As we prepare for the final phase of Exchange Web Services retirement, we are refining how EWSAllowedAppIDs setting (which you can use to define your EWS AppID allow list) will be applied. Our goal i...
Published Sep 04, 2026
Version 1.0
Blog Post
After successfully configuring EwsAllowedAppIDs and switching to EnforceAllowList, I noticed that Teams and Outlook calendar integration stopped working.
My current configuration is:
EwsEnabled : True
EwsAllowedAppIDs : <AppID1>,<AppID2>,<AppID3>,<AppID4>
EwsApplicationAccessPolicy : EnforceAllowList
EwsAllowList : {SkypeSpaces/, Teams/, MicrosoftNinja/, SchedulingService}
EwsBlockList :
The App IDs above represent the third-party applications in my environment that still require EWS access.
While the documentation does an excellent job covering how to identify and permit third-party applications, it is less clear which Microsoft services still require EWS access when moving to an allow-list model.
It would be helpful if Microsoft could provide additional guidance covering:
Microsoft-managed services that still depend on EWS
Recommended EwsAllowList entries for Microsoft 365 workloads
Requirements for Teams calendar integration
Requirements for Outlook calendar and scheduling functionality
Any known dependencies for Scheduling Assistant, Teams meeting scheduling, and related services
As organisations move to EnforceAllowList, understanding which Microsoft services require EWS exemptions will help avoid unexpected loss of functionality while still reducing the EWS attack surface.
Has Microsoft published, or does it plan to publish, a definitive list of Microsoft workloads and user-agent strings that should be permitted when implementing EWS allow-listing?
Greg Taylor - EXCHANGE
Microsoft
MicrosoftI STRONGLY encourage you and others to stop trying to do both user agent and appID based blocking at the same time in the first instance. User Agent blocking requires regex like syntax to do properly - Let's keep this simple. Stop blocking user agents to start with, set the EwsApplicationAccessPolicy back to Null. Get the AppID list right, as that's what matters for Oct, and then, once you have that working, invest some time in user agent blocking if you want to - but doing both these at the same time makes it much harder to get right, and troubleshoot. Not to mention that user agent based blocking is easily defeated - which is why we built AppID based blocking....
If you want to use user agent blocking and allow Teams calendar to work, I believe you need to use
Teams CalendarSkypeSpaces/1.0a$*+ but that's something the Teams team should be asked to confirm.
Thanks for your reply Greg. I am going to set the allow list back to null. I still have EWS Enabled set to True and an app ID list populated. So I should be ok for October. I had a misunderstabding with the EWS applcation access policy, it enabled while we were setting up the app IDs. Thanks for the correction.
- Greg Taylor - EXCHANGE
Great, and sorry if I came off strong there, didn't mean to. I'm glad you got it figured out and are working now - it's complex I know, and the naming of EWSAllowList for user agent based blocking is unfortunate I know. We're in this together, and we're here to help.