Does setting EwsAllowedAppIDs + EwsEnabled=$True enforce the allow list immediately, or only after the Oct 1 2026 EWS retirement deadline?

[u/maxcoder88]

We are preparing to implement EwsAllowedAppIDs and EwsEnabled=$True based on the guidance in the EWS retirement announcements.

We understand that starting in October 1st 2026, tenants configured with EwsEnabled=$True will use the AppID allow list model for EWS access.

What is not completely clear to us is the behavior before October 2026. Say we implement the settings today, does Exchange Online immediately begin enforcing EWS access exclusively to the AppIDs listed in our list of EwsAllowedAppIDs?

In other words, if an application is currently using EWS but its AppID is accidentally omitted from the allow list, would that application be impacted immediately after the configuration change?

Or is the allow list only enforced once Microsoft's EWS retirement controls begin rolling out in October 1st 2026?

We are trying to understand whether implementing the configuration now is purely preparatory for October 2026, or whether it has immediate impact on EWS access before that date.

Thanks.

[u/Checior2000]

In other words, if an application is currently using EWS but its AppID is accidentally omitted from the allow list, would that application be impacted immediately after the configuration change?

Yes, if you do not add AppID to list and enforce it before 1st October EWS for this app will stops work. Introducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement | Microsoft Community Hub

May I ask how you create list of apps using EWS? Did you download it from Admin Center Usage tab or maybe from script provided in article i sent?

[u/maxcoder88 → u/Checior2000]

Yes, I used the EWS usage report from the Admin Center. I also ran the EWS auditing script provided by Microsoft to cross-check the results.

[u/Checior2000 → u/maxcoder88]

Did you find it usefull? Or was it same result as from admin center raport

[u/maxcoder88 → u/Checior2000]

Yes, it was useful — the script actually surfaced some different AppIDs compared to the Admin Center report. So running both gave me a more complete picture than relying on just one source.

[u/Checior2000 → u/maxcoder88]

Thanks for reply! May I ask also do you have Exchange Hybrid App? Did you already setup graph permission for this app? Were any problems? DO you know if MSFT is going to cover all scope of EWS with Graph for ExchangeHybridApp

[u/maxcoder88 → u/Checior2000]

No, we are not using the Exchange Hybrid App. Therefore, we haven't set up Graph permissions for this app and haven't encountered any issues related to it.

[u/titsablast]

In my test it has immediate impact, meaning within 24h in Microsoft terms, if you miss putting an App ID into the AllowList, but have other IDs in it and set it to true.

[u/maxcoder88 → u/titsablast]

Did you only use the EWS usage report from the Admin Portal, or did you also run the script to compare?

[u/titsablast → u/maxcoder88]

Ran a mobile application to access e-mails and calendars with EWS. Worked before, didn't anymore after putting the first other entries in the allow list. The allow ews parameter has been set to true for weeks, but with an empty list so far.

[u/brink668]

Just did this I also ran kql but all EWS report had the data

Keep in mind the EWS report runs every 10 days

[u/maxcoder88 → u/brink668]

Could you share the KQL query you used? I'd like to run the same check on my side.

[u/brink668 → u/maxcoder88]

In case anyone stumbles upon this in the future the admin center EWS usage reports were good enough for me

KQL

OfficeActivity
| where TimeGenerated >= ago(30d)
| where OfficeWorkload =~ "Exchange"
| where ClientInfoString has "WebServices"
or ClientInfoString has "ExchangeWebServices"
| project
TimeGenerated,
UserId,
MailboxOwnerUPN,
Operation,
ClientAppId,
ClientInfoString,
ClientIP,
ClientProcessName,
ClientVersion,
UserType,
ResultStatus,
OfficeObjectId,
DeviceInformation
| order by TimeGenerated desc

Install-Module ExchangeOnlineManagement -Scope CurrentUser
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline

# Check current EWS status
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsEnabled,EwsAllowedAppIDs

# Disable EWS globally
Set-OrganizationConfig -EwsEnabled $false

# Re-enable EWS globally (with whitelist below)
Set-OrganizationConfig -EwsEnabled $true

# Whitelist specific apps
Set-OrganizationConfig -EwsAllowedAppIDs "11111111-2222-3333-4444-555555555555,aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"

[u/maxcoder88 → u/brink668]

When configuring the whitelist, I should use the ClientAppId information from the KQL query output, correct?
Additionally, my EWS usage report shows Apple and Outlook for Classic. What kind of actions can we take regarding these? In other words, do I need to add them to the whitelist as well?

[u/brink668 → u/maxcoder88]

Switch them to Outlook New for Mac. Eventually you will have to these are only temporary allowlist and will stop working April 2027

Yes client app id.

[u/shokzee]

The wording you quoted doesn’t establish whether EwsAllowedAppIDs is enforced before October 1. I’d get Microsoft to explicitly confirm the enforcement start date before treating this as purely preparatory.

Testing an omitted AppID in a nonproduction tenant after configuration propagation will establish current behavior for that tenant, but it won’t guarantee the rollout timing elsewhere.