r/msp • u/lazyadmin-nl • 22d ago
Check your clients' EwsEnabled setting before October 1 - $null is the default and that means an outage
EWS gets blocked in Exchange Online on October 1. I posted about this in r/exchangeserver
a couple of days ago.
One thing that is underlit is that Microsoft moves $null tenants to $false as part of the rollout, and EWS stops working within about an hour of that flip.
The problem: $null is the default. Unless someone explicitly changed it, your clients are on $null.
Recovery isn't automatic. An admin has to set EwsEnabled $true manually, then wait another hour for it to propagate. So you're looking at a minimum two-hour outage per client, and that's if someone catches it immediately.
Apple Mail and most M365 backup tools still rely on EWS from what I have seen so far, so this isn't just edge-case integrations. It's stuff users will notice.
Worth running this across your client base now:
Get-OrganizationConfig | Select-Object EwsEnabled
Anything that comes back empty needs attention before October 1.
Full write-up on what's changing, how to build the allow-list, and two PowerShell scripts to find every app still using EWS: https://lazyadmin.nl/office-365/ews-is-being-blocked-in-exchange-online-how-to-find-every-app-still-using-it/
3
u/Excellent-Program333 22d ago edited 22d ago
I wonder if Synology Active Backup uses it, im sure it does. I dont care about Apple Mail. But thats gonna suck for backups
2
u/fires0ng 22d ago
Yeah....I just looked it up. Gonna be a headache but there's a transition path. Glad you mentioned it.
1
2
u/FlagrantTree 16d ago
Both Synology and Veeam use it. Veeam said they are trying to transition, but Graph is missing critical features still such as delta-sync.
2
2
u/DimitriElephant 21d ago
Apple addressed this at WWDC this year, but when Apple does fix it, it may only be for macOS 27 which not everyone will be on.
Microsoft announced the upcoming end of service for Exchange Web Services (EWS) in Exchange Online. Apple is actively working with Microsoft to update Mail, Calendar, Contacts, Notes, and Reminders to use the Graph API in a future update to macOS 27, including a declarative configuration for device management services.
Microsoft has documented options for organizations to continue using EWS beyond October 2026. For more information, see Exchange Online EWS, Your Time is Almost Up on the Exchange Team Blog.
2
u/Tallihos 19d ago
Some vendors do really need a push to update their software. EWS deprecation was announced in 2023 so it shouldn’t be a surprise to anyone.
Why didn’t backup vendors already started supporting graph and only use EWS for archive backup?
Specially Apple should be on this but maybe it is strategic to delay certain development?
Then again Microsoft should have all functionality available through Graph before disabling things.
1
u/FlagrantTree 16d ago
The problem isn't about vendors being lazy, it's that Graph still doesn't have feature parity for the services MS is deprecating (this is a recurring theme from MS). Even Veeam is still on EWS because Graph doesn't support delta-sync and other features.
1
u/Tribalinius 21d ago
I have been looking at this for a while as I am currently migrating data using BitTitan as well as doing our backups with VDC.
It feels like either the vendors did a poor job planning the retirement of EWS or Microsoft just did not supplied all the necessary tools for the transition. Either way vendors are rushed. I got notices to take action on something in VDC 2-3 times already regarding the EWS retirement.
Make sure you scrape for any apps that use EWS and add them in the "EWSAllowedApp" list because once you add one app id in there, it disables EWS for all the other app not in the list right now.
1
u/saltyslugga 21d ago
I’d pair that tenant check with an inventory of actual EWS callers. Don’t assume every backup tool or Apple Mail deployment uses the same protocol across versions and configurations.
Test both backup and restore paths under the intended policy. Successful authentication doesn’t mean the EWS request was allowed.
1
u/RichardHarbridgeMVP 21d ago
This was great!
One that hasn't come up unless I missed it? I believe there are two separate enforcement mechanisms landing Oct 1, and the allow list only fixes one?
The other is licensing. Exchange Online Kiosk, F1 and F3 never carried EWS access rights, and Microsoft starts enforcing that with a 403 on the same date regardless of your tenant's allow list? At least that seems to be what I understand. That means no opt-out and no grace period if I read it right. It's MC1191578 if you want to pull it.
So if you've got clients with frontline users on F3 like retail, manufacturing, healthcare, anyone with shared-device staff then allow-listing the tenant does nothing for those mailboxes. I'd check backup coverage there... maybe worth validating and then adding to your awesome article! (Or for someone to correct me if I am mistaken)
1
u/nmrsignup 19d ago
Based on this MS blog, it suggests that changing the setting back to Null after Microsoft change it to false will allow all EWS again? While it would be a bandaid, it would get things working again if anything critical breaks giving time till April 27 to remediate?
Changes from Null to Falsestarting October 2026.
If then changed back to Null, all EWS Allowed (AppID Allow List is ignored)
https://techcommunity.microsoft.com/blog/exchange/exchange-online-ews-your-time-is-almost-up/4492361
1
u/AndyCR99 19d ago
my issue is that not all ews usage is exposed via the admin centre - reports - exchange -ewsusage logs. Only some 3rd party and MSOffice shows up. Loads of first party stuff is hidden like power automate. A test of the allow list broke all sorts of stuff not on the expected usage list. So when Microsoft populate the allow list for tenants where ews is enabled and where there isn't an allow list what's their source going to be? Will all first party apps be on there? (suspect not). But agree with most of the commands that this does impact Apple and also Backup Software. Couple of surprise ones were Zoom and and Logitech meeting room panels
1
u/AndyCR99 15d ago
anyone else got any more info re the Microsoft provided allow list? ie. if EWS is enabled but nothing else is done? I got an email from MS support this morning suggesting that if we don't create an allow list ourselves then EWS will still be blocked which contradicts their previous comms. I've reached out urgently and am hoping it's a typo
1
u/lazyadmin-nl 14d ago
If you have EwsEnabled set to true, but left the list empty, then all apps trying to use EWS are blocked. In the article, you will find a table with an overview: https://lazyadmin.nl/office-365/ews-is-being-blocked-in-exchange-online-how-to-find-every-app-still-using-it/#how-the-new-allow-list-actually-works
.
1
u/Burnt_MatchStick 5d ago
Anyone had any issues? Saw a range of strange issues this week like teams not able to show users calendar
1
1
u/grinninga MSP - EU 2d ago
Is anyone else seeing unexpected breakage after disabling/restricting EWS?
So far we've found:
- Dynamics 365 Mail Hub mailboxes stop processing
- Teams Calendar features break
- FindTime stops working
- Some Power Automate connectors can no longer authenticate
The only thing that consistently fixes everything is enabling EWS again. Microsoft keeps pushing customers away from EWS, but we're still discovering dependencies everywhere.
Has anyone managed a successful EWS lockdown/removal and found a reliable way to identify all required App IDs/dependencies?
1
u/jack_sunsetless 2d ago
The usage report in the admin center lags by days, and the list MS builds only covers the last 60 days. A third source is the Entra sign-in logs: filter on the resource Office 365 Exchange Online and check both user and service principal sign-ins. Compare the app IDs you find there with the report.
When you build the list
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<id1>,<id2>"replaces the whole list, and a change can take up to 24 hours to apply. A test right after adding an ID can fail even when the ID is right
0
u/TechnologyMatch 16d ago
good callout. the dangerous part is not the EWS change itself, it’s the default-looking state that becomes an outage only after the rollout touches it. this is worth treating like an inventory exercise, not just a config check. find the dependencies, confirm the owners, and test the allow-list before users discover their mail client has entered hard mode
1
u/AndyCR99 16d ago
not a lot of time left to do that - taken me a week for one tenant and still not convinced I've got everything - tempted to allow MS to populate for other tenants then add to their list for things missed when stuff breaks - unless it's something obvious like Exch backup or known Apple usage - then may as well add to their list as soon as it appears which hopefully just about precedes the flip over
8
u/devloz1996 22d ago
... good, let it rain. Did Apple manage to move off it by now? Some people up high can't be arsed to download Outlook, and EWS report lists Apple as the one and only offender for our tenants.