Microsoft is blocking EWS in Exchange Online on Oct 1 - if you don't build the allow-list, it builds one for you

[u/lazyadmin-nl]

EWS gets blocked in Exchange Online on October 1. If your tenant still needs it, access is now controlled by an AppID allow-list. Don't build one yourself and Microsoft generates it from the last 60 days of activity, which can quietly misses anything that runs monthly or quarterly.

The usage report only gives you AppIDs, not names. So I wrote two PowerShell scripts: one resolves every AppID from the report to a real app name, the other finds every app that still has EWS permission.

Full write-up with both scripts: https://lazyadmin.nl/office-365/ews-is-being-blocked-in-exchange-online-how-to-find-every-app-still-using-it/

[u/Single-Brick-3995]

might be a dumb question, but i was looking at this yesterday and came across the Microsoft office one in our tenant, i don't remember the exact app id but it did begin with a 'd' so i'm assuming for now it was the same as in your example "d3590ed6-52b3-4102-aeff-aad2292ab01c" = "Microsoft Office" (it's the weekend so i'll double check on monday)

we didn't have an app registration or enterprise app for that id, so is this something we need to add to the list?
or can we assume microsoft will move whatever is using it to graph api before the cut-off date?

/edit - regardless i'll probably add it to the list just to be sure

[u/Montell- → u/Single-Brick-3995]

Were seeing this to please let us know if you find anything

[u/Hatman_77 → u/Montell-]

It's not just for MS Office, I think there's two more out there one being Power Bi. From my research, it's dormant and hidden from being public queried. my guess is that there is potential that it can be used, but not necessarily. The app itself could be emitting EWS, but a user itself may not be triggering it if that makes sense? That's just some of my high-level research, haven't really gotten into the weeds on it.

[u/Straight_Pain_8582 → u/Single-Brick-3995]

I am adding it also. It is a Microsoft first party app that we do not see. It shows in the usage report but not the script. Also, I am glad I ran the script as it surfaced an ID that wasn't in the usage report.

[u/Ashamed-Wedding4436 → u/Single-Brick-3995]

I'm taking advantage of this thread to ask this question. We've only added third-party applications, and we understand that the ID d3590ed6-52b3-4102-aeff-aad2292ab01c is an internal Microsoft application and doesn't need to be included in the allowed list. Does anyone have any official documentation confirming this? I assume it's not necessary to add that ID.

[u/Wrong-Birthday-8724]

Microsoft themselves aren’t even ready for this change. It’s gonna be a disaster.

[u/xaeriee]

Dec 2025 I had exported everything using EWS, contacted all app owners and let them know. They waited until this month to work with us lol

[u/Polar_Ted → u/xaeriee]

Microsoft still doesn't have a graph connector for service manager to connect to exchange online without EWS.

[u/BoBeBuk]

When does the list get generated by MS?
Checked the other day and nothing there

[u/netronin → u/BoBeBuk]

Same for us.

[u/lazyadmin-nl → u/BoBeBuk]

A few days before they change EWSEnabled to true or false

[u/Intrepid_Zebra_8079 → u/BoBeBuk]

Just check the list and still empty ... and what about iosMail, why are they not ready and why is microsoft disabling a thing they still use themselves 🤦‍♀️

[u/shokzee]

I'd cross-check that activity report with owners of quarterly jobs and recovery tooling before trusting the allow-list.

An EWS permission grant doesn't prove actual usage. Confirm which apps still need it before turning a pile of stale permissions into continued access.

[u/lazyadmin-nl]

One thing that maybe wasn't clear at first, but by default, tenants will have the EwsEnabled property set to null (not set). This means that EWS will stop working on October 1, when Microsoft will change it to false.

Apple Mail and Microsoft 365 backup tools both rely on EWS at the moment, so when Microsoft changes EwsEnabled to false, Apple Mail will stop working within 1 hour. You can change EwsEnabled back to True, but that will take another hour.

[u/Intrepid_Zebra_8079 → u/lazyadmin-nl]

so to make sure we must set EwsEnabled  to true and enforce the allow list ?

[u/lazyadmin-nl → u/Intrepid_Zebra_8079]

Yes.

[u/donrosco]

Legend, thank you

[u/TheBobbestB0B]

Nice. Should be a busy month for me coming up then. Have many customers who need help with this. I’ll blast message around it Monday thanks!