As we have been announcing, Exchange Web Services (EWS) protocol is being turned off in Exchange Online. This protocol is used by various applications such as:
- Apple Mail / Calendar on macOS
- Classic Outlook on macOS
- Different Outlook desktop add-ins
- Outdated versions of Outlook Desktop on Windows
- Various other applications such as backup applications that our customers purchase from various software vendors
Such applications might give you various errors when EWS is turned off, from repeatedly asking for username or password, to giving you a clear error that EWS protocol is not available.
Retirement of this protocol is now in progress, you can see our progress in this post.
If your EWS applications stopped working, do this
Please note that Microsoft support cannot perform these steps for you. Only the tenant administrator can follow these steps and re-enable EWS.
- Check your tenant Message Center posts. Use the Search field to look for a post with a subject of “Action may be required: EWS will be disabled in your tenant in 7 days” or “EWS has been disabled in your tenant”. This will tell you when EWS was turned off in your tenant.
If you do find a post saying that Microsoft turned off EWS in your tenant, you have two options:
Option 1 (easiest): Use Microsoft 365 admin center Baseline Security Mode
- Go to the Microsoft 365 admin center, Baseline security mode page: https://admin.cloud.microsoft/#/baselinesecuritymode
- Find the “Block access to Exchange Web Services” line and click on it:
- Uncheck (de-select) the “Block your entire organization from using EWS” checkbox (1) and then press the “Apply change” (2) button:
- Now check (select) the same “Block your entire organization from using EWS” checkbox (3) and then again press the “Apply change” (4) button:
- You have now re-enabled EWS in your tenant. The setting change usually takes less than an hour to start working (and your EWS applications will just start working again). But note that this can take up to 4 hours in rare cases.
It might be a bit confusing that while you have checked / selected the “Block” setting, the underlying setting on your tenant is now actually set to allow EWS (EWSEnabled = True) with a specific app(s) in the EWS allow list.
- To learn which EWS applications are in the allow list to use EWS in your tenant, see the Scope Summary section (5). Apps that are listed / excluded are the ones that are excluded from being blocked.
Option 2 (more control): Use Exchange Online PowerShell
- Install Exchange Online PowerShell module and then, connect to Exchange Online PowerShell.
- Paste the following command into your connected PowerShell window:
Get-OrganizationConfig | Fl EWSEnabled- If the answer is “EwsEnabled : False” then EWS is disabled – this is your problem
- Paste the following command into the PowerShell window:
Set-OrganizationConfig -EWSEnabled $true- You have now re-enabled EWS in your tenant. The setting usually takes less than an hour to start working (and your EWS applications will just start working again). But note that this can take up to 4 hours in rare cases to start working.
Finding out which EWS applications are allowed in your tenant
Using the Baseline security mode: see the Scope Summary as shown in the above screenshot and use Exclude specific apps to modify the list.
Using the Exchange Online PowerShell: paste the following command into the Exchange Online PowerShell window:
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Fl EwsAllowedAppIDs- This will result in a list of EWS applications that Microsoft has detected were in use within last 60 days in your tenant. We already added them to “EwsAllowedAppIDs” – which is an “allow list” for EWS applications. You do not need to modify this list if everything is working properly once you re-enabled EWS by using previous steps. You can add additional apps to this list. Read more here.
Modifications to applications in the allow list take 24 hours to take effect.
The steps above will work only temporarily (until April 2027)
We are now in the first stage of EWS disablement, where customers are still able to re-enable EWS. Re-enabling EWS will stop working in April 2027.
The long-term solution is to update your applications to the application versions that do not use EWS. You must contact your application vendor to get the updated application version, or if you created the application yourself, you must change the code to not use EWS anymore. EWS will not be an option that your client applications can use after April 2027.
The EWS Deprecation Team
