Project Online retires on 30 September 2026 and its data becomes inaccessible. From 1 October, Microsoft starts deprecating EWS for cross-tenant free/busy, MailTips and calendar sharing, which move to Cross-Tenant Access Policy.
Exchange Web Services starts switching off in Exchange Online in October 2026, fully off by April 2027
EditorialBy TrustList Editorial
Microsoft begins disabling Exchange Web Services (EWS) in Exchange Online for all organisations in October 2026 and switches it off fully in April 2027. Apps that still use EWS, including Apple Mail and Calendar on macOS, need a migration plan now.
- United States
- Redmond, Wa
- Email Management
- Calendar Management
- +1 more
About Exchange Web Services starts switching off in Exchange Online in October 2026, fully off by April 2027
Exchange Web Services starts switching off in Exchange Online in October 2026, fully off by April 2027
1 October 2026: The long-announced end of Exchange Web Services (EWS) in Exchange Online has arrived. Microsoft's deprecation page states the timeline plainly: in October 2026, "EWS starts to be disabled globally for all organizations", and in April 2027 it is fully disabled. heise online reported on 30 September 2026 that the staged switch-off begins on 1 October. Microsoft's own page, read on 1 October, gives the month but not the day.
EWS is the old SOAP interface that many third-party mail, calendar, archiving, backup, CRM and room-booking tools use to reach Exchange mailboxes. Microsoft's replacement is Microsoft Graph.
What Microsoft's page says
- The disablement date was set in 2023. After the Midnight Blizzard incident in January 2024, which involved EWS, the scope was widened from third-party applications to all Microsoft applications as well.
- Microsoft offers EWS Usage Reports, an EWS Analyzer tool and a tutorial for AI-assisted code migration to help find and move EWS dependencies.
- A roadmap of remaining Graph gaps lists items still due in the third and fourth quarters of 2026, including full-fidelity import and export for archive, public folder and group mailboxes, In-Place Archive access, an Exchange Admin API, mailbox notes and contact lists. Microsoft says that if a capability is not on that list, you should not plan on a Graph equivalent arriving before EWS is fully disabled.
- Some EWS capabilities will never come to Graph: generic public-folder create, read, update and delete; generic Microsoft 365 Group mailbox item access; and legacy Discovery Mailbox access.
The Mac problem
heise reports that the built-in macOS apps (Mail, Calendar, Reminders, Contacts and Notes) use EWS to sync with Exchange Online, and that Apple has said support for Graph will come in a future update to macOS 27, without a date. heise found no sign of it in macOS 27.0.1. As EWS is switched off, those apps can stop syncing with Microsoft 365 mailboxes. heise says administrators can keep EWS working for listed applications for the coming months through an allow-list; we have not found that detail on Microsoft's page. iPhone and iPad mail use Exchange ActiveSync, not EWS.
What to do
- Run the EWS Usage Reports in the Microsoft 365 admin centre to see which applications still call EWS, and how often.
- Ask each vendor on that list for its Graph migration date in writing. Archiving, backup, e-discovery and migration tools are the most likely to depend on capabilities still on Microsoft's gap list.
- Plan for Mac users: move them to Outlook for Mac, or put the built-in apps on an exception path, until Apple ships Graph support.
- Do not build anything new on EWS. Microsoft is clear that features missing from its roadmap will not arrive before April 2027.
- On-premises Exchange Server is not part of this change; the timeline applies to Exchange Online.
Update, 22 October 2026: Microsoft has begun switching EWS off in tenants where neither EWSEnabled nor the app allow list had been set: such tenants get a seven-day Message Center notice, then Microsoft fills the allow list from the last 60 days of use and sets EWSEnabled to False. In a post of 21 October the Exchange team says only the tenant administrator can turn EWS back on, through Baseline security mode in the Microsoft 365 admin center or with Set-OrganizationConfig -EWSEnabled $true in Exchange Online PowerShell, usually within an hour and in rare cases up to four, and that changes to the allow list take 24 hours. That route is temporary: "Re-enabling EWS will stop working in April 2027." The apps it names as affected include Apple Mail and Calendar on macOS, classic Outlook for Mac, some Outlook add-ins, outdated Outlook for Windows and third-party backup tools.
Sources
Categories & features
- United States
- Redmond, Wa
- Email Management
- Calendar Management
- Calendar Sync
TrustList Weekly
The week in software and IT, in one email
The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.
You may be interested in
Microsoft says Outlook on the web and the new Outlook now handle attachments as a separate application, so existing Conditional Access policies apply to attachment download, preview and upload, and non-compliant users are blocked.
Microsoft says promotional mail will be tagged as Promotions in every Defender for Office 365 tenant at worldwide general availability, completing by late October 2026; moving it to a Promotions folder depends on the Bulk moves setting.
Microsoft re-released the September 2026 Exchange security updates on 2 October to add CVE-2026-96940 (CVSS 8.8): a signed-in user could read other mailboxes in the same organisation. Hybrid and management-tools servers need it too.
Microsoft says ExchangeOnlineManagement versions before 3.10.1 may fail interactive sign-in once strict logon enforcement begins on 31 March 2027 (rollout to late April), especially PowerShell 7 with WAM disabled. Upgrade and test scripts first.
From 10 October 2026, Exchange Online apps using EWS must be listed in EWSAllowedAppIDs (MC1485116); Microsoft fills the list on 8-9 October from 60 days of use. SharePoint one-time passcodes retire from mid-October to end November (MC1243549).
Secondary calendars, the rotas and team schedules users create, now disappear when their owner's account is deleted and go dark when it is suspended. Ownership has to move first.
Thunderbird 158.0.1 and 153.5.1 fix three high-rated flaws, including XMPP stanza injection and an NTLM memory leak; Firefox 158.0.1 and both ESRs build in the block on compromised eMudhra intermediates.
More on TrustList
Everything here links back to the same verified catalogue. Pick your next stop.
- More United StatesThe ranking for this subject
- CompaniesAgencies, consultancies and IT service providers, ranked by verified reviews.
- ProductsSoftware and SaaS with pricing, features, integrations and alternatives.
- AwardsAnnual recognition decided by verified reviews and an independent jury.
- LaunchesNew products and releases, voted up by the community every day.
- AI ModelsBenchmark scores and community ratings for every major model.
- RequestsBuyers describe what they need; vendors respond directly.
- PeopleReviewers, authors and makers with public profiles.
- ComparePut up to four listings side by side before you shortlist.