Microsoft starts switching off Exchange Web Services in Exchange Online from 1 October, with full shutdown on 1 April 2027

What happens on 1 October, and what does not

Microsoft has been telling customers since 2018 that Exchange Web Services would stop receiving feature updates, and since 2023 that it would be disabled in Exchange Online in October 2026. That date has now arrived. From 1 October 2026, tenants that have not explicitly kept EWS switched on with an application allow-list will have the EWSEnabled organisation setting changed to False. Microsoft's Exchange team describes the change as happening "on (or soon after)" 1 October and rolling out in stages, so not every tenant flips on the same day.

The second date matters as much as the first. On 1 April 2027 EWS is fully and permanently disabled in Exchange Online. After that, administrators lose the ability to change EWSEnabled at all, and Microsoft says there are no exceptions.

This is not a full shutdown yet

Some third-party coverage describes 1 October as the day EWS is shut down. It is not, and the difference changes what an administrator should do this week. Between now and 1 April 2027 EWS still exists in Exchange Online. What changes today is the default: EWS goes from allowed unless blocked to blocked unless allowed, and allowed only for named applications. An organisation that discovers a broken integration in October can still restore it. One that discovers it in April cannot.

Who is not affected

On-premises Exchange Server is out of scope. Microsoft's Exchange team states there are no changes to EWS in Exchange Server. In a hybrid deployment, mailboxes that remain on-premises can keep using EWS, while mailboxes hosted in Exchange Online are subject to the retirement. Anyone running Microsoft 365 with mail in the cloud is in scope.

Why Microsoft is doing it now

The retirement was planned before 2024, but the Midnight Blizzard incident in January 2024 involved EWS, and Microsoft says it raised the urgency and widened the scope from third-party applications to its own. Microsoft lists Outlook, Office, Teams and Dynamics 365 among the products it has been removing EWS dependencies from. That is a security argument rather than a commercial one, and it is a credible one: an old, broad mail API that a nation-state actor has already used is a liability. It also means there is no reason to expect a reprieve.

EWSEnabled and EWSAllowedAppIDs, explained

Two settings decide what happens to a tenant. EWSEnabled is the organisation-wide switch. EWSAllowedAppIDs is a tenant-level allow-list of application IDs permitted to use EWS, made generally available in late July 2026 and announced to administrators in Message Center post MC1447678 on 5 August, which asked them to act by 30 September.

The behaviour of each combination is what trips people up, because the meaning of "True" changes in October.

In both True states, EWS traffic from cross-tenant organisation relationships is still allowed, which matters for free/busy sharing between partner tenants.

The details that cause outages

Three operational facts from Microsoft's own guidance are worth stating plainly because each one turns a simple fix into a slow one.

• Allow-list changes take up to 24 hours. Adding an app ID is not instant, so a broken integration discovered on a Monday morning may stay broken until Tuesday.
• Setting the list replaces it. MC1447678 notes that writing EWSAllowedAppIDs overwrites the existing list, so every update must include every app ID you still need, not only the new one.
• The list is hidden by default. It only appears when requested explicitly with Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs. An administrator who runs Get-OrganizationConfig without the switch will not see it and may conclude there is no list.

There is also an older control, the EwsApplicationAccessPolicy allow and block lists, which work on user agents rather than app IDs. Microsoft says an application has to pass both checks, so a tenant that tightened the old policy years ago and has forgotten about it can still block an app that is on the new allow-list.

Scream tests and notices

Microsoft has said it may run temporary "scream tests", short periods with EWS switched off, to surface dependencies, and that tenants with EWSEnabled set to True are not affected by them. It also sends monthly Message Center posts with tenant-specific EWS usage summaries. If nobody in your organisation reads the Message Center, this is the retirement where that habit costs something.

Which tools break: mail clients, backup, archiving, CRM and sync

Microsoft's own applications have either moved off EWS or are close to it. The exposure sits almost entirely with third-party and in-house software that connects to Exchange Online mailboxes, and it clusters in five kinds of product.

Third-party mail and calendar clients

Desktop and mobile mail apps that are not Microsoft Outlook connect to Exchange Online in different ways, and some still use EWS for mail, calendar or contacts. If your staff use clients such as Spark, Canary Mail, BlueMail or Superhuman against a work mailbox, the question to put to each vendor is which protocol the Exchange connection uses today and whether a Graph-based version has shipped. We have not been able to verify the current protocol for each of these from primary sources, so treat that as a question to ask rather than an answer. If a client cannot confirm a date and you need to standardise, Outlook vs Spark is a useful starting comparison.

Microsoft 365 backup

Backup is the category most exposed, for a structural reason. A mailbox backup tool needs to read and restore items in full fidelity, and Microsoft's own roadmap lists full-fidelity import and export for archive mailboxes, public folders and Microsoft 365 Group mailboxes as parity gaps targeted for Q4 calendar 2026. That is after enforcement began. A backup product that relies on EWS for those mailbox types has nowhere to move yet, which means its customers will need it on the allow-list until Graph catches up.

If you run a cloud-to-cloud backup such as Keepit, Backupify, Spanning, AvePoint Cloud Backup or CloudAlly, check the last successful mailbox job date this week rather than trusting the dashboard status. A job that silently backs up fewer items is worse than one that fails loudly. The same applies to broader platforms with Microsoft 365 modules, such as Veeam, Acronis Cyber Protect and Druva. Our backup category and Keepit vs Spanning are the starting point if your vendor cannot give a clear answer.

Archiving, journalling and eDiscovery

Archiving tools hit the same gaps as backup, plus one that will not close. Microsoft has confirmed that generic access to legacy Discovery Mailboxes will not be added to Graph, and points customers to Microsoft Purview eDiscovery instead. Generic create, read, update and delete operations on public folders and Microsoft 365 Group mailboxes are also confirmed as never coming to Graph. A compliance tool built on those operations needs redesigning, not porting.

CRM and email sync

CRMs that log email and sync calendars with Exchange are the quiet risk, because the failure looks like a missing activity rather than an error. If your sales team uses Salesforce, HubSpot or Zoho CRM with an Exchange inbox or calendar integration, confirm which connector is in use and whether it is the vendor's current version. Older on-premises-era sync add-ons are more likely to be on EWS than the vendors' current cloud connectors. If you are weighing a switch anyway, HubSpot vs Salesforce and the wider CRM category cover the options.

Automation and in-house scripts

The longest tail is internal: PowerShell scripts, room-booking tools, help desk mail ingestion and reporting jobs written years ago against EWS. Microsoft also lists its own Outlook mail connector for Power BI Desktop and the Exchange Online connector in Excel Power Query among the dependencies it is changing. Low-code platforms such as Power Automate and Zapier are one way to rebuild a small integration on Graph rather than rewrite it; Power Automate vs Zapier compares the two.

Microsoft Graph is the replacement, with gaps

Microsoft Graph is the supported route for applications that need Exchange Online mailbox data, and Microsoft publishes a mapping of EWS operations to Graph APIs. For most mail, calendar and contact scenarios the mapping is direct. For some it is not, and Microsoft's deprecation page is unusually candid about which.

Microsoft describes these dates as targets that might change, and it adds a warning worth taking literally: if a capability is not on the roadmap, do not plan on a Graph equivalent arriving before EWS is fully disabled. The Q3 items were due by the end of September; check whether they have shipped before relying on them.

What the timing means

Read the two columns together and the shape of the problem is clear. Enforcement started on 1 October. The Graph capabilities that backup, archiving and migration tools most need are targeted for October to December. The final shutdown is 1 April 2027. That leaves a vendor whose product depends on Q4 features roughly three months, at best, between the API existing and EWS disappearing, to ship, test and get customers upgraded. Some will manage it. A buyer should not assume theirs will without asking for a date.

What to do now, and by when

The order matters, because the allow-list takes a day to apply and a tenant that has already been flipped to False has broken integrations until it does.

This week: find out what is using EWS

Start with the EWS usage reports in the Microsoft 365 admin center, which show which applications have been calling EWS in your tenant. Microsoft also publishes an EWS Usage Reporting tool and an EWS Analyzer for scanning code. The output is a list of application IDs, and each one needs an owner and a decision: keep on the allow-list for now, migrate, or retire.

This week: decide the allow-list deliberately

If you depend on applications that have not yet moved to Graph, set EWSEnabled to True and populate EWSAllowedAppIDs with exactly those app IDs, including any Microsoft first-party apps that appear in your usage reports. Microsoft has said it will pre-populate a list for tenants that have not built one, based on observed usage, but a list you have not reviewed is a list you cannot defend to a security team. Keep the list short. Every entry is an exception to a control Microsoft introduced for security reasons.

If your tenant has already been switched to False, setting EWSEnabled back to True with a populated allow-list restores access for the listed apps, through Exchange Online PowerShell (Set-OrganizationConfig -EWSEnabled $true) or Baseline Security Mode in the admin center. Microsoft warns that the flip itself causes a brief service interruption, so do it deliberately rather than repeatedly.

By the end of 2026: get dates from every vendor

For each third-party application on the list, ask the vendor three things in writing: whether a Graph-based version is available, which EWS-only features it still depends on, and the date by which it will no longer need EWS. A vendor that cannot answer the third question in October is telling you something. Our 2026 software shutdowns tracker is a reminder of how often vendors that miss a platform deadline simply exit the product.

By February 2027: migrate or replace

Plan to have nothing on the allow-list by the end of February, leaving March for the inevitable stragglers. On 1 April 2027 the allow-list stops mattering because EWS stops existing. Where a vendor will not make the date, the replacement decision needs to be taken early enough to migrate data, which for a backup or archive product means months, not weeks.

Check the rest of the October calendar

EWS is not the only Microsoft deadline this month. The Office 2021 family, Office LTSC 2021 and Publisher reach end of support on 13 October, covered in our Microsoft end of support guide, and from today a 5% uplift applies to annual-term CSP subscriptions billed monthly, covered in the October CSP uplift. Neither is connected to EWS, but all three land on the same Microsoft 365 administrators in the same fortnight.

The buyer view: what this costs and who pays

Microsoft is not putting a price on the retirement itself. The cost lands elsewhere, and it is worth naming it before it arrives on an invoice.

The cost is in vendor upgrades and in-house time

A vendor that has to rebuild its Exchange connector on Graph may ship it only in a newer product tier, or tie it to a renewal. Read the renewal quote carefully. For in-house integrations, the cost is developer time against a fixed deadline, which is the most expensive kind.

It is a natural review point

Any retirement that forces you to re-test a backup product, a mail client and a CRM sync is also a chance to ask whether you would buy them again. If you are reconsidering the platform itself, Microsoft 365 alternatives and Google Workspace are the obvious places to start, though moving a tenant to escape an API retirement would be using a sledgehammer on a nut. For mail clients, Outlook alternatives and comparisons such as Fastmail vs Outlook cover the field. For the cost of staying, Microsoft 365 pricing sets out the current plans.

Be sceptical of the vendor framing on both sides

Microsoft frames the retirement as a security improvement, which it is, and as well signposted, which it has been for years. It also leaves several Graph gaps open after enforcement begins and has confirmed that some EWS capabilities will simply not be replaced. Third-party vendors, for their part, have had since 2023 to prepare. A vendor telling you in October 2026 that it is "working with Microsoft" on EWS is a vendor that has not finished. The useful response to both is the same: a list of app IDs, a named owner for each, and a date in writing.

Questions people ask

Is Exchange Web Services shut down on 1 October 2026?

No. From 1 October 2026 Microsoft starts setting EWSEnabled to False in Exchange Online tenants that have not kept EWS on with an app allow-list, in stages. Administrators can re-enable it for named applications until 1 April 2027, when EWS is fully and permanently disabled.

Does the EWS retirement affect on-premises Exchange Server?

No. Microsoft states there are no changes to EWS in Exchange Server. In hybrid deployments, mailboxes still on-premises can keep using EWS, while mailboxes in Exchange Online are subject to the retirement.

What is EWSAllowedAppIDs?

A tenant-level allow-list of application IDs permitted to use EWS in Exchange Online. From October 2026, with EWSEnabled set to True, only the listed apps can use EWS and an empty list allows none. Changes take up to 24 hours, and setting the list replaces it, so include every app ID each time. View it with Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs.

How do I re-enable EWS if an application stopped working?

Set EWSEnabled to True with Exchange Online PowerShell or Baseline Security Mode, and make sure the application's ID is on EWSAllowedAppIDs. Allow-list changes can take up to 24 hours. This is temporary: it stops working on 1 April 2027.

What replaces Exchange Web Services?

Microsoft Graph. Microsoft publishes a mapping of EWS operations to Graph APIs, but some capabilities, including full-fidelity export of archive, public folder and group mailboxes, are only targeted for Q4 2026, and generic public folder access, generic group mailbox access and legacy Discovery Mailbox access will not be added at all.

How do I find out which apps use EWS in my tenant?

Use the EWS usage reports in the Microsoft 365 admin center, which list the applications calling EWS. Microsoft also provides an EWS Usage Reporting tool and an EWS Analyzer for code. Each app ID found needs an owner and a decision: allow-list it for now, migrate it to Graph or retire it.

Will my Microsoft 365 backup still work after October 2026?

Only if your backup vendor has moved to Graph or its app ID is on your allow-list. Backup is the most exposed category because several full-fidelity export APIs it needs are targeted for Q4 2026. Check the last successful mailbox job and ask the vendor for a written date by which it will not need EWS.

Sources

Every price, limit and date above was checked against these pages on the day shown. Where a figure has since moved, the vendor’s own page is the authority and this one is a snapshot.

1. 1Deprecation of Exchange Web Services in Exchange Online · Microsoft LearnThe October 2026 and April 2027 dates, the Graph parity roadmap, capabilities that will not be added and the migration tools.Checked 1 October 2026
2. 2MC1447678: Prepare for Exchange Web Services retirement with EWSAllowedAppIDs · Microsoft 365 Message CenterThe allow-list, its 24 hour propagation, the replace-on-write behaviour, the verification command and the 30 September act-by date.Checked 1 October 2026
3. 3Exchange Online EWS, Your Time is Almost Up · Microsoft Exchange Team BlogThe EWSEnabled state table, the staged rollout, scream tests, hybrid and on-premises scope, and re-enabling until April 2027.Checked 1 October 2026