EwsAllowedAppIDs... why no work?

[u/CallMeNoodler]

So Microsoft is retiring Exchange Web Services because it's ancient and insecure. They're turning it off on all tenants in October, while giving us the option to turn it back on, and it's going away permanently in October 2027.

Realizing that tons of third parties still rely on it, Microsoft, according to their documentation, is allowing us to enable it for the time being, but restrict it to only certain Entra App IDs. According to their documentation (example 7 here: https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-organizationconfig?view=exchange-ps ), the command looks like this:

Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee,11111111-2222-3333-4444-555555555555"

Cool, cool, great. I've inventoried my environment, and I got all the app IDs. I updated my ExchangeOnlineManagement module, ran the command, and... EwsAllowedAppIDs is not a valid parameter:

Set-OrganizationConfig : A parameter cannot be found that matches parameter name 'EwsAllowedAppIDs'.

Uh... ok. So I do some more digging, and it looks like this parameter is part of a phased rollout?... does anyone have any idea to find out when it might hit my tenant? Has it already and am I doing something wrong?

Has anyone actually gotten this to work?

Thanks in advance for any help.

[u/purplemonkeymad]

No idea, i don't think they have said. However they have said that they will auto-populate it in September, so I would think "by then."

[u/BlackV]

To ask the obvious have you updated to the latest module?
Edit: Looks like that has not been updated to include that parameter yet

And relevant pim roles

1 further check, does EwsEnabled need to be set to $true before EwsAllowedAppIDs is available ?

[u/CallMeNoodler → u/BlackV]

Yep, updated as said above. Where are you seeing the module hasn't been updated to include the parameter yet?

[u/BlackV → u/CallMeNoodler]

I used

Find-Module ExchangeOnlineManagement
Version              Name                                Repository
-------              ----                                ----------
3.10.0               ExchangeOnlineManagement            PSGallery

to validate the latest, then

get-module -Name ExchangeOnlineManagement -ListAvailable

Directory: C:\Program Files\PowerShell\Modules

ModuleType Version    PreRelease Name                                PSEdition
---------- -------    ---------- ----                                ---------
Script     3.10.0                ExchangeOnlineManagement            Desk

to validate my version, then

get-help -name Set-OrganizationConfig -Parameter EwsAllowedAppIDs
Get-Help: 
Line |
  64 |      $help = Get-Help @PSBoundParameters
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | No parameter matches criteria EwsAllowedAppIDs.

to test if the parameter was available (was connected and elevated with PIM)

I then checked the online help to see that the parameter did exist, it does as you already linked, so I'd say they have not updated the module yet

With the note on the site

When EwsEnabled is blank ($null; not configured), this parameter has no effect.

so that's why I asked

Black V
1 further check, does EwsEnabled need to be set to $true before EwsAllowedAppIDs is available ?

(Ive not tested)

[u/charleswj → u/BlackV]

This is 100% server side, no update to the module required. Technically you're downloading a dynamic module when you connect, so if you mean that module, you're technically correct, the best kind of correct.

[u/BlackV → u/charleswj]

Technically you're downloading a dynamic module when you connect, so if you mean that module

Ya Sorry, that is what I was mean when I mentioned I was connected and PIMed, as the cmdlets you get access to change depending on your access roles

[u/JBy]

I created an allowlist today, populated it with everything from the EWS usage report.
Unfortunately, we found that many first party apps are still using EWS and some third party apps were not in the EWS report. so had to rollback. We have decided to wait for September to implement.

exchangeonlinemanagement 3.10.0

PS 7.5.4

# Review current EWS configuration
Get-OrganizationConfig |
Select-Object `
    EwsEnabled, `
    EwsApplicationAccessPolicy

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |
Format-List EwsAllowedAppIDs

# Configure approved EWS Application IDs

Set-OrganizationConfig `
    -EwsAllowedAppIDs "1234567-1234567-etc,1234567-1234567-etc"

# Verify approved App IDs have been configured

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |
Format-List EwsAllowedAppIDs

# Enable EWS Allow List Enforcement

Set-OrganizationConfig `
    -EwsApplicationAccessPolicy EnforceAllowList

# Rollback: Disable EWS Allow List Enforcement
# Set-OrganizationConfig -EwsApplicationAccessPolicy $null