Find every app still on EWS before Microsoft removes it for good
Exchange Online started blocking Exchange Web Services on 1 October 2026 unless an app is allow-listed, and removes it permanently on 1 April 2027, with no way to turn it back on. EWS Exit Plan reads your tenant's EWS usage report, names the app behind each Application ID, and gives you a fixed-price plan per app: update it, replace it, move it to Microsoft Graph, or allow-list it for the months that are left.
Updated
- A scan built on Microsoft's own EWS usage report: every Application ID that called EWS, the SOAP actions it used and how often, matched to an app name.
- One decision per app, with the Microsoft Graph API that replaces each EWS call, taken from Microsoft's published EWS-to-Graph mapping and its list of gaps.
- Allow-listing set up correctly for apps that need until April 2027, so a critical tool keeps working while its vendor catches up.
Phased disablement of EWS in Exchange Online began on 1 October 2026: EWS is blocked unless the tenant sets EWSEnabled to True and allow-lists the app. After 1 April 2027, EWS access is permanently removed with no re-enablement.
Source: mc.merill.netMicrosoft's EWS usage report aggregates data weekly, not daily, and usage can take up to 10 days to show in the report.
Source: learn.microsoft.comRequests blocked by EWS access controls get HTTP 403 with an X-EWS-Policy-Reason header saying EWS is disabled, or blocked by policy, for the user or tenant.
Source: learn.microsoft.comEWS is already being switched off, and on 1 April 2027 it is gone
Exchange Web Services is the older interface that custom scripts and vendor apps use to read, sync, back up and report on mailboxes and calendars in Exchange Online. Microsoft stopped adding features to it in 2018 and in 2023 set October 2026 as the date to disable it. Disablement began rolling out tenant by tenant on (or soon after) 1 October 2026: EWS is blocked unless the tenant has EWS enabled and the app on an allow list. After 1 April 2027 it is removed permanently, with no re-enablement.
A blocked app does not always say why. Microsoft lists symptoms from repeated password prompts to a plain error that EWS is not available; a sync stops, or an export job fails with HTTP 403. Exchange Online puts the reason in a response header, either "EWS is disabled for this user or tenant" or "EWS is blocked by policy for this user or tenant", which nobody reads until someone complains.
Most of the work is identification. Microsoft's EWS usage report lists Application IDs, not product names, and its data is aggregated weekly and can take up to 10 days to appear. Each ID has to be traced to an app and a vendor, the vendor's Graph-ready version found, and anything in-house rewritten against Microsoft Graph, where most common EWS operations have a direct equivalent but a few never will.
Without it
- Doing it yourself: Free, and Microsoft documents every step: the EWS usage report, an EWS Analyzer tool for code, an AI-assisted…
- Allow-listing and waiting: Re-enabling EWS for named apps keeps them running for now, but only until 1 April 2027, when Microsoft removes EWS…
- Your MSP or a Microsoft partner: A good choice if they already manage the tenant and know your apps. Ask for a fixed price and a per-app plan, so you…
With EWS Exit Plan
- A scan built on Microsoft's own EWS usage report: every Application ID that called EWS, the SOAP actions it used and how often, matched to an app name.
- One decision per app, with the Microsoft Graph API that replaces each EWS call, taken from Microsoft's published EWS-to-Graph mapping and its list of gaps.
- Allow-listing set up correctly for apps that need until April 2027, so a critical tool keeps working while its vendor catches up.
- Application ID to app name
- SOAP action breakdown
How it works
- 1
Scan of your EWS usage
You export the EWS usage report from the Microsoft 365 admin center, or grant us a temporary read-only reporting role. We list every Application ID that called EWS in the last 90 days, with its SOAP actions, call volume and last activity, and match each ID to an app in your Enterprise Applications.
- 2
A plan per app
For each app we work out whether it is a Microsoft app to keep updated, a vendor app with a Graph-ready version, an app to replace, or your own code to move to Graph, with each EWS call mapped to its Graph API. You approve the plan and the price.
- 3
Bridge what cannot move in time
For apps that need until April 2027, we set EWSEnabled and the Application ID allow list with your admin, so only those apps keep EWS access. Allow-list changes can take up to 24 hours to apply.
- 4
Confirm and close
After the changes, we re-check the usage report for remaining EWS calls, allowing for its reporting delay, and give you a sign-off report: each app, its decision, its owner and its date.
Features
Application ID to app name
Each ID in the usage report matched to an Enterprise Application in Microsoft Entra, or to Microsoft's list of its own first-party app IDs, so you know which product you are dealing with.
SOAP action breakdown
Which EWS operations each app calls, such as FindItem, GetItem, SendItem or GetUserAvailability, and how often. That list decides whether a move is a version update or a rewrite.
Graph mapping per call
Each operation mapped to its Microsoft Graph equivalent using Microsoft's EWS-to-Graph mapping, for example FindItem to List messages and GetUserAvailability to Get free/busy schedule.
Parity-gap check
Operations that depend on capabilities still on Microsoft's Graph roadmap, such as archive or public folder import and export, or that Microsoft says will never come to Graph, are flagged early with an alternative.
Allow list done right
EWSEnabled and EwsAllowedAppIDs set so only named apps keep access, with a check that any User-Agent allow list does not block apps you still need, such as Teams calendar.
Vendor emails ready to send
A short email per vendor asking for their Graph-ready version and its date, written for you to send, so the answers land with the person who owns the contract.
403 troubleshooting
When an app fails, we read the X-EWS-Policy-Reason header and the organization and mailbox settings to tell whether EWS is disabled or the app is blocked by policy.
Sign-off report
Every app found, its decision, owner and date, and the tenant's final EWS settings. MSPs get it under their own brand.
A look inside
What you get: the working view and the delivery report.
Illustration of the layout, built from this page's own feature list. It shows no real results.
Who it's for
Small and mid-size businesses on Microsoft 365
A few third-party tools that touch mailboxes or calendars, and nobody who wants to learn the EWS usage report and Graph permissions before April.
Teams with their own scripts and integrations
In-house code that sends, files or reads mail through EWS. You get each EWS call mapped to its Graph replacement, ready for a developer to implement.
Managed service providers
Many client tenants, each with a different mix of apps. Hand us the scans and keep the client relationship, with reports under your brand.
Works with
- Exchange Online and the Microsoft 365 admin center
- EWS usage report (Reports > Usage > Exchange > EWS usage)
- Microsoft Entra enterprise applications and app registrations
- Exchange Online PowerShell: Get-OrganizationConfig, Set-OrganizationConfig, Get-CASMailbox
- Microsoft Graph mail, calendar and contacts APIs
- Microsoft's EWS-to-Graph API mapping
- EWS Managed API and SOAP clients
Pricing
Every plan starts with the scan, so you see how many apps still call EWS, and what each one needs, before the plan is written. Plans are one-time prices per Microsoft 365 tenant, paid once. Rewriting your own code and any vendor licence costs are not included; we quote code work separately once the plan shows its size. Founding customer pricing applies to early-access orders.
Orders are subject to the EWS Exit Plan terms.
Exit plan
$99 one-time
One tenant with a handful of EWS apps
- EWS usage scan first
- Up to 5 EWS apps
- Application IDs matched to app names
- A decision and owner per app
- Graph mapping for each EWS call
- Written plan with dates
Plan + bridge
$249 one-time
Apps that cannot all move before April 2027
- Up to 15 EWS apps
- Everything in Exit plan
- EWSEnabled and allow list set up with your admin
- Vendor emails ready to send
- Usage report re-checked after the changes
- EWS switched off for the tenant once usage is zero
MSP pack
$490 one-time
IT providers with several client tenants
- 5 tenants, up to 15 apps each
- Everything in Plan + bridge
- Reports under your brand
- A runbook your team can reuse
- Extra tenants at $99 each
Compared with the alternatives
- Doing it yourself
- Free, and Microsoft documents every step: the EWS usage report, an EWS Analyzer tool for code, an AI-assisted migration tutorial and the EWS-to-Graph mapping. The time goes into matching IDs to apps and chasing vendors, which is the part we take on.
- Allow-listing and waiting
- Re-enabling EWS for named apps keeps them running for now, but only until 1 April 2027, when Microsoft removes EWS with no re-enablement. It buys months, not a solution.
- Your MSP or a Microsoft partner
- A good choice if they already manage the tenant and know your apps. Ask for a fixed price and a per-app plan, so you can compare.
- Replacing the app
- When a vendor has no Graph-ready version, a replacement product can be faster than waiting. The plan says where that is the case.
What changed
- Phased disablement of EWS in Exchange Online began on 1 October 2026: EWS is blocked unless the tenant sets EWSEnabled to True and allow-lists the app. After 1 April 2027, EWS access is permanently removed with no re-enablement. Source: mc.merill.net
- Microsoft's EWS usage report aggregates data weekly, not daily, and usage can take up to 10 days to show in the report. Source: learn.microsoft.com
- Requests blocked by EWS access controls get HTTP 403 with an X-EWS-Policy-Reason header saying EWS is disabled, or blocked by policy, for the user or tenant. Source: learn.microsoft.com
- Microsoft says three EWS capabilities will never be added to Microsoft Graph: generic public folder access, generic Microsoft 365 Group mailbox access and legacy Discovery Mailbox access. Source: learn.microsoft.com
From request to an EWS-free tenant
We start the scan within 2 business days of your request; the plan follows within 3 business days of receiving the report.
- Day 1: Request the service; we send instructions to export the EWS usage report or grant read-only access.
- Day 2–3: Scan delivered: every app still calling EWS, matched to a name.
- Day 4–5: Plan per app and price confirmed; vendor emails ready to send.
- Week 2 onward: Allow list set for apps that need time, moves tracked, and EWS switched off for the tenant once the report shows no remaining calls.
Security and data
- The scan uses the usage report you export, or a read-only role you grant and can revoke at any time; we confirm when we have finished.
- We never ask for a Global Administrator password; changes use an account you create for the job and delete afterwards, or your admin makes them with us.
- We do not read mailbox content. The scan works from usage data: Application IDs, SOAP action names and call counts.
- Reports and job notes are deleted 30 days after delivery unless you ask us to keep them.
Questions
Is EWS already turned off in my tenant?
Possibly. Microsoft began a phased disablement on 1 October 2026: EWS is blocked unless EWSEnabled is set to True and the app is on the allow list. Run Get-OrganizationConfig | Format-List EwsEnabled in Exchange Online PowerShell to see the organization setting, and search Message Center for a post titled "EWS has been disabled in your tenant".
What happens on 1 April 2027?
Microsoft permanently removes EWS access in Exchange Online, with no re-enablement. Apps still using EWS stop working, whatever the allow list says.
Does this affect Exchange Server on-premises?
No. The retirement covers Exchange Online. Exchange Server on-premises is not affected, although hybrid setups should still check which apps talk to cloud mailboxes.
How do I find which apps use EWS?
In the Microsoft 365 admin center, go to Reports > Usage > Exchange and open the EWS usage tab. It lists each Application ID with its SOAP actions, call volume and last activity for the last 7, 30 or 90 days. Data is aggregated weekly and can lag by up to 10 days.
What about Outlook, Teams and other Microsoft apps?
Microsoft says it is removing EWS dependencies from its own products, including Outlook, Office, Teams and Dynamics 365. Keep those apps up to date. Its list of apps that still use EWS includes Apple Mail and Calendar on macOS, classic Outlook on macOS and outdated Outlook desktop versions on Windows. The scan separates Microsoft's app IDs from third-party ones.
Is there a Microsoft Graph replacement for everything?
No. Microsoft has confirmed three capabilities will never come to Graph, and lists others on a roadmap for Q3 and Q4 of 2026. It says not to plan on a Graph equivalent for any EWS capability missing from that roadmap.
Do you need admin access to our tenant?
Not for the scan: you can export the report yourself, or grant a temporary read-only reporting role. Allow-list changes are made by your admin with us on a call, or with a time-limited account you create and remove afterwards.
Is this an official Microsoft service?
No. EWS Exit Plan is an independent IT service. We use Microsoft's documented reports, settings and APIs, and your tenant stays under your control.
Know which apps break before 1 April 2027
Every plan starts with a scan of your EWS usage report, then a fixed-price decision for each app still calling EWS. From $99 per tenant.
Request service