← deemwar engineering examples Runnable · Node · zero deps · free · offline

EWS is switched off for good on 2027-04-01. Some of what you do with it never comes to Graph.

Most EWS code ports to Microsoft Graph. This page is about the part that does not, the licence it quietly needs, and the tenants that allow-listed an app last October and think they have time.

The dates

October 2026: EWS started to be disabled globally, with an allow list for apps that still need it (Microsoft Learn).
2027-04-01: fully and permanently disabled. "The ability to control EWSEnabled will be removed from tenant admins." Anything on the allow list stops that day (Exchange team blog).

What is not carried over

Two source classes, never blurred: the vendor's own docs are authoritative; community reports are real, dated and linked, but not vendor-confirmed, and they are labelled that way.

From the vendor's published docs

"The following EWS capabilities won't be added to Microsoft Graph. Plan migrations without a Graph equivalent for these capabilities." The list: generic public folder CRUD, generic Microsoft 365 Group mailbox CRUD, and Discovery mailbox access (source).
For Discovery mailboxes Microsoft's answer is "Use Microsoft Purview eDiscovery APIs", a different API with a different model, not a port.
"If an EWS capability isn't listed in this roadmap table, don't plan on a corresponding Microsoft Graph or Exchange Admin API capability being available before EWS is fully disabled."
Archive mailbox, public folder and group import/export are still roadmap targets ("Q4 CY2026"), with about a quarter left before the hard stop.

The price trap

The eDiscovery API: "App-only authentication and premium operations require E5 or an equivalent add-on subscription." A background service that replaces Discovery mailbox access is app-only by nature (source).
Since 2026-07-01, Microsoft 365 E3 is $39 and E5 is $60 per user per month: +$21 per user per month for users in scope, unless an add-on covers it (pricing update). Which users are "in scope" depends on the scenario; check before you buy.
E3 eDiscovery export "Requires pay-as-you-go billing".

Reported by users, not confirmed by the vendor

Graph cannot import an .eml with its original received date; EWS can, Graph creates a draft (2025-06-26, no accepted answer).
The Exchange Admin API cannot create mail-enabled security groups and "doesn't replace the full Exchange administration surface" (2026-03-16, unresolved).
On the Exchange team post, commenters report that usage reports lag about ten days and that Microsoft's own clients still depend on EWS (Aug–Sep 2026).

Check your own setup

Zero dependencies and offline: it reads your source tree and never connects to your tenant. It never asks for, stores or transmits a credential: you run it with your own login, and nothing leaves your machine.

node scan.js ./your-repo
node scan.js --demo

# and in Exchange Online PowerShell, your own session:
Get-OrganizationConfig | Format-List EwsEnabled,EwsApplicationAccessPolicy,EwsAllowList

$ node scan.js --demo Exchange Online EWS is fully disabled 2027-04-01 . Scanning 5 files [DEMO DATA] EWS Sync/MailSync.cs:1 var svc = new ExchangeService(ExchangeVersion.Exchange2013_SP1); EWS client usage: this path stops working 2027-04-01 unless moved to Graph. NOT YET Archive/Archiver.cs:1 var root = Folder.Bind(svc, WellKnownFolderName.ArchiveMsgFolderRoot); Archive mailbox access is still a roadmap target (Q4 CY2026); "don't plan on" anything not in the roadmap table. NO GRAPH Legal/Hold.cs:1 var boxes = svc.GetSearchableMailboxes("", false); Discovery mailbox access will not come to Graph; Microsoft points to Purview eDiscovery APIs, where app-only auth "require[s] E5 or an equivalent add-on". NO GRAPH Shared/Board.cs:1 var pf = Folder.Bind(svc, WellKnownFolderName.PublicFoldersRoot); Generic public folder CRUD is on Microsoft's "won't be added to Microsoft Graph" list. EWS import/restore.py:1 from exchangelib import Account EWS client usage: this path stops working 2027-04-01 unless moved to Graph. CHECK import/restore.py:2 acct.upload([(folder, mime_bytes)]) # .eml restore Import paths differ in Graph; one public report says Graph cannot import .eml with the original received date (community, not vendor-confirmed). SUMMARY: 2 EWS, 1 NOT YET, 2 NO GRAPH, 1 CHECK Lines marked NO GRAPH have no Microsoft Graph replacement coming. They need a redesign, not a port. Source: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-ews-exchange-online Also check the tenant: Get-OrganizationConfig | Format-List EwsEnabled,EwsApplicationAccessPolicy,EwsAllowList Any app on the allow list is running on borrowed time: on 2027-04-01 "The ability to control EWSEnabled will be removed from tenant admins."

scan.js Send us your output

The part nobody checks

Teams port the calls they know about, then learn about the rest when the allow list stops working. Two checks close that gap: scan every repository and scheduled script for EWS (not just the main app), and read the tenant's allow list, since every app on it is a dependency with a date. After the port, prove each workflow end to end on Graph with EWS switched off for that app, before April does it for you.

If you would rather not do it yourself

We take this on as fixed scope, and we will say plainly that you would be among our first customers for this particular engagement. What we bring is the breakage map above and a hard habit of proving the new setup works rather than assuming it.

EWS exit audit, fixed price. We scan your repositories and scripts, read the tenant allow list, and hand back every EWS dependency marked port / redesign / no Graph path, the licence impact of the eDiscovery route, and an order of work that fits before 2027-04-01.
Port and prove, fixed price. We move the code to Graph (and Purview where Microsoft says to), redesign the public folder, group mailbox and Discovery pieces that have no port, and run each workflow with EWS disabled to prove it works.