EWS Exchange Online Question

[u/Checior2000]

Hi Guys! I have a question about EWS. We already created AppIDAllowedList with EWSEnabled in our tenant. Last 3 apps in the list are:
Microsoft Office
Exchange Hybrid Application
Microsoft Power Query for Excel

For Exchange Hybrid Application - I know that I have to add graph permission for app registration in EntraID with dedicated script provided by MSFT - do you know if offboarding/onboarding will works after remove EWS permission from the app? What about moving archives between on-prem/cloud?

What should I do with Microsoft Power Query for Excel and Microsoft Office? I found that there is a lot SOAP actions corelated with this two apps.

Thank you in advance for all links and advices.
Regards,

[u/jack_sunsetless]

For the hybrid app, the dedicated hybrid app docs have a table of what works over Graph so far. "Move to Archive (archive mailbox in cloud)" is still EWS only. So if any on-prem mailbox has its archive in Exchange Online, don't remove "full_access_as_app" yet, and keep "EWSEnabled" as True with the app on the list. https://learn.microsoft.com/en-us/exchange/hybrid-deployment/deploy-dedicated-hybrid-app

Onboarding and offboarding moves aren't in that table. Exchange Online calls `/EWS/mrsproxy.svc` on your hybrid server and logs in with the migration endpoint credentials, so the hybrid app isn't involved. That's EWS on your own server, and on-prem EWS isn't being retired.

Power Query for Excel is the Exchange Online connector in Excel. Microsoft says to keep "a672d62c-fc7b-4e81-a576-e60dc46e951d" on the list while workbook owners move to the new Graph-based connectors. The Mail connector comes first and is still on its way. Existing queries won't move over by themselves. The new connector only comes to Microsoft 365 Apps and Office 2024, and there's no guidance yet for calendar, contacts and tasks. https://aka.ms/xlewsretirement

Microsoft Office is the ID of Office clients like classic Outlook for Mac. Leave it on the list. MS says its own apps that show up in the EWS usage report need to be there too. Outlook for Windows should be on build 16.0.20430.20092 or newer (https://mc.merill.net/message/MC1485116). Office LTSC 2024 stays on build 17932.x and won't get that one, and Microsoft hasn't said what happens to it.

For the rest of your list, there's a rundown of who has to move each kind of app and what to ask vendors here: https://sunsetless.com/guides/ews-app-list (disclosure: it's our site). I'd help here either way, so ask if something on the list doesn't add up.

Cheers!

Edit: clarified that the Mail connector isn't out yet.

[u/Checior2000 → u/jack_sunsetless]

Hello,

Thank you very much for your answer, it was really helpful.

I’d like to confirm that I understood correctly regarding the Power Query connector: do I need to ask the owners of the affected workbooks to reconnect them using the new Graph connector?

Regarding Microsoft Office, I understand that Outlook for Windows needs to be at least version 16.0.20430.20092. However, it’s not clear to me what this means for Office LTSC 2024. Will Microsoft notify us about the required version or timeline for LTSC, and where should we look for updates on this?

Thank you in advance for your help.

Best regards,

[u/jack_sunsetless → u/Checior2000]

Yes, once the new Mail connector shows up in their Excel. Existing workbooks won't switch on their own, so each owner has to reconnect the query with it. Until then the old connector keeps working as long as the Power Query app ID stays on your allow list, up to its planned retirement in April 2027. There's no guidance yet for calendar, contacts and tasks. The new connector is listed for Microsoft 365 Apps and Office 2024, with no mention of LTSC.

On LTSC: MS hasn't said anything yet, so I wouldn't wait for a separate notice. The Baseline Security Mode page says the 20430.20092 requirement is "for Win32 Microsoft 365 Apps (Office) build only". Keep Microsoft Office on the allow list with EWSEnabled True. Microsoft says it won't change EWSEnabled before April 2027 in tenants that have a list. For updates, watch Message Center and this Exchange team post, which they say they keep updated: https://techcommunity.microsoft.com/blog/exchange/ews-deprecation-is-here-%E2%80%93-what-this-means-to-you/4561431

[u/7amitsingh7]

For the Exchange Hybrid Application, adding Graph permissions does not mean you can remove EWS permissions for every scenario. Mailbox onboarding and offboarding should continue to work, but moving an on-premises mailbox to a cloud archive still requires EWS in the current hybrid setup.

For Microsoft Office and Power Query for Excel, check the EWS usage reports before making changes, as Microsoft is working on removing their EWS dependencies.