The Final Countdown to Remove EWS from Exchange Online Begins
Microsoft announced the dates leading to the final retirement of Exchange Web Services from Exchange Online. If all goes well, the EWS retirement in the cloud will happen by May 2027. Challenges still exist. Microsoft must remove EWS from its own apps, including Outlook, and help tenants and ISVs make the leap to Graph APIs. Plans are in place and progress is being made, but will everyone be ready when Microsoft starts to remove EWS permanently from Exchange Online in April 2027? https://office365itpros.com/2026/02/06/ews-retirement-may-2027/Microsoft Previews userConfiguration Graph API
A new userConfiguration API is available to retrieve data from Folder Associated Items (FAIs) in Exchange mailboxes. The new Graph API is part of the EWS migration project and is intended to allow application developers to migrate EWS code that updates FAIs with Graph equivalents. Most Microsoft 365 tenants will never use this API, but it’s nice to know how things work. https://office365itpros.com/2026/02/05/userconfiguration-api-beta/Microsoft Delays Retirement of Basic Authentication for SMTP AUTH
Microsoft has delayed the retirement of basic authentication for the SMTP AUTH client submissions protocol to 2027 or beyond. New tenants will be the first to be blocked and Microsoft will disable basic authentication for SMTP AUTH in a way that existing tenants can reenable the protocol. Eventually, we’ll get a date for final retirement sometime in 2027. These things take time! https://office365itpros.com/2026/01/29/smtp-auth-basic-retirement/
M365 tenant emails marked as spam (SCL:5, CAT:PHISH) despite perfect authentication
Hello, Our business emails from our M365 tenant are consistently marked as spam when sent to other M365 tenants, despite perfect email authentication. Technical status: - SPF: Pass ✓ - DKIM: Pass ✓ (recently enabled) - DMARC: Pass ✓ (recently enabled) - Composite Authentication: Pass (reason=100) ✓ But messages are still marked as: - X-MS-Exchange-Organization-SCL: 5 - X-Forefront-Antispam-Report: CAT:PHISH;SFV:SPM We suspect a tenant reputation issue, possibly because the tenant ran for months without DKIM enabled. Now that all authentication is correct, how can we request a reputation review? Thank you!Using the Exchange Online Message Trace API
January 22 saw the announcement of the beta version of an Exchange Online Graph-based message trace API. The API can retrieve message trace records and their details and offers equivalent functionality to the message trace cmdlets in the Exchange Online management PowerShell module. However, sometimes applications simply want to access data without going through a module, and that’s what this API delivers. The article includes a complete PowerShell script to demonstrate how to use the API. https://office365itpros.com/2026/01/27/message-trace-api/
Teams calendar for exchange on prem users not working
Hello I am having issues to make Exchange On prem users use Calendar on teams. Initially Client autodiscover was blocked externally but they added a cname and open flows but I am still having issues to makecalendar on teams work HCW as passed and new hybrid dedicated app was used any help is welcomeFeedback to users who report phishing
Hi, is it possible to create a power automate flow to find submissions from users and as soon as MS has added a verdict to a submission as real phish send a notification back to the user who has reported it? Trying to figure out what is needed for such integration and build a flow but I am stuck. Anyone who has built that and like to share learning?
Keep user account but provision new empty mailbox
i did ask in another forum but thought i would ask here as it seems impossible... we are hybrid exchange. We have litigation hold and purview retention policies in place. We have a scenario where an existing user is moving to a new role and her existing mailbox needs to be dissociated from her AD account and a new clean mailbox provisioned. The original mailbox needs to stay as inactive and searchable via ediscovery. Is it possible? I have asked AI and its said: Make sure all the holds and retention policies are in place Move the AD account to a non-syncing OU and run a delta sync The mailbox should show as inactive in exchange online Then it tells me to run Set-User <UserUPN> -PermanentlyClearPreviousMailboxInfo but ONLY if the recipient type shows as MailUser or User This is where i am stuck as it is still UserMailbox. It told me to restore the cloud only object which i did. But it still shows as RecipientType = UserMailbox when i check. Its now just a cloud only account, it has no license. The mailbox is inactive but its still a UserMailbox Is what i am trying to do possible? Would now just changing the cloud only account to have a new email address be the only way to retain it and then sync back the on-prem account?Modern Auth EWS error 50199 when signing from Crestron Touchpanels
Good Afternoon, All I am having a difficult time nailing down this issue. I have a few Crestron TTS-770s that were, up to last week, working correctly by pulling Calendars data with EWS. They were configured with a service account signed into EWS using 'modern authentication'. This week, these panels have disconnected and report that 'Needs to be authorized' as the EWS status. I have verified that CA is not blocking sign in, the account is excluded from MFA policies, and is correctly licensed for Exchange Access. We do not use Intune for device management. When I attempt to re-register the device, I follow the prompts until I am prompted to close the browser window; The device spins, then fails to connect with the status above. I have attempted this with the service account and my own Admin account with MFA, to the same result. Entra Enterprise Apps Sign-in logs show a 'Successful' entry, then immediately after, a 'Failed' entry with an error '50199'. I had not made changes to any of the URIs before initial failure, and any additional entries or changes do not change the results of the error. Initial URI was configured to 'https://app.noop' (no idea, was configured before I got here, and I hadn't needed to change it), I have attempted combinations of our Tenant URI, ' https://login.microsoftonline.com/common/oauth2/nativeclient', and other 'fixes' I had found while GTS-ing. I additionally have set my 'legacy authentication' and 'legacy applications' CA polices to read-only for troubleshooting. I am working to disable OAuth2ClientProfile on Exchange Online temporarily for troubleshooting. Does anyone have any ideas? Please let me know if any additional information is needed, or if needed to post in another location. Thank You
