{
  "id": "CB-M365-MAIL-011",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-011",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-011.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-011.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-011",
    "title": "Disable Exchange Web Services, or restrict it to approved applications",
    "finding": {
      "title": "Exchange Web Services is open to every application",
      "description": "Any client or tool, including attacker tooling with stolen credentials or tokens, can read and export mailboxes through EWS."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "ews",
      "legacy-protocols",
      "application-access",
      "retirement"
    ],
    "description": "Exchange Web Services (EWS) is turned off for the organization (`EwsEnabled $false`). When an\napplication still needs EWS until it is migrated to Microsoft Graph, EWS stays on only for that\napplication: `EwsApplicationAccessPolicy` is set to `EnforceAllowList` and `EwsAllowList` lists\nits user agent, or EWS is enabled on the single mailboxes concerned (`Set-CASMailbox -EwsEnabled`).\n\nMicrosoft is retiring EWS in Exchange Online: it disables EWS progressively from 1 October 2026 in\ntenants where administrators took no action, and removes it completely on 1 April 2027. After\nthat date the control no longer applies.\n",
    "rationale": "EWS is an old, broad API that gives full mailbox access and is widely used by mailbox export\nand search tools, including the ones attackers use after taking over an account or an\napplication. Turning it off before the retirement removes an exfiltration path and shows which\napplications still depend on it, while there is time to migrate them.\n",
    "impact": "Applications that still use EWS stop working: older Outlook for Mac versions, some third-party\nbackup, archiving, CRM, scheduling or migration tools, and custom scripts. Inventory them with\nvendors and through the application sign-ins to Office 365 Exchange Online before the change, and\nplan their move to Microsoft Graph.\n",
    "audit": {
      "manual": "1. There is no portal page for this setting. Connect to Exchange Online PowerShell as at least a\n   Global Reader.\n2. Run (read-only):\n   ```powershell\n   Get-OrganizationConfig | Format-List EwsEnabled, EwsApplicationAccessPolicy, EwsAllowList, EwsBlockList\n   Get-CASMailbox -ResultSize Unlimited -Filter \"EwsEnabled -eq $true\" | Format-Table PrimarySmtpAddress, EwsEnabled\n   ```\n3. Pass if `EwsEnabled` is `False`, or if `EwsApplicationAccessPolicy` is `EnforceAllowList`\n   with a short, documented `EwsAllowList`.\n4. Fail if `EwsEnabled` is `True` or empty with no allow list, or if the allow list contains a\n   wildcard that matches any client.\n"
    },
    "remediation": {
      "manual": "1. List the applications that still use EWS and their owners, and agree on a migration date.\n2. Connect to Exchange Online PowerShell as an Exchange Administrator.\n3. If no application needs EWS:\n   ```powershell\n   Set-OrganizationConfig -EwsEnabled $false\n   ```\n4. Otherwise, restrict it to the remaining applications:\n   ```powershell\n   Set-OrganizationConfig -EwsApplicationAccessPolicy EnforceAllowList -EwsAllowList \"<user agent 1>\",\"<user agent 2>\"\n   ```\n   or keep EWS off for the organization and enable it on the mailboxes that need it\n   (`Set-CASMailbox -Identity <mailbox> -EwsEnabled $true`).\n",
      "rollback": "`Set-OrganizationConfig -EwsEnabled $true` until 1 April 2027.\n"
    },
    "references": [
      {
        "title": "Control access to EWS in Exchange",
        "url": "https://learn.microsoft.com/exchange/client-developer/exchange-web-services/how-to-control-access-to-ews-in-exchange",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-OrganizationConfig",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-organizationconfig",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Baseline security mode settings",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/baseline-security-mode-settings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1114.002"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-006",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-037",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-001",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}