Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Use the app registration’s Application (client) ID GUID—not its Directory (tenant) ID. In the Microsoft Entra admin center, open the app registration in the tenant where it was created and copy the client ID from its Overview page. To see which IDs Exchange Online currently has configured, run Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs in Exchange Online PowerShell.
Find the app’s client ID in Microsoft Entra
- Sign in to the Microsoft Entra admin center with access to the tenant that contains the app registration.
- Confirm you are in the correct tenant, then open App registrations and select the application that connects to Exchange Online through EWS.
- On the app’s Overview page, copy Application (client) ID. Microsoft’s [app-registration guidance] distinguishes this GUID from the Directory (tenant) ID, which identifies the directory rather than the application.
The client ID is specific to the app registration and tenant; there is no universal ID to use. Microsoft documents EwsAllowedAppIDs as a list of application ID GUIDs in its [Set-OrganizationConfig reference].
As an Amazon Associate I earn from qualifying purchases.
Read the configured EWS app IDs in Exchange Online
Connect to Exchange Online PowerShell using an appropriately authorized administrator account, then run:
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDsThe -RetrieveEwsOperationAccessPolicy switch retrieves the configured app IDs, according to Microsoft’s [Exchange PowerShell reference]. Compare the returned GUIDs with the client ID copied from Entra.
#1 Best Overall
This command is for reading the configuration. Do not change the organization setting until you have confirmed which app and tenant the integration uses. Microsoft documents comma-separated GUIDs for multiple app IDs and $null to remove configured IDs and stop restricting access by app ID; those are configuration changes, not lookup steps. See the same [reference] before making a change.
Understand what EwsAllowedAppIDs controls
The setting applies to direct EWS SOAP connections. Its effect depends on EwsEnabled:
- When
EwsEnabledis$true, only applications whose IDs are listed can use EWS. - When
EwsEnabledis$false, EWS access is blocked regardless of the app-ID list. - When
EwsEnabledis$null, the app-ID parameter has no effect.
Microsoft’s [parameter reference] says EwsAllowedAppIDs does not affect Microsoft Graph API requests or the REST endpoint. If the integration uses Graph or REST rather than direct EWS SOAP, this is not the access-control list to troubleshoot.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCheck the user-agent policy if the app ID matches
A matching app ID does not guarantee access if the tenant also enforces an EWS user-agent allow/block list. Microsoft says both controls are evaluated for each connection, so both must permit it. The user-agent policy identifies applications by user-agent string; it is different from the GUID-based EwsAllowedAppIDs list. The Exchange PowerShell reference describes the user-agent allow-list setting as potentially governing EWS and REST, while the app-ID parameter applies only to direct EWS SOAP.
For example, Microsoft’s [EWS access-control guidance] warns that allowing the Teams app ID without retaining the required Teams Calendar user agent can block Teams Calendar. If the ID is present but access still fails, check the user-agent policy and the connection type before changing the app-ID list.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Account for Exchange Online EWS retirement
EWS is being retired in Exchange Online. Microsoft’s [EWS access-control article, last updated September 30, 2026] says the way EWSEnabled operates will change in October 2026 because of the deprecation. Microsoft’s [Power Platform cross-tenant authentication guidance, last updated August 15, 2026] describes a phased Exchange Online EWS retirement beginning in October 2026, with complete retirement by April 2027. For the specific Power Platform cross-tenant email synchronization scenario, Microsoft says the transition from EWS to Graph is planned by April 2027.
These are time-sensitive service announcements. Check Microsoft’s latest retirement guidance before planning a deployment or relying on EWS for a long-term integration.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
