Enable EWS for Add it (Microsoft 365 / Exchange Online)

Brief summary — Microsoft is gradually shutting down Exchange Web Services (EWS) starting October 1, 2026. To keep syncing calendar, contacts, and email between Microsoft 365 and the app working, your Microsoft 365 administrator needs to do two things in Exchange Online: allow the Add it app and enable EWS. This takes about 10 minutes.


Who does this?	Whoever is your Microsoft 365/Exchange administrator
Time	About 10 minutes, plus up to 24 hours before the change takes effect
Tool	Exchange Online PowerShell (Azure Cloud Shell or on-premises PowerShell)
App	Add it
Application ID	`c55ca600-29f4-42b5-8c9a-a2d53153f8a2`

Do you need to do this?

Yes, if you use the connection between the app and Microsoft 365 for calendar, contacts or email. Make the change well in advance before October 1, 2026 – then your users will not notice the transition at all.

Has sync already stopped working? Then Microsoft has reached your environment. The same steps in this guide will restore the connection. Telephony and other functions in the app are not affected.

What does this apply to – and what does it not apply to?

Applies to: the Microsoft 365 account that each user connects to their personal app for calendar, email, and contacts .

Does not apply: email addresses connected to Contact Center – they are not affected by the EWS shutdown.

Temporary solution — Microsoft will permanently close EWS on April 1, 2027 without exception. We are building the next generation of the Microsoft connector on Microsoft Graph in parallel, and we will contact you with instructions well in advance.

Before you start

Check this first – then the rest will happen in a few minutes.

Your account has permission to connect to Exchange Online and change the organization configuration (e.g. Exchange Administrator or Global Administrator).

The users' mailboxes are located in Exchange Online . The guide does not apply to on-premises Exchange Server.

The Add it app is administrator-approved in Entra ID (checked under Entra ID → Enterprise applications ).

You are using Azure Cloud Shell, or have the Exchange Online module installed locally: Install-Module ExchangeOnlineManagement.

Use only Application ID — Object ID is unique for each tenant and should not be used in . Application ID is the same across all tenants.EWSAllowedAppIDsc55ca600-29f4-42b5-8c9a-a2d53153f8a2

This is how you do it

Follow the steps in order and copy one block at a time.

Step 1 – Open PowerShell

Go to portal.azure.com , open Cloud Shell (the >_ icon in the top menu), and select PowerShell . Local PowerShell with the Exchange Online module works just as well.

Step 2 – Connect to Exchange Online

A login dialog will open. Log in with your administrator account.

Connect-ExchangeOnline

This is what you should see: a line stating that the module was loaded, and then a blank prompt with no error message. The command returns nothing if the connection was successful.

Step 3 – Read current settings

Get-OrganizationConfig | Select-Object EwsEnabled
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

This is what you should see: something like this, where the list may be empty or contain other apps:

EwsEnabled
----------
     False

EwsAllowedAppIDs : 1a2b3c4d-0000-0000-0000-abcdefabcdef

How to interpret EwsEnabled :

Value	Means
`False`	All EWS is blocked – sync does not work.
`True`	EWS is on and only apps in the AppID list are allowed.
`Null` (empty)	Temporarily open, but Microsoft may change it to `False` automatically during rollout.

Important – save the list before the next step — overwrites the entire list. Copy the value from to a text file before continuing, so you can restore if something goes wrong. The command in step 4 is written to preserve existing entries – but always have a copy.Set-OrganizationConfig -EwsAllowedAppIDsEwsAllowedAppIDs

Step 4 – Add Add it to the list of allowed apps

Select and run the entire block . It reads the existing list, adds Add it if it's missing, and writes everything back - existing apps are preserved.

$newAppId = "c55ca600-29f4-42b5-8c9a-a2d53153f8a2"
$currentRaw = Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Select-Object -ExpandProperty EwsAllowedAppIDs
$current = @($currentRaw -split "," | ForEach-Object { $_.Trim() } | Where-Object { $_ })
$updated = @($current + $newAppId | Select-Object -Unique)
Set-OrganizationConfig -EwsAllowedAppIDs ($updated -join ",")

This is what you should see: no printout and no error message. You verify the result in step 6.

Step 5 – Enable EWS

Then only the apps that are in the AppID list are allowed – including Add it.

Step 6 – Verify

Set-OrganizationConfig -EwsEnabled $true

Get-OrganizationConfig | Select-Object EwsEnabled
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

This is what a successful result looks like:

EwsEnabled
----------
      True

EwsAllowedAppIDs : c55ca600-29f4-42b5-8c9a-a2d53153f8a2

EwsEnabled should be True and EwsAllowedAppIDs should contain c55ca600-29f4-42b5-8c9a-a2d53153f8a2 – along with any apps that were there before.

Do you also want to check an individual mailbox:

How do you know it works in the app?

Get-CASMailbox -Identity "anvandare@foretaget.se" | Select-Object EwsEnabled

Wait up to 24 hours if necessary – Exchange updates its cache periodically, so the change may not always take effect immediately.

Check that meetings and contacts from Microsoft 365 are displayed as usual. Please test in an InPrivate/Incognito window.

Troubleshooting

Symptom	Probable cause	Measure
Sync still doesn't work right after the change	The Exchange cache has not been updated yet.	Wait up to 24 hours and try again in InPrivate/Incognito
Error 403 Forbidden	The app is blocked by Conditional Access or lacks approval.	Check admin approval for Add it in Entra ID as well as Conditional Access policies. Review interactive and non-interactive login logs
Add it is not visible in `EwsAllowedAppIDs`	The block in step 4 was not executed in its entirety	Run the entire block in step 4 again and verify according to step 6
`EwsEnabled` is `False` again	Microsoft's rollout has set the value	Rerun `Set-OrganizationConfig -EwsEnabled $true`
Other integrations stopped working after the change	The list was overwritten without the previous App IDs	Add back the saved App IDs using the same command as in step 4
One individual user is out of sync, the others are working	EWS turned off at the mailbox level, or the mailbox is not in Exchange Online	Check with `Get-CASMailbox` according to step 6

Legacy policy is something else — / is based on User Agent and is not the same as . If you are using such an older policy, Add it must pass both checks.EwsApplicationAccessPolicyEWSAllowListEWSAllowedAppIDs

What happens next?

October 1, 2026 – Microsoft will begin phasing out EWS in customer environments.

Until April 1, 2027 – The steps in this guide keep the connection going.

April 1, 2027 – EWS will be permanently closed. The new Microsoft connector, built on Microsoft Graph, will be in place well in advance and we will return with new instructions.

Do you need help?

Contact our support – we'll be happy to help with the setup.

Frequently asked questions

What parts of the app are affected by turning off EWS?

Only the personal Microsoft 365 connection in the user's app - that is, syncing of calendar, email and contacts . Telephony, call history and other functions work as usual.

Are the email addresses associated with Contact Center affected?

No. Email addresses associated with Contact Center are handled differently and are not affected by the EWS decommissioning. You do not need to do anything with them.

Does each user need to do something themselves?

No. Your Microsoft 365 admin makes the change once for your entire organization. Users don't need to re-link their accounts—sync will continue to work once the steps are complete.

What happens if we do nothing?

When Microsoft's shutdown reaches your environment, calendar, email, and contacts syncing will stop working in the app. It will be restored once the two steps in the guide are completed.

Is it safe to allow the Add it app?

Yes. Add it only has access to what is required for sync, and only for users who have linked their Microsoft 365 account in the app. The app is also administrator-approved in your Entra ID.

We use local Exchange Server – does the guide apply to us?

No. The guide applies to mailboxes in Exchange Online. Contact our support if you are running Exchange on-premises or in hybrid mode.

Official Microsoft sources

Exchange Online EWS, Your Time is Almost Up

Introducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement

Table of contents