# Exchange Web Services retirement: dates, EWS apps and Graph replacements

By Rotomal team · Updated 2026-11-03 · Part of [EWS Exit Plan](https://rotomal.com/ews-exit/)

**Short answer:** Microsoft is retiring Exchange Web Services (EWS) in Exchange Online. Phased disablement began rolling out from 1 October 2026, tenant by tenant: EWS is blocked unless an admin sets EWSEnabled to True and allow-lists the app's ID. After 1 April 2027, EWS is removed permanently with no way to re-enable it. Exchange Server on-premises is not affected. Find the apps that still call EWS in the Microsoft 365 admin center under Reports > Usage > Exchange > EWS usage, then move each one to Microsoft Graph.

## Timeline

| Date | What happened |
| --- | --- |
| July 2018 | Microsoft announced EWS would get no more functionality updates |
| 2023 | Disablement in Exchange Online set for October 2026 |
| January 2024 | Midnight Blizzard incident involving EWS; scope widened to Microsoft's own apps |
| 2025 | EWS usage reports, EWS Analyzer and admin controls to disable EWS released |
| 5 February 2026 | Message Center post MC1227454 published with the October 2026 and April 2027 dates |
| End of September 2026 | Date by which admins who needed EWS after October were asked to set EWSEnabled to True with an AppID allow list, to be excluded from the automatic switch to False (first given as end of August) |
| 1 October 2026 | Phased disablement began: EWS blocked unless EWSEnabled is True and the app is allow-listed |
| 1 April 2027 | EWS permanently removed, no re-enablement |

## Find the apps that still use EWS

- In the Microsoft 365 admin center, go to Reports > Usage, choose Exchange and open the EWS usage tab.
- Set the period to 90 days and export the table. It lists Application ID, SOAP action, call volume and last activity date.
- Look up each Application ID under Enterprise applications in Microsoft Entra. Microsoft publishes a list of its own first-party app IDs; those apps are being updated by Microsoft.
- In App registrations, an app granted the EWS permissions EWS.AccessAsUser.All (delegated) or full_access_as_app (application) is set up to call EWS, even if the report has not caught it yet.
- For your own code, Microsoft's EWS Analyzer tool scans a codebase for EWS calls.

The report aggregates data weekly and can take up to 10 days to show usage, so an app that runs monthly may not appear in a short window. Use the 90-day view.

## Check and set EWS access with PowerShell

These Exchange Online PowerShell commands come from Microsoft's documentation. The first two show the current settings; the last two allow EWS only for the listed Application IDs.

```
Get-OrganizationConfig |
    Format-List EwsEnabled,EwsApplicationAccessPolicy,EwsAllowList,EwsBlockList

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |
    Format-List EwsAllowedAppIDs
```

```
Set-OrganizationConfig -EwsAllowedAppIDs "11111111-2222-3333-4444-555555555555,aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
Set-OrganizationConfig -EwsEnabled:$true
```

When EwsEnabled is True, only the Application IDs in EwsAllowedAppIDs can use EWS. Changes to the list can take up to 24 hours to apply. If you also use a User-Agent allow list (EwsApplicationAccessPolicy EnforceAllowList), both checks must pass, so keep the user agents of apps you still need, such as Teams calendar. All of this stops working on 1 April 2027.

## Reading a 403 from EWS

| X-EWS-Policy-Reason header | Meaning | Check |
| --- | --- | --- |
| EWS is disabled for this user or tenant | EWS is turned off for the organization or the mailbox | Organization and mailbox EwsEnabled settings |
| EWS is blocked by policy for this user or tenant | An Application ID or User-Agent policy blocked the app | EwsAllowedAppIDs, EwsApplicationAccessPolicy, EwsAllowList, EwsBlockList |

Microsoft notes that a 403 on its own does not prove an EWS policy caused the failure; other access restrictions can return 403 too. Enabling EWS on a mailbox does not override an organization-wide disable.

## EWS to Microsoft Graph: common replacements

| EWS operation | Microsoft Graph API |
| --- | --- |
| FindItem | List messages |
| GetItem | Get message |
| CreateItem | Create message |
| SendItem | Send message, or Send mail |
| UpdateItem | Update message |
| MoveItem | Move message |
| DeleteItem | Delete message |
| GetAttachment / CreateAttachment | Get attachment / Add attachment |
| SyncFolderItems | Get messages delta |
| Subscribe (push notifications) | Create subscription |
| GetUserAvailability | Get free/busy schedule |
| GetUserOofSettings / SetUserOofSettings | Get / Update user mailbox settings |
| GetInboxRules | List rules |
| ResolveNames | List people |
| ConvertId | Translate Exchange IDs |

Taken from Microsoft's EWS to Microsoft Graph API mappings page, which also covers folders, reminders, calendar sharing and groups.

## Gaps: what Graph does not do yet, and never will

Microsoft's roadmap lists gaps it plans to close with target dates in the third and fourth quarters of 2026, including full-fidelity import and export for archive, public folder and Microsoft 365 Group mailboxes, In-Place Archive access, notes, contact lists, an Exchange Admin API and reporting messages as junk or phishing. It says the dates are targets and might change, and that if a capability is not on the roadmap you should not plan on a Graph equivalent before EWS is fully disabled.

Three capabilities will never be added: generic create, read, update and delete in public folders, the same for Microsoft 365 Group mailboxes, and access to legacy Discovery Mailboxes, where Microsoft points to Purview eDiscovery instead.

## Getting it done before April

The admin work is small; finding out what each Application ID is, and getting a date from each vendor, is what takes time. EWS Exit Plan starts with a scan of your usage report, then gives you a fixed-price plan per tenant, from $99: each app named, a decision for each, the Graph replacement for every EWS call your own code makes, and allow-listing for anything that needs until April.

## FAQ

### When is EWS being turned off?

Phased disablement in Exchange Online began on 1 October 2026, blocking EWS unless the tenant enables it and allow-lists the app. EWS is permanently removed after 1 April 2027.

### Is EWS being removed from Exchange Server on-premises?

No. The retirement applies to Exchange Online. Exchange Server on-premises is not affected.

### Can I turn EWS back on?

Until 1 April 2027, yes: set EWSEnabled to True and list the apps in EwsAllowedAppIDs. Microsoft says it pre-filled that list from recent usage for tenants that had not built their own, and that setting EWSEnabled back to Null in PowerShell re-enables EWS without restrictions until the final shutdown. After 1 April 2027 there is no re-enablement.

### What replaces EWS?

Microsoft Graph. Microsoft publishes a mapping from EWS operations to Graph APIs and says Graph has reached near-complete feature parity for the vast majority of EWS scenarios, with a few capabilities that will never be added.

### Why did my EWS app stop working in October 2026?

Most likely the phased disablement. Check the X-EWS-Policy-Reason header on the 403 response and the EwsEnabled and EwsAllowedAppIDs settings in Exchange Online PowerShell.

### Does the EWS usage report show app names?

No, it shows Application IDs. Look each one up under Enterprise applications in Microsoft Entra, or in Microsoft's list of its first-party app IDs.

## Sources

- Message Center MC1227454: Exchange Web Services (EWS) retirement update https://mc.merill.net/message/MC1227454
- Exchange Team Blog: Exchange Online EWS, Your Time is Almost Up (timeline, EWSEnabled values, updated 27 October 2026) https://techcommunity.microsoft.com/blog/exchange/exchange-online-ews-your-time-is-almost-up/4492361
- Exchange Team Blog: Exchange Online EWS application stopped working? Do this. https://techcommunity.microsoft.com/blog/exchange/exchange-online-ews-application-stopped-working-do-this-/4566215
- Microsoft Learn: Deprecation of Exchange Web Services in Exchange Online https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-ews-exchange-online
- Microsoft Learn: Exchange Web Services (EWS) usage report https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/ews-usage
- Microsoft Learn: Control access to EWS in Exchange (allow lists, 403 responses) https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-control-access-to-ews-in-exchange
- Microsoft Learn: EWS to Microsoft Graph API mappings https://learn.microsoft.com/en-us/graph/migrate-exchange-web-services-api-mapping
- Microsoft Learn: Authenticate an EWS application by using OAuth (EWS permissions) https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-authenticate-an-ews-application-by-using-oauth

[EWS Exit Plan](https://rotomal.com/ews-exit/) does this for you. Request it free, no card: https://rotomal.com/ews-exit/request/
---
Rotomal · https://rotomal.com/ews-exit/exchange-web-services-retirement/ · hello@rotomal.com