Microsoft began retiring Exchange Web Services (EWS) in Exchange Online on October 1, 2026, and full retirement follows on April 1, 2027. Many small businesses have no developer and no full-time administrator, and the tools that depend on EWS are often ones nobody has looked at in years. This post sets out a five-step plan: find what still uses EWS, sort each dependency, decide what happens to it, use the allow list only as a short bridge, and confirm the work before April 1. Hybrid organizations get a separate section, because they have one more deadline to plan for.
→
2 Sort
→
3 Decide
→
4 Bridge
→
5 Confirm
Where things stand on October 22, 2026
EWS disablement is already under way, and what your tenant is experiencing depends on its EWSEnabled setting. Microsoft’s Exchange Team states that from early October 2026, setting EWSEnabled to True is no longer enough on its own to keep EWS working, and that an application ID allow list called EWSAllowedAppIDs is required to name the apps permitted to use EWS. Microsoft populated that list on October 10 to 11 for tenants that had EWSEnabled set to True without a list. Tenants where EWSEnabled was never configured remain in Microsoft’s phased retirement and will have EWS disabled as that rollout reaches them.
For a small business, this means a backup product, a CRM connector, or a Mac mail client may stop working without any change on your side. Your first action is to check Message Center in the Microsoft 365 admin center for EWS notices about your tenant, and to find out from your IT provider which of these states your tenant is in.
This retirement applies only to Microsoft 365 and Exchange Online. Microsoft states there are no changes to EWS in Exchange Server, where EWS continues to be supported for on-premises mailboxes. If all of your mailboxes are in Exchange Online, the hybrid section later in this post does not apply to you.
Step 1: Find what still uses EWS
Most small businesses do not have a list of the third-party applications that read or write their email, calendars, and contacts. The Microsoft 365 admin center provides one starting point. Microsoft’s documentation states that the EWS usage report shows the SOAP actions used by each application calling EWS and the successful-call volume for each, filterable over the last 7, 30, or 90 days. Usage data is aggregated weekly, and it can take up to 10 days to appear.
The report lists application IDs rather than product names, so expect some detective work. Some entries will be Microsoft applications. Microsoft names Outlook for Windows, Classic Outlook for Mac, Excel Power Query, Power BI, and Exchange Server hybrid scenarios as Microsoft sources of EWS traffic.
The report only shows tools that ran recently, which matters for tools used once a quarter or once a year. Microsoft states that infrequently used applications may not be identified when it builds allow lists from usage. Export the report, list each application ID, and ask staff about tools used at month end, year end, or during audits that may not appear in it.
Step 2: Sort each dependency
An application ID becomes useful once you know what it is, who owns it, and what business process depends on it. Without that, you can’t ask a vendor the right question or judge the cost of losing the tool.
Sort each entry into one of five groups:
a vendor product, such as backup, archiving, CRM sync, or room booking
a custom script or internal automation left by a previous provider
a mail client, such as Classic Outlook for Mac
a Microsoft application
a hybrid connection to an on-premises Exchange Server
Then record a named owner and a one-line business purpose for each. If you manage more than one tenant, or want a fuller breakdown of vendor categories, our vendor checklist for MSPs covers that in detail.
Step 3: Decide what happens to each one
Microsoft Graph replaces EWS for most mailbox work, but not all of it. Microsoft’s Learn documentation lists remaining gaps with target dates it describes as targets that might change. It also lists three capabilities that won’t be added to Microsoft Graph: generic Public Folder CRUD, generic Microsoft 365 Group mailbox CRUD, and access to legacy Discovery Mailboxes, for which Microsoft points to Microsoft Purview eDiscovery APIs and workflows.
| Area | Moves to Microsoft Graph cleanly | Needs rework or has no Graph equivalent |
| Email, calendars, and contacts | Common read, send, and sync work for primary mailboxes | Personal contact lists and Additional Contact Properties (targeted for Q3 CY2026; delivery not confirmed) |
| Backup and migration tools | Primary mailbox content | Archive mailbox, Microsoft 365 Group mailbox, and public folder import and export in full-fidelity format (targeted for Q4 CY2026) |
| Archiving and eDiscovery | Regular mailbox content | In-Place Archive item access (targeted for Q4 CY2026); Discovery Mailbox access won’t be added |
| Public folders | Import and export (targeted for Q4 CY2026) | Generic Public Folder CRUD won’t be added |
| Microsoft 365 Group mailboxes | Group conversations, threads, and posts through Graph | Generic Microsoft 365 Group mailbox CRUD won’t be added |
| Custom scripts | Simple mail and calendar tasks | Scripts that use User Configuration objects, folder permissions, or non-draft MIME content (targeted for Q4 CY2026) |
| Third-party apps with no Graph release | No path once EWS is disabled | Replace or retire before April 1, 2027 |
On a phone, scroll the table sideways to see every column.
For each dependency, choose one of four outcomes:
Update: the vendor has a Microsoft Graph version. Get the date in writing and schedule the move.
Replace: the vendor has no dated Graph release, or depends on a capability Microsoft has said won’t be added. Start choosing a replacement now.
Retire: nobody can name an owner or a purpose. Remove it and its permissions.
Rebuild: an internal tool is still needed. Microsoft points to the EWS Analyzer tool and AI-assisted code analysis and refactoring, or a low-code approach with Power Platform or a Copilot Agent.
Supporting small-business clients through the EWS retirement?
If you are an MSP supporting small-business clients through this, WME provides Microsoft-exclusive delivery capacity. That includes EWS dependency assessments, vendor follow-up, and Microsoft Graph migration work in your clients’ tenants.
Step 4: Use the allow list as a short bridge
EWSAllowedAppIDs is a tenant-level administrative control. It can keep named apps working while their update or replacement is in progress. Microsoft states that tenants with EWSEnabled set to True and a configured allow list will not have that setting changed by Microsoft before April 2027. Microsoft also states that the list is a replacement list, so each update must include every required application ID, and that changes can take up to 24 hours to take effect.
The allow list is easy to get wrong in a few ways:
The older EWSAllowList setting. Microsoft states that EWSAllowList is unrelated to EWS retirement and does not replace EWSAllowedAppIDs.
Mac clients. New Outlook for Mac is not affected. If you still use Classic Outlook for Mac, Microsoft says to include the Microsoft Office application ID in the list.
Outlook for Windows build. Microsoft says Outlook for Windows should be on the August 2026 build 16.0.20430.20092 or later.
Licensing. Microsoft had planned to block EWS for mailboxes licensed only with Exchange Online Kiosk or Microsoft 365 F1, and has cancelled that block. EWS access for those mailboxes ends on the general retirement timeline.
Add an application to the list only when it has a dated exit plan, and record that date next to the entry.
If you run hybrid Exchange
Hybrid organizations keep some mailboxes on an on-premises Exchange Server and share free/busy and MailTips with Exchange Online. Microsoft calls this hybrid rich coexistence, and it depends on EWS today. Microsoft states that on-premises customers must be on at least the May 2026 update for Exchange Server SE to use Graph for rich coexistence. Hybrid customers must use Exchange SE to host on-premises mailboxes after April 2027. Between October 2026 and April 2027, they can enable EWS in Exchange Online and add their dedicated hybrid app to EWSAllowedAppIDs to keep rich coexistence working over EWS.
If you are on an older Exchange Server version, free/busy and MailTips between your on-premises and cloud mailboxes will stop working after April 2027. Plan an Exchange Server SE upgrade, or move the remaining mailboxes to Exchange Online, before then.
Step 5: Confirm before April 1, 2027
The April date is fixed. Microsoft’s Exchange Team states that starting April 1, 2027, EWS will be fully and permanently disabled, and that there will be no exceptions past April 2027.
Re-run the EWS usage report each month and check that call volume is falling as apps move off EWS. Where a backup or archiving vendor has moved to Microsoft Graph, run a test restore rather than relying on the product’s status page. Remove each allow-list entry once its app has moved, so the list shrinks toward zero before Microsoft disables EWS for good.
WME works as Microsoft-exclusive delivery capacity for MSPs that serve small businesses. We can run the EWS dependency assessment, sort and decide each app with your client, follow up with vendors, and carry out Microsoft Graph migration work.
The April date is fixed. Your inventory doesn’t have to wait.
We’ll run the EWS dependency assessment, sort and decide each app with your client, follow up with vendors, and carry out the Microsoft Graph migration work.
