EWS Retirement and Promodag Reports - Impact Assessment
Question:
Does the retirement of EWS from October 2026 onwards require us to make any changes to keep our Promodag working properly?
Answer:
Understanding the Impact
Whether you are affected depends on how you use Promodag Reports.
Who is affected
Promodag Reports uses EWS for two things:
-
Mailbox content reports (attachments, meetings, calendar items, and similar content reports), which read Office 365 mailboxes through EWS.
-
Sending e-mails through the Office 365 connection: if Promodag Reports is set to send reports and alerts using the Office 365 Connection option (instead of SMTP), every e-mail goes through EWS.
Mailboxes hosted on Exchange Server on-premises are not affected: Microsoft is not retiring EWS on Exchange Server.
What Microsoft is doing
Starting October 1, 2026, Microsoft blocks EWS tenant by tenant. Tenants where EWSEnabled is not set (the default) are switched to False, which blocks EWS for all applications. From then on, only applications listed in the tenant's EWS AppID Allow List (EWSAllowedAppIDs) can use EWS, and only if EWSEnabled is True.
EWS is permanently disabled on April 1, 2027, with no exceptions.
Recommended Actions — before October 1, 2026
Follow these steps in this order. After October 1, setting EWSEnabled to True with an empty allow list blocks all EWS.
Step 1: Find the Application ID of your Promodag Reports application.
In the Microsoft Entra admin center, open App registrations, select Promodag Reports RBAC Application (or the name you gave your custom application), and copy its Application (client) ID.
Step 2: Add it to the AppID Allow List, keeping the entries already there.
The command replaces the whole list, so read the current list first:
$current = Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Select-Object -ExpandProperty EwsAllowedAppIDs
$promodagAppId = "<your Application (client) ID>"
$updated = @($current, $promodagAppId) | Where-Object { $_ }
Set-OrganizationConfig -EwsAllowedAppIDs ($updated -join ",")
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs
Changes can take up to 24 hours to take effect. If Set-OrganizationConfig rejects the parameter, the feature has not reached your tenant yet: try again later.
Step 3 : Then set EWSEnabled to True.
Set-OrganizationConfig -EWSEnabled $true
Why not rely on Microsoft's automatic list?
Microsoft pre-populates the allow list from the last 60 days of EWS usage. Mailbox content reports are often run only occasionally, so Promodag Reports may be missing from that list. Add it yourself.
What if you do it after October 1?
Your administrator can still add Promodag Reports to the list and set EWSEnabled to True once EWS has been blocked, but EWS stays blocked in between, plus up to 24 hours. During that time, mailbox content reports fail (run them again afterwards: they read the mailboxes live, nothing is lost), and e-mails sent through the Office 365 connection are not sent — including the alerts that would tell you a scheduled batch failed.
Summary table
| Scenario | Are You Affected? | Action Required |
| You never run mailbox content reports and send e-mails through SMTP | No |
None. You can remove the full_access_as_app EWS permission |
| You send reports or alerts through the Office 365 connection | Yes |
Steps 1 to 3 before October 1, 2026 |
| You run mailbox content reports, even occasionally | Yes | Steps 1 to 3 before October 1, 2026 |
| Your mailboxes are all on Exchange Server on-premises | No | None |
Our Migration Plan
We are rewriting mailbox content reporting and e-mail sending to use Microsoft Graph instead of EWS. The allow list keeps Promodag Reports working until then, and at the latest until April 1, 2027.
Complexity: The migration is complex because:
- Graph APIs cannot fully replace all EWS functionalities;
- Graph APIs have limitations such as throttling and specific permission requirements;
- Extensive testing is required to ensure feature parity and reliability.
Comprehensive Exchange reporting made simple for Office 365, On-Premise, and Hybrid environments
Start your free 45-day trial of Promodag Reports