Exchange Web Services (Exchange Online) → Microsoft Graph

Exchange Web Services (EWS) is the SOAP-based API that scripts, line-of-business apps and third-party tools have used for years to read mail, manage calendars and sync contacts in Exchange Online. Microsoft is switching it off in the cloud service, and Microsoft Graph is the replacement. The change applies to Microsoft 365 and Exchange Online only. According to the Exchange Team blog, there are no changes to EWS in Exchange Server, so on-premises mailboxes can keep using it.

What is changing, and when

EWS stopped receiving feature updates in 2018, and in 2023 Microsoft set October 2026 as the start of disablement. The February 2026 announcement turned that into a phased, tenant-by-tenant plan driven by the EWSEnabled setting, which can be True, False or Null (the default).

On or soon after October 1, 2026, any tenant still set to Null is changed to False, which blocks EWS for every application. Admins who still need EWS have two documented routes: set EWSEnabled to True and maintain an AppID Allow List, or set it back to Null in Exchange Online PowerShell, which lifts restrictions until the final shutdown. Tenants that configured an allow list and set True by the end of September 2026 skip the automatic change. Microsoft says it will pre-populate allow lists from each tenant’s own usage, but recommends admins build their own.

From April 1, 2027, EWS is permanently disabled and tenant admins lose the ability to control the setting. The blog states there will be no exceptions past April 2027.

A blocked request returns HTTP 403 with an X-EWS-Policy-Reason header, and Microsoft notes that allow list changes can take up to 24 hours to apply because of caching.

What Graph covers, and what it does not

Microsoft describes Graph as having near-complete parity for the large majority of EWS scenarios, and publishes an operation-by-operation mapping covering messages, folders, attachments, inbox rules, MailTips, calendar availability and sharing, and notifications. EWS pull notifications map to delta queries, and push notifications map to Graph subscriptions.

The gaps are the real trade-off. Microsoft’s deprecation page lists three capabilities that will not be added to Graph: generic public folder create, read, update and delete operations; generic mailbox access for Microsoft 365 Group mailboxes; and access to legacy Discovery Mailboxes. Public folder and group import and export is a separate capability.

Other gaps are on a roadmap with target dates that Microsoft says might change. Items such as archive mailbox import and export, In-Place Archive access, user configuration objects and non-draft MIME creation carry a Q4 calendar 2026 target. Anything not on that roadmap should not be assumed to arrive before EWS goes away.

Authentication and limits

Graph requires registering the app in the Microsoft Entra admin center, with a client secret, certificate or federated credential for confidential clients. Access is either delegated, acting for a signed-in user, or app-only, using application permissions. Permissions that are not preauthorized need administrator consent, per the Graph authentication overview.

Throttling is also different. The Outlook service limits apply per app and mailbox pair: 10,000 requests in a 10-minute period, four concurrent requests, and 150 MB of uploads in a five-minute period. Exceeding a limit returns a 429 response.

A practical migration order

First, inventory. The Exchange Team points admins to the EWS usage reports in the Microsoft 365 admin center to find which apps still call EWS, including vendor products you may not know about.

Second, decide what buys time. If a vendor is not ready, an allow list entry for that one AppID is narrower than re-enabling EWS for everyone, and Microsoft calls these options temporary.

Third, port in layers: auth first, then reads, then writes, then change tracking. Replace polling loops with delta queries, and add retry logic that honors 429 responses before load testing against a real mailbox.

Finally, check your workload against the gap list before committing. Public folder integrations are the most exposed, since generic access is not coming. Hybrid shops should also note the blog’s statement that only Exchange SE supports Graph for calls to Exchange Online.