EWS already blocked for Apps and normal Userlogons before 1. October

Question

EWS already blocked for Apps and normal Userlogons before 1. October

Lenny Ludwig 0

Hey guys, MS will disable the Exchange web service on 1st of October. Unfortunately, in my organization, EWS is already not working anymore. I'm not talking about app-specific EWS applications registered in Entra under App Registration, no, I'm talking about the normal user login on a mail client via EWS (like Apple Mail and some other).

Our EWS config on Exchange looks like this:

EwsAllowEntourage :

EwsAllowList :

EwsAllowMacOutlook :

EwsAllowOutlook :

EwsApplicationAccessPolicy :

EwsBlockList :

EwsEnabled : True

EwsOperationAccessPolicyEnabled :

EwsOperationAccessPolicyAllowList :

EwsOperationAccessPolicyPopulated : False

EwsAllowedAppIDs :

Neither EWS Block nor Allow list nor the ApplicationAccessPolicy is configured. It just stopped working on Wednesday afternoon.

Is there any solution out there to fix this?

Lenny Ludwig 0 Reputation points

2026-08-21T11:06:51.69+00:00

Oraganization Policies are configured to allow Ews same for the user mailboxes directly.

EwsEnabled : True

EwsApplicationAccessPolicy :

EwsAllowList :

EwsBlockList :

EwsAllowedAppIDs :

2 answers

Your answer

Lenny Ludwig 0 Reputation points

2026-08-21T11:06:51.69+00:00

Oraganization Policies are configured to allow Ews same for the user mailboxes directly.

EwsEnabled : True

EwsApplicationAccessPolicy :

EwsAllowList :

EwsBlockList :

EwsAllowedAppIDs :

Answer 1

Jayden-P 3,375 Independent Advisor

Hi @Lenny Ludwig

Based on the Exchange Online EWS configuration you shared, there do not appear to be any EWS access restrictions configured at the organization level. To help isolate the cause of the issue, could you please verify the following:

Entra ID Sign-in Logs
- Review the Entra ID sign-in logs for affected users and check for any failed authentication attempts related to Exchange Online or Exchange Web Services (EWS).
Direct EWS Endpoint Access
- Attempt to browse directly to the EWS endpoint: https://outlook.office365.com/EWS/Exchange.asmx

Additionally, does it happen to entire users or just some users? What exact error did user get when tried to log in? (401, 403, etc.)

I look forward for your response.

Lenny Ludwig 0 Reputation points

2026-08-21T12:28:24.0433333+00:00

Hi Jayden,

the sign in logs show that the login was successful. When I go to https://outlook.office365.com/EWS/Exchange.asmx logged in as the specific account, I get a blank white page with no error.

Screenshot 2026-08-21 at 14.20.11.png
Jayden-P 3,375 Reputation points Independent Advisor

2026-08-21T12:34:23.52+00:00

Thank you for the update.

Based on the screenshot, the Entra ID sign-in for Apple Internet Accounts is showing a successful authentication, which suggests the user is able to successfully obtain a token and that the issue is likely occurring after authentication, when the client attempts to access mailbox data through EWS.

I recommend opening a support case with Microsoft support and providing what you gather. I apologize for not able to directly solve this for you, as I am a normal forum user, I do not have appropriate tool to investigate this behavior further.

Answer 2

If EwsEnabled : True and no EwsApplicationAccessPolicy, allow list, or block list is configured, the documented organization-level EWS settings shown do not indicate that EWS should be blocked.

For Exchange Online, EWS deprecation is in progress:

Admins can manually disable EWS at the organization and user levels in 2025.
EWS starts to be disabled globally for all organizations in October 2026.
EWS is fully disabled in April 2027.

For user-based EWS access, verify both scopes explicitly:

Check organization-level EWS
- Get-OrganizationConfig | fl EwsEnabled,EwsApplicationAccessPolicy,EwsAllowList,EwsBlockList,EwsAllowedAppIDs
- Expected state for general EWS availability: EwsEnabled is True or Null, with no policy blocking access.
- The default Null value is treated as EwsEnabled set to True.
Check mailbox-level EWS for affected users
- Get-CASMailbox <Alias, Primary SMTP, or UPN> | fl EWSEnabled
- If disabled, enable it with:
```
     Set-CASMailbox <Alias, Primary SMTP, or UPN> -EWSEnabled $True
```
If EWS was disabled for the whole organization, re-enable it with:
```
   Set-OrganizationConfig -EwsEnabled:$true
```
If Apple Mail or similar EWS-based clients are affected, note that these clients depend on EWS connectivity. Legacy Outlook for Mac also uses EWS in Exchange Online.
Plan remediation now
- Microsoft recommends identifying active EWS applications and starting migration now.
- Many scenarios already have mappings from EWS operations to Microsoft Graph APIs.

A key documented caveat: if EWS is disabled at the organization level with Set-OrganizationConfig -EwsEnabled:$false, per-user EWS overrides do not apply.