Recommended Free Tools
EwsAllowedAppIDs is an Exchange Online organization setting that limits which application IDs may connect to Exchange Web Services (EWS), but it is not a stand-alone “turn EWS on” switch. It takes effect only when EwsEnabled is $true; another gate, such as an EWS user-agent policy, can still deny a request. Microsoft says Exchange Online EWS disablement begins in October 2026 and is scheduled to be complete in April 2027, so administrators should troubleshoot current access while planning migration.
What EwsAllowedAppIDs does
EwsAllowedAppIDs is a cloud-only Exchange Online organization parameter containing the Azure AD application ID GUIDs permitted to access EWS. It does not accept wildcards. When specifying more than one ID, use a comma-separated list. Microsoft documents the parameter and its behavior in Set-OrganizationConfig.
As an Amazon Associate I earn from qualifying purchases.
EwsEnabled state |
Effect of EwsAllowedAppIDs |
|---|---|
$true |
Only application IDs on the configured list are permitted by this app-ID check. |
$false |
EWS is blocked regardless of the application ID list. |
$null or not configured |
EwsAllowedAppIDs has no effect. |
For example, Microsoft shows this syntax:
Set-OrganizationConfig -EwsAllowedAppIDs "11111111-2222-3333-4444-555555555555,aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"Those GUIDs illustrate formatting; do not copy them as real application IDs. Use the IDs for the applications your organization has identified and approved.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhy an allowed app ID can still get an access error
The app-ID filter and EWS user-agent allow/block policy are separate checks. Microsoft says both must pass for a connection. In particular, if EwsApplicationAccessPolicy is EnforceAllowList, an application with an allowed ID can still be denied when its actual user-agent string is missing from EwsAllowList. Microsoft gives Teams Calendar as an example: allowing its app ID may also require allowing its user-agent string. See Microsoft’s EWS access-control guidance.
#1 Best Overall
- The Microsoft Office 365 Bible: The Most Updated and Complete Guide to Excel, Word, PowerPoint, Outlook, OneNote, OneDrive, Teams, Access, and Publisher from Beginners to Advanced
- ABIS BOOK
User-agent policy may also affect REST or Graph connections in the documented access-control examples. Check the policy’s scope before changing it; do not broaden an allow list simply to clear one EWS error.
Diagnose a denied EWS request in layers
A generic access-denied error does not identify EwsAllowedAppIDs as the cause. Check effective settings and client behavior before changing the allowlist. Exchange Online organization settings and mailbox settings are distinct; organization-level disablement can override a mailbox exception.
- Inspect tenant configuration. Connect to Exchange Online PowerShell and run
Get-OrganizationConfig. ReviewEwsEnabled,EwsAllowedAppIDs,EwsApplicationAccessPolicy, and the associated allow and block lists. Microsoft’s configuration and policy examples are in Set-OrganizationConfig and its EWS access-control guidance. - Inspect the target mailbox. Run
Get-CASMailboxfor the affected mailbox and check its EWS-related settings. Compare these with the organization configuration rather than assuming a mailbox exception can override a tenant-wide block. - Verify both application identity and user agent. Confirm the configured GUID is the intended application ID, then compare the client’s actual user-agent string with the active allow/block policy.
- Check authentication configuration. Microsoft’s troubleshooting guidance specifically calls out the default authentication settings on the EWS virtual directory. Consult Tools and resources for troubleshooting EWS applications.
- Compare clients and logs. Compare the failing request with one from another EWS client to identify differences in identity, user agent, authentication, or request behavior. In Exchange Server environments where IIS access is available, Microsoft notes that IIS logs can provide further failure details.
If you cannot read back the configured list
A community Microsoft Q&A answer suggests trying Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy when the value is difficult to view. Treat that as a troubleshooting lead rather than the authoritative definition of the parameter: the Q&A is community-authored, and the core configuration behavior is established in the Microsoft parameter reference.
If the application uses app-only authorization
Exchange Online application RBAC is a separate authorization concern from the tenant’s EwsAllowedAppIDs filter. Microsoft lists the Application EWS.AccessAsApp role for EWS access. It also notes that application-permission changes can take 30 minutes to two hours to propagate because of cache maintenance; its test command bypasses that cache. See Role Based Access Control for Applications in Exchange Online.
Rank #3
Plan for Exchange Online EWS retirement
Microsoft’s Exchange Online EWS deprecation guidance says global disablement starts in October 2026 and EWS will be fully disabled in April 2027. These milestones apply to Exchange Online; do not treat them as an on-premises Exchange Server timetable.
Use the remaining transition period to identify active EWS workloads, prioritize internal application migration, and work with vendors on their migration plans. Microsoft documents Microsoft Graph mappings for many EWS scenarios, but its roadmap also identifies remaining parity work and capabilities that will not be added to Graph. Inventory the actual operations each client uses and verify those operations against the current Graph capabilities instead of assuming a complete one-to-one replacement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
