Configure EWSEnabled and EwsAllowedAppIds in Exchange Online

Overview

Microsoft is retiring Exchange Web Services (EWS) in Exchange Online, with full shutdown scheduled for April 1, 2027. Although automated enforcement begins October 1, 2026, all administrative configurations and exemptions must be completed on or before August 31, 2026 to prevent service disruptions.

Key Deadlines & Impact

• August 31, 2026 (Action Deadline): Last day to set EwsEnabled = $true and explicitly define your App ID allow list. Completing this ensures Microsoft exempts your tenant from automated disablement.

• September 2026 (Telemetry Sweep): Microsoft auto-populates allow lists for unconfigured tenants using telemetry, risking missed dependencies or misconfigured access.

• October 1, 2026 (Automated Block): Unconfigured tenants (Null) automatically have EWS flipped to $false, immediately breaking unapproved EWS integrations.

• April 1, 2027 (Full Shutdown): EWS is permanently decommissioned with no admin overrides available.

Required Action Items

1. Audit Applications: Identify all third-party and custom tools currently relying on EWS App IDs via Exchange Online logs.

2. Explicitly Set Tenant Status: Run Set-OrganizationConfig -EwsEnabled $true before August 31 to prevent automatic October blocks.

3. Set Approved App IDs: Run Set-OrganizationConfig -EWSAllowedAppIDs "AppID_1","AppID_2" to lock in your explicitly approved applications.

4. Migrate to Graph: Transition all allowed EWS applications to Microsoft Graph API before the final April 2027 decommission.

The EWSEnabled flag controls whether EWS is enabled or disabled for an Exchange Online organization. Microsoft has also introduced the EwsAllowedAppIds property, which contains the application IDs of the EWS applications that the organization intends to allow.

EwsAllowedAppIds is intended to be configured together with EWSEnabled.

Microsoft may automatically populate an allow list based on a tenant’s EWS usage. However, Microsoft recommends that tenant administrators create their own allow list so they can control exactly which EWS applications are permitted. The ticket identifies this as the main change to the previous EWSEnabled-only process. 

EWSEnabled values

Microsoft documents the following values:

• $true — EWS is enabled, subject to the organization’s EWS allow list configuration.
• $false — EWS is disabled.
• $null — The value has not been explicitly configured and is currently treated as enabled.

If EWSEnabled remains $null, Microsoft may change it to $false as part of the retirement roll-out on or after October 1, 2026. Exchange Online EWS will be fully retired on April 1, 2027.

What this means for Riva customers

Riva Cloud and Riva On-Premises with Microsoft 365 / Exchange Online

This guidance applies to both Riva Cloud and Riva On-Premises deployments that use EWS to connect to Exchange Online.

Customers currently using EWS in Exchange Online must:

• Review which applications require continued EWS access.
• Configure EWSEnabled as $true.
• Configure EwsAllowedAppIds with the application IDs that should remain permitted.
• Continue planning a transition to Microsoft Graph before EWS is fully retired.

Organizations that do not complete the required Exchange Online configuration will lose EWS access as Microsoft proceeds with the retirement roll-out.

Exchange On-Premises

The EWS retirement does not apply to on-premises Exchange Server environments.

• Customers using Exchange Server on-premises can continue to use EWS without impact from Microsoft’s Exchange Online retirement timeline.

• No changes are currently required for EWS usage in on-premises deployments.

How to configure EWSEnabled and EwsAllowedAppIds

Administrator access to Exchange Online is required.

Microsoft documents the following Exchange Online PowerShell commands for organization-wide and mailbox-level control of EWS access: 

$EwsAllowedAppIDs = @("YOUR-APPLICATION-CLIENT-ID") 
 
Connect-ExchangeOnline -ShowBanner:$false 
 
$config = Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy 
 
$config.EWSEnabled 
$config.EwsAllowedAppIDs 
 
Set-OrganizationConfig -EWSEnabled:$true 
 
$updatedAppIds = @( 
    @($config.EwsAllowedAppIDs) + 
    $EwsAllowedAppIDs | 
    Where-Object { $_ } | 
    Select-Object -Unique 
) 
 
Set-OrganizationConfig -EwsAllowedAppIDs ($updatedAppIds -join ",") 
 
$config = Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy 
 
$config.EWSEnabled 
$config.EwsAllowedAppIDs 
 
Disconnect-ExchangeOnline -Confirm:$false