Microsoft is retiring Exchange Web Services and plans to disable it permanently in October 2027. In the meantime, administrators are supposed to be able to keep EWS enabled while restricting access to approved Microsoft Entra application IDs.
The documented command is:
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee,11111111-2222-3333-4444-555555555555"
I updated the ExchangeOnlineManagement module and inventoried the applications using EWS, but running the command returns: "A parameter cannot be found that matches parameter name 'EwsAllowedAppIDs'."
It appears this capability may be rolling out gradually. Is there a way to check whether it has reached a tenant, or is there another prerequisite such as enabling EWS first? Has anyone successfully configured the allowlist?
2 Answers
This appears to be a phased tenant-side rollout rather than just a PowerShell module issue. Microsoft has indicated that the allowlist will be populated automatically around September, so the feature may become available by then. Updating the module alone does not necessarily make the organization parameter available.
This does work for some tenants with ExchangeOnlineManagement 3.10.0 and PowerShell 7.5.4. The general process is to review the current EWS settings, retrieve the operation access policy, set EwsAllowedAppIDs to a comma-separated list of approved application IDs, verify the value, and then set EwsApplicationAccessPolicy to EnforceAllowList.
Be careful when building the list: usage reports may omit some third-party applications, and even some Microsoft first-party applications may still use EWS. One administrator had to roll back after discovering those dependencies, so waiting for the broader rollout and validating every application is sensible.
The EWS usage report is useful but should not be treated as complete. We found first-party services and third-party applications that were missing from the report, so testing the allowlist in a controlled way is important before enforcing it.