On October 1, Exchange Online starts blocking Exchange Web Services by default. This is not a new announcement, Microsoft has been signalling it for a long while, and the news here is simply that the date is now days away. If something in your business still talks to Microsoft 365 mailboxes over EWS, it stops working, and the failure will look like a device or an app that mysteriously cannot send or read mail any more.
What is actually changing
EWS is an older interface that applications use to read mailboxes, send mail and manage calendars in Exchange. Modern apps use Microsoft Graph instead. From October 1, tenants that have never explicitly configured the setting will have EWS switched off: any tenant with the EWSEnabled property still unset gets it flipped to false as the change rolls out. To keep an application working past that date you need EWSEnabled set to true and an AppID allow list naming the specific apps permitted to use it. The final shutdown is April 1, 2027, and Microsoft has said there are no exceptions after that regardless of business impact. On-premises Exchange Server is not affected and keeps supporting EWS.
What tends to break in a small business
The things that use EWS are almost never the things you think about. In practice the usual suspects are scan-to-email on older multifunction copiers, legacy CRM or practice-management software with a mailbox integration, some third-party backup and archiving tools, older meeting-room booking systems, email signature managers, and any custom script a previous IT person wrote years ago. Outlook, Teams and current Microsoft 365 apps are fine, they moved to Graph long ago. It is the quiet infrastructure that bites here, which is the same lesson as every other end-of-support deadline: the risk is in what nobody has inventoried.
How to find out before Thursday
You do not have to guess. A Microsoft 365 administrator can check the organization's EWS settings and review sign-in activity to see which applications have actually been using EWS in your tenant. If you have an IT provider, this is a short request: ask them for the list of apps in your tenant still using EWS and what their plan is for each one. If you do not, the settings are reachable from Exchange Online administration, and the sign-in logs will show which application identities have been connecting.
What to actually do
- Ask for the list now, before the weekend is over. Knowing whether the answer is nothing or four things changes how urgent your week is.
- Chase the vendors that come back on the list. The question is simple: does your product support Microsoft Graph, and what version do we need. Many have shipped an update already and nobody installed it.
- Check the copiers. Scan-to-email often has a firmware update that fixes this, or can be switched to a supported sending method instead.
- Use the allow list as a bridge, not a plan. Setting EWSEnabled to true with a named AppID list buys time to April 2027 and nothing beyond it. Put a date in the calendar for the real migration.
- Write down what you found. The inventory you build this week is the thing that makes the next deprecation a ten-minute job instead of a scramble.
The takeaway
Deadlines like this one are not really security events, they are inventory tests. Businesses that know what connects to their mail system will lose an hour to this. Businesses that do not will discover it on Thursday, from a person at the front desk saying the scanner has stopped emailing invoices. Ten minutes of asking the right question today is the whole difference.