Apr 1, 2027 Phased switch-off: from Oct 2026

Exchange Online EWS is fully disabled from Apr 1, 2027 (phased switch-off from Oct 2026)

Microsoft says Exchange Web Services (EWS) in Exchange Online will be "fully and permanently disabled" starting April 1, 2027, with "no exceptions past April 2027." Before that, Microsoft is switching EWS off tenant by tenant from Oct 2026: tenants still on the default setting (Null) are changed to False, which blocks EWS for every app. Any app, script or service that still uses EWS needs to move to Microsoft Graph.

Who it's for: Microsoft 365 admins, and the people who look after a small business's Exchange Online mail, whose apps, scripts or services still use EWS.

Last updated Oct 22, 2026. Current dates: phased switch-off on (or soon after) Oct 1, 2026, tenant by tenant; full and permanent shutdown Apr 1, 2027. Microsoft updates its posts often, so re-check the sources.

The free read-only checks, sources and a checklist prompt are below.

Key dates

On (or soon after) Oct 1, 2026, phased, tenant by tenant
Microsoft says: "Any tenant with EWSEnabled still set to Null on October 1, 2026, will see the value changed to False as the deployment rolls out. That will block EWS for all applications in the tenant at that time." Microsoft controls when the change reaches each tenant.
Source: Microsoft Exchange Team Blog: Exchange Online EWS, Your Time is Almost Up
Apr 1, 2027
Final shutdown. Microsoft says: "Starting with April 1, 2027, EWS will be fully and permanently disabled" and "The ability to control EWSEnabled will be removed from tenant admins."
Sources: Microsoft Exchange Team Blog · Microsoft Learn: Deprecation of Exchange Web Services in Exchange Online ("April 2027: EWS is fully disabled.")

Microsoft Learn's timeline says: "October 2026: EWS starts to be disabled globally for all organizations."

Plain-English summary

EWS (Exchange Web Services) is an older interface that apps and scripts use to connect to Exchange. Microsoft is retiring it in Exchange Online and calls Microsoft Graph "the long-term strategic platform for most Exchange Online integration scenarios."

What your tenant sees now depends on its EWSEnabled setting. Microsoft says a tenant still on Null is changed to False as the rollout reaches it, which blocks all EWS. A tenant set to True keeps EWS only for apps on its AppID allow list (EWSAllowedAppIDs): Microsoft says that after enforcement begins, "setting EWSEnabled=True without an AppID allow list effectively becomes a block-all configuration."

If you find out you still need EWS after the change, Microsoft says an admin can re-enable it, "But note that there will be a service interruption in this case." Either way, everything stops on Apr 1, 2027. EWS on on-premises Exchange is not being retired.

Free steps, from Microsoft's posts

Review the EWS usage reports in the Microsoft 365 admin center to see which apps still call EWS. Microsoft also links scripts in "Notes From the Field: Finding and Remediating EWS App Usage Before Retirement".
Read your tenant's setting (read-only), in Exchange Online PowerShell: Get-OrganizationConfig | Format-List EWSEnabled. Microsoft says an empty value is the default (Null).
Read your current AppID allow list (read-only): Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs. Microsoft says the extra switch is required to return the list.
If Microsoft filled in the list for you, check it. Microsoft says an auto-populated list is based on "the previous 60 days of usage", so "it may miss applications that run infrequently, and it may include apps you no longer want to have access." A list you create yourself is not overwritten.
Sort every app into keep for now, move to Microsoft Graph, or retire. Microsoft's list of apps to keep can include its own clients: "This includes Microsoft first-party client apps such as Office, Power Query for Excel etc."
Before anyone changes the list, note Microsoft's warnings: setting the property "writes the full list value", so existing App IDs are replaced unless included, and "Changes to this list can take up to 24 hours to take effect." Make changes only under your own change control.
Ask each vendor whose app still uses EWS for its Graph date. Microsoft Learn says: "Work with your vendors to prioritize their migration from EWS."
Check Microsoft Learn's parity-gap roadmap. Microsoft says: "If an EWS capability isn't listed in this roadmap table, don't plan on a corresponding Microsoft Graph or Exchange Admin API capability being available before EWS is fully disabled."

Compare

What EWSEnabled does once the phased change reaches your tenant (Microsoft's tables)
EWSEnabled	Result
Null (default)	Changed to False during Microsoft's rollout, which blocks all EWS
True, AppID allow list has entries	Only apps on the list are allowed
True, list missing or empty	No EWS allowed (cross-tenant organization relationship traffic still works)
False	All EWS blocked
Any value, from Apr 1, 2027	EWS fully and permanently disabled

Your options
Option	Cost	What it does
Microsoft's posts and the steps on this page	Free	Official dates and read-only checks
EWS Cutover Kit	$39	Offline worksheets to classify apps and plan the allow list; does not change your tenant

FAQ

When is EWS turned off in Exchange Online?

Microsoft's Exchange Team says: "Starting with April 1, 2027, EWS will be fully and permanently disabled" and "There will be no exceptions past April 2027." Before that, a phased switch-off rolls out tenant by tenant from Oct 2026.

What happens to tenants that never changed the EWSEnabled setting?

Microsoft says any tenant with EWSEnabled still set to Null on October 1, 2026, will see the value changed to False as the deployment rolls out, which blocks EWS for all applications in the tenant at that time.

We still need EWS for an app. What are the options?

Microsoft lists two choices until the final shutdown: set EWSEnabled to True and maintain an AppID Allow List (EWSAllowedAppIDs), or set EWSEnabled back to Null with Exchange Online PowerShell, which re-enables EWS without restrictions until the final deprecation. Microsoft's recommended path is to configure or validate the AppID allow list and then set EWSEnabled to True.

Does EWSEnabled set to True still allow every app?

No, once enforcement reaches the tenant. Microsoft says that after enforcement begins, setting EWSEnabled=True without an AppID allow list effectively becomes a block-all configuration.

Is EWS being retired for on-premises Exchange?

No. Microsoft says EWS is not being retired on-prem. Hybrid scenarios vary: on-prem mailboxes may continue using EWS, while cloud mailboxes must move to Microsoft Graph.

Can we get an extension past April 2027?

Microsoft's FAQ answers: "There will be no exceptions past April 2027."

Sources

Microsoft Exchange Team Blog: Exchange Online EWS, Your Time is Almost Up (updated Sep 9, 2026)

Microsoft Exchange Team Blog: Introducing EWSAllowedAppIDs

Microsoft Exchange Team Blog: Take control of your EWSAllowedAppIDs list before EWS access changes (Sep 4, 2026)

Microsoft Learn: Deprecation of Exchange Web Services in Exchange Online

Microsoft Exchange Team Blog: The way to control EWS usage in Exchange Online is changing (EWSEnabled empty is the default)

Checked Oct 22, 2026. Microsoft updates these posts often; always check the Message Center posts for your own tenant.

Copy-paste prompt for any AI agent

My small business uses Microsoft 365 with Exchange Online. Microsoft's Exchange Team blog says EWS (Exchange Web Services) in Exchange Online is being switched off tenant by tenant from October 2026, that tenants with EWSEnabled still set to Null are changed to False (which blocks EWS for all apps), and that starting April 1, 2027, EWS will be fully and permanently disabled with no exceptions. Please help me check where we stand:
1. Make a checklist table of every app, script, add-in or service that might connect to our Exchange Online mail, calendars or contacts (name, who set it up, vendor contact, uses EWS yes/no/unknown, on our AppID allow list yes/no, plan: keep for now / move to Microsoft Graph / retire).
2. Tell me where to look: the EWS usage reports in the Microsoft 365 admin center, and the read-only commands Get-OrganizationConfig | Format-List EWSEnabled and Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs.
3. Give me a short message I can send each vendor asking whether their app still uses EWS and when it will use Microsoft Graph instead.
4. Remind me to read Microsoft's own posts and our Message Center for the current dates.
5. Set up reminders for January 15 and March 1, 2027. (These reminder dates are my choice, not Microsoft's.)
Do not change any settings and do not run any Set- commands. Do not ask me for passwords, tokens or App secrets, and do not log in to any account. Only list what I should check and I will decide.
When you state any deadline or date, quote the exact line from Microsoft's own pages that states it. If you cannot find that line, say "no deadline line found" instead of guessing.

Optional: an offline kit with the read-only checks (each linked to its Microsoft source), an app classification worksheet, an AppID allow-list planning sheet, an EWS-to-Graph migration map and a client notice template for MSPs. It does not change your tenant or connect to Microsoft 365; you run every check yourself.

Get the $39 EWS Cutover Kit on Gumroad

Not advice

General guidance, not legal, tax or IT advice. Check Microsoft's own posts and the Message Center for your tenant. No promise is made that any app will keep working or that a change will apply to your tenant on a given day; Microsoft controls the rollout. Microsoft, Microsoft 365, Exchange, Exchange Online and Microsoft Graph are trademarks of Microsoft, named only to describe what this page covers. First Mover Projects is independent and is not affiliated with, endorsed or sponsored by Microsoft.