This article contains information on Microsoft’s retirement of EWS for Exchange Online, affected Mimecast services, key deadlines, and required customer actions to migrate or export data before October 2026.
Overview
Microsoft is permanently retiring Exchange Web Services (EWS) for Exchange Online (Microsoft 365). This is a Microsoft-driven, industry-wide change that affects every vendor using EWS to connect to Microsoft 365, including Mimecast.
This FAQ explains what is changing, which Mimecast services are affected, and what action (if any) you need to take.
Key dates
- October 1st, 2026: EWS disabled by default.
- April 1st, 2027: Full and permanent shutdown of EWS for Exchange Online, with no exceptions.
What Is Happening
| Q: | What is Exchange Web Services (EWS)? |
| A: | EWS is a legacy Microsoft connector that allows applications to connect to Exchange Online mailboxes to perform operations such as reading, writing, syncing, and managing mail items and folders. Mimecast has historically used EWS to power several services including Threat Remediation, Sync & Recover, Continuity, and parts of the Mimecast Synchronization Engine (MSE). |
| Q: | Why is EWS being retired? |
| A: | Microsoft made this decision independently and has been signalling it for several years. In September 2023 they announced a hard shutdown for Exchange Online, and in early 2026 updated the timeline with a phased disablement plan. This is an industry-wide change; every vendor relying on EWS for Exchange Online connectivity is affected. Microsoft's full rationale is available in their official documentation. |
| Q: | When exactly does EWS stop working? |
| A: |
Microsoft's timeline has two stages:
Customers should target completing any required actions by August–September 2026 to allow time for testing before the October 2026 deadline. |
| Q: | Does EWS retirement affect On-Premises Exchange? |
| A: | No. Microsoft has confirmed that EWS retirement applies to Exchange Online only. Customers running On-Premises Exchange Server continue to use EWS without restriction. |
| Q: | What about hybrid environments (some mailboxes On-Premises, some in Exchange Online)? |
| A: | On-Premises mailboxes continue to use EWS without restriction. Cloud-hosted mailboxes in Exchange Online must move to Microsoft Graph API. If you have a hybrid environment and specific technical questions about your architecture, we recommend consulting Microsoft's guidance or contacting Mimecast Support. |
| Q: | Is Mimecast the only vendor affected? |
| A: | No. Any software using EWS to connect to Exchange Online is affected, including other security vendors, migration tools, and customer-built applications. Mimecast is proactively managing the transition across all affected services. |
| Q: | Can I check which apps in my Microsoft 365 tenant are still using EWS? |
| A: | Yes. Microsoft has introduced EWS Usage Reports in the Microsoft 365 Admin Center. Administrators can access these under Usage | Exchange | EWS Usage. These reports show usage trends and identify which applications are still making EWS calls, including Mimecast services. |
Which Mimecast Services Are Affected
| Q: | Which Mimecast services are impacted? |
| A: |
The following services have a direct EWS dependency and are affected:
Impact and required actions vary by service and are described in detail in the sections below. |
| Q: | What does the impact look like across these services? |
| A: |
Affected services fall into three categories:
|
| Q: | Are any Mimecast services NOT affected? |
| A: |
Yes. The following services are not affected and will continue to work normally:
|
| Q: | Is the Sync component of CI Sync & Recover affected? |
| A: | No. The Sync component of Sync & Recover, Email Security Cloud Integrated already uses Microsoft Graph API and is not impacted. Only the Restore component of Sync & Recover, Email Security Cloud Integrated is affected. |
Summary - Service Status at a Glance
| Service / Feature | Status | What you need to know |
| Mailbox Storage Management | Service ending |
Export your data before
October 2026 - April 2027, depending on when EWS is disabled for your Microsoft tenant. No replacement service available. |
| Managed Folders | Service ending |
Export your data before
October 2026 - April 2027, depending on when EWS is disabled for your Microsoft tenant. No replacement service available. |
| Simply Migrate, Archive Mailbox | Service ending | Service discontinued. Please export any data you wish to retain. |
| Sync & Recover, Restore (Email Security - MX & Email Security Cloud Integrated) | Temporarily unavailable | Restore will be unavailable from October 2026. Use PST/EML export as interim. Note: if you choose to keep EWS turned on, you will continue to have access to Restore until April 2027. |
| Simply Migrate, Legal Hold | Temporarily paused | Feature paused pending Microsoft API update. No timeline confirmed. |
| Threat Remediation | Action required | Migrate your connector to Microsoft Graph API before August –September 2026. |
| Sync & Recover, Email Security - MX, Sync | Action required | New connector coming in April - May 2026. Migrate before August – September 2026, when available. |
| Mailbox Folder Replication | Action required | New agentless solution in development. Additional communication to follow. |
| Calendar Replication | Action required | New agentless solution in development. Additional communication to follow. |
| Continuity for Office 365 (Event Monitor) | Action required | New connector required. Manual setup needed, not automatic. Guide to be supplied. |
Services Being Permanently Discontinued
(no direct replacement available after October 2026 / April 2027, depending on when EWS is disabled for your Microsoft tenant)
| Q: | Which services are being discontinued? |
| A: |
The following services will be discontinued due to the EWS retirement:
There is no viable replacement available for these specific functions via Microsoft's Graph API. Microsoft has confirmed that not all EWS functionality will be replicated in Graph API. |
| Q: | When will these services stop working? |
| A: | Mimecast will formally discontinue these services ahead of the final Microsoft deadline of April 1st, 2027. You will receive advance notice before any service is disabled. We strongly recommend exporting any data you wish to retain as soon as possible. |
| Q: | What should I do if I use one of these services? |
| A: | You should export any data you wish to retain before the service is discontinued. Please do not delay; we recommend taking action as soon as possible, and well ahead of October 2026. If you need guidance on how to export your data, please contact Mimecast Support. |
Services Temporarily Unavailable
| Q: | What is happening to the Restore function in Sync & Recover? |
| A: | The Restore function in both Email Security - MX and Email Security Cloud Integrated Sync & Recover will be temporarily unavailable from October 2026. Note that this is conditional. if you choose to keep EWS turned on, you will continue to have access to Restore until April 2027. This is not a permanent discontinuation. The underlying reason is that the Microsoft Graph API needed to rebuild Restore is currently in beta and doesn't have parity with EWS yet. Microsoft is working on providing this support. Once Microsoft promotes this API to general availability, Mimecast will rebuild and re-enable the Restore function. |
| Q: | What can I do while Restore is temporarily unavailable? |
| A: | The export to PST/EML function within Sync & Recover remains fully available and is not dependent on EWS. You can export mailbox content as PST or EML files and import them into any mailbox as an interim measure. No data stored in Sync & Recover is at risk during this period. |
| Q: | When will Restore be available again? |
| A: | Re-enablement depends entirely on Microsoft releasing the required API including support for Restore at par with EWS. Microsoft is working on providing this support. Mimecast cannot commit to a specific timeline at this stage. We will communicate as soon as this changes. |
| Q: | What is happening to Simply Migrate Legal Hold (Recovery Hold)? |
| A: | This feature is being temporarily paused, not permanently discontinued. As with Restore, the required Microsoft Graph API is currently in beta and cannot be used in production applications. Mimecast will re-enable this feature once Microsoft releases the API to general availability. |
| Q: | Is there a chance Legal Hold is never re-enabled? |
| A: | Microsoft's own policy states that beta APIs are not guaranteed to reach general availability. If the required API is not promoted or does not include the necessary functionality, Legal Hold may not be fully restorable in its current form. We will keep you informed as Microsoft's plans develop. |
| Q: | What should I do about compliance obligations while Legal Hold is paused? |
| A: | We understand Legal Hold is a compliance-critical feature. We recommend reviewing your active Legal Hold configurations and consulting your Legal or Compliance team about interim processes during the pause period. Mimecast will communicate as soon as the feature is re-enabled. |
Services Requiring Customer Action
| Q: | Which services require action from me, and by when? |
| A: |
The following services will continue working but require you to complete a migration before October 2026:
|
| Q: | Can my existing EWS connectors be automatically migrated? |
| A: | No. For all affected services, existing EWS connectors cannot be automatically migrated or upgraded. EWS and Graph API connectors are different application registrations in Microsoft Entra ID with different permission models. You will need to set up a new connector manually, following the migration guides Mimecast will provide. |
| Q: | I was told Continuity for Office 365 would update automatically. Is that correct? |
| A: | No, this is an important correction. Continuity for Office 365 customers using EWS-based connectors must manually set up a new connector as part of this transition. The migration is not automatic. Full setup guidance will be provided ahead of the October 2026 deadline. Please plan for the August – September 2026 window. |
| Q: | When does the Threat Remediation migration need to be completed? |
| A: | The Graph API migration path for Threat Remediation is available right now in the current release. You do not need to wait for a new version. We recommend completing the migration by August – September 2026 at the latest. Migrating onto the Graph API replacement also includes quicker remediation speed and increased security benefits. |
| Q: | What happens if I don't complete the migration before October 2026? |
| A: | If you have not migrated before Microsoft begins disabling EWS, your EWS-dependent Mimecast services will stop functioning when EWS is disabled for your Microsoft tenant. Microsoft's phased rollout begins October 1st, 2026, the exact timing for your individual tenant is not guaranteed. We strongly recommend targeting August – September 2026 and not relying on April 2027 as a buffer. |
| Q: | Will I lose any data or existing configuration during the migration? |
| A: | For Threat Remediation, Sync & Recover (Sync), and Continuity, no data loss is expected if migration is completed on time. For Mailbox Folder Replication and Calendar Replication, full details will be provided with the migration guide, when the new solution is released. |
| Q: | Do I need to allowlist applications using EWS? |
| A: |
You will need to perform this step prior to
September 1st, 2026, and it is
important if we have any services that need to use
EWS beyond that point. This allows
Microsoft 365 to build an
allowlist of applications using
EWS, and will allow them to be
used until April 2027.
|
Timelines & Deadlines
| Q: | What is the recommended migration timeline? |
| A: | Mimecast strongly recommends completing all required migrations by August – September 2026. This provides a buffer before the October 1st, 2026 initial EWS disablement and time to test and resolve any issues. |
| Q: | I heard Microsoft extended the deadline to April 2027. Does that mean I have more time? |
| A: | Microsoft has announced a phased approach: EWS starts being disabled by default from October 1st, 2026, with the absolute final shutdown on April 1st, 2027. Between those dates, tenant administrators may be able to temporarily re-enable EWS, but this is not guaranteed and Microsoft can remove this option at any time. There will be no extensions beyond April 1st, 2027 under any circumstances. We strongly advise against treating April 2027 as a safe buffer. Please target August–September 2026 for all required migrations. |
| Q: | When will I receive migration guides and further communications? |
| A: | Mimecast is actively preparing service-specific migration guides and customer communications for all affected services. You will receive these ahead of the October 2026 deadline. If you have not heard from us by April 2026 and believe you are affected, please contact your Mimecast Customer Success Manager (CSM), Account Executive, or Mimecast Support. |
See Also...
- Microsoft Exchange Web Services (EWS) Retirement - EOL - Apr 2026
- Email Security - MX
- Continuity
- Mimecast Synchronization Engine
- Simply Migrate
- Sync & Recover
- Sync & Recover - Overview
- Threat Intelligence & Remediation
Comments
Please sign in to leave a comment.