Apple Mail Stops Syncing Microsoft 365 on Mac: Exchange Online EWS Shutdown Workarounds

Here's what's changing, who's affected, and what admins can do while the clock runs.

What actually changed on October 1​

Microsoft has been heading here for years. In its Exchange Team blog, the company says it first announced this change was coming in 2018, when we announced that Exchange Web Services (EWS) will no longer receive functionality updates. In 2023, we announced that EWS will be disabled in Exchange Online in October 2026.

The final plan, published in February 2026, is a phased, admin controllable disablement plan that starts in October 2026 and concludes with a complete shutdown of EWS in 2027. Petri's reporting on that plan says that starting October 1, 2026, EWS will be disabled by default in Exchange Online on a tenant‑by‑tenant basis. Any tenant that has not explicitly configured its settings will see Microsoft automatically block EWS access.

"Tenant by tenant" is the important part. This isn't one global switch. MacRumors, which raised the alarm for Mac users, pointed to Microsoft's June update calling the change a "phased rollout," so some organisations will lose EWS before others. Not every Mac on earth stopped syncing at midnight. Some just will, at some point soon.

Key dates:

On the final date, Microsoft's Message Center notice MC1227454 is blunt: after April 1, 2027, EWS access will be permanently removed with no re-enablement. Petri adds that Microsoft has made it clear there will be no extensions.

In short: enforcement has started, it reaches tenants on a rolling schedule, and the April 2027 date is final.

Why Apple Mail on the Mac is caught in this​

The Mac is affected and the iPhone isn't because of how Apple's apps connect to Exchange. Apple's Platform Deployment documentation says macOS Mail and Calendar use EWS for Exchange accounts, while iPhone and iPad use Exchange ActiveSync (EAS). The EWS retirement doesn't remove the connection method iOS and iPadOS use, so phones and tablets aren't affected by this change.

Apple knows. Its deployment guide says the company is "actively working with Microsoft" to move Mail, Calendar, Contacts, Notes, and Reminders on the Mac to Microsoft Graph in a future macOS 27 update. The documentation gives no release date. MacRumors also reports that Apple skipped macOS 27.1 betas entirely and that the macOS 27.2 beta release notes don't mention Graph support yet. Treat that as MacRumors' observation, not an Apple statement, but either way, the fix hasn't arrived.

Who is affected:

• Affected: Mac users whose Microsoft 365 / Exchange Online work accounts are set up in Apple's built-in apps, once Microsoft's enforcement reaches their tenant and EWS is blocked.
• Not affected by this change: iPhone and iPad (they use EAS), and organisations running their own Exchange Server. Microsoft says the retirement covers only to Microsoft 365 and Exchange Online (all environments); there are no changes to EWS in Exchange Server.
• Not affected for now: tenants whose admins have explicitly kept EWS available with the right configuration.

Who's to blame? MacRumors commenters argued both ways. Some said eight years' notice was plenty for Apple to rewrite its Mail stack. Others said Microsoft could have made sure a major partner was ready. Both have a point. Microsoft's own deprecation page says that after the Midnight Blizzard incident in January 2024, which involved EWS, the scope was also widened from third party applications to include all Microsoft applications. We're working diligently to remove EWS dependencies in all Microsoft products. Even Microsoft has had to clean up its own EWS habits, so a third-party client being late isn't surprising.

In short: this hits only Macs, only Exchange Online, and only Apple's built-in apps. The fix depends on Apple shipping its Graph update.

The EWSEnabled setting decides what happens​

For admins, a single tenant setting, EWSEnabled, controls the outcome. Microsoft's guidance says many tenants still have EWSEnabled unset (Null), which behaves as unrestricted access. As the phased retirement rollout starts in October 2026, those tenants will have EWS disabled (EWSEnabled set to False) as part of the staged shutdown process. Administrators who still require EWS at that point will need to take explicit action.

The trap is in what True now means. Microsoft says that from October, enabling EWS without configuring an AppID allow list will no longer act as an unrestricted "allow everything" mode. Earlier WindowsForum coverage of the new EWSAllowedAppIDs feature put it plainly: during enforcement, True with an empty allow list means "allow nothing." Only a populated allow list keeps named applications working.

Microsoft had asked tenants to configure the allow list and set EWSEnabled=True by the end of August 2026 to avoid the automatic switch. That date has passed, so the question now is what your tenant is set to today and how to restore access if it has already flipped. Microsoft says tenant admins will be able to re-enable EWS if necessary until the final shutdown. Its February guidance also describes setting the value back to Null through Exchange Online PowerShell as an interim unrestricted option, and warns that restoring access after a block may cause a short service interruption.

Microsoft also warns about letting it build the allow list for you. If it populates the list automatically, we might also include apps in there you weren't aware of (if they show usage). We recommend that admins create their own AppID Allow Lists to control exactly which EWS applications they want to allow after October 2026.

In short: check EWSEnabled and the allow list now. True with an empty list is the most dangerous combination.

What admins should do now​

• Find out what still calls EWS. Microsoft says to review EWS usage in the Microsoft 365 admin center or using published scripts to identify dependent applications. If staff use Apple's built-in apps, include those Mac clients in the inventory and get their AppIDs from the usage data. Don't guess them.
• Confirm your tenant's state. Check the current EWSEnabled value and any configured allow list with your Exchange admin. If it says False, the rollout has reached you.
• Choose a stopgap. Either maintain a deliberate allow list that includes the clients you need, or use Microsoft's interim unrestricted option. Both expire on April 1, 2027.
• Move Mac users to a Graph-capable client. MacRumors suggests Microsoft's Outlook for Mac as the obvious option while Apple's update is pending. Check your organisation's requirements before pushing a client change. One MacRumors commenter noted that many organisations already require Outlook because of Microsoft 365 data-protection policies.
• Look beyond Mail. Microsoft's deprecation page says Graph doesn't cover every EWS capability, and some features, such as generic Public Folder CRUD operations, won't be added at all. Ask your vendors where their EWS-to-Graph migrations stand.
• Tell users before their inbox goes quiet. Mac users won't connect "Mail stopped updating" to a server protocol change. A short internal notice now saves a lot of helpdesk tickets later.

The bottom line​

Retiring EWS is the right security call, and Microsoft has signalled it for most of a decade. Apple Mail on the Mac is caught in the gap between Microsoft's schedule and Apple's unreleased Graph update. Admins can keep things running for now, but only until April 1, 2027, so plan the client migration rather than relying on the stopgap.

Update: University advisory confirms Legacy Outlook for Mac is also affected (October 2, 2026)​

The University of Colorado Anschutz reported on October 1 that EWS is no longer available in its Microsoft 365 environment, providing a real-world example of the tenant-level disruption now reaching organisations.

Its advisory adds an important client distinction: Legacy Outlook for Mac also relies on EWS and will no longer connect to Exchange Online where EWS has been blocked. The university directs those users to switch to New Outlook for Mac, which it says uses modern Microsoft 365 connectivity rather than EWS.

The notice also explicitly lists Outlook for Windows, Outlook on the web, and Outlook Mobile as unaffected by this EWS change. For IT teams, that makes New Outlook for Mac a clearer interim replacement not only for Apple Mail users, but also for Macs still running the legacy Outlook client.

The university further warns that room-booking tools, CRM connections, automated workflows, and other third-party mailbox integrations may fail if they remain EWS-dependent.

Update: October 10 deadline reported for EWS application allow lists (October 3, 2026)​

According to Neowin’s October 3 report citing Microsoft 365 Message Center notice MC1485116, Exchange Online will begin enforcing the EWSAllowedAppIDs requirement on October 10, 2026. The report adds a specific enforcement date to the previously described October transition: setting EWSEnabled=True alone will not preserve connectivity for applications missing from the allow list. This is an interim access-control deadline, not a replacement for the final EWS retirement date.

Neowin also reports that Microsoft will automatically create and populate allow lists for qualifying Worldwide tenants on October 8–9, using EWS activity observed during the preceding 60 days. That could help preserve access for active applications, but infrequently used integrations may be omitted. Administrators should therefore review the resulting entries rather than assume automatic population covers every dependency.

According to Neowin, configuration changes can take 24 hours to propagate. For IT teams maintaining temporary EWS access, the practical priority is to verify required application IDs before the reported enforcement date—particularly for Mac clients and integrations that run only occasionally. An enabled tenant setting should not be treated as proof that those applications will remain connected.