What is happening to Exchange Web Services (EWS)?
Microsoft is retiring Exchange Web Services (EWS) for Exchange Online (Microsoft 365). This affects all applications that connect to Exchange Online using EWS, including older versions of OnTime Group Calendar.
Microsoft’s current timeline is:
- October 1, 2026 – Microsoft may begin disabling EWS by default in Exchange Online tenants.
- April 1, 2027 – EWS for Exchange Online will be permanently retired.
Customers should plan to migrate to Microsoft Graph before these dates.
Does this affect OnTime Group Calendar?
Yes, if your OnTime installation communicates with Exchange Online using EWS.
Current versions of OnTime fully support Microsoft Graph, which is Microsoft’s replacement for EWS. Existing customers may continue using EWS until Microsoft retires it, but Microsoft now provides additional controls over which applications are permitted to access EWS.
Does this affect Exchange Server on-premises?
No.
Microsoft is only retiring EWS for Exchange Online (Microsoft 365). Exchange Server on-premises continues to support EWS.
What about hybrid environments?
Hybrid environments continue to be fully supported.
- Exchange Server on-premises mailboxes can continue using EWS.
- Exchange Online mailboxes should use Microsoft Graph whenever possible.
- OnTime supports hybrid deployments where both technologies are used simultaneously.
Why does OnTime still need access to EWS?
Some existing deployments or legacy configurations continue to use EWS when communicating with Exchange Online.
Until you migrate to Microsoft Graph, Exchange Online must allow the OnTime application to use EWS.
Understanding Microsoft’s EWS Allow Lists
Why are there two EWS allow lists?
Microsoft now supports two independent mechanisms for allowing applications to use EWS.
EWS Allow List (User-Agent)
The original allow list identifies applications by their User-Agent.
It is configured using:
- EwsApplicationAccessPolicy
- EwsAllowList
EWS Allowed App IDs
Microsoft has introduced a second allow list that identifies applications using their Microsoft Entra Application (Client) ID.
It is configured using:
- EwsAllowedAppIDs
Do I need to configure both?
Possibly but we will only cover EWS Allowed App IDs in this FAQ
What information do I need?
You’ll need:
- Exchange Online administrator permissions
- Exchange Online PowerShell
- The OnTime Microsoft Entra Application (Client) ID
How do I find the OnTime Application (Client) ID?
- Sign in to the Microsoft Entra admin center.
- Navigate to Applications → App registrations.
- Open the OnTime application.
- Copy the Application (client) ID.
You’ll use this value when configuring EwsAllowedAppIDs.
Configuring the App ID Allow List
How do I add OnTime’s Application ID?
Set-OrganizationConfig -EwsAllowedAppIDs “11111111-2222-3333-4444-555555555555”
Replace “11111111-2222-3333-4444-555555555555” with the OnTime Application (Client) ID.
How do I verify the App ID Allow List?
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs
Verify that the OnTime Application ID appears in the returned list.
How long do changes take to become effective?
Changes typically propagate throughout Microsoft 365 within several minutes.
Can I see which applications are still using EWS?
Yes.
Microsoft provides EWS Usage Reports in the Microsoft 365 Admin Center under:
Usage → Exchange → EWS Usage
These reports can help identify applications that still rely on EWS and assist with migration planning.
Should I migrate to Microsoft Graph now?
Yes.
Microsoft Graph is Microsoft’s strategic API for Exchange Online and is fully supported by current versions of OnTime Group Calendar.
Migrating to Microsoft Graph removes the need to manage EWS allow lists and ensures long-term compatibility with Microsoft 365.
What happens if I do nothing?
If your Exchange Online deployment continues to rely on EWS:
- Microsoft may begin disabling EWS by default in your tenant starting October 1, 2026.
- Beginning April 1, 2027, EWS for Exchange Online will no longer be available.
- Any application still using EWS—including OnTime if it has not been migrated to Microsoft Graph—will no longer be able to communicate with Exchange Online.
Until you migrate to Microsoft Graph, ensure that OnTime has been added to every EWS allow list that is enabled in your Exchange Online tenant. If both the User-Agent allow list and the App ID allow list are in use, OnTime must be present in both.