Exchange Web Services enters the final stretch before Microsoft pulls access

Microsoft is set to disable Exchange Web Services (EWS) in Exchange Online, paving the way for its permanent retirement by April 1, 2027. EWS, introduced with Exchange Server 2007, enables applications to access mailbox data, such as emails, calendars, and contacts. Microsoft claims the service no longer meets modern security, scalability, or reliability standards and advises migrating integrations to Microsoft Graph.

Starting October 1, Microsoft will alter tenant-level EwsEnabled settings left at null to false, effectively blocking EWS. Administrators can temporarily maintain continuity by setting EwsEnabled to true and adding approved applications to the EwsAllowedAppIDs list; otherwise, they will be barred. However, this is only a temporary measure until the service's final shutdown on April 1, 2027.

Microsoft is clear: "There will be no exceptions." The retirement applies solely to EWS in Exchange Online, leaving on-premises Exchange Server untouched. Microsoft ceased adding new features to EWS in Exchange Online in 2018 and announced its retirement in 2023, giving administrators ample time to prepare. Nevertheless, migrating away from such a deeply embedded API is no simple task.

Markus Müller, Boomi's global field CTO for API management, highlights the primary challenge as identifying every EWS usage instance. With swift integration rollouts and sparse documentation, many organizations may lack a comprehensive inventory of their EWS dependencies. Müller suggests translation layers to convert EWS calls into Microsoft Graph requests as a temporary workaround, but they introduce another component to maintain without resolving the need for migration.

He emphasizes that organizations should continuously monitor APIs as dependencies throughout their lifecycle rather than relying on deprecation notices to surface them. Microsoft has not disclosed the number of organizations or processes still reliant on EWS in Exchange Online. Once the phased blocking commences, any overlooked integrations will likely surface through support tickets reporting sudden failures of previously reliable workflows.