Two separate Microsoft changes affect how ShareGate Migrate uses Exchange Web Services (EWS) for mailbox migrations with Copy mailboxes, and both take effect around the same time in 2026.

A tenant-wide EWS block. Starting October 1, 2026, Microsoft blocks EWS by default in every Exchange Online tenant that hasn't opted in, with a full, permanent shutdown on April 1, 2027.
A license-based restriction for Kiosk, F1, and F3 mailboxes. These licenses never included EWS access rights, and starting October 1, 2026, Microsoft will begin enforcing that restriction regardless of your tenant's allow list status.

Note: These are separate mechanisms with separate fixes. Configuring your tenant's EWS allow list, described below, only addresses the tenant-wide block. If your migration includes mailboxes on a Kiosk, F1, or F3 license, you also need to complete the license fix described in this article below.

To avoid disruptions to your mailbox migrations, configure your tenant's EWS allow list before August 31, 2026, and update the licenses for any Kiosk, F1, or F3 mailboxes before migrating them.

What's changing

Microsoft's timeline

August 31, 2026

Deadline to configure your tenant to keep EWS enabled for the tenant-wide block. Tenants that set EWSEnabled to True and configure an EWS allow list before this date are excluded from the automatic October 1 block.

This deadline doesn't apply to the Kiosk, F1, and F3 license restrictions. That restriction has no opt-out grace period.

October 1, 2026

Both changes take effect on this date.

The tenant-wide block: EWS is blocked by default in any Exchange Online tenant that hasn't opted in. Microsoft sets EWSEnabled to False for these tenants.

The license restriction: EWS requests from mailboxes on a Kiosk, F1, or F3 license return an HTTP 403 error, regardless of your tenant's allow list status.

Tenant administrators can still re-enable EWS after this date, but there will be a service interruption.

April 1, 2027

EWS is permanently shut down in Exchange Online. Re-enablement will not be possible after this date.

ShareGate Migrate's plan

ShareGate Migrate currently uses EWS for Copy mailboxes only.

For all other migration scenarios, this change has no impact.

What you need to do

Depending on your migration, you may need to complete one or both of the following actions before October 1, 2026.

1. Configure your tenant's EWS allow list

Once ShareGate Migrate is allow-listed using either method below, the EWS retirement warning banner in ShareGate Migrate disappears automatically.

Note: These steps must be performed in both your source and destination tenants.

What you'll need

Access to Exchange Online PowerShell
Exchange admin permissions or higher
The ExchangeOnline Management module in PowerShell

Add ShareGate Migrate to your EWS allow list

Open PowerShell.
Run the following command:
```
Set-OrganizationConfig -EWSEnabled $true -EWSAllowList @{Add="ExchangeServicesClient/*", "*Sharegate*","kiota-dotnet/*"} -EwsApplicationAccessPolicy EnforceAllowList
```
This enables EWS for your tenant and adds all three UserAgents required by ShareGate Migrate to your EWS allow list. ExchangeServicesClient/* covers standard EWS calls. *Sharegate* and kiota-dotnet/* are required for Microsoft Graph endpoints that use EWS in the background, including group calendar migration.

Warning: These patterns match any app that uses the same UserAgents, not ShareGate specifically. Before running this command, check whether any other apps in your organization use EWS with different UserAgents, as they will be blocked by EnforceAllowList. You can add their UserAgent strings to EWSAllowList as needed. ShareGate has no visibility into third-party apps in your tenant.
To confirm the change was applied successfully, run:
```
Get-OrganizationConfig | Select-Object EWSEnabled, EWSAllowList, EwsApplicationAccessPolicy
```
The output should show EWSEnabled as True, ExchangeServicesClient/*, *Sharegate*, and kiota-dotnet/* listed under EWSAllowList, and EwsApplicationAccessPolicy set to EnforceAllowList.
Repeat these steps in your destination tenant if it is a different Microsoft 365 organization.

Alternative: allow-list by application ID (EwsAllowedAppIDs)

Microsoft also introduced EwsAllowedAppIDs, a newer way to control EWS access by application ID instead of UserAgent string. If you'd rather use this method, add ShareGate Migrate's application ID to your tenant's EwsAllowedAppIDs allow list instead of configuring EWSAllowList.

Note: Setting EwsAllowedAppIDs replaces the existing list each time you set it, unlike EWSAllowList, which supports adding entries incrementally. Include every application ID your tenant needs when you run the command.

Run the following command, using ShareGate Migrate's application ID for Copy mailboxes:

Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "ce9858bf-0093-4723-9742-3af3b3c5e25a"

To confirm the change was applied, run:

Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

Other options

If you prefer not to configure an allow list right away, two other options are available. Both involve service interruptions after October 1, 2026.

Keep EWS enabled without an allow list

Run Set-OrganizationConfig -EWSEnabled $true to enable EWS without restricting it to specific UserAgents. This works now, but Microsoft will block EWS for tenants that have not configured an allow list on October 1, 2026.

Do nothing until October 1, 2026

If EWSEnabled is currently $null, EWS will continue to work until October 1, 2026. On that date, Microsoft will automatically set it to False. To re-enable EWS after that, run Set-OrganizationConfig -EWSEnabled $null. You will still need to configure an allow list before April 1, 2027.

Important: This configuration is temporary. After April 1, 2027, Microsoft will permanently disable EWS in Exchange Online regardless of tenant settings.

We are working with Microsoft to ensure ShareGate Migrate no longer requires EWS.

2. Update licenses for Kiosk, F1, and F3 mailboxes

Exchange Online Kiosk and Microsoft 365 F1 and F3 licenses (including Office 365 F3, formerly Kiosk K1) never included EWS access rights.

Starting October 1, 2026, Microsoft enforces this restriction: EWS requests from mailboxes on only these licenses return an HTTP 403 error.

Note: Adding ShareGate to your tenant's EWS allow list does not fix this. That solution only addresses the tenant-wide block.

Assign a license that includes EWS access rights, such as Exchange Online Plan 1, Exchange Online Plan 2, or a Microsoft 365 or Office 365 E3 or E5 plan, to affected mailboxes before migrating them.

You can reassign the original frontline license once the migration is complete.

Note: This must be done in both your source and destination tenants.

Find and license affected mailboxes in ShareGate Migrate

To find and license affected mailboxes in your destination tenant:

Go to Copy identities (see Copy identities overview).
In the identity planning view, use the Filter button to filter by source license, then select the Kiosk, F1, and F3 licenses your organization uses.
Select the affected identities, then use Bulk Edit > Assign licenses to apply a destination license that includes EWS access to all of them at once.

Note: Copy identities assigns licenses in your destination tenant only. If your source tenant also needs a temporary license change, for example, if you're running Copy mailboxes before decommissioning the source, assign it directly in the Microsoft 365 admin center.

For details on filtering and bulk-assigning licenses, see Copy identities overview.

Microsoft Exchange Web Services (EWS) change and impact on mailbox migrations