Exchange Online Now Blocks EWS Unless Admins Name the Apps

Microsoft began retiring Exchange Web Services in Exchange Online on Oct. 2, and from Oct. 10 a tenant that keeps EWS on must also list the apps allowed to use it, the Exchange team said in an Oct. 2 blog post. Any mailbox app that still talks to EWS and is missing from that list stops working.

An allow list is now required to keep EWS on

Setting EWSEnabled to true no longer keeps EWS running on its own, Microsoft said. Starting Oct. 10, the multitenant worldwide cloud requires an EWSAllowedAppIDs list whenever EWS is enabled. Other Microsoft clouds will get their own dates through Message Center.

Microsoft recorded every tenant with EWS enabled and no allow list at the end of Oct. 2 Pacific time. On Oct. 8 and 9 it built a list for each of them from the apps that called EWS in the previous 60 days. A tenant that wasn’t on the Oct. 2 snapshot has to write its own list.

Tenants that never touched the setting are next

A second phase turns EWS off for tenants where EWSEnabled is still unset and no allow list exists, Microsoft said. Each selected tenant gets a 7-day warning in Message Center. Microsoft then sets EWSEnabled to false and fills in an allow list from 60 days of usage. An admin who needs EWS back sets it to true again.

Edits to the allow list take 24 hours to apply. Changes to EWSEnabled usually land in under an hour but can take up to 4.

Microsoft’s own clients are mostly covered

Outlook for Windows should be on the August 2026 build 16.0.20430.20092 or later, Microsoft said. The new Outlook for Mac is unaffected, but a tenant that still runs classic Outlook for Mac needs the “Microsoft Office” app ID on its list. Excel Power Query has its own retirement notice. Microsoft said it will update customers on Power BI soon.

Microsoft’s September posts on hybrid deployments and cross-tenant calendar sharing put the final EWS shutdown at Apr. 1, 2027. The hybrid post says the changes run from October 2026 to April 2027.

Apple’s Mac apps still rely on EWS

Apple Mail, Calendar, Contacts, Notes and Reminders on macOS still use EWS to reach Exchange Online, the deliverability blog Spam Resource reported on Oct. 5. It said Apple is working with Microsoft to move those apps to Microsoft Graph, with no release date announced. iPhones and iPads use Exchange ActiveSync and aren’t affected.

The take

We think the allow list is the real deadline, not April. An app that isn’t on the list fails the day the setting takes effect. Microsoft builds the list from 60 days of past traffic. A tool that runs once a quarter can be missing from it.

A 60-day window only records what already happened. It can’t see what a tenant forgot it depends on. Month-end reports, backup jobs, shared-mailbox scripts and help-desk plugins are the usual gaps.

Our advice is to pull the EWS usage report this week and match every app ID in it to a named owner. Then ask each owner for a Graph migration date that falls before Apr. 1, 2027.