How to keep EWS working in Exchange Online after October 2026

Microsoft is retiring Exchange Web Services (EWS) in Exchange Online (Microsoft 365 cloud), and the first deadline is days away. If your organization relies on an app that syncs mail, calendars, tasks, or contacts over EWS, you can keep it running until the final shutdown with a short PowerShell change. Here’s what’s happening and how to do it.

The timeline

A phased EWS disablement begins October 1st, 2026, with permanent shutdown starting April 1st, 2027.

Beginning October 1st, EWS will be blocked unless the tenant configures an AppID allow list and sets EWSEnabled to True. Without admin action, Microsoft will set EWSEnabled to False and EWS apps will stop working. After April 1st, 2027, EWS access will be permanently removed with no re-enablement. This only affects cloud Microsoft 365, no changes are being made to EWS in Exchange Server (on-premises).

1. Find the app IDs you need to allow

The new allow list works on Entra application IDs. Unlike the older EwsAllowList, which filters on an easily spoofed user agent string, EWSAllowedAppIDs relies on the special application identifier registered in Microsoft Entra ID. Collect the Application (client) ID for every EWS app your organization still uses. For SyncPenguin, use:

98874266-492b-43c2-9259-6a1e9618c17c
af15e02e-df4e-4ea2-b8ae-19a9b7542a50
c3eebf7d-e7a6-4569-af78-f270f3221cc3

2. Enable EWS and add the app to the allow list

Connect to Exchange Online PowerShell (as an admin) and run the following script:

Connect-ExchangeOnline

$appIds = @(
    "98874266-492b-43c2-9259-6a1e9618c17c",
    "af15e02e-df4e-4ea2-b8ae-19a9b7542a50",
    "c3eebf7d-e7a6-4569-af78-f270f3221cc3"
) # SyncPenguin app IDs. Change or add any others to the list

$current = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy).EwsAllowedAppIDs
$updated = @(
    $current -split "," | ForEach-Object { $_.Trim() } | Where-Object { $_ }
    $appIds
) | Select-Object -Unique

Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs ($updated -join ",")

Note that when EwsEnabled is True, only applications specified in the allow list can access EWS, so include everything you still depend on.

3. Verify

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled, EwsAllowedAppIDs

Note that the configuration change can take up to 24 hours to propagate. Also, be sure to check that the mailboxes being synced haven’t been individually blocked, because Exchange Online will only allow a mailbox to use EWS if both the organization and mailbox settings are true.

Alternative solution without allow list

MIcrosoft will automatically change the value of EwsEnabled from Null to False starting October, 2026. You can then just re-enable EWS by setting EWSEnabled to back Null after it was automatically set to False by Microsoft (after October 1st). There will be a brief service interruption while the change takes effect, but re-enablement remains available until April 1st, 2027.

Set-OrganizationConfig -EWSEnabled $null

What SyncPenguin customers should do

We recommend reconnecting your SyncPenguin accounts to switch them from EWS to the Microsoft Graph API, as described in this blog post. If you’re not ready yet, you can extend EWS access using the steps above, but keep in mind this only works until April 1st, 2027. Feel free to contact us if you need any help during the transition period.

For official information about Microsoft EWS deprecation, please check this article.