The EWS usage report in the Microsoft 365 admin center tells you which Application IDs still call EWS — as raw GUIDs, with no names attached. This tool resolves them: which application each GUID is, which vendors have shipped a Microsoft Graph fix, and which items actually need your attention in the next — days.
Decode your EWS usage report → MSP fleet viewM365 admin center → Reports → Usage → Exchange → EWS usage → Export. You get App IDs, SOAP actions, call volume, last activity.
The full CSV, a fragment, or a bare list of Application IDs from sign-in logs — all accepted. Matching happens locally against our App ID database.
Example: “This GUID is Cisco Unity Connection voicemail sync — affected after October unless upgraded to 15 SU4 (Field Notice FN74365).” Every entry cites its public source.
The admin-center EWS report is single-tenant, portal-only, and aggregated weekly. We’re building the managed-services view: every client tenant’s EWS exposure on one remediation dashboard, weekly change tracking, and digest cards delivered into Microsoft Teams.
Every few years Microsoft retires a load-bearing protocol, and every tenant relearns the same lesson. Here’s where we are:
Exchange Online kills basic authentication. Scripts and scanners everywhere break.
Teams webhook connectors stop functioning after the May 18–22 shutoff.
EWS starts being switched off per tenant. Allow lists buy time — nothing more.
Allow lists stop working. No extensions, no exceptions, per Microsoft.
Deprecations are never one and done. Basic authentication in 2022. Office 365 Connectors in 2026. Now Exchange Web Services. Each retirement strands working software and hands administrators the same project: determine what we run that is about to stop working. What Breaks Next tracks Microsoft’s retirement calendar so you don’t have to — starting with the largest one currently scheduled.
Key references: Microsoft Learn — Deprecation of EWS in Exchange Online · Exchange Team blog · EWSAllowedAppIDs announcement.