EWS shutdown breaks Apple Mail on Macs with Microsoft 365

The timeline is now binding

Microsoft has moved the retirement of Exchange Web Services from announcement to enforcement. Since 1 October 2026, EWS requests to Exchange Online are blocked. In tenants that took no action, the tenant property EWSEnabled is set to False.

There is an emergency brake. Setting EWSEnabled to True and maintaining an allow list of AppIDs restores access until 31 March 2027. This is done through Exchange Online PowerShell. On 1 April 2027, Microsoft says the shutdown becomes complete and permanent, with no exceptions.

The scope of that setting matters. EWSEnabled applies to the entire tenant. You cannot set it for individual users or individual sites. Exchange Server on premises is unaffected, the retirement covers Exchange Online only.

What stops working on the Mac

Apple Mail, Apple Calendar and Apple Contacts are affected as soon as a Microsoft 365 business account is configured in them. Legacy Outlook for Mac is affected as well. This combination is common in agencies, because Apple Mail was never deliberately replaced after the initial setup.

The failure is quiet. No dialogue appears, the mailboxes just stop updating. Support tickets usually arrive as a suspected network or password problem. In mixed environments it gets worse, because Windows workstations with Outlook carry on working and suspicion falls on the Macs, while the cause sits in the tenant.

Outlook for Windows, the current Outlook for Mac, Outlook on the web, Outlook Mobile, the Mail app on iOS and iPadOS and Teams are not affected. Whether and when Apple Mail will move to Microsoft Graph is open. Apple has given no date.

Check your server-side integrations too. Ticketing, CRM, archiving and signature products sometimes reach mailboxes through EWS. Form submissions and transactional mail from website and shop projects normally run over SMTP and are untouched by the retirement.

A second deadline on 30 November 2026

On 5 November 2026, Microsoft announced the permission change for the Exchange Online Admin API v2.0 through Message Center post MC1540345. Exchange.ManageV2 becomes Exchange.AdminAPI.Manage, and Exchange.ManageAsAppV2 becomes Exchange.AdminAPI.ManageAsApp. The new permissions have been available since 1 November 2026, migration runs until 30 November 2026, and from 1 December 2026 the old ones count as deprecated worldwide. For GCC, GCC High and DoD, deprecation starts on 1 January 2027.

The endpoints themselves stay in place, the names and the consent model change. The existing RBAC requirements in Exchange Online continue to apply. Alongside this, the MailboxFolderPermission endpoint returns the User field as a structured object with DisplayName, Name and PrimarySmtpAddress. Scripts that read that value as text will fail silently afterwards.

What to do now

The order matters. Measure first, then migrate, then clean up. If you set the allow list, you have bought a postponement until 31 March 2027 and should put that date in the calendar.

Avoid moving every Mac workstation to the new Outlook for Mac in the middle of a production phase. The interface and the local data handling differ noticeably from the old client, and people need support through that.

• Record per Mac which accounts are configured in Apple Mail, Calendar and Contacts. This can be scripted through MDM.

• Read the tenant's EWSEnabled value with Exchange Online PowerShell before you plan anything.

• Review actual EWS usage and name the applications behind it.

• Switch the Admin API permissions by 30 November 2026, test afterwards, and only then remove the old ones.

• Review any scripts that evaluate MailboxFolderPermission.

• Clarify the migration plans of each archiving and compliance vendor individually.