As we prepare for the final phase of Exchange Web Services retirement, we are refining how EWSAllowedAppIDs setting (which you can use to define your EWS AppID allow list) will be applied. Our goal i...
Published Sep 04, 2026
Version 1.0
Blog Post
I have a question about the automatic population behavior of EwsAllowedAppIDs.
I first set:
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<some App IDs>"
Later, because I cannot confidently identify every application in my tenant that still uses EWS, I remove the manually configured list:
Set-OrganizationConfig -EwsAllowedAppIDs $null
When the October 2026 enforcement logic reaches my tenant, will Microsoft automatically populate EwsAllowedAppIDs based on my tenant’s recent EWS usage?
Or, because I previously configured the list manually, will it remain customer-managed and therefore not be auto-populated even after I set it to $null?
I would appreciate clarification, as I need to avoid disrupting existing EWS workloads that may not yet be fully inventoried.
Nino_Bilic
Microsoft
MicrosoftNo, in this case, we would not populate your list because you already touched it.
People should understand that we really want tenant admins to take control of their list. We will do it for all of the tenants who read nothing, did nothing, will get surprised when EWS turns off. Most of the tenants, in other words, and it is a mechanism to help them turn EWS back on if they need to with the least amount of waiting after they have EWS outage.