Microsoft EWS Retirement: What it means for Microsoft 365 migrations and how to prepare
Read more – Microsoft EWS Retirement: What it means for Microsoft 365 migrations and how to prepare
Preparing Exchange Online for Continued EWS Access with Transvault Intelligent Migrator
Overview
Microsoft has announced the phased retirement of Exchange Web Services (EWS) for Exchange Online.
Beginning in October 2026, Microsoft will begin disabling EWS for Exchange Online tenants that have not been configured to continue using it during the transition period.
Transvault Intelligent Migrator will continue to support Exchange Online migrations using EWS throughout this transition. Customers using Exchange Online should review their Microsoft 365 tenant configuration before October 2026 to ensure EWS remains available.
This article explains the Microsoft 365 configuration required to continue using EWS with Transvault Intelligent Migrator during Microsoft’s transition period.
Does this affect my current migration?
No, provided your migration completes before Microsoft permanently retires EWS in April 2027. Existing and new migration projects can continue using Exchange Online via EWS during Microsoft’s transition period, provided the tenant remains configured to allow EWS access.
Any Exchange Online migration continuing beyond Microsoft’s final EWS retirement will need to use Microsoft Graph.
Required configuration
Microsoft now controls Exchange Online EWS access using the EWSEnabled tenant setting.
For customers continuing to use EWS with Transvault Intelligent Migrator, we recommend following Microsoft’s preferred approach:
- Set EWSEnabled = True
- Configure an EWS Allow List
- Include the Microsoft Entra Application ID(s) used by Transvault Intelligent Migrator within that Allow List
This ensures EWS remains enabled while restricting access to approved applications.
Microsoft also permits EWSEnabled = Null as a temporary transition option. However, Transvault recommends following Microsoft’s preferred approach of configuring an EWS Allow List and setting EWSEnabled = True.
Important
Setting EWSEnabled = True without an appropriate EWS Allow List may prevent applications from accessing EWS once Microsoft’s October 2026 changes take effect. We therefore recommend configuring the allow list before enabling EWSEnabled = True.
Identifying the Transvault application
The Microsoft Entra Application (Client) ID used by Transvault Intelligent Migrator must be included within the EWS Allow List.
If your organisation uses multiple application registrations with Intelligent Migrator, each application used for Exchange Online connectivity should be included.
Configuring the EWS Allow List
Once you have identified the Microsoft Entra Application ID(s) used by Transvault Intelligent Migrator, configure them within the Exchange Online EWS allow list.
The following examples illustrate the minimum configuration required. Commands should be run from an Exchange Online PowerShell session by a Microsoft 365 administrator.
Set-OrganizationConfig -EwsAllowedAppIDs “11111111-2222-3333-4444-555555555555”
You can verify the configured allow list using:
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs
Finally, configure the tenant to use the allow list:
Set-OrganizationConfig -EWSEnabled $true
Refer to Microsoft’s documentation for guidance on updating existing allow lists, adding or removing application IDs, and other advanced configuration scenarios.
What happens if I do nothing?
If no action is taken, Microsoft will gradually change tenants from EWSEnabled = Null to EWSEnabled = False as part of the phased rollout beginning in October 2026.
Once this occurs, Exchange Online will reject EWS connections and Transvault Intelligent Migrator connection tests or migration operations using EWS will fail until EWS is re-enabled in accordance with Microsoft’s guidance. The exact error presented may depend on the operation being performed.
What about Microsoft Graph?
Transvault has been developing Microsoft Graph support since Microsoft announced the retirement of Exchange Web Services, following Microsoft’s published guidance throughout. Microsoft Graph support has now been implemented and validated across the core Exchange Online migration workflows, with final validation continuing around specific archive scenarios and controlled production validation now under way ahead of general availability.
Transvault has been actively engaged with Microsoft through the Microsoft Graph Technology Adoption Programme (TAP), helping us validate Migrator against Microsoft’s evolving Graph capabilities and guidance.
We are confident in Intelligent Migrator’s readiness for the transition to Microsoft Graph ahead of Microsoft’s permanent EWS retirement in April 2027.
Current guidance is:
- Continue using EWS for production Exchange Online migration projects.
- Prepare your Microsoft 365 tenant for Microsoft’s EWS transition.
- Follow future Transvault communications regarding production readiness of Microsoft Graph support.
Frequently Asked Questions
- Should we move to Microsoft Graph immediately?
-
No. We currently recommend continuing to use EWS for production Exchange Online migration projects while ensuring your Microsoft 365 tenant is configured for Microsoft’s transition period. We’ll provide guidance when Microsoft Graph support reaches general availability.
- Is this required for on-premises Exchange?
-
No. Microsoft’s EWS retirement applies only to Exchange Online.
- Do I need to create a new Microsoft Entra application?
-
Not usually. You can continue using your existing application, provided it is included in the EWS Allow List where required.
- We’re already migrating using EWS. Can we switch to Microsoft Graph during the project?
-
Yes. Intelligent Migrator is designed to support resumable migrations. When Microsoft Graph support becomes generally available, existing migration projects will be able to transition from EWS to Microsoft Graph by updating the Exchange Online connection configuration.
Migration progress and tracking information are retained by Intelligent Migrator, allowing the migration to continue without restarting from the beginning. Transvault will publish guidance on the recommended transition process before Microsoft Graph support reaches general availability.
- If we enable EWS before October 2026, can we continue using it indefinitely?
-
No. Microsoft’s temporary EWS re-enable option only allows continued use during the transition period. Microsoft has confirmed that Exchange Online EWS will be permanently retired in April 2027, after which Exchange Online migrations must use Microsoft Graph.
- Where can I find Microsoft’s guidance?
-
Refer to Microsoft’s documentation for the latest information:
Relevant resources
