Forum Discussion
Microsoft Blocks EWS Access for Kiosk Users
A December 2 announcement says that Exchange Online will block access to Exchange Web Services for users with kiosk or frontline worker licenses from March 2026. In fact, the Exchange Online service description has always excluded EWS access for these licenses, but the necessary code to enforce the exclusion was never implemented. It will be in March. Time to check licenses…
https://office365itpros.com/2025/12/05/exchange-web-services-kiosk/
1 Reply
The March 2026 date no longer holds. MC1191578 was last updated on 10 June 2026 and now sets enforcement at 1 October 2026.
Worth separating from the start, because the two changes landing on that same date get conflated constantly:
MC1191578, the licence enforcement. Scoped to Exchange Online Kiosk, F1 and F3 only. Requests without a suitable licence return HTTP 403. The only remedy Microsoft names is reassigning a licence that carries EWS rights, so Exchange Online Plan 1/2 or E3/E5.
MC1227454, the retirement itself. Published 5 February 2026, so after this post. It is tenant-wide and not licence-scoped at all. EWSEnabled flips to False on 1 October 2026 unless the tenant configures an AppID AllowList and sets EWSEnabled=True, and that has to be done before the end of August 2026. Full retirement follows on 1 April 2027 with no re-enablement.
The trap I would flag for anyone reading this in a hurry: the AllowList is the lever for the retirement, not for the licence block. An admin who configures it and assumes their F3 kiosk application is covered still gets the 403. Different change, different fix, same date.
