For applications that access Exchange Online, Microsoft recommends moving from Exchange Web Services (EWS) to Microsoft Graph—but Graph is not a drop-in replacement for every EWS workload. Use Graph when it supports the operations and mailbox types your application needs. For Exchange Server on-premises, Graph is not supported, so it is not a direct EWS replacement.
The timing makes the decision urgent for Exchange Online: Microsoft’s phased EWS disablement began October 1, 2026, and permanent retirement is scheduled for April 1, 2027. Those dates apply to Exchange Online, not every on-premises EWS deployment.
Which API should you use?
Choose Microsoft Graph by default for new or maintained applications that access Exchange Online, after checking that it supports the application’s actual operations. Keep EWS only where a required capability or deployment constraint prevents a supported Graph migration, and plan around Microsoft’s Exchange Online retirement schedule.
For Exchange Server on-premises, do not treat Graph as the replacement: Microsoft Learn states, “Microsoft Graph is not supported for Exchange on-premises.” In hybrid environments, identify where each target mailbox resides; the word “hybrid” alone does not establish that Graph can serve every mailbox.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches#1 Best Overall
How EWS and Graph differ
| Decision area | Exchange Web Services | Microsoft Graph | What it means for your choice |
|---|---|---|---|
| Microsoft’s Exchange Online direction | Microsoft announced in August 2018 that it would make no active investment in EWS APIs for Exchange Online. | Microsoft recommends Graph for migrating Exchange Online applications. | For supported Exchange Online scenarios, plan toward Graph rather than new EWS dependencies. Microsoft’s migration overview. |
| Deployment support | Used with Exchange deployments including on-premises Exchange. | Not supported for Exchange on-premises. | Check mailbox location, especially in hybrid organizations, before selecting the API. Microsoft’s migration overview. |
| Protocol | SOAP-based. | REST-based, with JSON serialization. | The protocol and integration model change; Microsoft’s general description is not a workload-specific performance guarantee. Microsoft’s migration overview. |
| Authentication | Supports OAuth 2.0 and currently also supports basic authentication, which is deprecated and being deactivated across Microsoft 365 organizations. | Uses OAuth 2.0 and does not support basic authentication. | Applications still using basic authentication need an authentication change; moving to Graph does not preserve that method. Microsoft’s authentication comparison. |
| Permissions | Supports delegated and application permissions; Microsoft describes mailbox access as all-or-nothing. | Supports delegated and application permissions, with more granular permissions for Exchange Online mailbox features. | Graph can support narrower access, but permission design and administrator consent still need review. Microsoft’s authentication comparison. |
| Application identity and impersonation | EWS impersonation lets a service-account application act as a user. | Applications authenticate with their own identity using client credentials; administrators can restrict application access to specific mailboxes. | Redesign and review authorization rather than swapping endpoints while assuming impersonation behaves identically. Microsoft’s authentication comparison. |
| Feature coverage | Some existing operations may not have a Graph equivalent. | Many scenarios map, but Microsoft lists remaining gaps and capabilities it will not add. | Compare your operations and mailbox types with the current mapping and roadmap before estimating migration effort. Microsoft’s EWS feature mapping and roadmap. |
| Development resources | Existing integrations may use SOAP implementations. | Offers Graph Explorer, SDKs in multiple languages, and access to a broader Microsoft 365 API surface. | These resources can help with discovery and implementation, but do not establish feature parity. Microsoft’s migration overview. |
Check feature coverage before committing to migration
Microsoft says many EWS scenarios have direct Graph mappings, but similarity between endpoint names is not proof that an operation behaves the same way. Match the application’s real EWS calls and mailbox types against Microsoft’s current feature mapping and parity roadmap.
Some capabilities will not be added to Graph. Microsoft identifies generic Public Folder CRUD, generic Microsoft 365 Group mailbox CRUD, and generic Discovery Mailbox access among them. For group scenarios, Microsoft points developers to supported Graph group conversations, threads, and posts. For supported discovery scenarios, it points to Microsoft Purview eDiscovery APIs and workflows.
Rank #2
- Used Book in Good Condition
Other parity items have estimated Q3 or Q4 calendar-year 2026 targets, including notes, contact lists, additional contact properties, and import/export scenarios. Microsoft warns that target dates may change. Check the current roadmap and availability in the cloud where the application will run; do not treat a target quarter as a delivery guarantee. Microsoft also warns: “If an EWS capability isn’t listed in this roadmap table, don’t plan on a corresponding Microsoft Graph or Exchange Admin API capability being available before EWS is fully disabled.”
Review authentication and permissions as part of the design
Move off basic authentication
EWS currently supports basic authentication, but Microsoft says it is deprecated and being deactivated across Microsoft 365 organizations. Graph does not support it. A workload that relies on basic authentication therefore needs an OAuth 2.0 plan, whether it remains on EWS temporarily or moves to Graph. See Microsoft’s authentication comparison.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose delegated or application access deliberately
Delegated permissions operate in the context of an authenticated user. Application permissions let an application act without a user. Microsoft characterizes EWS mailbox access as covering everything the delegated user can access, or everything available to EWS under application permissions, without granular mailbox scoping. Graph can grant access to particular Exchange Online features—for example, mail reading without calendar or contact access.
Do not equate impersonation with Graph application access
EWS impersonation and Graph application permissions are different authorization patterns. With Graph, an application authenticates as itself using client credentials. Administrator consent can grant broad mailbox access by default, while administrators can limit the application to specific mailboxes. Review the required scope and mailbox restrictions with least privilege in mind rather than carrying an EWS service-account design over unchanged. Microsoft documents these authentication and permission differences.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Build an inventory-led migration plan
- Find active EWS use. Identify applications, owners, target mailboxes, and usage. Microsoft recommends starting with EWS Usage Reports; its deprecation guidance also describes the EWS Analyzer as a way to investigate applications. See Microsoft’s EWS deprecation guidance.
- Confirm where the mailboxes are hosted. Separate Exchange Online targets from on-premises targets, including within hybrid deployments. This establishes whether Graph is an available option at all.
- Map actual operations and mailbox types. Compare every operation the application uses with the current EWS-to-Graph mapping and roadmap. Include relevant mail, calendar, contact, task, archive, public-folder, group, or discovery workflows; scope the check to the application rather than assuming all categories apply.
- Record the authorization model. Note basic authentication, OAuth, delegated or application permissions, and EWS impersonation. Plan any OAuth conversion, consent, scope reduction, and mailbox restrictions as design work.
- Test the workflows that matter. Validate the application’s actual operations and access boundaries against the Graph implementation, including any mailbox types or cloud availability relevant to its deployment.
- Resolve unsupported capabilities. If a required feature has no Graph equivalent, evaluate Microsoft’s documented alternative where one exists or work with the application vendor. Do not assume a missing roadmap entry will arrive before EWS is disabled.
What the retirement dates mean
Microsoft’s current guidance says phased EWS disablement in Exchange Online begins October 1, 2026, with permanent retirement scheduled for April 1, 2027. The dates make identifying and resolving Exchange Online dependencies time-sensitive. They do not establish a retirement date for every EWS deployment on on-premises Exchange. Review Microsoft’s deprecation guidance and the Exchange Online service description for current service details.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
