Table of Contents
EWS Retirement from Exchange Online by May 2027
According to the Exchange team blog (5 February 2026), the sands of time are running out for Exchange Web Services (EWS). The next big date on the horizon is the disablement of EWS in Exchange Online, due in October 2026. Removing EWS from Exchange Online also impacts Outlook classic, and work is ongoing to eliminate the final vestiges of EWS from Outlook. The next step is the plan to “fully and permanently” disable EWS from April 1, 2027. The announcement is also posted in message center notification MC1227454.
Microsoft points out that EWS is nearly 20 years old. The protocol was designed at a time when Exchange servers functioned inside local datacenters, and the level of online threat was a pale shadow of what it is today. EWS was the only game in town for ISVS and other developers who wanted access to the contents of Exchange mailboxes, which is why EWS ended up being used for anything from backup products to mailbox import-export utilities.
The countdown to final eradication of EWS revolves around the EWSEnabled property in the Exchange Online tenant configuration. The full details of how the setting works are described in Microsoft’s post. Essentially, in October 2026 tenants will see the setting change from True to False to block EWS. They’ll be able to change the setting back to Null (the default) or True to restore EWS access.
The Allow List for Exchange Web Services Apps
Microsoft plans to support an allow list of apps permitted to use EWS. In a proactive step to help administrators, The new allow list for EWS apps takes precedence over the existing EWSApplicationAccessPolicy setting.
Microsoft says that they will create an allow list for tenants based on the set of apps observed to use EWS within each tenant. Tenants can then adjust the app allow list as they choose until the final phase-out commences on April 1, 2027. Of course, having an app list generated by Microsoft is nice, but understanding what those apps do and who uses the apps is more important, which is why it’s necessary to review the EWS usage reports in the Microsoft 365 admin center.
Timing for Exchange Web Services Retirement
Removing protocols from Exchange Online cannot be done across Microsoft 365 immediately. It takes time for the commands to adjust server configurations to ripple out across the hundreds of thousands of Exchange Online mailbox servers. Microsoft emphasizes that the process to disable EWS will start on April 1, 2027, so it’s unwise to plan for EWS access after that. As shown in their timeline (Figure 1), Microsoft expects that EWS will be completely one from Exchange Online in May 2027.
Exchange Web Services and ISVs
The plan is specific to Exchange Online and doesn’t affect EWS for Exchange Server. The Microsoft Graph is core to the removal of EWS. Microsoft says that they’re working hard to close the gaps that exist between EWS and current Graph API capabilities. Over the past few months, Microsoft has released an Exchange Admin API (a wrapper around Exchange PowerShell cmdlets) and the Graph userConfiguration API. Both are steps to help developers move code from EWS to Graph.
Gaps remain (like support for archive mailboxes and public folders) and it’s possible that EWS features will never make it to Graph. It’s just a fact of IT life that moving from one API to another seldom benefits from a perfect 1-to-1 match. Another issue is that the Graph APIs are currently accessed through the beta endpoint, which means that Microsoft can drop or dramatically change an API without a lot of warning. Customers and ISVs alike will want to see the APIs made available through the production (V1.0) Graph endpoint as soon as possible.
An on-premises variant of the Graph APIs doesn’t exist, so EWS will continue working for on-premises applications. This creates an interesting challenge for ISVs that offer products for both on-premises and cloud environments because two code bases will be required. Given the smaller on-premises addressable base, it’s possible that EWS-based products for the on-premises world will receive little or no further development.
The Exchange SE Question
Exchange SE is now the only supported version of Exchange Server. Microsoft makes it clear that only Exchange SE servers will support the Graph API calls to Exchange Online for rich co-existence (meaning features like access to Free/Busy information and MailTips) in hybrid environments. Microsoft made this point in an update to their post about security changes for hybrid deployments on February 3, but it’s easy to miss updates to nine-month-old posts.
In a nutshell, once Microsoft turns off EWS for Exchange Online in October 2026, hybrid deployments must be prepared to switch to Graph API requests using the dedicated hybrid application with mailboxes, and any on-premises mailbox that interacts with Exchange Online mailboxes must be hosted on Exchange SE.
There’s lots of work to be done to retire EWS. I hope that your tenant is prepared.
Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365. Only humans contribute to our work!