EWSAllowedAppIDs: the EWS allow list

Checked 19 October 2026 against Microsoft's message center notices MC1447678 and MC1485116.

EWSAllowedAppIDs is the list of application IDs allowed to use Exchange Web Services in an Exchange Online tenant. From 10 October 2026, for affected Worldwide tenants, an app has to be on it as well as EWS being turned on. Microsoft says apps not on the list may lose access to EWS. Microsoft's rollout window for the requirement, across Worldwide, GCC, GCC High and DoD, runs from early October 2026 to early July 2027; the dated milestones are for Worldwide tenants only.

Read your current list

In Exchange Online PowerShell:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

Before you change it

Why the pre-filled list can miss apps

On 8 to 9 October 2026 Microsoft created a list for Worldwide tenants that had EWSEnabled set to True and no list of their own on 3 October 2026, built from the previous 60 days of EWS activity. A tenant with EWSEnabled not set got no list; Microsoft says those tenants have EWS disabled in its phased retirement. Microsoft warns that infrequently used apps may not have been identified. An app that runs once a quarter can be off the list, and the first sign is the day it next runs and fails.

To find them, compare the EWS usage report with your list. Look up any single ID here:

Or let the plan page do the comparison: load the report, paste the list from the command above, and see which apps in the report are not on it. Both are read in your browser and never uploaded. The plan is $49 per tenant, or $199 for ten tenants. See pricing.

All the dates are on EWS retirement dates.

Sources