EwsAllowedAppIDs before the EWS retirement
A focused explanation of the App ID setting Microsoft is using in the EWS retirement, what it does alongside EwsEnabled, and what a configuration snapshot cannot establish by itself.
The fixed-date milestones are available as a calendar. Month windows and operational targets remain text so they are not presented as invented event dates.
Download the calendar: two source-confirmed fixed-date milestones
The retirement configuration is keyed on App ID
EwsAllowedAppIDs is the Exchange Online list of Entra application IDs that may use EWS when EwsEnabled is true. It is distinct from the older User-Agent access-policy mechanism.
Beginning 1 October 2026, Microsoft rolls out updated EWS behavior tenant by tenant rather than changing every tenant on one known day.
For EwsEnabled=true, if EwsAllowedAppIDs is absent, Microsoft creates a list shortly before the new logic reaches that tenant, using observed usage from the previous 60 days.
For EwsEnabled=null, Microsoft creates a missing list a few days before changing that tenant to EwsEnabled=false; the list may not appear until later in October.
Microsoft says it will not overwrite or change a customer-managed list. That list remains authoritative for the tenant.
A Microsoft-generated list may omit infrequent applications and retain applications the administrator does not want, so it is evidence to review rather than a business decision.
Sources for this section
Writing the list is a full replacement
The documented write replaces the complete EwsAllowedAppIDs value. There is no documented incremental add or remove operation, so a proposed list needs a read-before-write comparison and the complete prospective set.
Observed usage is useful evidence, but it is not proof that an application is safe to keep, remove, or allow without an owner, a stated report window, and change-control review.
- Keep the current configuration snapshot with the proposal.
- Record App IDs that have no confirmed owner or evidence.
- With EwsEnabled=true, an empty App ID list is permissive before enforcement and blocks all EWS applications once updated behavior reaches the tenant.
Sources for this section
Published timing is not a tenant schedule
Microsoft's broad preparation target is Before 1 October 2026. The published exact-day milestone is 1 October 2026, when phased disablement begins.
Those facts describe Microsoft's retirement programme. They do not identify a particular tenant's disablement date or create a safe-removal decision for any App ID.