The EWS retirement checklist for service providers.

List every customer tenant, with three contacts for each: the person who approves changes, an administrator who can grant or remove consent in Microsoft Entra, and an Exchange administrator.

Record each tenant's current EWSEnabled value and EWSAllowedAppIDs list (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy), including any list Microsoft pre-populated. You need these values for every later decision and for rollback.

Agree with each customer what "done" means for each application: migrated and confirmed working, or retired, with its EWS access removed. Write it down before you start.

Read the Office 365 Exchange Online service principal, then the application-role assignments and delegated grants on it. Any grant of full_access_as_app or a delegated EWS scope is a candidate. Resolve each holder to its application ID, owning tenant and enabled state.

Impactfold Automatic, across every connected tenant, with each read's outcome recorded.

Check Exchange Online RBAC for Applications: review the service principals registered in Exchange and their management role assignments for Application EWS.AccessAsApp. That access does not appear as consent in Microsoft Entra.

Impactfold Not covered. Do this by hand.

Record whether each read was complete. If a request was refused, cut short or failed, the tenant is unknown, not clear.

Impactfold An incomplete read is classified Unknown with the reason, and can never report Safe.

Open the EWS usage report (Microsoft 365 admin center → Reports → Usage → Exchange → EWS usage), export it, and match application IDs to the candidates above. Data is aggregated weekly and can take up to 10 days to appear, so an application that runs rarely may be missing.

Impactfold Not covered. Impactfold observes consent, not usage.

For each application that holds EWS access or appears in the report, ask its owner or vendor whether it still needs EWS, and what its Microsoft Graph path and timeline are.

Move each application to its Graph-based version, or retire it. Have the customer confirm that the functions they rely on still work.

For anything that must keep EWS until 1 April 2027, decide on the allow list with the customer. Treat setting EWSAllowedAppIDs and EWSEnabled as a change: list who is affected, agree a window, keep the values from step 2 for rollback, and allow up to 24 hours for it to take effect.

Once an application no longer needs EWS, remove its EWS consent in Microsoft Entra, and any EWS role assignment in Exchange, under your own privileged access. Note who did it and when.

Impactfold Create the task from the finding, assign it, and mark it ready for verification. Impactfold never makes the change.

Wait for the change to settle, then read the tenant again, completely. A read made too soon can still show a removed grant.

Impactfold A later complete scan closes the finding and the task together, attributed to that scan.

Keep the before, the change and the after, with a timestamp and the person responsible for each. That is what the customer will ask for months later.

Impactfold Append-only audit trail for every finding.

Re-check each tenant from time to time until 1 April 2027. A newly installed application can bring EWS consent back.

Impactfold Run a scan again; a returning exposure reopens the finding and its task. Scans are started by an operator, not on a schedule.