"October 1, 2026, is when EWS will be disabled by default, although tenants can keep the lights on a little longer by setting the EWSEnabled flag to true by August, but the service will be shut down entirely on April 1, 2027. EWS has long been deprecated, and Microsoft announced its retirement in 2023. The noose tightened in 2025, with confirmation that certain license types (F1 or F2) would be blocked from using it."
"The service is an API that allows applications to access mailboxes and data stores in Exchange Online and Exchange Server. It dates back to Exchange Server 2007, and has proven popular with integrators and third parties (as well as in-house applications such as Outlook Classic). It is also popular with miscreants. Following the Midnight Blizzard security incident, Microsoft "elevated the urgency" of pushing the tech out to pasture."
"The timeline means affected administrators who have not yet begun or completed a migration will need to get moving. Microsoft's preference is a move to Microsoft Graph. However, it noted the service is just at "near-complete" feature parity and even Microsoft itself had yet to conclude the migration of all its impacted applications. To focus minds, Microsoft also said it "may perform temporary 'scream tests'" where it turns EWS off and on to expose hidden dependencies."
Microsoft will disable Exchange Web Services (EWS) by default in Microsoft 365 and Exchange Online on October 1, 2026, with a full shutdown on April 1, 2027. Tenants can delay disablement by setting the EWSEnabled flag to true by August, but some license types (F1, F2) were already slated to lose access. EWS is an API dating to Exchange Server 2007 used by integrations and legacy applications and abused by attackers. Microsoft recommends migrating workloads to Microsoft Graph, which is near feature parity. Microsoft may run temporary "scream tests" to reveal hidden dependencies. EWS in Exchange Server remains unchanged.
Read at Theregister
Unable to calculate read time
Collection
[
|
...
]