Note: PowerShell integration requires a ShareGate Migrate Pro or Enterprise subscription. It is not available on the Essentials plan.

Starting October 1, 2026, Microsoft will block EWS requests by default across all Exchange Online tenants, with a full, permanent shutdown planned for April 1, 2027.

ShareGate Migrate currently uses EWS for mailbox migrations with Copy mailboxes.

To avoid disruptions to your mailbox migrations, we recommend configuring your tenant to allow EWS for ShareGate before August 31, 2026.

What's changing

Microsoft's timeline

August 31, 2026

Deadline to configure your tenant to keep EWS enabled. Tenants that set EWSEnabled to True and configure an EWS allow list before this date will be excluded from the automatic October 1 block.

October 1, 2026

EWS is blocked by default in all Exchange Online tenants that have not opted in. Microsoft will set EWSEnabled to False for any tenant still on the default setting.

Tenant administrators can still re-enable EWS after this date, but there will be a service interruption.

April 1, 2027

EWS is permanently shut down in Exchange Online. No re-enablement will be possible after this date.

ShareGate Migrate's plan

ShareGate Migrate currently uses EWS for Copy mailboxes only.

For all other migration scenarios, this change has no impact.

What you need to do

To keep the above mailbox features working after October 1, 2026, configure your tenant's EWS allow list to include ShareGate before August 31, 2026.

Note: These steps must be performed in both your source and destination tenants.

What you'll need

Access to Exchange Online PowerShell
Exchange admin permissions or higher
The ExchangeOnline Management module in PowerShell

Add ShareGate Migrate to your EWS allow list

Open PowerShell.
Run the following command:
```
Set-OrganizationConfig -EWSEnabled $true -EWSAllowList @{Add="ExchangeServicesClient/*", "*Sharegate*","kiota-dotnet/*"} -EwsApplicationAccessPolicy EnforceAllowList
```
This enables EWS for your tenant and adds all three UserAgents required by ShareGate Migrate to your EWS allow list. ExchangeServicesClient/* covers standard EWS calls. *Sharegate* and kiota-dotnet/* are required for Microsoft Graph endpoints that use EWS in the background, including group calendar migration.

Warning: These patterns match any app that uses the same UserAgents, not ShareGate specifically. Before running this command, check whether any other apps in your organization use EWS with different UserAgents, as they will be blocked by EnforceAllowList. You can add their UserAgent strings to EWSAllowList as needed. ShareGate has no visibility into third-party apps in your tenant.
To confirm the change was applied successfully, run:
```
Get-OrganizationConfig | Select-Object EWSEnabled, EWSAllowList, EwsApplicationAccessPolicy
```
The output should show EWSEnabled as True, ExchangeServicesClient/*, *Sharegate*, and kiota-dotnet/* listed under EWSAllowList, and EwsApplicationAccessPolicy set to EnforceAllowList.
Repeat these steps in your destination tenant if it is a different Microsoft 365 organization.

Note: This command can take up to 4 hours to take effect across your tenant. We recommend running it outside of a planned migration window.

Other options

If you prefer not to configure an allow list right away, two other options are available. Both involve service interruptions after October 1, 2026.

Keep EWS enabled without an allow list

Run Set-OrganizationConfig -EWSEnabled $true to enable EWS without restricting it to specific UserAgents. This works now, but Microsoft will block EWS for tenants that have not configured an allow list on October 1, 2026.

Do nothing until October 1, 2026

If EWSEnabled is currently $null, EWS will continue to work until October 1, 2026. On that date, Microsoft will automatically set it to False. To re-enable EWS after that, run Set-OrganizationConfig -EWSEnabled $null. You will still need to configure an allow list before April 1, 2027.

Important: This configuration is temporary. After April 1, 2027, Microsoft will permanently disable EWS in Exchange Online regardless of tenant settings.

We are working with Microsoft to ensure ShareGate Migrate no longer requires EWS.

Microsoft Exchange Web Services (EWS) change and impact on mailbox migrations