As we prepare for the final phase of Exchange Web Services retirement, we are refining how EWSAllowedAppIDs setting (which you can use to define your EWS AppID allow list) will be applied. Our goal i...
Published Sep 04, 2026
Version 1.0
Blog Post
Make sure you don’t overlook the need to add your Dedicated Exchange Hybrid App into your EWSAllowedAppIDs list.
While reviewing our EWS usage reports in preparation for enabling EWS allow‑listing, we discovered that the Dedicated Exchange Hybrid App — the service principal Microsoft instructs hybrid organizations to deploy — is still actively using EWS for core coexistence features (free/busy, MailTips, availability lookups).
Microsoft’s documentation mentions transitioning hybrid features to Graph, but no Graph permission list, migration steps, or parity guidance has been published, and the Dedicated Hybrid App continues to rely on EWS in production environments.
If EWS is restricted without adding this AppID to your allow‑listing, hybrid coexistence will break.
Because this app is not labeled or named in a recognizable way in the Enterprise Applications list, I wanted to remind everyone: don’t forget to include it if you’re running a hybrid Exchange environment. 😊
If it's not labeled or Named, How do you find it in the Enterprise Application List?
How did you create the app— with script or HCW?
The Script creates an App called "ExchangeServerApp-<individualGUID>", you can find this in Enterprise Application List.
Otherwise go to your local Exchange Shell:
Get-AuthServer "EvoSts - *" | fl ApplicationIdentifier
An Entra search for this ApplicationIdentifier should show your used App.
The person I was replying to stated about not overlooking the 'Dedicated Exchange Hybrid App' I was referring to that comment. I am currently running a Hybrid Exchange environment, 1 Exchange SE OnPrem server connected to O365/Azure. I wasn't aware of a 'Dedicated Exchange Hybrid App' but even so, if it is hidden, how do we find it. When I have Powershell up and connected to Exchange Online and run "Get-AuthServer "EvoSts - *" | fl ApplicationIdentifier" it returns an error stating "couldn't be performed because object 'EvoSts - *' couldn't be found on..."
If I run just "Get-AuthServer "EvoSts" it will return info.
I have the list of EWS apps from the Exchange EWS usage page in Exchange Online and have them all in our 'EWSAllowedAppIDs' list, so far no screams from general population.
What am I missing?
have you added Graph permissions after setting up the hybrid app? You have to:
Update Your Exchange SE Hybrid On-premises Rich Coexistence to Graph | Microsoft Community Hub
I can NOT see my dedicated Hybrid App in the EWS usage Report. Still Graph & EWS Permission set in the App:
Sign In Logs for dedicated App showing only Graph Resource Access.
