Avoid disruptions in mailbox access: Microsoft is retiring Exchange Web Services (EWS) in Exchange Online. EWS is the old Exchange API that many applications use to access email, calendar, contacts, and mailbox data. As part of this process, starting July 1, 2026, Microsoft will block EWS access for users whose licenses do not include EWS rights.
Who is affected?
Users with the following assigned licenses will lose access:
- Exchange Online Kiosk
- Microsoft 365 F1 / Office 365 F1
- Microsoft 365 F3 / Office 365 F3
These licenses never included EWS rights, but Microsoft has not enforced the restriction until now.
Starting July 1, 2026, EWS calls from these users will return HTTP 403 (Forbidden).
Does this matter to my organization?
If you have applications, integrations, scripts, or tools that still rely on EWS, they may stop working for these users after July 1, 2026.
Background: EWS – End of Life?
In 2018, Microsoft announced that Exchange Web Services (EWS) will no longer receive functionality updates. Starting October 1, 2026, Microsoft will begin blocking all EWS requests from non‑Microsoft applications to Exchange Online.
Important:
- This retirement applies only to Microsoft 365 and Exchange Online.
- Exchange Server (on‑premises) is not affected; EWS continues to function normally on:
- Exchange Server 2016
- Exchange Server 2019
- Future Exchange Server subscription editions
How does EWS work in Exchange Online?
Exchange Web Services (EWS) lets applications connect securely to Exchange Online to access mailbox data such as email, calendar, contacts, and folders. The EWS app sends HTTPS/SOAP requests that pass through authentication, load balancers, and the Client Access Server layer. Autodiscover then tells the app where the mailbox is located, and the EWS service retrieves or updates data from the mailbox servers. In short, EWS is the API that applications use to read and modify Exchange Online mailbox content.
How does Microsoft Graph work?
Microsoft Graph is the unified API that applications use to access Microsoft 365 data across services like Teams, Planner, OneDrive, and SharePoint. A third‑party app authenticates through Microsoft Entra ID using OAuth2, then sends HTTPS/JSON requests to the Microsoft Graph API gateway. Graph routes these requests to the correct service and returns the required data. In short, Microsoft Graph is the single, modern API that connects apps securely to all Microsoft 365 services.
Why is Microsoft retiring EWS in Exchange Online?
Microsoft is retiring EWS in Exchange Online because it is an outdated, insecure legacy protocol, and they want all developers to move to the more secure, modern Microsoft Graph API, especially after EWS was used in the Midnight Blizzard attack in 2024.
Why Microsoft Graph Is Better Than EWS?
Microsoft Graph replaces EWS because it is more secure, more modern, and works across all Microsoft 365 services – not just Exchange. Graph uses OAuth2 with Microsoft Entra ID, while EWS relied on outdated authentication methods like Basic Auth. Graph provides one unified API for accessing Teams, Planner, OneDrive, SharePoint, Exchange and more, whereas EWS could only access Exchange mailbox data. Graph continues to receive updates, new features, and improvements, while EWS is deprecated and will be fully disabled in Exchange Online.
What you should do now
- Identify any applications still using EWS
- Legacy mailbox tools, scripts, calendar sync, reporting, monitoring, etc.
- Check which users have Kiosk or Frontline licenses
- These users will lose EWS access unless you change their license.
- Assign a license that includes EWS rights (if needed)
Options include:
- Exchange Online Plan 1 or Plan 2
- Microsoft 365 E3 or E5
- Office 365 E3 or E5
- Plan your long-term migration to Microsoft Graph
- Microsoft Graph is the supported API going forward.
Need help reviewing EWS usage or choosing the right licenses?
Our Microsoft licensing experts at SCHNEIDER IT MANAGEMENT help you identify affected users, evaluate dependencies, and move to the correct licensing. Contact us now to keep your operations running.