Exchange Online EWS disabled: why apps stopped working and how to fix it

What changed in October 2026

Microsoft has been retiring EWS in Exchange Online for years. In its February 2026 Exchange Team post (updated in October) it set out the final steps:

Date	What happens
Until end of September 2026	Preparation period. Admins could set EWS on and build an app allow list to opt out of the October change.
On or soon after October 1, 2026	Tenants that hadn’t configured EWS (setting left blank) were switched to off, which blocks EWS for every app.
Until April 2027	Admins can still turn EWS back on.
From April 1, 2027	EWS is “fully and permanently disabled”, with no exceptions.

Exchange Server on your own hardware isn’t affected. In a hybrid setup, mailboxes still on-premises keep using EWS. If your tenant was switched off, Microsoft 365 Message center should show posts titled “Action may be required: EWS will be disabled in your tenant in 7 days” and “EWS has been disabled in your tenant”.

Which apps break

Microsoft’s own troubleshooting post, “Exchange Online EWS application stopped working? Do this.”, names these as typical casualties:

• Apple Mail and Calendar on macOS with an Exchange account
• Classic Outlook for Mac
• Some Outlook desktop add-ins, and outdated versions of Outlook for Windows
• Third-party apps that read mailboxes, especially backup and migration tools

Microsoft says these apps “might give you various errors”. Some show a clear message that the EWS protocol isn’t available; others just keep prompting for a username and password, which looks like a sign-in problem but isn’t. Microsoft doesn’t publish one fixed error text, so go by the timing: if an app broke in early October 2026 and the mailbox is in Exchange Online, check EWS first. iPhone and iPad Mail use a different protocol (ActiveSync) and weren’t affected, according to MacRumors.

Confirm EWS is off in your tenant

Connect to Exchange Online PowerShell as an admin and run:

Get-OrganizationConfig | Fl EWSEnabled

Microsoft’s post says that if the answer is EwsEnabled : False, EWS is disabled. A blank value means it was never configured (EWS on), and True means it’s on but limited to an allow list of apps.

Microsoft support can’t turn EWS back on for you. A global admin or Exchange admin in your organisation has to do it.

Fix 1: Turn EWS back on in the admin center

1. Sign in to the Microsoft 365 admin center as an admin.
2. Open the Baseline Security Mode settings, where Microsoft placed the EWS control.
3. Untick Block your entire organization from using EWS. To allow only certain apps, use the Exclude specific apps option instead.
4. Save, then give it time before testing.

Microsoft says re-enabling “usually takes less than an hour”, and up to four hours in rare cases.

Fix 2: Turn EWS back on with PowerShell

The Set-OrganizationConfig documentation gives three values for -EwsEnabled, and the difference matters:

Value	Effect
$null (blank)	Not configured. EWS works for all apps, as it did before October. This is the simplest way to restore everything.
$true	EWS is on, but only apps listed in EwsAllowedAppIDs can use it. Anything not on the list stays blocked.
$false	All EWS access is blocked, whatever the allow list says.

To restore access for every app until the April 2027 cut-off:

Set-OrganizationConfig -EwsEnabled $null

To allow only named apps, use their Microsoft Entra application IDs:

Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<app-id-1>,<app-id-2>"

You can see the current list with Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Fl EwsAllowedAppIDs. Microsoft says it built a list automatically for tenants that never made one, based on apps seen in the last 60 days, so an app used rarely may be missing. Allow-list changes take about 24 hours to apply. Admins report that setting the list replaces it rather than adding to it, so include every app you still need.

Don’t confuse this with EwsAllowList and EwsBlockList, older settings that filter by user agent. Microsoft says those are “not related to EWS deprecation”.

If one user is still broken

EWS can also be turned off for a single mailbox. The Set-CASMailbox documentation says the mailbox setting only counts when the organisation setting isn’t $false. Check and fix one user like this:

Get-CASMailbox [email protected] | Fl Ews*
Set-CASMailbox [email protected] -EwsEnabled $true

Then have the user quit and reopen the app. If it still prompts for a password, remove and re-add the account. For Outlook on Windows, resetting Outlook to default settings covers creating a fresh profile.

Apple Mail and Calendar on Mac

Apple says on its deployment support page that it’s working with Microsoft to move Mail, Calendar, Contacts, Notes and Reminders on the Mac to Microsoft Graph “in a future update to macOS 27”. As of early October 2026 that update hadn’t shipped, so check Apple’s page for the current status.

Until it arrives, Mac users have two practical options:

• Ask your admin to keep EWS available until April 2027 (Fix 1 or Fix 2).
• Switch to new Outlook for Mac, which doesn’t rely on EWS. If you work with a shared mailbox, see how to add a shared mailbox in Outlook.

Some people suggest setting the account up as IMAP. That’s not Microsoft’s or Apple’s advice; it covers mail only, not calendar or contacts, and only works if your organisation allows IMAP.

Before April 2027: the real fix

Turning EWS back on is a stopgap. Microsoft’s guidance is to update each app to a version that doesn’t use EWS, ask the vendor about its plan, or move in-house code to Microsoft Graph. Practical steps:

• List every app that broke in October, plus anything on your allow list.
• Check each vendor’s notes. Backup tools such as Veeam have published their own EWS guidance.
• Move users of classic Outlook for Mac and outdated Outlook for Windows to current versions. If you rely on classic Outlook on Windows, keep it updated; see how to get classic Outlook.
• Once nothing needs EWS, Microsoft says “you can simply leave it” blocked.

Other Exchange Online sync faults can look similar. If rules won’t load rather than mail, see “There was an error reading the rules from the server”.

Related guides

• How to reset Outlook to default settings (classic and new Outlook)
• How to add a shared mailbox in Outlook (Windows, Mac, web and mobile)
• Classic Outlook download: how to get it back on Windows 11 and 10
• “There was an error reading the rules from the server” in Outlook
• Classic Outlook error when sharing Contacts: the workaround that works

Official sources

• Microsoft Exchange Team: Exchange Online EWS application stopped working? Do this.
• Microsoft Exchange Team: Exchange Online EWS, your time is almost up
• Microsoft Learn: Set-OrganizationConfig