replaces the whole list, so adding one ID on its own removes every other app. Read the current list first, then write the merged list:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled,EwsAllowedAppIDs
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<current IDs>,<new ID>"

Changes to the list take up to 24 hours. A blocked call returns HTTP 403 with the header X-EWS-Policy-Reason. The free script prints the merged command for every app in use (it never runs it).

Sources

MSP or IT partner? The M365 Readiness Pack runs this EWS check, the SMTP AUTH check and SPF/DKIM/DMARC for every domain once per client tenant, and writes a client-ready report with your logo, next steps and an email to send the client. Read-only, works with GDAP.

See the pack (from $49)
Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other apps