Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working.
EWS is an API for developing apps that can access Exchange mailbox items (e.g., email messages, meetings, and contacts) from Exchange Online and on-premises Exchange servers.
This API is used by various apps, including but not limited to Outlook desktop add-ins, older versions of Outlook for Windows, the Apple Mail / Calendar on macOS, and various other apps.
In February, the company announced it will start blocking the EWS API by default on October 1, 2026, but will let IT administrators temporarily maintain access via an app allowlist until the final shutdown on April 1, 2027. However, when EWS is disabled, the apps show errors ranging from alerts that the EWS protocol is unavailable to repeated prompts to enter the username or password.
To avoid these issues and fix EWS apps that are no longer working, Microsoft says tenant administrators can re-enable EWS in the Microsoft 365 admin center Baseline Security Mode by unchecking "Block your entire organization from using EWS" on the Baseline Security Mode page.
Another option is to use Exchange Online PowerShell to run the "Set-OrganizationConfig -EWSEnabled $true" command, which should re-enable EWS within 4 hours.
"We are now in the first stage of EWS disablement, where customers are still able to re-enable EWS. Re-enabling EWS will stop working in April 2027," Microsoft said.
"The long-term solution is to update your applications to the application versions that do not use EWS. You must contact your application vendor to get the updated application version, or if you created the application yourself, you must change the code to not use EWS anymore."
Microsoft also advised app developers using the EWS API to switch to the Microsoft Graph API before EWS shuts down, since it has near-complete feature parity with EWS for most scenarios.
The company also added that the EWS retirement process affects only Microsoft 365 and Exchange Online environments, and the API will continue to work in on-premises Exchange Server installations.
The EWS retirement announcement followed a 2018 warning that EWS would stop receiving functionality updates and Microsoft's September 2023 announcement that it planned to begin shutting down the EWS API in October 2026.
In October 2021, Microsoft revealed that it had deprecated the 25 least-used EWS Exchange Online APIs and removed support for them in March 2022 for security reasons.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.