Microsoft Exchange Online EWS API Retirement Breaks Legacy Applications

Microsoft has confirmed that IT administrators can re-enable the retired Exchange Web Services (EWS) API in Exchange Online. This action restores functionality for applications that have stopped working due to the API’s default disablement. The company provided specific instructions for tenant admins to uncheck the block setting in the Microsoft 365 admin centre Baseline Security Mode. Alternatively, administrators may use Exchange Online PowerShell to run a command that re-enables the service within four hours.

Root cause

The disruption stems from Microsoft’s planned retirement of the EWS API, which was announced in February. The company stated it would begin blocking EWS by default on 1 October 2026, with a final shutdown scheduled for 1 April 2027. When EWS is disabled, applications that depend on it display errors such as unavailable protocol alerts or repeated credential prompts. This affects various tools, including Outlook desktop add-ins, older Windows Outlook versions, and Apple Mail on macOS.

Attack path

This event involves no malicious activity or exploitation. The service interruption results from Microsoft enforcing its deprecation timeline for the legacy API. Applications fail because they attempt to communicate via EWS, which is now blocked by default in Exchange Online environments. The errors are purely functional, indicating that the protocol is unavailable rather than suggesting a security breach or unauthorised access attempt.

Affected versions

• Older versions of Outlook for Windows
• Outlook desktop add-ins relying on EWS
• Apple Mail and Calendar applications on macOS
• Custom-built applications using the EWS API
• Third-party apps accessing Exchange mailbox items via EWS

Mitigation

• Uncheck "Block your entire organization from using EWS" in the Microsoft 365 admin centre Baseline Security Mode.
• Run the "Set-OrganizationConfig -EWSEnabled $true" command in Exchange Online PowerShell to re-enable access within four hours.
• Contact application vendors to obtain updated versions that do not use EWS.
• Modify custom application code to replace EWS calls with Microsoft Graph API endpoints.

Why it matters

Teams usually encounter similar disruptions when legacy protocols are retired in favour of modern standards. It is essential to identify which internal tools depend on deprecated interfaces before enforcement dates arrive. Administrators should verify application compatibility with current APIs and coordinate with vendors for updates. Monitoring logs for authentication failures or protocol errors helps detect affected services early. Planning migration paths well in advance prevents sudden service outages and ensures continuity for critical business applications.

What to do and how to stay safe: Microsoft

• Inventory all applications accessing Exchange Online to identify those using the EWS API.
• Contact vendors to confirm whether updated versions supporting Microsoft Graph are available.
• Test alternative API integrations in a non-production environment before full deployment.
• Monitor application logs for EWS-related errors once the default block is enforced.

Step-by-step guide: Password Policies Examples That Reduce Password Fatigue

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When will the ability to re-enable EWS stop working?

Microsoft states that re-enabling EWS will stop working in April 2027.

Does this retirement affect on-premises Exchange Server installations?

No, the EWS retirement process affects only Microsoft 365 and Exchange Online environments.

What is the recommended long-term solution for EWS-dependent apps?

Update applications to versions that do not use EWS, preferably switching to the Microsoft Graph API.