EWS Retirement: Afi Is Ready with Microsoft Graph

Microsoft is retiring Exchange Web Services (EWS) in Exchange Online. If you use anything that reads or moves mailbox data through EWS — custom apps, scripts, migration tools, backup tools — now is the time to reduce risk before Microsoft turns those legacy connections off.

If you are an Afi customer: you do not need to do anything. Afi handles the EWS transition behind the scenes. Your backups will keep running without any changes on your end.

Microsoft updated the retirement plan in February 2026 (MC1227454) to introduce a phased shutdown with a harder final deadline of April 1, 2027, and new admin controls that have their own deadlines. Some tenants may also be hit earlier with Kiosk/F1/F3 license enforcement starting July 1, 2026.

Note on pre-retirement “scream tests”: Before October 2026, Microsoft plans to run short, temporary EWS disablement periods to surface hidden dependencies. Monitor your EWS Usage report and vendor communications during this period.

The February 2026 update introduced an important operational control that the original retirement announcement did not include.

Starting October 1, 2026, EWS will be blocked unless a tenant explicitly opts in by setting EWSEnabled=True and maintaining an AppID AllowList of permitted service principals. Without admin action, Microsoft will set EWSEnabled=False automatically, and any EWS-dependent apps will stop working on that date.

If you have EWS-dependent tools that will not be migrated in time, you must configure the AllowList before the end of August 2026 — not October 1. That window exists to ensure the change takes effect before enforcement begins.

After April 1, 2027: EWS access is permanently removed with no re-enablement, regardless of AllowList configuration. All applications must be on Microsoft Graph by that date.

Retiring EWS based on memory does not work. Start by finding exactly which apps still call EWS, then work with app owners and vendors on a migration plan.

Use EWS Usage Reports in Microsoft 365 Admin Center

Path: Microsoft 365 Admin Center → Reports → Usage → Exchange → EWS usage

The report shows:

• Application ID (Entra app / service principal)
• SOAP action
• Call volume
• Last activity date (UTC)

Two operational notes:

• Data is aggregated weekly, not daily.
• The report is documented for Worldwide tenants; sovereign/government clouds may need alternate discovery methods.

Turn Inventory into Action

For each app you find:

• Move to Microsoft Graph where possible.
• Work with vendors on their EWS transition plan and ask for a specific dated commitment.
• Redesign around Graph gaps if the app depends on archive/public folders or other edge cases.
• Retire abandoned scripts and legacy tools.
• If migration will not be complete by October 2026, configure the AppID AllowList and set EWSEnabled=True by end of August 2026.

Microsoft Graph covers most everyday mailbox access, but Microsoft has also called out a few real gaps as part of the EWS retirement guidance.

Key gaps to keep in mind:

• Online Archive mailbox access: this has historically lagged, and Microsoft is still working on it. Affects backup, archiving, and compliance tools most directly.
• Mailbox settings and hidden data: some behind-the-scenes mailbox configuration data is not fully covered in Graph.
• Admin / management scenarios: some Exchange Online management tasks still have limited Graph coverage.
• Public folders: Microsoft has confirmed there will be no programmatic CRUD API after April 2027 (beyond Outlook client access and bulk import/export options).

These aren't "small app" issues. They hit hardest for backup, archiving, migration, and compliance tools, where you need full coverage and reliable restore.

Many vendors say they "support Microsoft Graph," but a lot of products still rely on EWS for parts of Exchange Online, especially for the less common and more complex mailbox areas.

Common patterns we see across vendors:

• Split coverage: Graph for basic Exchange mailboxes, but EWS for edge cases like Online Archive mailboxes, Recoverable Items folders, or certain restore paths.
• Fallback designs: Graph is the default, but the product drops back to EWS when Graph is throttled or fails.
• Legacy implementations: EWS is still the main way the product reads or restores Exchange data because it was simpler or more complete at the time.

Use EWS Usage Reports to see which apps still call EWS in your tenant, then use that evidence to push vendors for a clear, dated migration plan.

Vendor Due Diligence Questions (for other tools in your stack)

• Do you use EWS anywhere today? For which workloads and mailbox types?
• What is your Graph-only plan by July 2026, October 2026, and the hard deadline of April 1, 2027?
• How do you deal with Graph throttling and partial failures without an EWS fallback?
• Is the Online Archive migration on your roadmap, and when?

Afi's Microsoft 365 backup uses public Microsoft 365 APIs with application permissions (not user impersonation through a single admin account) and supports Exchange Online backup and recovery for mail, contacts, calendars, tasks, group mailboxes, Online Archive, and Recoverable Items (based on your SLA policy).

Already Graph-first today

• Primary mailbox data: Mail, contacts, and calendar backup runs on Microsoft Graph and modern auth.
• Tasks: Exchange tasks are backed up via the Microsoft To Do API in Graph, including lists, task metadata, checklists, and attachments.
• Operational resilience: Afi is built to handle Graph throttling and transient errors, pause when needed, and resume from saved state while monitoring recurring issues across tenants.

Answering the due diligence questions for Afi

• Remaining EWS-dependent workloads (group mailboxes, Recoverable Items) are actively being migrated and targeted for completion ahead of October 2026.
• Graph throttling is handled natively — Afi pauses, retries, and resumes without falling back to EWS.

Coming soon (as remaining EWS dependencies are removed)

• Group mailboxes: Migrating remaining group mailbox coverage to the Graph Group Conversations API.
• Recoverable Items: Expanding Graph-based coverage for the mailbox “safety net” folders where deleted items often land first (e.g. the soft-delete folder). This helps support everyday recovery scenarios and retention-related behavior.

We expect EWS retirement to be a smooth, behind-the-scenes transition for Afi customers. Microsoft 365 will block EWS automatically at deprecation, and no additional actions will be required from our customers to keep backups running.

Note on Online Archive: Afi supports Exchange Online Archive today, but Microsoft has not provided a Graph API replacement for archive mailbox access yet — this is a known gap across the entire ecosystem. Existing coverage remains unaffected. We are tracking Microsoft's roadmap and will update customers as a migration path becomes available.

EWS retirement is now an execution project, not a "later" problem. The phased shutdown starts October 1, 2026, some tenants are affected earlier, and the hard final deadline of April 1, 2027 leaves no room for delays.

Practical playbook:

1. Inventory EWS usage with Microsoft 365 EWS Usage Reports — do this now.
2. Prioritize high-risk vendor tools and business-critical workflows.
3. Plan around known Graph parity gaps (archive, public folders, admin configuration).
4. If EWS-dependent tools will not be migrated by October 2026, configure the AppID AllowList and set EWSEnabled=True before the end of August 2026.
5. Watch for Microsoft's pre-retirement “scream tests” and use them to surface hidden dependencies.
6. Hold all vendors to a specific, dated Graph migration commitment before April 1, 2027.

If you are an Afi customer, you are in good hands. If you are evaluating backup tools, ask the right questions — and make sure the answers come with dates.