Microsoft Exchange Online: Prepare for Exchange Web Services retirement with EWSAllowedAppIDs

🚨 The Signal: Exchange Web Services (EWS) will retire from October 2026. A new EWSAllowedAppIDs feature allows administrators to create an allow list for applications permitted to use EWS, enabling a controlled transition and reducing risk.

The Impact

Exchange Online administrators are affected, facing a security risk if unapproved applications continue to use EWS, or if critical applications are not allow-listed.

  • Exchange Online Admins: Risk of service disruption if EWS-dependent apps are not allow-listed.
  • Security Teams: Risk of unauthorized data access if EWS is not restricted to approved applications.
  • Application Owners: Risk of application failure if EWS dependencies are not identified and managed.
  • Compliance Teams: Risk of non-compliance if EWS access is not adequately controlled.

The Action

  1. Identify all applications currently using EWS in your Exchange Online environment.
  2. Create an allow list of approved application IDs using the EWSAllowedAppIDs configuration.
  3. Test the allow list configuration to ensure critical applications continue to function.
  4. Monitor EWS usage leading up to the October 2026 retirement enforcement date.
  5. Develop a plan to migrate any remaining EWS-dependent applications to modern APIs before April 2027.

Domain: Exchange · Impact: high · Workload: Exchange Online · Essential Eight: Application Control, Restrict Administrative Privileges · ISM: ISM-0445, ISM-0843, ISM-1175, ISM-1380, ISM-1490, ISM-1507, ISM-1508, ISM-1509, ISM-1544, ISM-1582, ISM-1647, ISM-1648, ISM-1650, ISM-1656, ISM-1657, ISM-1658, ISM-1659, ISM-1660, ISM-1686, ISM-1688, ISM-1689, ISM-1870, ISM-1871, ISM-1883, ISM-1897, ISM-1898