Table of Contents
Retirement of Exchange Web Services on Course for April 1, 2027
Reading Microsoft’s latest epistle about the retirement of Exchange Web Services (EWS) gave me the sense of chickens coming home to roost. The takeaway is blunt: the final countdown is on, and once April 1, 2027, comes around, Microsoft will permanently retire EWS from Microsoft 365. EWS is a legacy protocol that Microsoft wants to remove as part of its ongoing effort to reduce attack surface and move customers to more modern APIs. The fact that attackers used EWS to exfiltrate data from Microsoft’s own tenant in the Midnight Blizzard attack in January 2024 underlines the need for EWS to go.
After April 1, 2027, EWS-based applications cease to function. Any attempt by an application to use EWS to communicate with Exchange Online simply won’t work. The situation is as simple and as easy to understand as that.
Yet the real-world impact of the retirement still surprises some tenant administrators. It’s easy to understand why. Unless administrators exerted tight control over every application deployed into their tenant, including client-side apps and add-ons, they might not even realize that EWS is present. Perhaps the app originated on-premises and moved to Exchange Online as part of the tenant migration. Perhaps it was purpose built by some long-departed team.
Exchange Web Services Applications Fail in Different Ways
Microsoft’s note explains that affected applications can fail in different ways, from repeated credential prompts to explicit errors stating that EWS is unavailable. The net result is that the users of what might be deemed as a critical application might not discover that a problem exists until they see errors. Finding who can fix the problem by upgrading code or replacing the app from scratch then becomes the issue, whether inside or outside the organization.
I’m sure that your tenant is under control. You have identified every application which uses EWS and have a mitigation plan in place. Development resources skilled in the Graph APIs have been identified and are working to upgrade apps. The vendors for third-party EWS-based applications are known and have a replacement app ready to go. Life is good.
Given their experience of phasing out basic authentication for email protocols, the Exchange team is pretty good at managing the process of removing old protocols from the product. They understand that practical guidance is important, especially when tenants might not be totally aware of how a retirement might affect their operations.
Re-enabling Exchange Web Services
The article focuses on what to do if applications suddenly stop working after Microsoft disables EWS for a tenant. It’s critical to keep an eye on the message center because Microsoft will post a warning that “Action may be required: EWS will be disabled in your tenant in 7 days,” followed by confirmation that “EWS has been disabled in your tenant.”
Administrators can re-enable EWS via the Baseline Security Mode settings in the Microsoft 365 admin center or by updating the tenant configuration through Exchange Online PowerShell. This is a temporary escape hatch rather than a reprieve for EWS. The retirement will go ahead in April 2027 and EWS will disappear from the Microsoft 365 ecosystem.
In other words, reenabling EWS buys time that hopefully will be well used. It does not change the destination.
Understanding Exchange Web Services Usage
One of the more interesting aspects is the use of the EwsAllowedAppIDs allow list. Microsoft says that it has already populated this list with applications detected using EWS within the previous 60 days. Administrators can review the list and, if necessary, add additional application identifiers. Changes to the allow list take up to 24 hours to become effective. For some organizations, this might be the first clear inventory of applications that still depend on EWS. That information alone can help prioritize remediation efforts.
Speaking of which, a gentleman called Brendan Nolan-Cattanach reached out to me to say that he has an application to help Microsoft 365 tenants understand how to resolve application identifiers to EWS application names to better understand where applications come from and their current status.
I have not used the application and do not stand over it, but it might be of some use to tenants who see a bunch of application identifiers listed in the EWS usage report in the Microsoft 365 admin center and don’t know how to deal with them. Not everyone will be in the delightful position that I am where the report is empty (Figure 1).
The blunt but precise situation is that “EWS will not be an option that your client applications can use after April 2027.” Time is running out. Do you know your tenant’s status?
We published the original edition of the Office 365 for IT Pros eBook in May 2015. At that point, the book was 500 pages long, focused mostly on Exchange Online, and cost $49.95, or the equivalent of 25 cups of black coffee. Now the 13th version (Microsoft 365 for IT Pros, 2027 edition) is 970 pages, covers the core components of Microsoft 365, and includes separate books covering Automating Microsoft 365 with PowerShell (480 pages), Power Platform for IT Pros (250 pages) and Microsoft Purview for IT Pros (320 pages), and costs $59.95, or less than 10 cups of black coffee. Your favorite beverage has gotten way more expensive since 2015 while Office 365 for IT Pros continues to add value at a great price. Who doesn’t like a book that is updated monthly to make sure that its text keeps pace with everything that happens inside Microsoft 365? https://gum.co/O365IT/