Configure EWSEnabled and EwsAllowedAppIds in Exchange Online

Grace Wannapongsai
Grace Wannapongsai
  • Updated

Overview

Microsoft has announced the retirement of Exchange Web Services (EWS) in Exchange Online. The retirement process begins on October 1, 2026, with full shutdown scheduled for April 1, 2027.

The EWSEnabled flag controls whether EWS is enabled or disabled for an Exchange Online organization. Microsoft has also introduced the EwsAllowedAppIds property, which contains the application IDs of the EWS applications that the organization intends to allow.

EwsAllowedAppIds is intended to be configured together with EWSEnabled.

Microsoft may automatically populate an allow list based on a tenant’s EWS usage. However, Microsoft recommends that tenant administrators create their own allow list so they can control exactly which EWS applications are permitted. The ticket identifies this as the main change to the previous EWSEnabled-only process. 

EWSEnabled values

Microsoft documents the following values:

  • $true — EWS is enabled, subject to the organization’s EWS allow list configuration.
  • $false — EWS is disabled.
  • $null — The value has not been explicitly configured and is currently treated as enabled.

If EWSEnabled remains $null, Microsoft may change it to $false as part of the retirement rollout on or after October 1, 2026. Exchange Online EWS will be fully retired on April 1, 2027.

What this means for Riva customers

Riva Cloud and Riva On-Premises with Microsoft 365 / Exchange Online

This guidance applies to both Riva Cloud and Riva On-Premises deployments that use EWS to connect to Exchange Online.

Customers currently using EWS in Exchange Online should:

  • Review which applications require continued EWS access.
  • Configure EWSEnabled as $true.
  • Configure EwsAllowedAppIds with the application IDs that should remain permitted.
  • Continue planning a transition to Microsoft Graph before EWS is fully retired.

Organizations that do not complete the required Exchange Online configuration may lose EWS access as Microsoft proceeds with the retirement rollout.

Exchange On-Premises

The EWS retirement does not apply to on-premises Exchange Server environments.

  • Customers using Exchange Server on-premises can continue to use EWS without impact from Microsoft’s Exchange Online retirement timeline.

  • No changes are currently required for EWS usage in on-premises deployments.

How to configure EWSEnabled and EwsAllowedAppIds

Administrator access to Exchange Online is required.

Microsoft documents the following Exchange Online PowerShell commands for organization-wide and mailbox-level control of EWS access: 

Action Command
Block the entire organization from using EWS

Set-OrganizationConfig -EwsEnabled:$false

Important: Disabling EWS in the organization also disables per-user EWS overrides.
Enable EWS for the organization Configure EWSEnabled as $true and configure EwsAllowedAppIds with the application IDs that the organization intends to allow.
Block an individual mailbox from using EWS Set-CASMailbox -Identity adam@contoso.com -EwsEnabled:$false
Allow an individual mailbox to use EWS Set-CASMailbox -Identity adam@contoso.com -EwsEnabled:$true

Riva has a PowerShell script available to help configure the EWSEnabled flag and the EwsAllowedAppIds property for your Exchange Online organization.

Please contact the Riva Support Team for assistance and access to the script.

For more information

 

Related to