Action required: Retirement of EWS-based Personal Bookings controls (Microsoft Bookings)

🚨 The Signal: Microsoft is deprecating EWS-based controls for Personal Bookings by August 2026, shifting management exclusively to OWA Mailbox Policies. This centralises control, enhancing consistency and security posture for scheduling services.

The Impact

Microsoft 365 administrators are affected, with a moderate security risk if existing EWS configurations are not migrated to OWA Mailbox Policies, potentially exposing unintended Personal Bookings access.

• Administrators: Must review and migrate EWS-based Personal Bookings settings to OWA Mailbox Policies.
• Organisations: Risk of unintended Personal Bookings access if migration is not completed by August 2026.
• Security Teams: Need to validate OWA Mailbox Policy configurations to ensure secure access controls.
• Users: May experience changes in Personal Bookings availability based on new policy enforcement.

The Action

1. Identify all users currently managed by EWS-based Personal Bookings controls (Set-OrganizationConfig or Set-CASMailbox).
2. Review your existing OWA Mailbox Policies, especially the default policy, for Personal Bookings settings.
3. Create or modify OWA Mailbox Policies to reflect desired Personal Bookings access for user groups.
4. Assign appropriate OWA Mailbox Policies to users to enforce Personal Bookings access controls.
5. Verify Personal Bookings access for a sample of users after policy application.

Domain: Exchange · Impact: medium · Workload: Exchange Online