Skip to main content

Microsoft Exchange Web Services (EWS) change and impact on mailbox migrations

Explains the EWS deprecation, how it will affect ShareGate Migrate, and how to avoid disruptions with Copy mailbox

Note: PowerShell integration requires a ShareGate Migrate Pro or Enterprise subscription. It is not available on the Essentials plan.

Starting October 1, 2026, Microsoft will block EWS requests by default across all Exchange Online tenants, with a full, permanent shutdown planned for April 1, 2027.

ShareGate Migrate currently uses EWS for mailbox migrations with Copy mailboxes.

To avoid disruptions to your mailbox migrations, we recommend configuring your tenant to allow EWS for ShareGate before August 31, 2026.

What's changing

Microsoft's timeline

August 31, 2026

Deadline to configure your tenant to keep EWS enabled. Tenants that set EWSEnabled to True and configure an EWS allow list before this date will be excluded from the automatic October 1 block.

October 1, 2026

EWS is blocked by default in all Exchange Online tenants that have not opted in. Microsoft will set EWSEnabled to False for any tenant still on the default setting.

Tenant administrators can still re-enable EWS after this date, but there will be a service interruption.

April 1, 2027

EWS is permanently shut down in Exchange Online. No re-enablement will be possible after this date.

ShareGate Migrate's plan

ShareGate Migrate currently uses EWS for Copy mailboxes only.

For all other migration scenarios, this change has no impact.

What you need to do

To keep the above mailbox features working after October 1, 2026, configure your tenant's EWS allow list to include ShareGate before August 31, 2026.

Note: These steps must be performed in both your source and destination tenants.

What you'll need

Add ShareGate Migrate to your EWS allow list

  1. Open PowerShell.

  2. Run the following command:

    Set-OrganizationConfig -EWSEnabled $true -EWSAllowList @{Add="ExchangeServicesClient/*"} -EwsApplicationAccessPolicy EnforceAllowList

    This enables EWS for your tenant and adds ExchangeServicesClient/* to your EWS allow list. ShareGate Migrate uses this UserAgent to make EWS calls.

    Warning: The ExchangeServicesClient/* pattern matches any app built on Microsoft's EWS library, not ShareGate specifically. Before running this command, check whether any other apps in your organization use EWS with a different UserAgent, as they will be blocked by EnforceAllowList. You can add their UserAgent strings to EWSAllowList as needed. ShareGate has no visibility into third-party apps in your tenant.

  3. To confirm the change was applied successfully, run:

    Get-OrganizationConfig | Select-Object EWSEnabled, EWSAllowList, EwsApplicationAccessPolicy

    The output should show EWSEnabled as True, ExchangeServicesClient/* listed under EWSAllowList, and EwsApplicationAccessPolicy set to EnforceAllowList.

  4. Repeat these steps in your destination tenant if it is a different Microsoft 365 organization.

Note: This command can take up to 4 hours to take effect across your tenant. We recommend running it outside of a planned migration window.

Important: This configuration is temporary. After April 1, 2027, Microsoft will permanently disable EWS in Exchange Online regardless of tenant settings.

We are working with Microsoft to ensure ShareGate Migrate no longer requires EWS.

Did this answer your question?