When is EWS turned off in Exchange Online?

In two stages. From October 2026 Microsoft switches it off tenant by tenant, with a 7-day warning in Message Center, for every tenant that never set EWSEnabled. On 1 April 2027 it is switched off for everyone, permanently, and the setting stops being yours to change.

Will Microsoft fill in my EWSAllowedAppIDs list for me?

Only once, and only from the last 60 days of usage. Tenants that had EWSEnabled set to True on 2 October got a list on 8 or 9 October; tenants still at Null get one a few days before Microsoft sets them to False. Anything that runs less often than every 60 days will be missing. A list you made yourself is never overwritten.

Is EWSAllowList the same thing as EWSAllowedAppIDs?

No. EWSAllowList and EWSBlockList are the older controls of EwsApplicationAccessPolicy, which match on the client's user-agent string and also affect REST. EWSAllowedAppIDs matches on the Entra application ID and is the one the retirement uses. A request has to pass both, so configuring the old one does not keep an application working.

Does the EWS retirement affect Exchange Server on-premises?

Not on-premises EWS itself. It does affect two hybrid cases: on-premises mailboxes with archives in Exchange Online, and an on-premises organisation sharing free/busy with a different Exchange Online organisation. Both need the online tenant to keep EWS enabled for now.

EWS retirement timeline: October 2026 to April 2027

Exchange Web Services in Exchange Online is being switched off tenant by tenant from October 2026, and for everyone on 1 April 2027. The date that matters for your tenant depends on one setting, EWSEnabled, and on whether you have an application allow list.

The short version: since 10 October 2026, a tenant that wants EWS needs EWSEnabled = True and an EWSAllowedAppIDs list; only applications on the list get through. Tenants that never touched the setting are being moved from Null to False one by one, each with a 7-day warning in Message Center. On 1 April 2027 EWS is off everywhere, with no exceptions.

Every date, in order

These are the dates as Microsoft has published them, most recently in the Exchange Team’s post of 3 October 2026. They apply to the worldwide multi-tenant cloud; government and sovereign clouds get their own dates through Message Center.

When	What happens
July 2018	EWS in Exchange Online stops getting new features.
September 2023	Microsoft announces the retirement, aimed at October 2026.
February 2026	The plan becomes two stages: a phased disablement from October 2026, then the end on 1 April 2027 (MC1227454).
1 October 2026	Mailboxes licensed only for Exchange Online Kiosk, F1 or F3 lose EWS: requests get HTTP 403 (MC1191578, moved from 30 June).
2 October 2026	Microsoft records every tenant with `EWSEnabled = True` and no allow list.
8–9 October 2026	Those tenants get an `EWSAllowedAppIDs` list, filled from the application IDs that used EWS in the previous 60 days.
From 10 October 2026	An allow list is required. With `EWSEnabled = True`, only listed applications reach EWS. A tenant that sets `True` from now on writes its own list.
October 2026 onward	Tenants still at `Null` are set to `False`, one at a time. Each gets a 7-day warning in Message Center, and Microsoft fills its allow list from 60 days of usage a few days before the switch, so setting `True` afterwards restores what was in use.
1 April 2027	EWS is off permanently. Administrators can no longer change `EWSEnabled`, and Microsoft has said there will be no exceptions.

Content that says “EWS stops on 1 October” is wrong in a way that matters. Nothing stopped for everyone that day; what changed is that EWS became something a tenant must explicitly keep, application by application.

Where your tenant stands today

`EWSEnabled`	Allow list	What EWS does now
`Null` (never set)	Ignored	Works for every application, until Microsoft reaches your tenant and sets it to `False`. Watch Message Center for the 7-day notice.
`True`	Present	Works only for the application IDs on the list.
`True`	Missing	Required since 10 October. If your tenant was `True` on 2 October, Microsoft made the list for you; check what is on it. If you set `True` later, the list is yours to write.
`False`	Ignored	Blocked for everyone. Setting `True` again, with a list, still works until 1 April 2027.

Checking and changing it

In Exchange Online PowerShell. The allow list is not returned by a plain Get-OrganizationConfig; it needs its own switch:

Get-OrganizationConfig | Format-List EWSEnabled
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

Four things about changing it that Microsoft’s own field notes call out, and that catch people:

The list is written whole. Set-OrganizationConfig -EwsAllowedAppIDs replaces the list rather than adding to it. Read the current value, add or remove one ID, write it back.
Changes are slow, and not equally slow. A change to the allow list takes about 24 hours to reach every server; a change to EWSEnabled usually under an hour, sometimes up to four. A test run straight after a change proves nothing.
Order matters. Write the list while EWSEnabled is still Null (the list is ignored then), wait a day, and only then set True. The other way round can leave anything not yet listed blocked until the list arrives.
The fastest undo while testing is Set-OrganizationConfig -EWSEnabled $null: an hour later EWS is unrestricted again.

To see what uses EWS, use the EWS usage report in the Microsoft 365 admin center and look at 90 days rather than 7: Microsoft’s automatic lists only look back 60, so anything monthly or quarterly is exactly what they miss. The report names applications by Entra application ID; resolve them under Entra ID → Enterprise apps.

Two settings with nearly the same name

EwsAllowedAppIDs is the retirement’s gate and matches on the application ID. EwsAllowList and EwsBlockList are the decade-old user-agent controls of EwsApplicationAccessPolicy, which also affect REST. They are checked separately: a request must pass both. Configuring the old pair does not keep an application on EWS, and clearing it to “tidy up” can break REST workloads that never used EWS at all.

Microsoft’s own applications are on the list too

It would be reasonable to assume Microsoft exempts itself. It does not: any Microsoft application that shows up in your EWS usage report needs its application ID on your list to keep working. What Microsoft said on 3 October:

Classic Outlook for Windows should be on the August 2026 build (16.0.20430.20092) or later, after which it should not need EWS; Microsoft suggests testing whether the Office client’s ID can be left off.
Outlook for Mac: the new Outlook is unaffected. Classic Outlook for Mac needs the Microsoft Office application ID on the list.
Excel Power Query has its own guidance; Power BI was still to be announced.
Exchange hybrid: on-premises mailboxes with archives in Exchange Online, and on-premises organisations sharing free/busy with another Exchange Online organisation, both need the online tenant to keep EWS enabled for now, with the hybrid application on the list.

What this means for email signatures

Signature tools that write Outlook signatures through EWS keep working only while their application ID is on your list, and stop on 1 April 2027 whatever you do. There is no like-for-like move: Microsoft Graph, the replacement Microsoft recommends for everything else, has no API for Outlook signatures. The real choices are an Outlook add-in, a transport rule or an outbound relay, and they trade very different things. We compare them in EWS deprecation and email signatures.

For the record, Ascripto does not use EWS: Microsoft 365 signatures go through an outbound connector to our relay, and Gmail signatures through Google’s own API. Nothing on this page changes it.

Sources

Exchange Team, EWS Deprecation Is Here – What This Means To You, 3 October 2026.
Exchange Team, Take control of your EWSAllowedAppIDs list before EWS access changes, 4 September 2026.
Exchange Team, Notes from the field: testing EWSAllowedAppIDs safely, 14 October 2026.
Exchange Team, Impact of Exchange Online EWS Deprecation on Hybrid Rich Coexistence and Cross-org Sharing, 30 September 2026.
Message Center MC1227454, Exchange Web Services (EWS) retirement update; MC1191578, Update to EWS Access for Kiosk / Frontline Worker Licenses (updated 10 June 2026).