UPDATE July 14, 2026: Please see our release blog post for July 2026 Security Update, which, once installed, removes our recommendation to keep CVE-2026-42897 mitigation in place: Released: July 2026...
Updated Jul 14, 2026
Version 17.0
Blog Post
You can list all mailboxes that currently have OWA Light mode enabled with:
Get-CASMailbox -ResultSize Unlimited -ReadIsOptimizedForAccessibility | Where-Object {$_.IsOptimizedForAccessibility -eq $true} | Select-Object Name,PrimarySmtpAddress,IsOptimizedForAccessibility
You can disable OWA Light mode for all users who currently have it enabled with:
Get-CASMailbox -ResultSize Unlimited -ReadIsOptimizedForAccessibility | Where-Object {$_.IsOptimizedForAccessibility -eq $true} | Set-CASMailbox -IsOptimizedForAccessibility $false
You can globally disable the OWA Light feature so that users can no longer enable it themselves with:
Set-OwaVirtualDirectory "owa (Default Web Site)" -OWALightEnabled $false
Unfortunately (at least) in our environment the command only finds a subset of mailboxes with OWA Light mode enabled - several mailboxes haven't been found... So I've thought yesterday that I've fixed it for all affected mailboxes - but have in reality only done this for some of them...