EWS Retirement Readiness

The question it answers: Is Exchange Web Services still on, and which mailboxes and apps still depend on it before it is switched off?

Exchange Web Services is disabled by default from 1 October 2026 in tenants whose EWSEnabled setting is still unset, and switched off for good on 1 April 2027. Anything that still talks to EWS - backup, archiving, CRM or signature tools, room booking displays, scripts - stops working then. This report shows the organisation and mailbox EWS settings and every app that holds an EWS permission.

Note

Microsoft publishes no API for the admin centre’s EWS usage report (Reports > Usage > EWS usage). Export it as CSV there and upload it below the report to list the apps that actually called EWS.

At a glance

Where in the app	Exchange Online › Mail Security & Hygiene › EWS Retirement Readiness
Workload	Exchange Online
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	No extra licence needed.
Report id (API and MCP)	exchange.hygiene.ews-readiness

Columns

Column	Key	Type
Severity	Severity	Status
Area	Category	Text
Setting / mailbox / app	Subject	Link
Check	Setting	Text
Value	Value	Text
Finding	Finding	Text
Detail	Detail	Text
Granted	When	Date
EWS requests	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application	+ View-Only Configuration / View-Only Recipients role
Application.Read.All	Microsoft Graph	Read all applications
Directory.Read.All	Microsoft Graph	Read directory data

Data sources it reads

• Get-OrganizationConfig (EwsEnabled, EwsApplicationAccessPolicy, EwsAllowList)
• Get-CASMailbox (EwsEnabled per mailbox)
• GET /v1.0/servicePrincipals/{Exchange Online}/appRoleAssignedTo (full_access_as_app)
• GET /v1.0/oauth2PermissionGrants (EWS.AccessAsUser.All)

Through the API and MCP

GET /ir-api/v1/reports/exchange.hygiene.ews-readiness?size=100

An AI assistant reads it with the MCP tool get_report and the id exchange.hygiene.ews-readiness. The client needs the Read grant for Exchange Online. See Using the API.