Microsoft is getting serious about the end of Exchange Web Services (EWS) and has announced that, starting in March 2026, it will begin blocking EWS access to mailboxes without license rights.
EWS is an API that allows applications to access mailboxes and data stores in Exchange Online and Exchange Server. From March, users with only Microsoft 365 or Office 365 F1 or F3 licenses for frontline workers, or with Exchange Online Kiosk licenses, will be blocked from using EWS.
The workaround? Change to an Exchange Online Plan 1 or 2 license, or a Microsoft 365 or Office 365 E3 or E5 license. Microsoft said that the licenses had never actually permitted access to mailboxes via EWS, but the company had never enforced the restrictions.
“This is another step in our ongoing commitment to enhance the security and control mechanisms of EWS,” Redmond said in a statement.
The company is keen to kill off EWS, although only in Microsoft 365 and Exchange Online. When it announced the retirement in 2023 (deprecation occurred in 2018), it emphasized that the end was not nigh for EWS in Exchange Server.
The API played a role in the Midnight Blizzard incident, where miscreants stole emails and other data. One result of the event was that Microsoft “elevated the urgency of the EWS deprecation effort.”
From March 1, 2026, requests to use EWS without a suitable license will result in an HTTP 403 response. Customers will therefore need to check that they do indeed have a suitable license or face integrations suddenly stopping.
Disentangling EWS from the enterprise environments could be challenging for customers, and is partly why Microsoft has provided years of notice of the changes.
It also highlights that the clock is ticking for all mailboxes in Exchange Online, regardless of license. By October 2026, EWS will be “disabled globally for all organizations.”
Microsoft’s preferred alternative to EWS is the Graph API. The problem, as noted by one contributor to Microsoft’s forum post, is that the Graph API does not do everything that EWS can. For example, in the post about the deprecation of EWS in Exchange Online, Microsoft admitted that “There are a few major EWS features [sic] areas that the Microsoft Graph API doesn’t fully support.”
The Register asked Microsoft if the Graph API would reach feature parity well ahead of October 2026. The company has yet to respond. ®
