Exchange Online EWS Retirement: What SMB Admins Need to Know Before October 2026

Exchange Web Services (EWS) is a long-standing SOAP-based programming interface that lets applications connect to Exchange mailboxes to read email, calendar items, contacts, and other mailbox data. It has been used for years by third-party applications, custom line-of-business tools, and even some Microsoft products and hybrid deployments to talk to Exchange Online. Microsoft is now retiring EWS in Exchange Online on a fixed timeline, and the process starts soon enough that SMB administrators should begin checking their environment now, not after the phased disablement begins.

This matters even if your organization has never deliberately built anything against EWS. Some line-of-business software, backup and archiving tools, CRM connectors, and hybrid configurations use EWS behind the scenes without administrators necessarily being aware of it. If those connections stop working, the failure can look like a random outage rather than an expected retirement.

Why Microsoft is retiring EWS

According to Microsoft’s documentation, EWS deprecation was first announced in 2018, when Microsoft stated that EWS would no longer receive functionality updates. In 2023, Microsoft set the disablement timeline that is now taking effect. The urgency of this effort increased significantly after the Midnight Blizzard security incident in January 2024, which involved EWS and led Microsoft to widen the scope of the retirement effort from third-party applications to include all Microsoft applications as well, including Outlook, Office, Teams, and Dynamics 365.

Microsoft’s stated direction is to move applications from EWS to the Microsoft Graph API, which is the modern interface Microsoft is standardizing on for accessing Microsoft 365 data.

Key dates for the EWS retirement

Based on Microsoft’s published documentation, there are two milestones administrators need to track:

• October 1, 2026 – Phased disablement of EWS begins across Exchange Online tenants.
• April 1, 2027 – EWS is fully and permanently disabled in Exchange Online, with no documented exceptions after this date.

Microsoft’s Exchange Online service description explicitly confirms both dates and states that customers should plan to migrate EWS-based applications to Microsoft Graph. The dedicated EWS deprecation article on Microsoft Learn confirms the same two dates as the overall retirement timeline for all organizations.

It’s worth noting that “phased disablement” beginning in October 2026 does not necessarily mean every tenant loses EWS access on that exact date in the same way. Microsoft’s documentation for one specific scenario — hybrid Skype for Business Server deployments — describes a tenant-level setting that Microsoft automatically changes on October 1, 2026, for tenants that have not explicitly configured it. That mechanism is described in more detail below, and it’s a useful indicator of how the broader phased disablement is likely to be enforced, even though the specific documentation for it is written in the context of Skype for Business Server hybrid environments.

Understanding EwsEnabled and EwsAllowedAppIDs

Exchange Online has a tenant-level configuration setting called EwsEnabled that controls whether EWS can be used at all in the organization. According to Microsoft’s documentation, this setting has three possible states:

• $true – EWS is enabled. Starting in October 2026, only applications whose App IDs are on an allow list can call EWS.
• $false – EWS is blocked tenant-wide, and all EWS requests fail immediately.
• $null – This is described as the default state today. Microsoft automatically changes this to $false on October 1, 2026, for any tenant that has not explicitly set it to $true.

The allow list itself is controlled through a related setting, EwsAllowedAppIDs, which lists the specific application IDs permitted to call EWS once EwsEnabled is set to $true. Administrators configure and verify these settings using Exchange Online PowerShell, with cmdlets such as Set-OrganizationConfig and Get-OrganizationConfig.

Microsoft’s documentation also notes an important detail: to ease the transition, Microsoft pre-populates the allow list for tenants that haven’t created their own list before September 2026, based on each tenant’s own EWS usage telemetry. This means that even organizations that take no action may retain some EWS connectivity into the phased disablement period, based on what Microsoft has already observed being used. However, relying on an automatically generated list is a passive approach — administrators who want certainty over which applications keep working should review and explicitly manage their own allow list rather than assume Microsoft’s telemetry-based list matches their needs exactly.

Practical recommendation: Before October 1, 2026, check your tenant’s current EwsEnabled and EwsAllowedAppIDs values. If you have any application, hybrid deployment, or vendor tool that depends on EWS and needs to keep working past the start of the phased disablement, explicitly set EwsEnabled to $true and confirm its App ID is on the allow list, rather than depending on the default or an auto-generated list.

Which workloads may be affected

The supplied Microsoft documentation identifies several categories of impact, though the scope and exact behavior can differ by scenario:

Hybrid Skype for Business Server deployments

Microsoft’s documentation for Skype for Business Server hybrid environments states that this change affects deployments where Skype for Business Server runs on-premises but mailboxes are hosted in Exchange Online. These deployments use EWS calls from the on-premises server to Exchange Online for integration features, and those calls are subject to the retirement. Microsoft documents that pure on-premises deployments — where both Skype for Business Server and Exchange Server are on-premises — are not affected, since EWS retirement applies only to Exchange Online.

For this specific scenario, Microsoft’s documentation describes an end-of-August-2026 deadline to configure EwsEnabled and the allow list, and a requirement to install an upcoming Skype for Business Server update (replacing EWS calls with Microsoft Graph API calls) before April 1, 2027.

Exchange Server hybrid deployments (free/busy, profile pictures, MailTips)

According to Microsoft support documentation, starting with the Exchange Server Subscription Edition May 2026 Hotfix Update, Exchange Server supports using the Microsoft Graph API in hybrid deployments for free/busy information, profile picture sharing, and partially for MailTips. This change is explicitly described as replacing EWS for most hybrid scenarios ahead of the EWS retirement in Exchange Online.

If your organization runs a hybrid Exchange environment for these purposes, installing the relevant hotfix update is the documented path to keeping these specific features working after EWS is retired.

Third-party applications and custom tools

EWS has historically been widely used by third-party software vendors and custom-built line-of-business applications to interact with Exchange mailboxes. Microsoft’s deprecation documentation encourages organizations to identify their active EWS applications and begin migration, and notes that many application scenarios already have direct mappings between EWS operations and Microsoft Graph APIs.

Microsoft’s own products

Microsoft’s documentation states that the company is actively working to remove EWS dependencies from its own products, specifically naming Outlook, Microsoft Office, Microsoft Teams, and Dynamics 365. This is presented as ongoing work rather than something already complete, so administrators should not assume every Microsoft product has already finished this transition.

Functionality that may not have a direct replacement

Microsoft’s roadmap documentation lists several capability gaps between EWS and Microsoft Graph that are still being closed, with estimated delivery targets such as Q3 or Q4 of calendar year 2026 for things like archive mailbox import/export, public folder import/export, Microsoft 365 Group mailbox import/export, and generic CRUD (create, read, update, delete) access to user configuration objects and personal contact lists.

More significantly, Microsoft has confirmed that some EWS capabilities will not be added to Microsoft Graph at all:

• Generic Public Folder CRUD operations (public folder import/export is treated as a separate, still-planned capability)
• Generic Microsoft 365 Group mailbox CRUD operations (Microsoft points to existing Graph APIs for group conversations, threads, and posts instead)
• Generic access to legacy Discovery Mailboxes (Microsoft points to Microsoft Purview eDiscovery APIs instead)

If any of your organization’s tools rely on these specific capabilities, Microsoft’s documentation indicates there will not be a direct Graph-based replacement, and you should plan around alternative approaches rather than waiting for parity.

How to identify remaining EWS usage in your tenant

Rather than guessing which applications in your environment might depend on EWS, Microsoft provides tools specifically for this purpose, according to its deprecation documentation:

• EWS Usage Reports – reporting built into Microsoft 365 admin center usage reporting, intended to show EWS activity in your tenant.
• EWS Analyzer tool – a tool referenced in Microsoft’s documentation for analyzing and helping refactor EWS-dependent code.
• AI-assisted code analysis and refactoring guidance – a tutorial referenced by Microsoft for using AI assistance during EWS-to-Graph migration work.

Practical recommendation: Treat identifying EWS usage as the first task, before deciding on any technical response. Many SMB organizations don’t have full visibility into which line-of-business tools, backup products, or integrations quietly depend on EWS. Reviewing usage reporting and asking software vendors directly whether their product uses EWS is a reasonable starting point, since vendor-supplied software is often the source of hidden EWS dependency rather than anything built in-house.

What SMB Microsoft 365 administrators should do before October 2026

Based on the documented timeline and mechanisms above, the following actions are practical recommendations — not all of them are formal Microsoft requirements for every organization, but they reflect a sensible response to the documented retirement plan:

1. Check your tenant’s current EWS configuration. Review the EwsEnabled and EwsAllowedAppIDs settings using Exchange Online PowerShell rather than assuming they are already configured the way you want.
2. Inventory EWS usage. Use Microsoft’s EWS Usage Reports and ask vendors of any third-party or custom applications whether they rely on EWS to connect to Exchange Online.
3. Decide whether to rely on Microsoft’s auto-populated allow list or manage your own. Microsoft’s documentation confirms it will pre-populate an allow list from tenant telemetry for tenants without one before September 2026, but administrators who want certainty over which apps continue working should configure the list explicitly.
4. Check for hybrid dependencies. If you run Skype for Business Server hybrid or Exchange Server hybrid deployments, review the specific documented deadlines and updates for those scenarios, since they carry their own configuration steps and hotfixes separate from the general EWS retirement timeline.
5. Review the confirmed parity gaps. If your organization depends on generic public folder access, Microsoft 365 Group mailbox CRUD operations, or legacy Discovery Mailbox access through EWS, plan around the fact that Microsoft has stated these will not be replaced in Microsoft Graph.
6. Monitor the Microsoft 365 Message center. Microsoft’s documentation points to the Message center as the channel for release announcements related to this retirement, including updates for affected products.
7. Start migration work early rather than waiting for the October 2026 start date. Microsoft’s own guidance is to begin identifying and migrating EWS-dependent applications now rather than waiting for all parity gaps to close.

Looking ahead

The EWS retirement in Exchange Online is a multi-year, security-driven change with two firm dates: phased disablement starting October 1, 2026, and full retirement on April 1, 2027, which Microsoft describes as a hard deadline with no exceptions. For most SMB administrators, the immediate priority isn’t a single configuration change — it’s visibility. Knowing which applications, integrations, and hybrid components in your environment actually use EWS is the foundation for everything else, whether that means configuring an allow list, engaging a vendor for an update, or planning a migration to Microsoft Graph—based functionality.

Because Microsoft continues to update parity gaps and release guidance as the retirement date approaches, treat this article as a starting point rather than a final checklist, and keep an eye on the Microsoft 365 Message center and Microsoft Learn documentation as the October 2026 phase begins.