EwsAllowedAppIDs: what to set, and what happens if you don't

The allow list is the only thing that keeps an EWS application running past the October 2026 enforcement wave, and it only works in combination with EwsEnabled. Two settings, one org-level cmdlet, and a deadline on the far end that the allow list does not move.

`EwsEnabled` is tri-state, and blank is not the same as True

$null (blank) — never decided. Microsoft automatically changes this to $false on October 1, 2026 for any tenant that has not explicitly set $true.
$true — EWS is enabled. Starting October 2026, only applications on the allowed app IDs list can call EWS. $true on its own no longer permits unrestricted access.
$false — EWS is disabled org-wide.

The organisation-level setting overrides per-mailbox EWS settings, so this is the level the retirement acts on and the level to check.

The exact commands

Read the current state:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |
  Format-List EwsEnabled, EwsAllowedAppIDs

Opt the tenant in and set the allow list — the values are Entra application (client) IDs, comma-separated:

Set-OrganizationConfig -EwsEnabled:$true
Set-OrganizationConfig -EwsAllowedAppIDs "<comma-separated Entra app client IDs>"

Then read it back from the tenant and confirm both values landed. If you would rather not read the output by eye, pipe it into the free scanner and get a plain verdict:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy |
  Format-List EwsEnabled, EwsAllowedAppIDs |
  deadlinescan tenant

What each verdict means.

The pre-population, and what it does not cover

Microsoft pre-populates the allow list for customers who have not created one before September 2026, based on each tenant's own EWS usage telemetry. That is a real softener and it has two edges worth knowing:

It does not rescue a tenant whose EwsEnabled is still blank. That tenant is still changed to $false on October 1, 2026, allow list or no allow list.
It is built from what the tenant was observed using. An application that runs monthly, or one that was quiet during the observation window, is exactly the kind of thing a telemetry-built list misses. Read the list back and check it against what you know calls EWS.

Microsoft's Message Center notice for the enforcement wave is explicit that its own software counts: “Microsoft first-party applications that continue to rely on EWS must also be included if they appear in your usage reporting.”

The tail: what the allow list actually buys

Oct 1, 2026
Enforcement begins. Tenants with EwsEnabled=True and a configured allow list will not have their EwsEnabled setting modified by Microsoft before April 2027.
Mar 31, 2027
The last day allow-listed applications work. Admins can re-enable EWS during this phased window.
Apr 1, 2027
Hard deadline. Microsoft has confirmed there are no extensions or exceptions after this date, and EWS access is permanently removed with no re-enablement.

So the allow list is a runway, not a reprieve. The work it buys time for is finding and moving the call sites — and finding out which of them Graph does not replace, because those cannot be moved at all and need a plan instead. The parity gaps, in full.

Then scan the code

DeadlineScan is a free, MIT-licensed command-line scanner that reads a directory tree and reports the EWS and QuickBooks Online call sites in it, with what each one maps to. It makes no network calls and sends no telemetry, so your code never leaves the machine.

deadlinescan scan ./my-repo

Get the scanner: email hello@deadlinescan.com and you'll get the source and a Windows binary by reply — the public repository is being prepared.

A finding count of zero means no affected call sites were FOUND — not that you're unaffected.

Sources

Microsoft Learn — Prepare for EWS retirement: the tri-state setting, the automatic change to $false on October 1, 2026, the Set-OrganizationConfig commands, the pre-population before September 2026, and the April 1, 2027 hard deadline.
Microsoft Learn — Deprecation of Exchange Web Services in Exchange Online.
Message Center MC1447678 (archive copy): EWSEnabled=True without EWSAllowedAppIDs no longer permitting unrestricted access; tenants with both left unmodified before April 2027; first-party applications must be included.
Message Center MC1227454 (archive copy): phased disablement from October 1, 2026, re-enablement during the phased period, and no re-enablement after April 1, 2027.