Exchange Web Services (EWS) is being shut down in Exchange Online. Microsoft began phasing it out on October 1, 2026, and will switch it off permanently on April 1, 2027 (MC1227454). Any app, script or device that still reads mail or calendars through EWS will stop working unless an admin acts.
EWS arrived with Exchange Server 2007 and powered third-party integrations, custom scripts and multifunction printer workflows (Petri). Microsoft stopped adding features to it in 2018 and pointed developers to Microsoft Graph (MC676299). The retirement covers Exchange Online only. EWS in on-premises Exchange Server is unchanged (MC676299).
The scope has also widened since the 2023 announcement. After the January 2024 Midnight Blizzard incident, which involved EWS, Microsoft extended the effort to its own applications and is removing EWS dependencies from products such as Outlook, Office, Teams and Dynamics 365 (Microsoft Learn).
Timeline
The phased shutdown is already under way, and the final cutoff is April 1, 2027 with no extension. Microsoft’s schedule (MC1227454), supplemented by one consultancy’s reading of the September step (ITECS), runs as follows.
When
What happens
Before October 2026
Temporary “scream tests” may break EWS briefly to surface hidden dependencies. Tenants needing EWS past October were told to set up an AppID allow list and EWSEnabled=True by the end of August 2026.
September 2026
Microsoft said it would fill allow lists from observed usage where admins had not (per ITECS). The tenant admin still owns the result.
October 1, 2026
Phased, tenant-by-tenant disablement begins. EWS is blocked unless the tenant has an AppID allow list and EWSEnabled=True. Untouched tenants are set to EWSEnabled=False, and admins can re-enable it if needed.
April 1, 2027
EWS is permanently removed from Exchange Online. No setting can bring it back.
Who is affected
Anything that reaches Exchange Online mailboxes through EWS and is not a Microsoft client is at risk. Microsoft names custom and vendor applications that handle mail, calendar or other integrations (MC1227454).
The failures are often silent. Exchange Online stays healthy while a dependent job simply stops, so the first symptom may be a backup that no longer captures new items, an incomplete archive search, or a scheduling tool that stops creating appointments (ITECS). Common hiding places:
Backup, archiving and eDiscovery connectors, including archive mailbox access (HandsOnTek)
Public-folder workflows and shared queues
Exchange hybrid features that call from on-premises servers into cloud mailboxes
Line-of-business apps such as CRM, ticketing, room booking and scanners
Old scripts and service accounts that no one owns anymore
Free/busy and calendar sharing
Yes, with limits: free/busy, MailTips and calendar sharing with other organizations currently rely on EWS and have to move, while sharing inside your own tenant is unaffected (Petri). What breaks depends on your setup.
Scenario
Impact
Replacement
Exchange Online to another Microsoft 365 tenant (organization relationships, sharing policies)
Partners may stop seeing your free/busy, MailTips and shared calendars once EWS disablement reaches your tenant
Microsoft 365 Cross-Tenant Access Policy
Exchange hybrid (on-premises and Exchange Online)
Rich coexistence features such as free/busy, MailTips and profile photos have run over EWS
Dedicated hybrid app using Graph, plus Exchange Server SE with the May 2026 hotfix update
Exchange Online sharing with another organization’s on-premises Exchange
Not yet covered by the Microsoft 365 cross-tenant migration
Microsoft says to watch Message Center for guidance
Sharing inside one tenant
Not affected
None
For the cross-tenant case, Microsoft’s rollout of the replacement was set to finish by September 15, 2026 for free/busy and MailTips and by October 30, 2026 for calendar sharing, with government clouds paused as of October 20 (MC1446796). To see whether you are in scope, run Get-OrganizationRelationship and Get-SharingPolicy in Exchange Online PowerShell. You are affected if an enabled relationship or policy shares free/busy or MailTips with a partner hosted in Microsoft 365. Calendars published by URL to anonymous recipients also show up in the sharing policy output (MC1446796). Microsoft’s migration guide walks through setting up the new policies and removing the old configuration.
If you are not ready, keeping EWSEnabled set to True preserves the old sharing until the April 1, 2027 shutdown (MC1446796).
Hybrid organizations follow a separate path. Exchange Online uses EWS to fetch free/busy, MailTips and photos for on-premises mailboxes, and Microsoft’s dedicated hybrid app moves those calls to Graph (Microsoft 365 for IT Pros). Exchange Server SE’s May 2026 hotfix update adds Graph support for free/busy and profile pictures, and for MailTips partially (Microsoft Support). On-premises mailboxes that interact with Exchange Online mailboxes need to be hosted on Exchange SE (Microsoft 365 for IT Pros).
Find your EWS usage
Start with the usage report in the Microsoft 365 admin center under Reports > Usage > Exchange > EWS usage (MC1227454). It lists application IDs, the operations they call, call volume and last activity, over 7, 30 or 90 days aggregated weekly (ITECS). Microsoft also publishes a usage reporting script, an EWS Analyzer for code, and a tutorial on AI-assisted refactoring (Microsoft Learn).
The report can miss rare callers. A quarterly job, a year-end archive run or a disaster-recovery tool may not appear in a 90-day window, so cross-check against Entra app registrations, sign-in logs, scheduled tasks and vendor consoles. If an app has already stopped working, Microsoft has published a troubleshooting post for exactly that case (Exchange Team blog).
Migrating to Microsoft Graph
Microsoft Graph is the designated replacement, and many EWS operations already have direct Graph equivalents (Microsoft Learn). Microsoft advises starting now rather than waiting for every gap to close. Some scenarios still lack parity, so check each integration against the roadmap before assuming a clean port.
Targeted for Q4 2026: full-fidelity import and export for archive, public-folder and Microsoft 365 Group mailboxes, plus In-Place Archive access, user configuration objects and a few smaller operations. These dates are estimates and may move.
Not coming to Graph: generic public-folder create/read/update/delete, generic Microsoft 365 Group mailbox access, and legacy Discovery Mailbox access. Microsoft points to Purview eDiscovery APIs for discovery work.
Anything not on the roadmap: Microsoft says not to plan on a Graph or Exchange Admin API equivalent before EWS is fully disabled.
Treat the move as a security change as well as an API change. Graph uses a per-workload permission model, so build each new grant from what the app actually needs instead of copying broad legacy EWS access (ITECS). For vendor products, ask for a written, version-specific statement of which mailbox types (shared, archive, public folder) the Graph-based release covers.
Admin checklist
With the phased disablement already running, the first job is to learn what your tenant looks like today, then work down this list.
☐ Check your tenant’s current EWSEnabled value and who last changed it
☐ Export the EWS usage report (90 days) and record every application ID
☐ Cross-check against Entra app registrations, sign-in logs, scripts and scheduled jobs
☐ Assign a business owner and technical owner to each dependency
☐ Get a written, version-specific Graph migration answer from each vendor
☐ Run Get-OrganizationRelationship and Get-SharingPolicy to find cross-tenant free/busy, MailTips and calendar sharing, then plan the Cross-Tenant Access Policy move
☐ For hybrid, confirm the dedicated hybrid app and Exchange SE hotfix level cover free/busy and MailTips
☐ Compare each workflow with Microsoft’s parity roadmap and flag gaps early
☐ Allow EWS only for approved app IDs, with an expiry date well before April 1, 2027
☐ Pilot each migrated workflow, including restores for backup and archive tools
☐ Remove old EWS permissions, secrets and service accounts once proven
☐ Re-run the usage report until it shows only approved temporary traffic, then none
Bottom line
An allow list only buys time: April 1, 2027 is a hard stop, and Microsoft’s guidance is to migrate to Graph rather than extend. The safest approach is to find every dependency now, migrate what Graph supports, and plan alternatives for the gaps while there is still room to test.
Sources
Facts here were checked against these pages, and the third-party ones are noted as such. Details such as the Q4 2026 parity dates are Microsoft’s estimates and may change.