What is happening to Exchange Web Services (EWS)?
Microsoft is retiring Exchange Web Services (EWS) for Exchange Online (Microsoft 365). This affects all applications that connect to Exchange Online using EWS, including older versions and certain configurations of OnTime Group Calendar.
Microsoft’s current timeline is:
October 1, 2026 – EWS will be disabled by default in Exchange Online tenants.
April 1, 2027 – EWS for Exchange Online will be permanently retired.
Customers should plan to migrate to Microsoft Graph before these dates.
Does this affect OnTime Group Calendar?
Yes, if your OnTime installation connects to Exchange Online using EWS.
Current versions of OnTime fully support Microsoft Graph, which is Microsoft’s recommended replacement for EWS. Existing customers can continue using EWS until Microsoft disables it, but we recommend planning your migration well before October 2026.
Does this affect On-Premises Exchange?
No. Microsoft is only retiring EWS for Exchange Online (Microsoft 365). Customers using Exchange Server on-premises can continue using EWS without changes.
What about hybrid environments?
Hybrid environments continue to work.
- On-premises mailboxes can continue using EWS.
- Exchange Online mailboxes should use Microsoft Graph.
OnTime supports hybrid deployments and can use both technologies where appropriate.
Why does OnTime still need access to EWS?
Some deployments or legacy configurations may still rely on EWS for Exchange Online communication.
Microsoft allows administrators to control which applications may use EWS through the Exchange Online EWS Allow List, helping prevent unauthorized applications from accessing Exchange Online through EWS.
What is the EWS Allow List?
The EWS Allow List is an Exchange Online security feature that restricts EWS access to approved applications only.
If your organization enforces an allow list, the OnTime Application (Client) ID must be added before OnTime can connect using EWS.
What information do I need before configuring the EWS Allow List?
You will need:
- The OnTime Application (Client) ID from Microsoft Entra ID.
- Exchange Online administrator permissions.
- Access to Exchange Online PowerShell.
How do I find the OnTime Application ID?
- Sign in to the Microsoft Entra admin center.
- Navigate to Applications → App registrations.
- Open the OnTime application.
- Copy the Application (client) ID.
You’ll use this value in the PowerShell commands below.
How do I add OnTime to the EWS Allow List?
After connecting to Exchange Online PowerShell, run:
Set-OrganizationConfig `
-EwsApplicationAccessPolicy EnforceAllowList `
-EwsAllowList @{Add=”YOUR-ONTIME-APPLICATION-ID”}
Replace YOUR-ONTIME-APPLICATION-ID with the actual Application (Client) ID from Microsoft Entra ID.
This command:
- Enables the EWS Allow List policy.
- Adds the OnTime application to the list of approved EWS applications.
How can I verify that OnTime was added successfully?
Run: Get-OrganizationConfig | Select-Object -ExpandProperty EwsAllowList
Verify that the OnTime Application ID appears in the returned list.
How do I remove an application from the EWS Allow List?
If you need to remove an application:
- First review the current list:
Get-OrganizationConfig | Select-Object -ExpandProperty EwsAllowList - Then remove the desired Application ID:
Set-OrganizationConfig `
-EwsAllowList @{Remove=”YOUR-APPLICATION-ID”} - Finally, verify the removal:
Get-OrganizationConfig | Select-Object -ExpandProperty EwsAllowList
The removed Application ID should no longer appear.
How long do changes take to become effective?
Changes to the EWS Allow List can take several minutes to propagate throughout Microsoft 365. During this time, access changes may not take effect immediately.
Can I see which applications are still using EWS?
Yes. Microsoft provides EWS Usage Reports in the Microsoft 365 Admin Center under:
Usage → Exchange → EWS Usage
These reports help identify applications that are still making EWS requests and assist with migration planning.
Should I migrate to Microsoft Graph now?
Yes. Microsoft Graph is Microsoft’s strategic API for Exchange Online and is the recommended platform going forward. OnTime Group Calendar fully supports Microsoft Graph, and customers are encouraged to migrate well before Microsoft’s EWS retirement dates to ensure a smooth transition.
What happens if I do nothing?
If your Exchange Online deployment still depends on EWS:
- After October 1, 2026, EWS may be disabled by default in your tenant.
- After April 1, 2027, EWS connectivity to Exchange Online will no longer be available.
Any application still relying on EWS for Exchange Online—including OnTime if not migrated to Microsoft Graph—will no longer be able to communicate with Exchange Online until it has been reconfigured to use Microsoft Graph.