SyncPenguin is Moving from EWS to Microsoft Graph API: What You Need to Know in 2026

If you use SyncPenguin to keep your contacts, calendar meetings, or tasks in sync between Exchange/Outlook and other platforms, this post explains an important change happening under the hood — and a small action some of the customers will need to take to keep their sync running smoothly.

Note: this only relates to customers who currently use connectors named “Office 365” in SyncPenguin. If you sync uses “Microsoft 365” or “Outlook” connectors, no action is required as they already use Graph API.

The Background: Why EWS Is Going Away

For over a decade, Exchange Web Services (EWS) has been the standard API that third-party applications — including sync tools like SyncPenguin — used to read and write mailbox data: emails, calendar events, contacts, and tasks. It’s a mature, well-documented protocol, and a huge share of the Microsoft 365 ecosystem was built on top of it.

That era is ending. Microsoft first signaled the shift away from EWS back in 2018, when it announced that EWS in Exchange Online and Office 365 cloud would no longer receive new feature updates, and that developers should start building on Microsoft Graph platform instead. For years, this was treated as a “soft” deprecation — EWS kept working, and Graph slowly matured to close the functionality gap.

That changed in 2023, when Microsoft announced a hard deadline for disabling EWS in Exchange Online. The urgency increased further after the Midnight Blizzard incident in January 2024, in which attackers exploited an OAuth application with EWS-related permissions. That incident pushed Microsoft to widen the scope of the EWS shutdown to cover Microsoft’s own first-party applications as well, not just third-party ones.

Key Dates

• July 2018 — Microsoft announces EWS will no longer receive feature updates in Exchange Online; Graph API is named as the long-term replacement.
• 2023 — Microsoft formally announces that EWS access to Exchange Online will be disabled starting October 2026.
• January 2024 — The Midnight Blizzard security incident accelerates and broadens the deprecation effort.
• October 1, 2026 — Microsoft begins phased disablement of EWS for Exchange Online tenants. This is tenant-controlled at first, meaning organizations that haven’t opted into an allow-list extension will start seeing EWS calls blocked around this date.
• April 1, 2027 — EWS is permanently retired for all Exchange Online tenants, with no exceptions and no re-enablement option.

It’s worth noting that this deprecation applies specifically to Exchange Online (cloud-hosted mailboxes). On-premises Exchange Server deployments are not affected by this timeline, since Microsoft Graph does not currently offer a path for on-premises mailbox access, and there no such plans at the moment. Organizations running hybrid environments will need to pay close attention to how their mailboxes are hosted, since only cloud-hosted mailboxes are impacted by the shutdown.

Given the scale of the Microsoft 365 ecosystem, this is not a niche change — it affects every application that has historically relied on EWS to talk to Exchange Online, including backup tools, migration tools, CRM integrations, and two-way sync services like SyncPenguin.

What This Means for SyncPenguin

SyncPenguin has historically used EWS to power two-way synchronization of:

• Contacts
• Calendar meetings
• Tasks

between Exchange/Outlook accounts and the other platforms our customers connect. With Microsoft’s shutdown timeline now locked in, we’ve been migrating this integration over to the Microsoft Graph API — the modern, OAuth-based API that Microsoft is standardizing on across Microsoft 365. Note that only the “Office 365” connector is affected. Connectors named “Microsoft 365” or “Outlook” already use Graph API.

This migration isn’t a simple endpoint swap. Graph uses a different authentication model, scopes (OAuth 2.0 with granular Graph API scopes instead EWS.AccessAsUser.All or EWS.AccessAsApp), different data structures than EWS. That means every connected Exchange/Outlook account in SyncPenguin needs to go through a reconnection process to authorize the new Graph-based connection and generate fresh access tokens.

Action Required: Reconnecting Accounts Flagged with a Warning

To make this transition as smooth as possible, we’ve rolled out account-level warnings inside SyncPenguin for any connection that still needs to move over to Graph. If one of your synced accounts is affected, you’ll see it marked with a “Warnings found” yellow label on your sync page.

Here’s what to do:

1. Open your sync page in SyncPenguin.
2. Look for any connected account marked with “Warnings found” and click on it.
3. Click the RECONNECT button on the connection window.
4. Follow the on-screen steps to sign in and re-authorize the connection through Microsoft’s OAuth 2.0 login flow.

Once reconnected, that account will be running on the Microsoft Graph API, and your contacts, calendar, and task syncing will continue uninterrupted — including after Microsoft begins disabling EWS in October 2026.

Why You Shouldn’t Wait

It might be tempting to leave this until closer to the October 2026 deadline, but we’d recommend reconnecting as soon as you see the warning on your account for a few reasons:

• Phased disablement means unpredictable timing. Because the initial October 2026 shutdown is tenant-controlled on Microsoft’s side, some organizations’ EWS access could stop working before others, depending on their tenant configuration.
• Avoid a sync gap. Reconnecting proactively means there’s no window where your calendar, contacts, or tasks fall out of sync because the underlying API stopped responding.
• It only takes a minute. The reconnect flow is a short, guided process — sign in, grant the updated permissions, and you’re done. Our support is always ready to help in case of any questions.

A Note on Public Folders

There’s one area where this migration isn’t a clean like-for-like swap: public folders.

Microsoft Graph does not currently offer full API support for programmatically creating, reading, updating, or deleting public folder content, and Microsoft has confirmed this gap will continue to exist when EWS access is disabled in October 2026. In other words, this isn’t something SyncPenguin can simply route through Graph the way we can with individual mailbox contacts, calendar meetings, and tasks — the replacement API doesn’t yet exist on Microsoft’s side.

If you currently sync a public folder through SyncPenguin, here’s what this means for you:

• Syncing for public folder contacts, calendars, or tasks will stop working once EWS access is disabled for your tenant, since there is no Graph-based equivalent to fall back on.
• This limitation comes directly from Microsoft’s API roadmap, not from SyncPenguin — we’re tracking Microsoft’s public folder parity work closely and will roll out support the moment a viable Graph-based path is available.
• In the meantime, please reach out to our support team if public folder syncing is part of your workflow. We can walk you through the current status, help you plan around the change, and flag your account so we can notify you directly if and when Graph support for public folders becomes available.

We know this is a frustrating gap, and it isn’t unique to SyncPenguin — it affects every third-party tool that has relied on EWS for public folder access. We’ll continue publishing updates here as Microsoft’s public folder support on Graph evolves.

Questions?

If you run into any issues during the reconnecting process, or you’re not sure whether one of your accounts is affected, reach out to our support team and we’ll help you get sorted quickly.

Thanks for being a SyncPenguin customer — we’re committed to keeping your sync running reliably through this transition and beyond.