Exchange Web Services (EWS) retirement in Exchange Online is entering its final phase. Over the last several years, Microsoft has worked with product teams, independent software vendors (ISVs), and c...
Updated Sep 09, 2026
Version 17.0
Blog Post
9 MIN READ
Introducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement
The MC1447678 message states:
"Tenants with EWSEnabled not configured (Null) remain subject to Microsoft's phased retirement process and will have EWS disabled as part of that rollout."
The table in this blog post states:
Starting October 2026: EWSEnabled null Allow List ignored Behavior All EWS allowed
Which statement is correct now?
Nino_Bilic
Microsoft
MicrosoftI mean... the table does not stop there, does it? :) It says that EWS will be allowed until Null is flipped to False (which starts in October). Not all tenants will be flipped from Null > False at the exact same moment.
|
EWSEnabled Value |
Allow List State |
Behavior |
|
Null |
Ignored |
All EWS allowed (but tenant will have EWSEnabled set to False at some point as part of phased rollout by Microsoft) |
What happens if a tenant sets EwsEnabled back to $null after Microsoft has already flipped it to $false on October 1? Does the phased rollout catch it again, or does it stay $null?
Exchange Online EWS, Your Time is Almost Up | Microsoft Community Hub
How will EWS be disabled?
We’ll disable EWS tenant-by-tenant using the https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-control-access-to-ews-in-exchange property, which supports three values: True, False, and Null (the default today). A new feature will allow admins to define an AppID Allow List - read more here Introducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement | Microsoft Community Hub. When enabled, only apps on that list can access EWS.
The EWSEnabled property in your tenant will change on (or soon after) Oct 1, 2026, as follows:
EWSEnabled value
Before Oct 2026
Starting Oct 2026
True
- If no Allow List, all EWS is allowed
- If Allow List is configured, only apps on it are allowed
Only Apps in the Allow List Allowed
False
All EWS Blocked
All EWS Blocked
Null
All EWS Allowed
All EWS Allowed (allow list ignored)
Any tenant with EWSEnabled still set to Null on October 1, 2026, will see the value changed to False as the deployment rolls out. That will block EWS for all applications in the tenant at that time.
If you want to keep EWS blocked, you can simply leave it that way.
But if you still need to use EWS, you will have two choices:
- Set EWSEnabled to True and maintain an Allow List (via https://learn.microsoft.com/en-us/microsoft-365/baseline-security-mode/baseline-security-mode-settings?view=o365-worldwide or Exchange Online PowerShell).
- Set EWSEnabled back to Null, which re-enables EWS without restrictions until the final deprecation occurs. This will have to be done using Exchange Online PowerShell.
- Greg Taylor - EXCHANGE
We'll probably leave it set to Null for a while, while we process all the tenants we haven't previously processed. But then we'll circle back and start changing Null to False again I think. Why would you set it to Null when True and a list are better options?
I really hope that Microsoft does not keep changing Null back to False from October 2026 to April 2027. For our tenants, we might have any number of reasons, including schedule conflicts, coordination, and other timelines that prevents us from moving to True and List for EWS apps, besides all the other EWS-related items that Microsoft tells us about. A new message center post just came out this week about more EWS changes for EXO Organization Sharing and transitioning to Cross Tenant Access policies, which aren't available for a month yet. If we purposely change EwsEnabled to Null after the first False change, please honor that and give us until April 2027 like documented.
