Block Access to Exchange Web Services (EWS)

Exchange Web Services (EWS) provides applications with access to mailbox data such as email, calendars, contacts, and tasks. If your organization no longer relies on EWS, disabling it reduces unnecessary access paths to sensitive Exchange Online data.

Before blocking EWS, identify applications, backup solutions, integrations, and automation workflows that still depend on it. Microsoft is retiring EWS in Exchange Online, so remaining integrations should be migrated to Microsoft Graph wherever possible.

Recommended implementation

• Inventory applications and integrations currently using EWS.
• Confirm whether backup, archiving, migration, calendar, or third-party applications depend on EWS.
• Migrate supported integrations from EWS to Microsoft Graph.
• Review the current organization-wide EWS configuration using Get-OrganizationConfig | Format-List Ews*.
• If EWS is not required, disable it organization-wide using Set-OrganizationConfig -EwsEnabled:$false.
• If only specific mailboxes should be restricted, use Set-CASMailbox -Identity user@domain.com -EwsEnabled:$false.
• If EWS must temporarily remain available, restrict access to explicitly approved applications rather than allowing unrestricted EWS usage.
• Monitor application and user impact after enforcement and document any approved exceptions.

Important consideration

Do not disable EWS without first identifying existing dependencies. Legacy applications, backup products, migration tools, and other integrations may still rely on EWS and could stop functioning after the change.

For Exchange Online environments, blocking unnecessary EWS access should also be considered part of the migration strategy toward Microsoft Graph rather than a standalone configuration change.