Microsoft Starts the Countdown to the End of Exchange Web Services

Microsoft has officially started the clock on the retirement of Exchange Web Services (EWS) in Exchange Online, with a phased shutdown beginning in October 2026 and a hard stop scheduled for April 1, 2027. While EWS has been deprecated for years, this is the clearest signal yet that organizations still relying on it need to act now.

Exchange Web Services, first introduced with Exchange Server 2007, has long been a foundational API for mailbox access, powering everything from third‑party integrations and custom scripts to multifunction printer workflows. But Microsoft has been clear that EWS no longer meets modern security, reliability, and scalability requirements, particularly in cloud environments.

What’s changing and when

The retirement applies only to Exchange Online and Microsoft 365. On‑premises Exchange Server is not affected and will continue to support EWS. For cloud tenants, Microsoft has outlined a two‑stage process.

Starting October 1, 2026, EWS will be disabled by default in Exchange Online on a tenant‑by‑tenant basis. Any tenant that has not explicitly configured its settings will see Microsoft automatically block EWS access. Administrators who still require EWS during the transition will need to set the EWSEnabled property to True and maintain an AppID allow list that explicitly permits approved applications.

Then, on April 1, 2027, EWS will be permanently shut down in Exchange Online. Microsoft has stated there will be no exceptions beyond this date, regardless of workload or business impact.

Key dates at a glance

Exchange Web Services (EWS) retirement timeline:

• October 1, 2026 – Exchange Web Services is disabled by default in Exchange Online. Tenants that have not explicitly configured EWS settings will see EWS blocked automatically.
• End of August 2026 – Deadline for administrators who want to retain temporary EWS access by setting EWSEnabled=True and configuring an AppID allow list. Tenants that do this in advance will be excluded from the initial automatic block.
• October 2026 – March 2027 – Transition period where EWS can be selectively re‑enabled, but only as a short‑term measure while migrations are completed. Microsoft may run temporary “scream tests” to expose hidden dependencies.
• April 1, 2027 – Final shutdown of Exchange Web Services in Exchange Online. EWS access is permanently removed with no exceptions.

Why Microsoft is forcing the issue

Microsoft has been signaling the end of EWS since 2018, when it stopped adding new features to the platform. The company’s strategic replacement is Microsoft Graph, which now offers near‑complete parity for most common EWS scenarios and uses modern authentication and authorization models.

Security has also played a role. Following high‑profile cloud security incidents, Microsoft has been steadily reducing legacy access surfaces in Microsoft 365. EWS, with its broad mailbox access and SOAP‑based design, is firmly in that category.

What administrators should do now

If you’re responsible for Exchange Online, the most dangerous assumption you can make is that “we’re probably not using EWS anymore.” Many organizations still have hidden dependencies, particularly in third‑party tools and older automation scripts.

Microsoft now provides EWS usage reports in the Microsoft 365 admin center, which should be your starting point. Identify every application and workflow that still depends on EWS, then engage vendors or internal teams to confirm Microsoft Graph support and migration timelines.

If you expect to need EWS beyond October 2026, plan ahead. Configure the AppID allow list and tenant settings before the end of August 2026 to avoid being caught by the automatic disablement wave. But treat this as a temporary safety net, not a long‑term strategy.

The message from Microsoft is: EWS in Exchange Online is living on borrowed time. The earlier you start unwinding those dependencies, the less painful 2026, and especially 2027, will be.