EwsAllowedAppIDs is an Exchange Online organization setting that lists Azure AD application ID GUIDs permitted to access Exchange Web Services (EWS). It only filters access when EwsEnabled is $true; it cannot restore EWS when EWS is disabled, and it is not the only policy that can deny a request. Microsoft plans to begin disabling EWS globally in Exchange Online in October 2026, with full disablement in April 2027, so treat allowlisting as an access-control setting—not a long-term workaround for migration.
What does EwsAllowedAppIDs do?
EwsAllowedAppIDs identifies the Azure AD application IDs allowed to connect to EWS in Exchange Online. The IDs are GUIDs. Microsoft documents the parameter for Exchange Online; do not assume it is available for on-premises Exchange Server.
The list’s effect depends on the organization-level EwsEnabled setting:
$true: EWS is enabled, and only application IDs inEwsAllowedAppIDsare permitted by this check.$false: EWS is blocked regardless of the app-ID list.$nullor not configured:EwsAllowedAppIDshas no effect.
When specifying multiple application IDs, use a comma-separated list. Microsoft’s syntax example is:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Set-OrganizationConfig -EwsAllowedAppIDs "11111111-2222-3333-4444-555555555555,aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"Those values illustrate the command format; do not copy them as real application IDs. Use the GUIDs for the applications your organization has identified and approved. See Microsoft’s Set-OrganizationConfig parameter reference.
Why can an allowed app still receive an access error?
The app-ID filter is separate from EWS user-agent access policy. Microsoft says both checks are evaluated for each connection and both must pass. If EwsApplicationAccessPolicy is set to EnforceAllowList, an app ID can be allowed while the request is still denied because the client’s matching user-agent string is missing from EwsAllowList.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Microsoft uses Teams Calendar as an example: allowing its app ID may also require allowing its user-agent string under the user-agent policy. That policy can apply to REST or Graph connections as well, so check its scope before changing it. See Microsoft’s EWS access-control guidance.
How to troubleshoot a denied EWS request
Work through the effective controls in order before changing the app-ID list. A generic access error does not establish that EwsAllowedAppIDs caused the denial.
Recommended Free Tools
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Check organization settings. In Exchange Online PowerShell, run
Get-OrganizationConfig. ReviewEwsEnabled, the EWS application access policy, the allow and block lists, and the app-ID list. - Check the mailbox settings. Run
Get-CASMailboxfor the affected mailbox and inspect its EWS settings. Organization-level disablement can override a mailbox exception; organization and mailbox settings are distinct controls. - Verify the client identity and user-agent. Confirm the configured GUID is the intended application ID, then check whether the actual user-agent string passes any applicable allow/block policy.
- Check authentication. Verify the authentication configuration that applies to the request. Microsoft’s EWS troubleshooting guidance specifically calls out default authentication settings on the EWS virtual directory.
- Compare client behavior. Compare the same operation with another EWS client and identify what differs, such as identity, user-agent, or authentication. For Exchange Server environments where IIS access is available, Microsoft says IIS logs can provide further information about failures.
For broader diagnostic guidance, see Microsoft’s EWS troubleshooting tools and resources.
How to read or retrieve the configured app-ID list
If you cannot see the configured value in a standard organization-configuration view, a Microsoft Q&A response suggests trying Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy. This is community guidance, not the authoritative parameter reference; verify the command and its behavior against current Microsoft documentation before relying on it. The Q&A discussion is at Microsoft Q&A on retrieving EwsAllowedAppIDs.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
How the EWS retirement affects Exchange Online
Microsoft’s current Exchange Online deprecation guidance says global EWS disablement starts in October 2026 and EWS will be fully disabled in April 2027. Microsoft recommends identifying active EWS applications, prioritizing migration of internal applications, and working with vendors on their migration. These dates apply to Exchange Online; they are not a timetable for on-premises Exchange Server.
Microsoft Graph offers direct mappings for many EWS scenarios, but its published roadmap still identifies parity work with target dates and capabilities that will not be added. Check the actual operations each application uses rather than assuming Graph is a complete one-to-one replacement. The current milestones and roadmap are on Microsoft’s Exchange Online EWS deprecation page.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
App-only authorization is a separate check
For app-only access, Microsoft lists the Exchange application role EWS.AccessAsApp. That authorization is separate from the tenant’s EwsAllowedAppIDs filter. Microsoft notes that application-permission changes can take 30 minutes to two hours to reflect because of cache maintenance; its documented test command bypasses that cache. Review the Application RBAC guidance for Exchange Online when investigating app-only authorization.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
