Apple Mail EWS sync intermittent after EwsEnabled=True + AppID allow list
We're a small Microsoft 365 Business tenant (Exchange Online Plan 1/2 mix). One user's Apple Mail (macOS, Exchange/EWS account) intermittently stops syncing new mail — Connection Doctor shows a healthy green "Connection and login to server succeeded," but Get New Mail/manual fetch and forced Sync All Accounts return nothing new, while the same mail is already present via ActiveSync on the same user's iPhone/iPad. Symptoms recur every 1–3 days after temporarily resolving. Troubleshooting completed so far: - Confirmed autodiscover/External URL correctly resolves to outlook.office365.com/EWS/Exchange.asmx - Confirmed EWS enabled at the mailbox level (Manage email apps in admin center) - Found EwsEnabled was blank/null at the org level — set to $true via Set-OrganizationConfig - Configured EwsAllowedAppIDs to include Apple's app ID (f8d98a96-0999-43f5-8af3-69971c7bb423, "Apple Internet Accounts") - Fully removed and re-added the Mac Mail account after the above org-level change - Restarted the Mac, tried DNS changes (8.8.8.8/8.8.4.4), ruled out router-level filtering - Verified no antivirus/VPN/security software on this Mac's network Despite all this, the issue persists intermittently. Notably, a second mailbox on the same tenant, used with Apple Mail on a different Mac (different macOS version, different physical location/network), does NOT experience this issue — so it doesn't appear to be a blanket tenant-wide EWS disruption. Given Apple Mail's continued reliance on EWS ahead of the October 2026 phased disablement, and Microsoft's acknowledgment that Apple Mail for Mac is a heavy EWS consumer they're working with Apple to migrate to Graph, I'm wondering: 1. Could this be related to the ongoing "scream test" EWS disruption testing Microsoft has mentioned, and if so, is there a way to check whether a specific mailbox has been included in that testing? 2. Any known differences in EWS session/connection handling between macOS versions that could explain one Mac being affected and not the other? 3. Anything else worth checking tenant-side (throttling policies, CAS mailbox settings, conditional access rules) that could apply per-mailbox rather than tenant-wide? Happy to provide EWS usage report data or run any diagnostic commands if it helps others hitting the same thing before October.
account only remote wipe device
Hello, My o365 account is E3. My phone is android, I installed outlook on my phone. I tested to wipe the outlook on my phone with my admin account, but after I click the "account only remote wip1e device", it showed "Saving in progress", then showed a red "X". The client is Outlook for iOS and Android, client type is outlook not EAS. Do I need more steps to wipe outlook on my phone? or a role/permission is missed? Thanks and regards, AdsnowReference Architecture for an On-Premises AI Assistant for Microsoft Exchange.
Bringing Secure AI Capabilities to On-Premises Microsoft Exchange Many organisations continue to operate Microsoft Exchange within their own data centres because of regulatory requirements, data-residency policies, security considerations, operational dependencies, or the need to maintain complete control over sensitive email information. At the same time, users increasingly expect Artificial Intelligence to help them manage growing email volumes, understand long conversation threads, locate information quickly, analyse attachments, and prepare relevant responses. This creates an important question: Can organisations introduce AI-assisted email capabilities without migrating their on-premises Exchange environment or sending email data to public AI services? With the right architecture, the answer is yes. The opportunity for AI in on-premises Exchange Users spend a significant amount of time reading lengthy email chains, searching for previous discussions, identifying action items, reviewing attachments, and preparing responses. An AI-powered email assistant can help reduce this effort while continuing to operate within the organisation’s controlled infrastructure. Such a solution can be integrated with Microsoft Exchange through an Outlook Web App, or OWA, Add-In. The Add-In provides AI-assisted capabilities within the familiar Outlook Web interface and can be centrally deployed to selected users or Active Directory groups by the Exchange administrator. The purpose is not to replace Exchange or change the way emails are managed. Instead, it introduces an intelligence layer that helps authorised users interact more efficiently with the email information they are already permitted to access. Key capabilities of an AI-powered Exchange Email Assistant 1. Email and conversation summarisation The assistant can summarise an individual email or an entire conversation thread. Instead of reading every message in a long chain, the user can receive a structured summary covering: The purpose of the conversation. Important decisions and commitments. Key action items. Deadlines and pending responses. Relevant information available in attachments. The summarisation process can consider both incoming and sent messages so that the complete context of the conversation is preserved. 2. Contextual draft reply generation The assistant can prepare a suggested response based on the complete email thread and the user’s instructions. Users may select an appropriate tone, such as: Formal. Neutral. Technical. The generated response is placed in the user’s Exchange Draft folder or displayed for review within the OWA Add-In. A critical control is that the AI assistant does not independently send the email. The user remains responsible for reviewing, editing, approving, and sending the response. This human-review approach helps organisations adopt AI while retaining accountability over external and internal communications. 3. Natural-language mailbox search Traditional mailbox search generally depends on exact keywords, sender names, subjects, or date filters. An AI-enabled search experience allows users to search their mailbox using natural-language questions, such as: “Find emails received last month regarding the infrastructure renewal.” “Show unread emails from the finance team that require my approval.” “Find the discussion where the customer confirmed the delivery date.” “Summarise emails from a particular sender concerning the purchase order.” The solution can combine semantic search with traditional keyword-based search to improve the relevance of results. Users can also apply filters such as sender, subject, date range, read or unread status, and conversation thread. 4. Attachment analysis and OCR Important information is often contained within email attachments rather than the email body itself. An on-premises AI assistant can process supported documents, including: PDF files. Microsoft Word documents. Microsoft Excel files. Scanned documents. Image-based attachments. Optical Character Recognition, or OCR, can be used to extract information from scanned or image-based documents. The extracted content can then support email summarisation, contextual draft generation, and mailbox search. For example, a user may ask the assistant to prepare a response based on the commercial terms or delivery date mentioned in an attached document. Maintaining strict mailbox privacy Mailbox privacy is one of the most important architectural considerations for an enterprise AI email assistant. Each user must only be able to access and process emails from their own authorised mailbox. Information retrieved from one user’s mailbox must never become available to another user. This isolation should be enforced across every layer of the solution, including: User authentication. Exchange access tokens. Application sessions. Search indexes. Vector embeddings. AI prompts and responses. Cache and temporary data. Audit logs. The backend should validate the authenticated user and verify mailbox ownership for every request made to Exchange. Where vector search is used, mailbox data should be stored in user-isolated collections, partitions, or namespaces. This helps prevent cross-user retrieval at the data layer rather than relying only on controls within the user interface. Operating without public cloud AI services For organisations with strict security or data-sovereignty requirements, the AI models and supporting components can be deployed within the customer’s infrastructure. A fully on-premises architecture may include: A locally hosted Large Language Model. An on-premises embedding model. A re-ranking model. A vector database. A keyword-search engine. A backend API layer. An OCR or document-intelligence service. A secured OWA Add-In. Integration with Active Directory. Audit, monitoring, and administrative controls. The entire solution can operate within an internal network without sending email content, attachments, prompts, or generated responses to public AI platforms. This model can also support air-gapped environments where internet access is either restricted or completely unavailable. Centralised deployment and administration The OWA Add-In can be deployed centrally through Exchange administration controls. Administrators can assign the Add-In only to selected users or security groups. Employees who are not assigned the solution will not see the AI assistant within their Outlook Web interface. Administrative controls may include: User and group assignment. Enabling or disabling individual AI features. Summarisation-only mode. Draft-generation controls. Attachment-size restrictions. Session and retention policies. Model and performance settings. Usage monitoring. Audit logs. Resource utilisation monitoring. These controls allow organisations to begin with a limited group of users and gradually extend the solution after validating performance, security, and user adoption. Security and governance considerations Introducing AI into an enterprise email environment requires more than deploying a language model. The complete solution should be designed around security, privacy, governance, and responsible AI principles. Important considerations include: Authentication and authorisation The solution should integrate with the organisation’s existing identity infrastructure, such as Active Directory, and enforce role-based access controls. Encryption Email content, attachments, indexes, logs, and other sensitive information should be encrypted both in transit and at rest. Data retention Organisations should clearly define whether AI prompts, generated summaries, and draft content are retained. In privacy-sensitive environments, generated content may remain available only for the active session and should not be permanently stored by the AI application. Auditability The system should record relevant operational events, such as the user identity, requested function, timestamp, and processing status. Depending on the organisation’s policy, the actual email or generated response content may be excluded from audit logs. Human oversight AI-generated responses should be treated as suggestions. The user must review and approve them before sending. The assistant should also disclose its limitations and avoid presenting uncertain outputs as confirmed facts. Performance and capacity On-premises AI processing depends on available compute, memory, storage, and GPU resources. The architecture should account for: Number of concurrent users. Average mailbox size. Volume and size of attachments. Expected response time. Model size. Search-index growth. OCR processing requirements. High availability and backup requirements. A practical adoption approach Organisations do not need to introduce all capabilities at once. A controlled proof of concept can begin with a limited number of users and a defined set of features. A practical implementation sequence may include: Phase 1: Email summarisation Start with individual email and conversation-thread summaries. This provides immediate value while keeping the initial architecture relatively focused. Phase 2: Contextual draft replies Introduce draft generation with mandatory user review and clearly defined tone controls. Phase 3: Attachment processing Enable OCR and document parsing for supported attachments. Phase 4: Intelligent mailbox search Index authorised mailbox content and introduce natural-language search with strict per-user isolation. Phase 5: Wider deployment After security testing, performance validation, and user feedback, extend the solution to additional departments or user groups. Conclusion Organisations operating on-premises Microsoft Exchange do not necessarily need to choose between maintaining control over their email environment and adopting AI-assisted productivity capabilities. A carefully designed on-premises AI email assistant can support email summarisation, contextual draft preparation, attachment analysis, and natural-language mailbox search while keeping sensitive information within the organisation’s infrastructure. The most important success factors are not limited to the AI model itself. Identity controls, mailbox isolation, human approval, auditing, infrastructure sizing, and data-governance policies are equally important. For organisations evaluating private, sovereign, or air-gapped AI, on-premises Exchange can become an effective starting point for introducing practical AI capabilities in a secure and controlled manner. Connect with us to implement this solution in your organization. About the Author Vinay Prakash is the CEO of Glorious Insight and an Ex Microsoft Employee. He works with organisations on Data, Artificial Intelligence, Microsoft cloud technologies, enterprise applications, and secure on-premises AI solutions. For technical discussions related to private or on-premises AI adoption, he can be reached at: Email: email address removed for privacy reasonsUnauthorized: You don't have permission to access this page or perform this action
I frequently encounter an 'Unauthorized' error when attempting to manage Distribution Lists in the Exchange Admin Center, even while logged in with Global Administrator or Exchange Online Administrator privileges. Is this a known widespread issue, or is it specific to the configuration of these individual tenants?The Demise of the OWA Light Client
On July 8, Microsoft said that they will retire the OWA Light client for Exchange Server in August 2026. But what happened to the OWA Light client for Exchange Online? It seems like Microsoft announced the retirement of OWA Light for Exchange Online in June 2024, but didn’t really make the fact clear in a blog post about consumer accounts. In any case, you can’t run OWA Light for Exchange Online, even if you wanted to. https://office365itpros.com/2026/07/17/owa-light-retirement/
How to resolve Junk email validation error
I'm attempting to add an email address to all users mailboxes using Set-mailboxJunkEmailConfiguration. The command fails and returns an email address as the error (see below). I've dumped the three lists contained in the record and the address displayed in the error isn't in any of them. The lists are TrustedSendersAndDomains, TrustedRecipientsAndDomains, and BlockedSendersAndDomains. The command I'm running is: set-mailboxjunkemailconfiguration -identity email address removed for privacy reasons -TrustedSendersAndDomains @{Remove="email address removed for privacy reasons"} The error returns: Set-MailboxJunkEmailConfiguration: |Microsoft.Exchange.Data.Storage.JunkEmailValidationException|Junk email validation error. Value: mailto:email address removed for privacy reasons. Note: all email addresses have been changed. The error happens on a handful of accounts and the value is unique to each user. This error happens on approx. 20 of 5100 mailboxes. Any ideas?Cross-Tenant Message Recall and Duplicate DDG Detection Enhance Exchange Online Messaging
Last week, the Exchange development team announced two interesting developments. Stopping duplicate dynamic distribution groups and cross-tenant message recall. Preventing tenants from creating duplicate DDLs saves service resources and might make tenants easier to manage. The real value is in cross-tenant message recall, which solves a problem by allowing users to recall messages delivered outside their tenant. The facility only works if the receiving tenant allows, but nothing can be done for messages delivered outside Microsoft 365. https://office365itpros.com/2026/07/15/cross-tenant-message-recall/How to Check Distribution Lists for Activity Over the Last 90 Days
The new Get-MessageTraceV2 cmdlet can fetch 90 days of message trace data, which means that we can check for inactive distribution lists using data for the last 90 days instead of being constrained to the last 10 days. This is done by running fetches for nine batches of traffic, each covering ten days. Distribution lists are still important to Exchange Online and Microsoft 365, and it’s good to know which distribution lists are in active use (and how much traffic they get) and which are not. All done with PowerShell. https://office365itpros.com/2026/07/09/inactive-distribution-list-2026/HVE for Microsoft 365: When to Use It, When Not To, and Who Should Be Allowed to Send at Scale
Microsoft recently announced the General Availability of High Volume Email for Microsoft 365, also known as HVE, in Exchange Online. This is an important and long-awaited capability for organizations that need to send large volumes of internal email from applications, devices, or line-of-business systems without using regular user mailboxes as bulk-sending engines. But HVE should not be misunderstood. It does not mean that every mailbox in Exchange Online should now be used for mass email. It does not mean Exchange Online has become a general-purpose marketing platform. And it does not remove the need for proper outbound email governance. Why HVE Matters For years, many organizations have used regular Exchange Online mailboxes, shared mailboxes, or service accounts to send automated messages from applications, scanners, monitoring platforms, ticketing platforms, and custom business applications. That approach creates several problems. Standard mailboxes are designed for human and business communication, not for sustained high-volume automated traffic. Exchange Online has recipient limits, message rate limits, outbound spam protections, and tenant-level controls to protect the service and reduce abuse. HVE introduces a more appropriate model for specific high-volume scenarios. Instead of using a normal mailbox for automated traffic, organizations can create dedicated HVE accounts and use specific SMTP endpoints, admin controls, reporting, and governance for approved high-volume internal messaging scenarios. What HVE Is Designed For HVE is designed for automated, operational, and transactional messaging at scale, primarily for internal recipients within the tenant. Examples include: Internal application notifications. Line-of-business system messages. Device-generated messages. Operational alerts. Security advisories. Internal workflow communications. Monitoring platform alerts. IT service notifications. Large-scale internal announcements generated by systems. This is especially relevant when the organization needs to send messages at scale but still wants to keep the workload within Microsoft 365 governance and Exchange Online mail flow. In practical terms, HVE is useful when the sender is not a human user, but a controlled business system. What HVE Is Not HVE is not a replacement for marketing platforms. HVE is not a general-purpose internet bulk email engine. HVE is not a way to bypass Exchange Online sending limits for external campaigns. HVE is not the correct platform for newsletters, promotional campaigns, large-scale customer communication, or high-volume external transactional email. For external transactional, marketing, or customer-facing bulk email, organizations should evaluate platforms designed for that purpose, such as Azure Communication Services Email, SendGrid, Amazon SES, Mailchimp, Brevo, or another specialized delivery platform. When to Use HVE Use HVE when the workload matches these characteristics: The sender is an application, device, service, or business system. The recipients are primarily internal users in the Microsoft 365 tenant. The volume is higher than what should be sent from a standard mailbox. The workload is operational, automated, or transactional. The organization needs centralized Microsoft 365 administration and reporting. The organization wants to avoid impacting user mailbox sending limits. The use case is approved, documented, monitored, and governed. Good examples: A security platform sending internal security advisories. A monitoring system sending infrastructure alerts to internal teams. A business workflow system sending high-volume approval or status notifications. An IT service platform sending internal notifications. A service management platform sending ticket updates to internal users. A device management system sending operational messages to internal teams. When Not to Use HVE Do not use HVE when the workload is external bulk email. Avoid HVE for: Marketing campaigns. Newsletters to customers. Promotional email. Mass external invitations. External transactional email at scale. Customer invoices and receipts in high volume. OTP or password reset flows for external users. External portal notifications. Any workload where deliverability, bounce handling, reputation management, unsubscribe handling, analytics, or customer consent management are required. Those workloads require a platform designed for external delivery, reputation management, suppression lists, opt-out, tracking, bounce handling, and compliance. Who Should Be Allowed to Use HVE HVE should not be enabled casually for every team or every application. It should be treated as a controlled platform capability. Recommended eligible senders: Approved line-of-business applications. Corporate systems owned by IT, Security, Operations, Facilities, or Service Management teams. Managed devices or services with a clear business purpose. Internal platforms that send operational messages to employees. Applications with documented ownership, authentication, monitoring, and expected volume. Recommended non-eligible senders: Normal users. Shared mailboxes used by humans. Marketing teams sending to external audiences. Unmanaged scripts. Legacy systems with no owner. Applications with unknown volume. Systems that send to external recipients at scale. Any application using HVE just to avoid standard mailbox limits. The core principle is simple: HVE should be enabled for workloads, not for convenience. Governance Model Before enabling HVE, organizations should define a governance model. At minimum, each HVE account should have: A named business owner. A technical owner. A documented purpose. Expected daily and monthly volume. Recipient scope. Authentication method. Monitoring process. Incident response path. Decommissioning criteria. Review frequency. HVE accounts should not become invisible service accounts that nobody owns. They should be treated as privileged communication identities. Security and Authentication HVE supports OAuth authentication, and Microsoft provides guidance for restricting OAuth authentication to specific Microsoft Entra ID applications. This is important because organizations should avoid broad, uncontrolled access. They should restrict which applications can send through each HVE account, monitor usage, and separate workloads by purpose. For example: One HVE account for security alerts. One HVE account for monitoring systems. One HVE account for IT service notifications. One HVE account for internal operational communications. This separation improves visibility, investigation, accountability, and risk containment. HVE vs Standard Exchange Online Mailboxes A standard Exchange Online mailbox should be used for normal human communication. A shared mailbox should be used for collaborative business processes. An HVE account should be used for approved high-volume internal system email. A dedicated external delivery platform should be used for marketing, bulk external communication, or high-volume transactional email. Scenario Recommended Platform Human business email Exchange Online mailbox Team or department mailbox Shared mailbox Low-volume application notifications Standard Exchange Online, if approved High-volume internal system notifications HVE Internal operational alerts at scale HVE Marketing campaigns Marketing platform External transactional email Transactional email service Customer newsletters Marketing automation platform OTP/password reset for external users Dedicated transactional platform External bulk email Dedicated bulk email provider HVE and the Mailbox External Recipient Rate Limit Cancellation Microsoft also announced that the Mailbox External Recipient Rate Limit in Exchange Online was cancelled indefinitely. However, that cancellation should not be interpreted as permission to use Exchange Online for uncontrolled bulk sending. Microsoft was clear that other limits remain unchanged, including the existing Recipient Rate Limit and the Tenant-level External Recipient Rate Limit. That distinction is important. The cancellation of one mailbox-level external recipient limit does not remove the need for proper architecture. Exchange Online still has service limits. Outbound spam controls still apply. Tenant-level protections still matter. And HVE is still not a marketing engine. Practical Architecture Decision Before enabling HVE, ask these questions: Who is sending? Is the sender a human, shared mailbox, application, or device? Who are the recipients? Are they internal or external? What is the expected volume? Is the workload operational, transactional, promotional, or human communication? Does the business need Microsoft 365 mail flow and governance? Does the use case require bounce handling, unsubscribe, tracking, or reputation management? Is the application properly authenticated and monitored? Who owns the account? Who approves the sending pattern? Who responds if the account is abused? If the workload is internal, automated, high-volume, and business-approved, HVE may be the right answer. If the workload is external, promotional, customer-facing, or marketing-driven, use a dedicated email delivery platform. Recommended Enablement Approach Organizations should enable HVE in phases. First, identify existing systems currently using user mailboxes, shared mailboxes, or SMTP AUTH for automated sending. Second, classify each workload as internal, external, operational, transactional, marketing, or human communication. Third, migrate only approved internal high-volume workloads to HVE. Fourth, move external high-volume workloads to dedicated email delivery platforms. Fifth, monitor usage and review HVE accounts regularly. This avoids turning HVE into another uncontrolled sending layer. Conclusion High Volume Email for Microsoft 365 is an important addition to Exchange Online. It gives organizations a native way to support high-volume internal system messaging without using standard mailboxes for automated high-volume traffic. But HVE is not a free pass for bulk email. It is not a marketing platform. It is not a replacement for transactional email services. And it should not be enabled for every mailbox or every application. The right approach is workload classification. Use Exchange Online for corporate communication. Use HVE for approved high-volume internal system messaging. Use dedicated platforms for external bulk, marketing, and transactional email. The question is not only: “Can this system send email through Microsoft 365?” The better architectural question is: “What type of email is this, who is the audience, and what is the correct platform for this workload?” That is where proper email architecture begins.
