Microsoft Issues Guidance to Re-enable Retired Exchange Web Services API in Exchange Online

Microsoft has released official guidance for IT administrators seeking to restore functionality to Exchange Online applications that rely on the Exchange Web Services (EWS) API. The API, which has been retired as part of Microsoft's ongoing cloud modernization efforts, has caused a number of EWS-dependent applications to stop working following recent deprecation changes.

According to the guidance, administrators can re-enable the retired EWS API through specific PowerShell commands and configuration adjustments. Microsoft emphasizes that while this will restore application functionality, the API is considered retired and may present legacy security risks if not properly configured or monitored.

The company recommends that organizations assess whether modern alternatives—such as Microsoft Graph—are available before re-enabling the API. For those that must retain EWS for operational continuity, Microsoft advises implementing strict access controls, logging, and regular security reviews to mitigate potential risks associated with running retired software components.

As of the publication date, no active exploitation of the EWS retirement has been reported. The issue is characterized as a compatibility disruption rather than a security vulnerability, though the re-introduction of a retired API surface is viewed as a potential attack surface if not managed carefully.

Microsoft's advisory serves as a configuration fix rather than a security patch. Administrators are directed to Microsoft Learn for the detailed steps required to re-enable the API and are encouraged to evaluate the long-term viability of EWS-dependent workloads within their cloud environment.