Exchange Online
Exchange Online requires an EWS app allow list
October 10, 2026 · 6 days ago
Microsoft · high confidence · Last verified October 15, 2026 · MC1485116
What breaks
For affected Worldwide tenants with EWS enabled, EWSEnabled set to true is no longer enough. Applications that are not on EWSAllowedAppIDs may lose Exchange Web Services access.
Who is affected
- Exchange Online administrators
- Tenants that still set EWSEnabled to true
- Apps and services that still call EWS, including ones that show up in EWS usage reports
- Microsoft apps the October 1 post says can still generate EWS traffic: Outlook for Windows, classic Outlook for Mac, Excel Power Query, Power BI, and Exchange Server hybrid
Source notes
MC1485116 says Microsoft identifies affected Worldwide tenants on October 2, 2026. After that date, tenants that enable EWS must configure EWSAllowedAppIDs themselves.
The same post says Microsoft creates and populates EWSAllowedAppIDs on October 8–9, 2026 for qualifying Worldwide tenants, using EWS activity from the previous 60 days. Infrequently used applications may be missed. Allow-list changes can take up to 24 hours.
Tenants with EWSEnabled left unset (null) stay on Microsoft’s phased retirement and are not the October 10 allow-list case. Cross-tenant organization relationships are not covered by the allow-list requirement. EWSAllowList is a different setting and does not replace EWSAllowedAppIDs.
The October 10 date is from the public Message Center archive at mc.merill.net, not from a tenant admin center. Confirm MC1485116 in your own Message Center. Microsoft Learn still describes October 2026 and April 2027 without this day.
Sources
Message Center archive MC1485116, published October 1, 2026
Date history
Published August 24, 2026
MC1447678, updated August 24, 2026, said Exchange Online EWS retirement enforcement begins October 1, 2026, and full retirement begins April 1, 2027.
Published October 1, 2026
MC1485116 moved the allow-list requirement to October 10, 2026. On that date, EWSAllowedAppIDs becomes required when EWSEnabled is true for affected Worldwide tenants.