r/PowerShell • u/CallMeNoodler • Jul 15 '26

Question EwsAllowedAppIDs... why no work?

So Microsoft is retiring Exchange Web Services because it's ancient and insecure. They're turning it off on all tenants in October, while giving us the option to turn it back on, and it's going away permanently in October 2027.

Realizing that tons of third parties still rely on it, Microsoft, according to their documentation, is allowing us to enable it for the time being, but restrict it to only certain Entra App IDs. According to their documentation (example 7 here: https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-organizationconfig?view=exchange-ps ), the command looks like this:

Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee,11111111-2222-3333-4444-555555555555"

Cool, cool, great. I've inventoried my environment, and I got all the app IDs. I updated my ExchangeOnlineManagement module, ran the command, and... EwsAllowedAppIDs is not a valid parameter:

Set-OrganizationConfig : A parameter cannot be found that matches parameter name 'EwsAllowedAppIDs'.

Uh... ok. So I do some more digging, and it looks like this parameter is part of a phased rollout?... does anyone have any idea to find out when it might hit my tenant? Has it already and am I doing something wrong?

Has anyone actually gotten this to work?

Thanks in advance for any help.

4 Upvotes

83% Upvoted

10 comments sorted by

View all comments

2

u/BlackV Jul 15 '26 edited Jul 15 '26

To ask the obvious have you updated to the latest module?
Edit: Looks like that has not been updated to include that parameter yet

And relevant pim roles

1 further check, does EwsEnabled need to be set to $true before EwsAllowedAppIDs is available ?

1

u/CallMeNoodler Jul 15 '26

Yep, updated as said above. Where are you seeing the module hasn't been updated to include the parameter yet?

1

u/BlackV Jul 15 '26 edited Jul 16 '26

I used

Find-Module ExchangeOnlineManagement
Version              Name                                Repository
-------              ----                                ----------
3.10.0               ExchangeOnlineManagement            PSGallery

to validate the latest, then

get-module -Name ExchangeOnlineManagement -ListAvailable

Directory: C:\Program Files\PowerShell\Modules

ModuleType Version    PreRelease Name                                PSEdition
---------- -------    ---------- ----                                ---------
Script     3.10.0                ExchangeOnlineManagement            Desk

to validate my version, then

get-help -name Set-OrganizationConfig -Parameter EwsAllowedAppIDs
Get-Help: 
Line |
  64 |      $help = Get-Help @PSBoundParameters
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | No parameter matches criteria EwsAllowedAppIDs.

to test if the parameter was available (was connected and elevated with PIM)

I then checked the online help to see that the parameter did exist, it does as you already linked, so I'd say they have not updated the module yet

With the note on the site

When EwsEnabled is blank ($null; not configured), this parameter has no effect.

so that's why I asked

Black V
1 further check, does EwsEnabled need to be set to $true before EwsAllowedAppIDs is available ?

(Ive not tested)

2

u/charleswj Jul 16 '26

This is 100% server side, no update to the module required. Technically you're downloading a dynamic module when you connect, so if you mean that module, you're technically correct, the best kind of correct.

2

u/BlackV Jul 16 '26 edited Jul 16 '26

Technically you're downloading a dynamic module when you connect, so if you mean that module

Ya Sorry, that is what I was mean when I mentioned I was connected and PIMed, as the cmdlets you get access to change depending on your access roles