Exchange Web Services retirement: dates, EWS apps and Graph replacements

Timeline

Find the apps that still use EWS

• In the Microsoft 365 admin center, go to Reports > Usage, choose Exchange and open the EWS usage tab.
• Set the period to 90 days and export the table. It lists Application ID, SOAP action, call volume and last activity date.
• Look up each Application ID under Enterprise applications in Microsoft Entra. Microsoft publishes a list of its own first-party app IDs; those apps are being updated by Microsoft.
• In App registrations, an app granted the EWS permissions EWS.AccessAsUser.All (delegated) or full_access_as_app (application) is set up to call EWS, even if the report has not caught it yet.
• For your own code, Microsoft's EWS Analyzer tool scans a codebase for EWS calls.

The report aggregates data weekly and can take up to 10 days to show usage, so an app that runs monthly may not appear in a short window. Use the 90-day view.

Check and set EWS access with PowerShell

These Exchange Online PowerShell commands come from Microsoft's documentation. The first two show the current settings; the last two allow EWS only for the listed Application IDs.

Get-OrganizationConfig |
    Format-List EwsEnabled,EwsApplicationAccessPolicy,EwsAllowList,EwsBlockList

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |
    Format-List EwsAllowedAppIDs

Set-OrganizationConfig -EwsAllowedAppIDs "11111111-2222-3333-4444-555555555555,aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
Set-OrganizationConfig -EwsEnabled:$true

When EwsEnabled is True, only the Application IDs in EwsAllowedAppIDs can use EWS. Changes to the list can take up to 24 hours to apply. If you also use a User-Agent allow list (EwsApplicationAccessPolicy EnforceAllowList), both checks must pass, so keep the user agents of apps you still need, such as Teams calendar. All of this stops working on 1 April 2027.

Reading a 403 from EWS

Microsoft notes that a 403 on its own does not prove an EWS policy caused the failure; other access restrictions can return 403 too. Enabling EWS on a mailbox does not override an organization-wide disable.

EWS to Microsoft Graph: common replacements

Taken from Microsoft's EWS to Microsoft Graph API mappings page, which also covers folders, reminders, calendar sharing and groups.

Gaps: what Graph does not do yet, and never will

Microsoft's roadmap lists gaps it plans to close with target dates in the third and fourth quarters of 2026, including full-fidelity import and export for archive, public folder and Microsoft 365 Group mailboxes, In-Place Archive access, notes, contact lists, an Exchange Admin API and reporting messages as junk or phishing. It says the dates are targets and might change, and that if a capability is not on the roadmap you should not plan on a Graph equivalent before EWS is fully disabled.

Three capabilities will never be added: generic create, read, update and delete in public folders, the same for Microsoft 365 Group mailboxes, and access to legacy Discovery Mailboxes, where Microsoft points to Purview eDiscovery instead.

Getting it done before April

The admin work is small; finding out what each Application ID is, and getting a date from each vendor, is what takes time. EWS Exit Plan starts with a scan of your usage report, then gives you a fixed-price plan per tenant, from $99: each app named, a decision for each, the Graph replacement for every EWS call your own code makes, and allow-listing for anything that needs until April.

Questions