If your EWS applications stopped working and you are looking for a quick relief, please see Exchange Online EWS application stopped working? Do this. | Microsoft Community Hub. Re-enabling EWS is pos...
Updated Oct 27, 2026
Version 21.0
Blog Post
Well, misunderstandings aside, no one has come on here and said that the sky fell after setting ewsenabled = true with a correctly populated EWSAllowedAppIDs.... Here I go..... I've also tested successfully in a M365 Lab but labs don't and can't have everything a production environment has.
Love these global settings.
Closing this off, this went without issue.
We actually changed EwsEnabled from Null to True about a week before populating the EWSAllowedAppIDs on Aug 21. This was more of a strategic political safeguard than recommended order of steps. (Our EwsEnabled was Null, and September\October was coming: At least get EwsEnabled to be set to True while our company calendar allows low\no impact changes. Then, should there be an unexpected change embargo at least we fall back to MS populating the EWSAllowedAppIDs property for us without the need for a change).
I had created an app called EWS traffic generator and it ran constantly so I could tell when the population of EWSAllowedAppIDs took affect.
Note: EwsEnabled changed from Null to True about a week before Aug 21st.
August 21 2:31am ET - EWSAllowedAppIDs populated with all AppIDs from EWS Usage Report (purposely not including my EWS traffic generator).August 21 10:03am ET - EWS traffic generator went from "HTTP Status: 200" to "Request failed with status 401 Unauthorized"
I would think since all tenants are not the same size, this time it took to apply varies within the 24 hours expectation? I could see it being similar or different for various reasons.
"When you do things right, people won't be sure you've done anything at all." --- Season 3, Godfellas episode, Futurama.
- Greg Taylor - EXCHANGE
Microsoft
Nice job, and thanks for sharing. You should be seeing 403's for the app if it's authenticated but not authorized - so to confirm that, re-auth the app if you are using delegated auth, and look for a 403. 401 is an authN failure. 403 is an authZ failure.
Thank you Greg.
Yes the 401 was interesting. I was using permission type Application (locked down with an access policy) not delegation. Not looking back, moving forward ;)Here is the moment we went from EWS all open to EWS only for permitted AppIDs (and this EWS traffic generator AppID NOT being on the list)
