Exchange Web Services (EWS) retirement in Exchange Online is entering its final phase. Over the last several years, Microsoft has worked with product teams, independent software vendors (ISVs), and c...
Updated Sep 22, 2026
Version 18.0
Blog Post
9 MIN READ
Introducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement
Nino_Bilic
Hey there.
I opened a case with MS as this is a bit confusing.
We are in a hybrid deployment with 2 mailboxes in 365 and all others on-prem. We migrate mailboxes for testing.
We have the latest Exchange SE and the Hybrid Application configured. EWS is set to True.
We show two AppIDs listed in the EWS usage repot.
1. Our Hybrid App
2. d3590ed6-52b3-4102-aeff-aad2292ab01c - Microsoft Office
Support said we do not need to configure anything for EWSAllowedAppIDs. It was mentioned our Hybrid App was also using Graph API. We have not done anything to enable that we can remember and it is listed in the report.
Support based that on us having the EnableExchangeHybrid3PAppFeature configured and the ability of the Hybrid App to see the AuthServer: EvoSts, etc. (From Health Checker)
Are we going to suffer an outage if we follow MS Support suggestion that we are OK the way we are? I know MS will populate it if we need it, but we rather get ahead
Can we just configure the EWSAllowedAppIDs and then evaluate?
Thank You
Nino_Bilic
Microsoft
MicrosoftIf you switched your on-premises servers to Graph Update Your Exchange SE Hybrid On-premises Rich Coexistence to Graph | Microsoft Community Hub then you do not need to add anything into EWSAllowedAppIDs as far as on-premises server is concerned. If you did not yet switch your on-premises to use Graph, then starting in October, you would need to set EWSEnabled = True on your tenant and populate the ID of your hybrid app into EWSAllowedAppIDs (in addition to whatever else EWS use might exist in your Online tenant which sounds like might be only Microsoft Office?)