If you use SyncPenguin to keep your contacts, calendar meetings, or tasks in sync between Exchange\/Outlook and other platforms, this post explains an important change happening under the hood \u2014 and a small action some of the customers will need to take to keep their sync running smoothly.<\/p>\n\n\n\n
Note: this only relates to customers who currently use connectors named “Office 365”<\/strong> in SyncPenguin. If you sync uses “Microsoft 365”<\/strong> or “Outlook”<\/strong> connectors, no action is required as they already use Graph API.<\/p>\n\n\n\n For over a decade, Exchange Web Services (EWS) has been the standard API that third-party applications \u2014 including sync tools like SyncPenguin \u2014 used to read and write mailbox data: emails, calendar events, contacts, and tasks. It’s a mature, well-documented protocol, and a huge share of the Microsoft 365 ecosystem was built on top of it.<\/p>\n\n\n\n That era is ending. Microsoft first signaled the shift away from EWS back in 2018, when it announced that EWS in Exchange Online and Office 365 cloud would no longer receive new feature updates, and that developers should start building on Microsoft Graph platform instead. For years, this was treated as a “soft” deprecation \u2014 EWS kept working, and Graph slowly matured to close the functionality gap.<\/p>\n\n\n\n That changed in 2023, when Microsoft announced a hard deadline for disabling EWS in Exchange Online. The urgency increased further after the Midnight Blizzard incident in January 2024, in which attackers exploited an OAuth application with EWS-related permissions. That incident pushed Microsoft to widen the scope of the EWS shutdown to cover Microsoft’s own first-party applications as well, not just third-party ones.<\/p>\n\n\n\n It’s worth noting that this deprecation applies specifically to Exchange Online<\/strong> (cloud-hosted mailboxes). On-premises Exchange Server deployments are not affected by this timeline, since Microsoft Graph does not currently offer a path for on-premises mailbox access, and there no such plans at the moment. Organizations running hybrid environments will need to pay close attention to how their mailboxes are hosted, since only cloud-hosted mailboxes are impacted by the shutdown.<\/p>\n\n\n\n Given the scale of the Microsoft 365 ecosystem, this is not a niche change \u2014 it affects every application that has historically relied on EWS to talk to Exchange Online, including backup tools, migration tools, CRM integrations, and two-way sync services like SyncPenguin.<\/p>\n\n\n\n SyncPenguin has historically used EWS to power two-way synchronization of:<\/p>\n\n\n\n between Exchange\/Outlook accounts and the other platforms our customers connect. With Microsoft’s shutdown timeline now locked in, we’ve been migrating this integration over to the Microsoft Graph API<\/strong> \u2014 the modern, OAuth-based API that Microsoft is standardizing on across Microsoft 365. Note that only the “Office 365”<\/strong> connector is affected. Connectors named “Microsoft 365”<\/strong> or “Outlook”<\/strong> already use Graph API.<\/p>\n\n\n\n This migration isn’t a simple endpoint swap. Graph uses a different authentication model, scopes (OAuth 2.0 with granular Graph API scopes instead To make this transition as smooth as possible, we’ve rolled out account-level warnings inside SyncPenguin for any connection that still needs to move over to Graph. If one of your synced accounts is affected, you’ll see it marked with a “Warnings found”<\/strong> yellow label on your sync page.<\/p>\n\n\n\n Here’s what to do:<\/p>\n\n\n\n Once reconnected, that account will be running on the Microsoft Graph API, and your contacts, calendar, and task syncing will continue uninterrupted \u2014 including after Microsoft begins disabling EWS in October 2026.<\/p>\n\n\n\n It might be tempting to leave this until closer to the October 2026 deadline, but we’d recommend reconnecting as soon as you see the warning on your account for a few reasons:<\/p>\n\n\n\n There’s one area where this migration isn’t a clean like-for-like swap: public folders<\/strong>.<\/p>\n\n\n\n Microsoft Graph does not currently offer full API support for programmatically creating, reading, updating, or deleting public folder content, and Microsoft has confirmed this gap will continue to exist when EWS access is disabled in October 2026. In other words, this isn’t something SyncPenguin can simply route through Graph the way we can with individual mailbox contacts, calendar meetings, and tasks \u2014 the replacement API doesn’t yet exist on Microsoft’s side.<\/p>\n\n\n\n If you currently sync a public folder through SyncPenguin<\/strong>, here’s what this means for you:<\/p>\n\n\n\nThe Background: Why EWS Is Going Away<\/h3>\n\n\n\n
Key Dates<\/h4>\n\n\n\n
What This Means for SyncPenguin<\/h3>\n\n\n\n
EWS.AccessAsUser.All<\/code> or EWS.AccessAsApp<\/code>), different data structures than EWS. That means every connected Exchange\/Outlook account in SyncPenguin needs to go through a reconnection process<\/strong> to authorize the new Graph-based connection and generate fresh access tokens.<\/p>\n\n\n\nAction Required: Reconnecting Accounts Flagged with a Warning<\/h3>\n\n\n\n
Why You Shouldn’t Wait<\/h3>\n\n\n\n
A Note on Public Folders<\/h3>\n\n\n\n