Disable Exchange Web Services, or restrict it to approved applications

Description

Exchange Web Services (EWS) is turned off for the organization (EwsEnabled $false). When an application still needs EWS until it is migrated to Microsoft Graph, EWS stays on only for that application: EwsApplicationAccessPolicy is set to EnforceAllowList and EwsAllowList lists its user agent, or EWS is enabled on the single mailboxes concerned (Set-CASMailbox -EwsEnabled).

Microsoft is retiring EWS in Exchange Online: it disables EWS progressively from 1 October 2026 in tenants where administrators took no action, and removes it completely on 1 April 2027. After that date the control no longer applies.

Rationale

EWS is an old, broad API that gives full mailbox access and is widely used by mailbox export and search tools, including the ones attackers use after taking over an account or an application. Turning it off before the retirement removes an exfiltration path and shows which applications still depend on it, while there is time to migrate them.

Impact

Applications that still use EWS stop working: older Outlook for Mac versions, some third-party backup, archiving, CRM, scheduling or migration tools, and custom scripts. Inventory them with vendors and through the application sign-ins to Office 365 Exchange Online before the change, and plan their move to Microsoft Graph.

Audit

1. There is no portal page for this setting. Connect to Exchange Online PowerShell as at least a Global Reader.
2. Run (read-only):

   Get-OrganizationConfig | Format-List EwsEnabled, EwsApplicationAccessPolicy, EwsAllowList, EwsBlockList
   Get-CASMailbox -ResultSize Unlimited -Filter "EwsEnabled -eq $true" | Format-Table PrimarySmtpAddress, EwsEnabled
   

3. Pass if EwsEnabled is False, or if EwsApplicationAccessPolicy is EnforceAllowList with a short, documented EwsAllowList.
4. Fail if EwsEnabled is True or empty with no allow list, or if the allow list contains a wildcard that matches any client.

Remediation

1. List the applications that still use EWS and their owners, and agree on a migration date.
2. Connect to Exchange Online PowerShell as an Exchange Administrator.
3. If no application needs EWS:

   Set-OrganizationConfig -EwsEnabled $false
   

4. Otherwise, restrict it to the remaining applications:

   Set-OrganizationConfig -EwsApplicationAccessPolicy EnforceAllowList -EwsAllowList "<user agent 1>","<user agent 2>"
   

   or keep EWS off for the organization and enable it on the mailboxes that need it (Set-CASMailbox -Identity <mailbox> -EwsEnabled $true).

Rollback

Set-OrganizationConfig -EwsEnabled $true until 1 April 2027.

References

• Control access to EWS in Exchange Microsoft, vendor-doc, accessed 2026-10-24
• Set-OrganizationConfig Microsoft, vendor-doc, accessed 2026-10-24
• Baseline security mode settings Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-006 Keep modern authentication enabled for Exchange Online
• related CB-M365-MAIL-037 Scope application access to mailboxes with RBAC for Applications
• related CB-M365-AUTH-001 Block legacy authentication with Conditional Access

People and lifecycle