Exchange Online

Microsoft said today that the Exchange Web Services (EWS) API for Exchange Online and Office 365 will be retired in approximately three years.

EWS is a cross-platform API that can be used to develop apps capable of accessing mailbox items such as email messages, meetings, and contacts. 

These resources can be retrieved from various sources, including Exchange Online, Exchange Online as part of Office 365, and on-premises editions of Exchange (starting with Exchange Server 2007).

"Today, we are announcing that on October 1, 2026, we will start blocking EWS requests from non-Microsoft apps to Exchange Online," the Exchange Team said on Tuesday.

"While the EWS components of the service will continue to receive security updates and certain non-security updates, product design and features will remain unchanged. This change also applies to the EWS SDKs for Java and .NET, as well."

It's important to note that EWS' retirement applies only to Microsoft 365 and Exchange Online across all environments.

No changes are being made to EWS within Exchange Server, and the adjustments made in Exchange Online will have no impact on Outlook for Windows or Mac, Teams, or other Microsoft products.

EWS components will continue to receive security updates along with some non-security updates. However, there will be no changes to the product's design or features. 

As Redmond further explained, this transition extends to the EWS Software Development Kits (SDKs) for both Java and .NET.

Devs advised to switch to the Graph API

Microsoft advised developers using the EWS API to switch to the Microsoft Graph API until retirement, as it will also provide them access to Exchange Online data.

However, the company also warned developers of some feature gaps between EWS and Microsoft Graph, with the most important ones including no access to archive mailboxes, lack of folder-associated information and user configuration, no Exchange Online management capabilities, and no third-party app access to Exchange Online public folders.

The Exchange Team says it's working on closing the functionality gaps; however, in some cases, developers might have to find alternatives to features that won't make it into the Graph API.

"We understand changes like this may cause some inconvenience, but we are confident it will ensure more secure, reliable, and performant experiences," the Exchange Team added.

"We will publish regular communications as we progress towards this deadline to aid affected tenants in identifying EWS usage. Thank you in advance for updating and opening your apps to a wider range of useful and intelligent features on Microsoft Graph."

Today's announcement follows an initial one made in August 2018, when the company warned developers that it would stop investing resources into EWS APIs for Exchange Online.

Three years later, in October 2021, Redmond said it deprecated the 25 least used APIs of EWS for Exchange Online. It also removed support for these deprecated APIs in March 2022 for security purposes.

Related Articles:

W3LL phishing kit hijacks thousands of Microsoft 365 accounts, bypasses MFA

Microsoft Excel to let you run Python scripts as formulas

Major U.S. energy org targeted in QR code phishing attack

EvilProxy phishing campaign targets 120,000 Microsoft 365 users

Microsoft shares fix for Outlook asking to reopen closed windows