Exchange Web Services Goes Dark October 1, 2026: The Integrations About to Break at Your Texas Business

Exchange Web Services (EWS) is a SOAP-based API Microsoft shipped with Exchange 2007. For nearly two decades it has been the plumbing behind scanners, room panels, CRM connectors, backup tools and scripts that need to read a mailbox or drop a message into one. Microsoft announced its retirement in 2023 and has been steadily tightening the screws since. Here is where the schedule stands as of July 2026:

• June 2026: Microsoft began deploying the EWSAllowedAppIDs tenant control, a per-tenant allow list that names the specific applications still permitted to call EWS.
• End of August 2026: The practical deadline. If you set EWSEnabled to True and configure an allow list before the end of August, your tenant is excluded from the October 1 automatic change.
• September 2026: For tenants that set EWSEnabled to True but never built a list, Microsoft pre-populates an allow list based on observed usage. That is a safety net, not a plan. It can include applications you never intended to keep, which is exactly the outcome an inventory is supposed to prevent.
• October 1, 2026: Tenants that never configured the setting (EWSEnabled still Null) get flipped to False as the change rolls out tenant by tenant. Microsoft also begins blocking EWS requests from non-Microsoft apps that have not been explicitly allowed. Separately, mailboxes on Exchange Online Kiosk and on Microsoft 365 and Office 365 F1 and F3 licenses lose EWS access on this date, because those SKUs never carried EWS rights in the service description and the restriction is finally being enforced. That license change was originally scheduled earlier and was pushed to October 1 after customer feedback.
• April 1, 2027: Full shutdown. EWS is fully disabled across Exchange Online regardless of allow lists or exemptions, and no new exceptions are granted. Everything moves to Microsoft Graph.

Two clarifications that save a lot of panic. First, this only affects Exchange Online. On-premises Exchange Server is not part of this retirement. Second, Microsoft's own clients (Outlook for Windows, Outlook for Mac, Teams) are exempt from the blocking, so your users' email is not going to stop working. The damage lands on the third-party and homegrown things nobody has looked at in years.

The single most dangerous property of this change is silence. If your tenant has never had the EWSEnabled value explicitly set, it is currently Null, which historically meant "allow everything." On October 1 that Null becomes False, and non-Microsoft applications calling EWS start getting access denied. Your users notice nothing. Your monitoring probably notices nothing. The copier just stops emailing scans, and the archiving tool just stops archiving.

That is a very different failure mode from a server going down. There is no alert, no red dashboard, no help desk flood. There is one department quietly working around a broken workflow while your compliance retention window develops a hole in it.

EWSAllowedAppIDs is a tenant-level allow list of Microsoft Entra application IDs (GUIDs). When EWSEnabled is True and the allow list is populated, only applications whose App IDs appear on that list can use EWS. Everything else is blocked. It applies only to direct EWS (SOAP) connections, so it has no effect on anything already calling Microsoft Graph or the REST endpoint.

Administrators configure it through Exchange Online PowerShell using Set-OrganizationConfig with the -EwsEnabled $true and -EwsAllowedAppIDs parameters, passing a comma-separated list of GUIDs. You verify the result with Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy and format the EwsAllowedAppIDs property; the RetrieveEwsOperationAccessPolicy switch is required because the list is not returned by default. One practical gotcha: writing the property replaces the entire list, so adding or removing a single App ID means reading the current value, editing it, and writing the whole thing back.

Scope matters too. The allow list itself is tenant-wide, but EWSEnabled exists at both the organization level (Set-OrganizationConfig) and the mailbox level (Set-CASMailbox), and since a change that finished rolling out on March 31, 2026, both have to be True for EWS to work. Admins who remember the older behavior, where a True at the mailbox level overrode the organization setting, get caught by this.

None of that is difficult. The hard part is the sentence before it: knowing which GUIDs belong on the list. That is an inventory problem, not a PowerShell problem.

Microsoft gives you the raw data. In the Microsoft 365 admin center, go to Reports, then Usage, then Exchange, then the EWS usage tab. The report shows Application ID, the specific SOAP action being called, call volume, and last activity date, filterable across the last 7, 30, or 90 days. Note that the data is collected and aggregated weekly rather than daily, so a monthly process (think a month-end billing export) may not show up in a 7-day window. Pull 90 days.

What you get back is a list of GUIDs, not a list of vendors. Unresolved GUIDs can be matched against Microsoft's published list of application IDs for common Microsoft applications, or looked up in Enterprise Applications in Microsoft Entra ID, or resolved with the Graph PowerShell SDK using Get-MgServicePrincipal filtered on the App ID. Below is what those GUIDs usually turn out to be at a 15 to 120 person business in Houston, The Woodlands, Katy or Sugar Land.

Scan to Email in Microsoft 365 and EWS

Multifunction copiers, standalone document scanners and fax/scan appliances are the number one casualty. Many were configured years ago by a copier dealer who set up scan-to-email against Exchange using whatever method worked at the time. Some of those use SMTP and will be fine. Some use EWS and will not. Law firms, title companies, medical practices and accounting firms in the Houston metro run enormous scan volume, and a silent scan-to-email failure in a records-heavy business is a genuinely expensive problem.

Copier and Phone System Calendar Integration

Meeting-room display panels outside conference rooms read free/busy data from Exchange. Older panels do it through EWS. So do a surprising number of phone systems: voicemail-to-email delivery, presence based on calendar status, and auto-attendant schedules driven by an Exchange calendar. When copier and phone system calendar integration breaks, the symptom is a room panel showing an empty schedule or voicemails that quietly stop arriving in inboxes, which is exactly the sort of thing people tolerate for weeks before reporting.

Backup, Archiving and Compliance Tools

This is the category with real consequences. Veeam has published a support statement confirming that its software using EWS, including Veeam Backup for Microsoft 365 and Veeam Data Cloud for Microsoft 365, is transitioning to the Microsoft Graph API, and that customers need to move to a supported release and reauthorize the application so the additional Graph permissions are granted in Microsoft Entra ID. Email archiving and journaling platforms, eDiscovery collectors and third-party retention tools are in the same boat. If you are subject to FTC Safeguards, SEC/FINRA retention or HIPAA requirements, an archiving connector that fails on October 1 creates a documented gap you will have to explain. Confirm your Microsoft 365 backup and recovery tooling is on a Graph-capable version before the deadline, not after.

Line-of-Business Connectors and Legacy Clients

Older CRM, practice-management, ERP and field-service platforms often ship an "Exchange sync" module for contacts, tasks and calendar. So do email signature managers, shared-mailbox helpdesk tools, and appointment reminder services. Then there is the long tail: legacy Mac mail clients that authenticate against Exchange via EWS, and homegrown PowerShell or Python scripts written by someone who no longer works there, which pull an inbox at 6 a.m. and drop attachments on a file share.

• Pull the report. Export 90 days of EWS usage from the Microsoft 365 admin center. Budget 20 minutes.
• Map every App ID to a vendor. Resolve GUIDs through Entra Enterprise Applications or Graph PowerShell. Anything you cannot identify goes on a "must investigate" line, not a "probably fine" line.
• Open a ticket with every vendor. One question, in writing: "Is your product on Microsoft Graph, what version do we need, and by what date?" Written answers matter, because a verbal "we're working on it" in July is worthless in October.
• Whitelist only what you must keep. Set EWSEnabled to True and populate EWSAllowedAppIDs with the App IDs that genuinely still need EWS, before the end of August, so your tenant is excluded from the automatic flip and you are not relying on Microsoft's September auto-population to guess for you.
• Set a cutover test date in September. Pick a low-traffic evening, briefly remove an app from the allow list or block it, and confirm you can reproduce the failure and the fix. Discovering breakage on your schedule beats discovering it on Microsoft's.

For most Houston-area small businesses this is a genuinely small project. The audit is a couple of hours. Firmware updates on copiers and room panels, vendor version upgrades, and rewriting two or three legacy scripts against Graph is a finite, well-scoped engagement, and it is a great deal cheaper than a week of untraceable Q4 outages plus emergency vendor escalations. If you already have internal IT, this is exactly the kind of deadline-driven work a co-managed IT arrangement handles well without disrupting your team's roadmap.

Worth noting: Microsoft's motivation here is security, not tidiness. Microsoft has stated that the Midnight Blizzard incident of January 2024 involved EWS and elevated the urgency of the deprecation effort, widening its scope from third-party applications to Microsoft's own products as well. Retiring EWS and forcing everything onto Graph with granular, consentable permissions is a meaningful reduction in attack surface, and it pairs naturally with tightening the rest of your Microsoft 365 security and management posture.

Will my users lose Outlook or Teams email on October 1, 2026?

No. Microsoft's own clients including Outlook for Windows, Outlook for Mac and Teams are exempt from the October blocking. The change targets third-party and custom applications calling EWS. Your users' day-to-day email, calendar and Teams experience is unaffected.

Does the Exchange Online EWS deadline affect on-premises Exchange Server?

No. This retirement applies to Exchange Online in Microsoft 365 only. On-premises Exchange Server deployments and their EWS endpoints are not part of this change. Hybrid organizations should still audit anything pointed at the cloud side of the environment.

What if I miss the end-of-August window to configure EWSAllowedAppIDs?

You are not permanently locked out. Microsoft has confirmed that if your tenant gets flipped to EWSEnabled=False on October 1, an administrator can set EWSEnabled back to True afterward, with a brief service interruption while the change takes effect, and that re-enablement remains available up until April 1, 2027. The real cost is the day you spend figuring out that EWS was the cause in the first place. And it is temporary regardless: on April 1, 2027 EWS stops working for everyone.

How do I know if my copier uses EWS or SMTP for scan to email?

Check the scan destination configuration in the device's embedded web interface. If it points at an Exchange endpoint with a mail-server URL and a user account rather than an SMTP relay host on port 587 or 25, it is a strong candidate for EWS. The definitive answer is the App ID in the EWS usage report cross-referenced with the device vendor. Many copier fleets can simply be moved to authenticated SMTP or a mail relay, which sidesteps the issue entirely.

What replaces EWS?

Microsoft Graph. It is the modern REST API for Microsoft 365 data, with OAuth-based authentication and granular per-application permissions. Most active vendors already have Graph-based versions shipping. The work is usually upgrading to a supported release and reauthorizing the app's permissions, not rebuilding anything. Microsoft also publishes direct mappings between EWS operations and their Graph equivalents for the custom code you do have to touch.

The businesses that get hurt by the Exchange Web Services retirement 2026 are not the ones with complicated environments. They are the ones where a copier stops emailing scans on a Thursday and nobody connects it to a mail-platform change that happened weeks earlier. If nobody at your company can name every application touching your Microsoft 365 mailboxes, that inventory is the highest-value two hours available to you this quarter. LayerLogix runs EWS dependency audits, vendor-readiness tracking and Graph cutover testing for businesses across Houston, The Woodlands and the greater Texas market. Talk to our Houston IT support team about getting your tenant configured before the end of August, or see how our managed IT services in Houston keep deadlines like this from becoming Q4 surprises.