How to Find Active EWS-Based Apps in a Microsoft 365 Tenant

Use the Exchange Web Services Usage Report to Track Down the Apps Still Using EWS

On April 22, I wrote about the steps Microsoft is taking to prepare for the removal of Exchange Web Services (EWS) from Exchange Online through the introduction of a dedicated app for hybrid interoperability. Essentially, the new app will take over as the fulcrum for fetching data such as free/busy information from on-premises mailboxes, first using EWS before moving to Graph API requests later this year.

This is an example of Microsoft preparing first-party apps before retiring EWS. Third-party apps running in tenants might also still use EWS. It’s important to check if such apps exist so that contact can made with the app vendor to ascertain their plans for EWS retirement. To help with the process, the reports section of the Microsoft 365 admin center has an EWS usage report (Figure 1).

Exchange Web Services (EWS) usage report in the Microsoft 365 admin center. — Figure 1: Exchange Web Services (EWS) usage report in the Microsoft 365 admin center

Validating Apps Listed in the EWS Usage Report

The report details the application identifier, SOAP action (API call) and volume, and the last activity date. Application identifiers make a lot of sense to Microsoft 365 (and more specifically, Entra ID), but they’re hard for humans to understand. Fortunately, it’s easy to resolve the application identifiers for many Microsoft apps by consulting the Verify first-party Microsoft apps in (Entra ID) sign-in reports page. A quick check against the apps reported for my tenant found the following apps:

Office 365 Exchange Online (00000002-0000-0ff1-ce00-000000000000).
Office 365 SharePoint Online (00000003-0000-0ff1-ce00-000000000000)
Teams (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
Microsoft Office (d3590ed6-52b3-4102-aeff-aad2292ab01c)
Microsoft Outlook (5d661950-3475-41cd-a2c3-d671a3162bc1)
Teams Web Chat (5e3ce6c0-2b1f-4285-8d4b-75ee78787346).

None of these are surprising. EWS has long been used for calendar lookups, and Teams uses EWS in its middle tier to communicate with Exchange. The apps listed here probably use EWS to fetch information about the current calendar status for users to display that status in their profile data.

Checking for Other Apps

Two explanations exist if you find an application identifier that isn’t in Microsoft’s list of first-party applications. The app is either owned by Microsoft but didn’t make it onto the list for some reason. The more likely reason is that it’s a third-party or custom-developed app that uses EWS.

You can resolve the application identifier by searching the set of enterprise applications in the Entra admin center or with PowerShell. Figure 2 shows an extract of the set of enterprise apps with Teams in the name. You can’t search by application identifier or even sort the set of apps by application identifier, so finding the right app can be tiresome.

Enterprise apps listed in the Entra admin center. — Figure 2: Enterprise apps listed in the Entra admin center

Instead of grappling with the Entra admin center UI, it’s usually faster to search for an enterprise application with PowerShell. In this case, I create an interactive Microsoft Graph PowerShell SDK session with the Application.Read.All scope (permission) and use the Get-MgServicePrincipal cmdlet to look for the application with a specific identifier. Once you know the name, you can find other details by examining the app’s properties through PowerShell or the Entra admin center.

Connect-MgGraph -Scopes Application.Read.All
Get-MgServicePrincipal -Filter "Appid eq '5d661950-3475-41cd-a2c3-d671a3162bc1'" | Select-Object DisplayName, AppId

DisplayName       AppId
-----------       -----
Microsoft Outlook 5d661950-3475-41cd-a2c3-d671a3162bc1

Time Ebbing Away

Microsoft plans to retire EWS from Exchange Online on 1 October 2026. That seems like a long time away, but it’s not if you have to track down the developers of EWS apps built for your organization internally or externally. Unlike other deadlines, Microsoft won’t extend the retirement date for EWS because the API is considered insecure and a prime method for attackers to exfiltrate data from a compromised tenant.

Perhaps your EWS usage report will only contain references to Microsoft first-party apps. If so, you’re all set. If not, it’s time to get moving and either retire or upgrade apps.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Cart

Cart