Created by Claude - please verify

EWS readiness - Exchange settings and app permissions. Actual EWS traffic only appears if you upload the admin centre's EWS usage CSV.

Required Microsoft Graph permissions

Exchange.ManageAsApp (+ View-Only Configuration / View-Only Recipients role) Application.Read.All Directory.Read.All — application permissions, granted to the app registration with admin consent.

Licence: None.

Endpoints: Get-OrganizationConfig (EwsEnabled, EwsApplicationAccessPolicy, EwsAllowList) · Get-CASMailbox (EwsEnabled per mailbox) · GET /v1.0/servicePrincipals/{Exchange Online}/appRoleAssignedTo (full_access_as_app) · GET /v1.0/oauth2PermissionGrants (EWS.AccessAsUser.All)

Microsoft publishes no API for the admin centre's EWS usage report (Reports > Usage > EWS usage). Export it as CSV there and upload it below to list the apps that actually called EWS.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

EWS Retirement Readiness

Exchange Web Services is disabled by default from 1 October 2026 in tenants whose EWSEnabled setting is still unset, and switched off for good on 1 April 2027. Anything that still talks to EWS - backup, archiving, CRM or signature tools, room booking displays, scripts - stops working then. This report shows the organisation and mailbox EWS settings and every app that holds an EWS permission.

Optional - EWS usage CSV from the Microsoft 365 admin centre: