After over 20 years, Microsoft today announced that the Exchange Web Services (EWS) API for Exchange Online will be discontinued in April 2027.
Applications can use EWS, a cross-platform API, to access Exchange mailbox contents, including contacts, meetings, and emails that are fetched from a variety of sources, including Exchange Online and on-premises versions of Exchange (beginning with Exchange Server 2007).
On October 1, 2026, Microsoft will start disabling Exchange Online EWS by default; however, administrators can keep access temporarily by using an application allowlist. There are no exceptions made, and the final closure takes place on April 1, 2027.
Administrators will not be automatically blocked in October if they create allow lists and configure settings by the end of August 2026. Beginning in September 2026, Microsoft will use each tenant’s usage habits to pre-populate allow lists for organisations that haven’t made their own.
Before the ultimate cutoff, the organisation may also perform “scream tests” in which EWS is momentarily disabled to reveal hidden dependencies. IT administrators will be updated through monthly Message Center emails that include usage reports and tenant-specific reminders.
It’s crucial to remember that EWS will still work in on-premises Exchange Server installations and that this retirement process solely impacts Microsoft 365 and Exchange Online settings.
“Today we’re announcing we will use a phased, admin controllable disablement plan that starts in October 2026 and concludes with a complete shutdown of EWS in 2027,” the Exchange Team announced on Thursday. “EWS was built nearly 20 years ago, and while it served the ecosystem well, it no longer aligns with today’s security, scale, or reliability requirements.”
Since the Microsoft Graph API has nearly full feature parity with EWS for the majority of scenarios, Microsoft also recommended that developers utilising the EWS API migrate to it until EWS is decommissioned.
On-premises, EWS is not being decommissioned. Depending on how apps access data, hybrid scenarios can take several forms. Cloud mailboxes must switch to Graph, but on-premise mailboxes can stay on EWS.
However, Microsoft noted that only Exchange SE would allow Graph for calls to Exchange Online; thus, hybrid clients will need to utilise Exchange SE to host on-premises mailboxes. “Autodiscover will help apps determine mailbox location automatically,” the company added.
The statement today follows Microsoft’s 2018 warning that EWS will no longer get functionality updates and its September 2023 declaration that it would start decommissioning the EWS API in October 2026.
For security considerations, Microsoft announced in October 2021 that it has deprecated the 25 least-used EWS APIs for Exchange Online and terminated support for them in March 2022.
Crucial Information for Administrators
In terms of the scope, only Microsoft 365 and Exchange Online are impacted by this retirement. Exchange Server (on-premises) still supports EWS.
For replacement, since the Microsoft Graph API is now the main interface for mailbox access, Microsoft advises moving all third-party and custom apps to it.
Admins will be able to proactively construct an AppID Allow List beginning in early 2026 thanks to a new functionality. The tenant will not be included in the first October block if they are set up by the end of August 2026.
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
