DKDKCISSP
Threat Research

Microsoft shares how to fix broken Exchange Online EWS apps

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working.

DKCISSP News DeskBleepingComputer22 Oct 2026, 9:19 pm4 min read
Microsoft shares how to fix broken Exchange Online EWS apps
Image courtesy of BleepingComputer. Original report
DKCISSP REPORT

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working.

EWS is an API for developing apps that can access Exchange mailbox items (e.g., email messages, meetings, and contacts) from Exchange Online and on-premises Exchange servers.

This API is used by various apps, including but not limited to Outlook desktop add-ins, older versions of Outlook for Windows, the Apple Mail / Calendar on macOS, and various other apps.

In February, the company announced it will start blocking the EWS API by default on October 1, 2026, but will let IT administrators temporarily maintain access via an app allowlist until the final shutdown on April 1, 2027.

You must contact your application vendor to get the updated application version, or if you created the application yourself, you must change the code to not use EWS anymore." ​Microsoft also advised app developers using the EWS API to switch to the Microsoft Graph API before EWS shuts down, since it has near-complete feature parity with EWS for most scenarios.

The company also added that the EWS retirement process affects only Microsoft 365 and Exchange Online environments, and the API will continue to work in on-premises Exchange Server installations.

However, when EWS is disabled, the apps show errors ranging from alerts that the EWS protocol is unavailable to repeated prompts to enter the username or password.

To avoid these issues and fix EWS apps that are no longer working, Microsoft says tenant administrators can re-enable EWS in the Microsoft 365 admin center Baseline Security Mode by unchecking on the Baseline Security Mode page.

Re-enabling EWS will stop working in April 2027," Microsoft said .

In October 2021 , Microsoft revealed that it had deprecated the 25 least-used EWS Exchange Online APIs and removed support for them in March 2022 for security reasons.

Another option is to use Exchange Online PowerShell to run the command, which should re-enable EWS within 4 hours.

"The long-term solution is to update your applications to the application versions that do not use EWS.

The EWS retirement announcement followed a 2018 warning that EWS would stop receiving functionality updates and Microsoft's September 2023 announcement that it planned to begin shutting down the EWS API in October 2026.

"We are now in the first stage of EWS disablement, where customers are still able to re-enable EWS.

What happened

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working.

EWS is an API for developing apps that can access Exchange mailbox items (e.g., email messages, meetings, and contacts) from Exchange Online and on-premises Exchange servers.

This API is used by various apps, including but not limited to Outlook desktop add-ins, older versions of Outlook for Windows, the Apple Mail / Calendar on macOS, and various other apps.

What changed

In February, the company announced it will start blocking the EWS API by default on October 1, 2026, but will let IT administrators temporarily maintain access via an app allowlist until the final shutdown on April 1, 2027.

You must contact your application vendor to get the updated application version, or if you created the application yourself, you must change the code to not use EWS anymore." ​Microsoft also advised app developers using the EWS API to switch to the Microsoft Graph API before EWS shuts down, since it has near-complete feature parity with EWS for most scenarios.

The company also added that the EWS retirement process affects only Microsoft 365 and Exchange Online environments, and the API will continue to work in on-premises Exchange Server installations.

Who is affected

However, when EWS is disabled, the apps show errors ranging from alerts that the EWS protocol is unavailable to repeated prompts to enter the username or password.

To avoid these issues and fix EWS apps that are no longer working, Microsoft says tenant administrators can re-enable EWS in the Microsoft 365 admin center Baseline Security Mode by unchecking on the Baseline Security Mode page.

Why it matters

Re-enabling EWS will stop working in April 2027," Microsoft said .

In October 2021 , Microsoft revealed that it had deprecated the 25 least-used EWS Exchange Online APIs and removed support for them in March 2022 for security reasons.

Technical details

Another option is to use Exchange Online PowerShell to run the command, which should re-enable EWS within 4 hours.

"The long-term solution is to update your applications to the application versions that do not use EWS.

The EWS retirement announcement followed a 2018 warning that EWS would stop receiving functionality updates and Microsoft's September 2023 announcement that it planned to begin shutting down the EWS API in October 2026.

Response

"We are now in the first stage of EWS disablement, where customers are still able to re-enable EWS.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Attribution

BleepingComputer: Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working.

What to watch next

Watch for revised vendor guidance, fixed versions and mitigation updates.

MORE IN THREAT RESEARCH

More cybersecurity reporting

Iranian Hacking Group Found Hosting C2 Infrastructure in the USInfosecurity Magazine · 22 Oct 2026, 6:35 pmZoe Kleinman: PHP is the cyber equivalent of an unexploded bombBBC News · 22 Oct 2026, 3:47 pmInstall critical PHP safety update or go offline, cyber chiefs tell websitesBBC News · 21 Oct 2026, 5:39 pmCritical security issue affecting PHPNCSC-UK · 21 Oct 2026, 5:30 am