EwsAllowedAppIDs before the EWS retirement
A focused explanation of the App ID setting Microsoft is using in the EWS retirement, what it does alongside EwsEnabled, and what a configuration snapshot cannot establish by itself.
Other reference notes retain their 7 September 2026 source baseline unless separately dated; this is not a fresh verification of every linked document.
The fixed-date milestones are available as a calendar. Month windows and operational targets remain text so they are not presented as invented event dates.
Download the calendar: two source-confirmed fixed-date milestones
The retirement configuration is keyed on App ID
EwsAllowedAppIDs is the Exchange Online list of Entra application IDs that may use EWS when EwsEnabled is true. It is distinct from the older User-Agent access-policy mechanism.
Microsoft's 26 October 2026 update describes the current Worldwide multi-tenant cloud rollout. Sovereign cloud timing is separate; do not apply the Worldwide cutoff to those clouds.
For EwsEnabled=true with a missing list, Microsoft reports that it populated EwsAllowedAppIDs on 10-11 October 2026. Administrators setting EwsEnabled=true after 11 October must populate the list themselves. For tenants already set to true, Microsoft says it will not change EWS availability until April 2027; this is not a guarantee that an application or its configuration works.
For EwsEnabled=null with a missing list, the disablement process has started. A 7-day Message Center warning precedes list population based on the previous 60 days of usage and the change to EwsEnabled=false. A tenant administrator may temporarily re-enable EWS subject to the App ID list; full retirement in April 2027 remains unchanged.
Microsoft says it will not overwrite or change a customer-managed list. That list remains authoritative for the tenant.
A Microsoft-generated list may omit infrequent applications and retain applications the administrator does not want, so it is evidence to review rather than a business decision.
Sources for this section
Writing the list is a full replacement
The documented write replaces the complete EwsAllowedAppIDs value. There is no documented incremental add or remove operation, so a proposed list needs a read-before-write comparison and the complete prospective set.
Observed usage is useful evidence, but it is not proof that an application is safe to keep, remove, or allow without an owner, a stated report window, and change-control review.
- Keep the current configuration snapshot with the proposal.
- Record App IDs that have no confirmed owner or evidence.
- With EwsEnabled=true, an empty App ID list is permissive before enforcement and blocks all EWS applications once updated behavior reaches the tenant.
Sources for this section
Published timing is not a tenant schedule
Microsoft's broad preparation target is Before 1 October 2026. The published exact-day milestone is 1 October 2026, when phased disablement begins.
Those facts describe Microsoft's retirement programme. They do not identify a particular tenant's disablement date or create a safe-removal decision for any App ID.