EwsAllowedAppIDs is an Exchange Online organization-level allow list for application IDs that make direct Exchange Web Services (EWS) SOAP requests. It only takes effect when EwsEnabled is $true; it does not grant OAuth permissions, and it does not control Microsoft Graph. The Exchange Online administrator configures the tenant-wide setting, while owners of EWS integrations must identify the correct application IDs.
Microsoft’s EWS retirement guidance says it changed EwsEnabled from $null to $false on October 1, 2026, for tenants that had not opted in. Since that date has passed, check the tenant’s current configuration rather than assuming EWS is enabled.
As an Amazon Associate I earn from qualifying purchases.
What EwsAllowedAppIDs controls
EwsAllowedAppIDs is a parameter of Exchange Online’s Set-OrganizationConfig cmdlet. It accepts one or more Microsoft Entra application IDs (GUIDs) and restricts which applications can make direct EWS SOAP connections when EWS is enabled. Microsoft documents the behavior in its Set-OrganizationConfig reference.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Organization setting | Effect on EWS | Effect of EwsAllowedAppIDs |
|---|---|---|
EwsEnabled = $true |
EWS is enabled, subject to applicable access controls. | Only application IDs on the configured list are allowed; other app IDs are blocked. |
EwsEnabled = $false |
EWS is blocked for the organization. | The list cannot override the block. |
EwsEnabled = $null |
Behavior must be assessed against the tenant’s current retirement-related configuration. | Under the cmdlet reference’s documented behavior, the app-ID parameter has no effect. |
Setting EwsAllowedAppIDs to $null removes the app-ID restriction. That does not enable EWS: EwsEnabled and other applicable policies still determine whether requests can connect.
#1 Best Overall
Who should configure it
Exchange Online tenant administrators
The Exchange Online administrator should review and configure this organization-wide setting when the tenant still needs EWS and wants to restrict it to approved applications. Because it applies across the organization, changing the list can affect integrations used by multiple teams or services.
EWS integration owners and identity administrators
Owners of each integration should identify and validate the application ID it actually uses, then provide it to the Exchange administrator. Allowing an ID is not the same as registering an application in Entra or granting it permission to access EWS. Microsoft’s OAuth guidance for EWS applications describes registration and the delegated or application permissions needed, depending on whether a user is present or the application runs as a background service.
Mailbox administrators
Organization-level controls are not the only EWS settings to check. Microsoft documents mailbox-level controls through Get-CASMailbox and Set-CASMailbox, alongside organization-level settings managed with Get-OrganizationConfig and Set-OrganizationConfig. An organization-level EwsEnabled block can prevent EWS across the tenant regardless of mailbox overrides. See Microsoft’s EWS access-control guidance.
How to set and verify the application-ID list
- Check the current organization settings. In Exchange Online PowerShell, run
Get-OrganizationConfigand inspectEwsEnabled. To retrieve the configured app-ID policy, useGet-OrganizationConfig -RetrieveEwsOperationAccessPolicyand inspectEwsAllowedAppIDs. Microsoft documents this retrieval switch; do not assume an ordinary output always includes the property. - Confirm the required IDs with integration owners. Verify each Entra application ID against the application that makes the EWS request. Do not assume that a display name, client secret, or permission grant is a substitute for the ID.
- Preserve required entries, then apply the full intended list. The parameter takes comma-separated IDs. For example:
Set-OrganizationConfig -EwsAllowedAppIDs "<app-guid-1>,<app-guid-2>". Treat this as the organization’s complete intended allow list: read the existing value first so a change does not accidentally remove another team’s required application. - Verify the resulting policy. Run
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicyagain and confirm the IDs, then verifyEwsEnabledseparately. - Remove the ID restriction only if intended. To clear the restriction, run
Set-OrganizationConfig -EwsAllowedAppIDs $null. This removes the app-ID filter; it does not turn EWS on or bypass other controls.
How it differs from Graph and other EWS controls
It does not allow or block Microsoft Graph
EwsAllowedAppIDs applies to direct EWS SOAP connections. Microsoft explicitly states it does not affect Microsoft Graph API requests or the REST endpoint in the cmdlet reference. It is therefore not a general Microsoft 365 API allow list.
Application IDs and user-agent rules are separate checks
EwsApplicationAccessPolicy with EwsAllowList or EwsBlockList evaluates user-agent strings, not Entra application IDs. When both an application-ID policy and a user-agent policy are present, Microsoft’s access-control guidance says both must permit the connection. An allowed app ID alone does not guarantee access if a user-agent allow list also blocks the request.
Special case: Skype for Business Server hybrid
Microsoft’s EWS retirement preparation guidance for Skype for Business Server hybrid describes a scenario-specific EWS continuity requirement: enable tenant EWS and allow both the deployment’s Skype for Business Server app ID and the Skype desktop client app ID. The guidance identifies the desktop client ID as d3590ed6-52b3-4102-aeff-aad2292ab01c. To identify the server app ID, it gives this command:
Get-CsOAuthConfiguration | Format-List ServiceName
Microsoft’s guidance said administrators needed to make the configuration by the end of August 2026 for calls to continue through phased disablement. It also identifies a later migration from EWS to Microsoft Graph before permanent EWS retirement, including an April 1, 2027 deadline for a Skype for Business Server update. These dates apply to that documented hybrid scenario; use the current Microsoft guidance for the deployment and check the tenant’s actual settings.
Quick Recap
What to check when an EWS app is blocked
- Confirm the API path. This allow list concerns direct EWS SOAP access, not Graph API or REST calls.
- Check
EwsEnabled. If it is$false, no application ID on the list can enable EWS. - Check the configured app ID. Retrieve the organization policy with
-RetrieveEwsOperationAccessPolicyand compare it with the ID the integration actually uses. - Check other access controls. A user-agent policy or mailbox-level setting may also affect the connection.
- Check OAuth separately. The allow list does not register an Entra application or grant delegated or application permissions.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
