Why does Set-OrganizationConfig reject the EwsAllowedAppIDs parameter?
Asked by
MellowCedar42
Microsoft is retiring Exchange Web Services and plans to disable it permanently in October 2027. In the meantime, administrators are supposed to be able to keep EWS enabled while restricting access to approved Microsoft Entra application IDs.
The documented command is:
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee,11111111-2222-3333-4444-555555555555"
I updated the ExchangeOnlineManagement module and inventoried the applications using EWS, but running the command returns: "A parameter cannot be found that matches parameter name 'EwsAllowedAppIDs'."
It appears this capability may be rolling out gradually. Is there a way to check whether it has reached a tenant, or is there another prerequisite such as enabling EWS first? Has anyone successfully configured the allowlist?
Answers
This does work for some tenants with ExchangeOnlineManagement 3.10.0 and PowerShell 7.5.4. The general process is to review the current EWS settings, retrieve the operation access policy, set EwsAllowedAppIDs to a comma-separated list of approved application IDs, verify the value, and then set EwsApplicationAccessPolicy to EnforceAllowList.
Be careful when building the list: usage reports may omit some third-party applications, and even some Microsoft first-party applications may still use EWS. One administrator had to roll back after discovering those dependencies, so waiting for the broader rollout and validating every application is sensible.
Reply to this answer
This appears to be a phased tenant-side rollout rather than just a PowerShell module issue. Microsoft has indicated that the allowlist will be populated automatically around September, so the feature may become available by then. Updating the module alone does not necessarily make the organization parameter available.
Reply to this answer
Make sure you are using a current ExchangeOnlineManagement release and have the necessary privileged role activated through your identity management process. In tenants where the feature is available, you can inspect it with Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy and then view EwsAllowedAppIDs. The parameter may still be missing entirely when the backend capability has not reached the tenant.
Reply to this answer
Add your answer
Answers are reviewed before publication.
SilverMaple26: The EWS usage report is useful but should not be treated as complete. We found first-party services and third-party applications that were missing from the report, so testing the allowlist in a controlled way is important before enforcing it.