The EWS Deprecation Dilemma
Starting October 1, 2026, Microsoft will begin the six-month rolling deprecation of Exchange Web Services (EWS) on all Microsoft 365 tenants, with it being turned off for good on April 1, 2027. EWS presents the only effective way to migrate your Public Folder data from Exchange Online. Some tenants will see EWS disabled sooner while others much later, and it is impossible to know when this will occur for your tenant. However, Microsoft is allowing customers to make certain organization-level changes to their tenant to keep EWS-based applications working during the rolling deprecation period.
If you have been on the fence about migrating your public folders from Exchange Online, you will want to act as soon as possible.
Steps to Take
Here are the high-level steps that you need to take before October 1, 2026. You can still make these changes after October 1, 2026, but Microsoft may disable EWS in your tenant at any time after that date.
- Create or use an existing Entra Application that has been granted EWS API permissions
- Enable EWS at the tenant organization level
- Add the App ID from your Entra Application to the EWS Allow list
There are two paths that you can take to complete these steps:
Automated
The automated approach uses a free trial of the ExchangeSavvy Messaging Suite to complete all three steps above. The only requirement is a Microsoft 365 account with sufficient privileges to accept an Entra Application on behalf of your organization. The software will handle everything else. Here is how it works:
- Complete the Get Started form and request a free trial, or click on Contact Us and fill out the form, asking for a free trial to complete the EWS enablement steps
- You will receive a link to the software with directions for installing and activating the free trial license
- Once activated, we will send you a link to a KB article, which walks you through the process
Manual
Here are the steps for completing the EWS enablement process for your tenant:
- Log in to the Entra Administrator Portal
- Click on App registrations in the left-hand blade
- Click on + New Registration near the top of the primary window
- Give your new Entra Application a Name
- For Supported account types, set it to Single tenant only – <tenant name>
- Under Redirect URI (optional), click on the dropdown that states Select a platform and choose Public client/native (mobile & desktop) option
- In the text field next to Redirect URI (optional), paste the following text: urn:ietf:wg:oauth:2.0:oob
- Click Register at the bottom
- On the Overview page of your new Entra Application, take note of the Application (client) ID. You will need this later.
- Click on API permissions on the left-hand blade
- In the primary window, select + Add a permission
- In the new window, click on APIs my organization uses at the top
- In the search bar at the top, type “Office 365“. Select Office 365 Exchange Online
- Click on the Application permissions tile
- Add the following API permissions:
- full_access_as_app under the Other permissions heading
- Exchange.ManageAsApp under the Exchange heading
- Click on Add permissions below
- Back on the primary window, click on Grant admin consent for <tenant name>. Click on Yes when prompted. This will change the status of all APIs to Granted for <tenant name>
- In the far left-hand blade (outside the application), click on Roles & admins
- In the search bar in the primary window, type “exchange“
- Click on Exchange Administrator (do not check the box, as this blocks the ability to click the option)
- Select + Add assignments at the top
- Search for the name of your new Entra Application, check the box when you see it, then click Add
At this point, you have completed the minimum needed for this application. You can add a certificate or client secret later.
Next, we need to enable EWS for your tenant and add the App ID for your new Entra Application to the EWS Allow List:
- Open PowerShell 7 and connect to Exchange Online using the command Connect-ExchangeOnline. If this does not work, you will need to install the module first
- Once connected, run the following command to see the state of EWS enablement for your tenant:
Get-OrganizationConfig | fl EWSEnabled
- Most tenants will have this option empty. However, if it is set to True, you can skip to the next step. Otherwise, run the following command to enable it:
Set-OrganizationConfig -EWSEnabled $true
- Next, run the following command to see if you have any App IDs in the EWS Allow List:
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | fl EwsAllowedAppIDs
- If the command in Step 4 came back blank, then run the following command, inserting the App ID between the double quotes. Otherwise, skip to Step 7:
$newEWSAllowedAppIds = “<Insert App ID here>”
- Add the new App ID to the EWS Allow List:
Set-OrganizationConfig -EwsAllowedAppIDs “$newEWSAllowedAppIds”
- If the command in Step 4 came back with other App IDs listed, then run the following command, inserting the App ID between the double quotes where prompted:
$currentEWSAllowedAppIDs = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |
Select-Object -ExpandProperty EwsAllowedAppIDs)
$newEWSAllowedAppIds = “<Insert App ID here>”
- Append the new App ID to the EWS Allow List:
Set-OrganizationConfig -EwsAllowedAppIDs “$currentEWSAllowedAppIDs,$newEWSAllowedAppIds”
- Confirm that EWS is enabled and the new App ID has been added to the EWS Allow List for your tenant:
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EWSEnabled,EWSAllowedAppIDs
It can take up to an hour for these changes to take effect.
Conclusion
By taking action, you can ensure you can migrate your public folders with most migration solutions through April 1, 2027.
