EWS retirement checklist for MSPs: what it means for scanners and scan-to-email
Microsoft started switching off Exchange Web Services (EWS) in Exchange Online in October 2026 and removes it for good on April 1, 2027. Most copiers send scans over SMTP, not EWS, so most scan-to-email keeps working. This checklist helps you find the devices and connectors that do use EWS, and keeps the separate SMTP AUTH deadline in view.
Two different "EWS"s. Printer makers also call the device's own web admin page the "Embedded Web Server" (EWS), for example on HP and Xerox. That page isn't affected. This guide is about Exchange Web Services, Microsoft's mailbox API.
The dates
| When | What happens |
|---|---|
| From Oct 1, 2026 (rolling out tenant by tenant) | Tenants whose EWSEnabled setting was still blank (Null) get it set to False, which blocks EWS for every app. An admin can turn it back on with EWSEnabled=True plus an AppID allow list. |
| Oct 2026 to Mar 2027 | Monthly Message Center posts with each tenant's EWS usage. Microsoft may run short "scream tests" that turn EWS off and on again. |
| Apr 1, 2027 | EWS is permanently off in Exchange Online. Microsoft says there will be no exceptions. |
| End of Dec 2026 (separate change) | SMTP AUTH with Basic auth (a username and password to smtp.office365.com) is turned off by default. This is the one that hits most copiers. |
EWS on Exchange Server (on-premises) isn't changing.
Which scan workflows can use EWS
- Scan-to-email over SMTP: doesn't use EWS. It's affected by the SMTP AUTH change instead (see the hub guide).
- Device or vendor "connectors" that read or send through the mailbox API, look up the address book, or file scans into mailboxes or public folders. Some older ones were built on EWS. Check the vendor's notes for your model.
- Document capture and scan-routing software on a server that watches a mailbox and files attachments. These often used EWS.
- Fax-to-email and fax servers that deliver into mailboxes.
You don't have to guess: the tenant's EWS usage report lists every app ID that called EWS.
Checklist, per client tenant
- Pull the EWS usage report. Microsoft 365 admin center ▸ Reports ▸ Usage ▸ Exchange ▸ EWS usage. Export it and note each AppId.
- Name the apps. Look each AppId up under Entra ID ▸ Enterprise applications. Expect Microsoft's own apps on the list (Microsoft Office is
d3590ed6-52b3-4102-aeff-aad2292ab01c); those are Microsoft's job. Focus on third-party and in-house ones. - Check the tenant setting. In Exchange Online PowerShell:
Get-OrganizationConfig | Format-List EWSEnabled. False means EWS is already blocked; if nobody has complained, you may not need it. - Per app, decide: update to a version that uses Microsoft Graph, replace it, or (until April 1) keep it on the AppID allow list with
EWSEnabled=True. The allow list buys time only. - For scanners, check both deadlines at once. While you're in each device's settings for EWS, record whether it sends with SMTP AUTH. Those devices also need a fix before the end of December: OAuth firmware or a relay. See Find devices still using SMTP AUTH Basic.
- Tell the client what changes. If a connector loses features (for example, address book lookups), write down the workaround before cutover day.
- Recheck the report monthly until April. Anything new on it is a dependency you missed.
Where a relay fits
If a scan workflow only needs to send mail, it doesn't need EWS or a password. Point the device or the software at a local SMTP relay that sends as one mailbox through Microsoft Graph with OAuth. That covers both deadlines in one change. Workflows that read mailboxes or file into public folders need a Graph-capable version of that software instead; a relay won't help there.
Next: the scan-to-email cutover checklist has the per-site rollout and test table.
Keep older scanners sending, without a third-party mail service
ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta from October 2026.
Join the betaView on GitHub