Microsoft Blocks EWS Access for Kiosk Users

The March 2026 date no longer holds. MC1191578 was last updated on 10 June 2026 and now sets enforcement at 1 October 2026.

Worth separating from the start, because the two changes landing on that same date get conflated constantly:

MC1191578, the licence enforcement. Scoped to Exchange Online Kiosk, F1 and F3 only. Requests without a suitable licence return HTTP 403. The only remedy Microsoft names is reassigning a licence that carries EWS rights, so Exchange Online Plan 1/2 or E3/E5.

MC1227454, the retirement itself. Published 5 February 2026, so after this post. It is tenant-wide and not licence-scoped at all. EWSEnabled flips to False on 1 October 2026 unless the tenant configures an AppID AllowList and sets EWSEnabled=True, and that has to be done before the end of August 2026. Full retirement follows on 1 April 2027 with no re-enablement.

The trap I would flag for anyone reading this in a hurry: the AllowList is the lever for the retirement, not for the licence block. An admin who configures it and assumes their F3 kiosk application is covered still gets the 403. Different change, different fix, same date.