Exchange Online administrators increasingly encounter the frustrating “EWS Request Blocked” error. Unfortunately, this issue often appears without warning and immediately disrupts email access for users relying on older applications.
As Microsoft continues strengthening security across Exchange Online and Exchange Web Services, many legacy email clients, third-party applications, and custom integrations face compatibility challenges. Consequently, organizations that have not modernized their email infrastructure frequently experience blocked connections, synchronization failures, or authentication errors.
The good news is that most EWS-related issues can be diagnosed and resolved. However, administrators must first understand why Exchange Online is blocking these requests. Once the root cause becomes clear, selecting the appropriate fix becomes much easier.
In this guide, you’ll learn the most common reasons behind the EWS Request Blocked error, practical troubleshooting steps, and long-term solutions that help future-proof your environment.
What Does “EWS Request Blocked” Mean?
Exchange Web Services (EWS) is Microsoft’s SOAP-based API that allows applications to access mailbox data, calendars, contacts, tasks, and other Exchange resources.
Historically, countless applications relied on EWS, including:
- Legacy email clients
- CRM integrations
- Help desk platforms
- Backup solutions
- Calendar synchronization tools
- Custom enterprise applications
When Exchange Online returns an EWS Request Blocked message, Microsoft is actively preventing the application from accessing mailbox data through EWS.
In many cases, the block occurs because:
- The client uses unsupported authentication methods.
- EWS has been disabled.
- Application policies restrict access.
- Microsoft security requirements are not met.
- The application relies on a deprecated EWS implementation.
Microsoft provides detailed guidance through its official documentation:
Why Exchange Online Is Blocking EWS Requests
1. Basic Authentication Is No Longer Supported
One of the most common causes is Basic Authentication.
For years, applications connected to Exchange Online using only a username and password. However, Microsoft permanently disabled Basic Authentication because it represented a significant security risk.
As a result, older applications attempting Basic Authentication typically receive:
- 401 Unauthorized
- Authentication failed
- EWS Request Blocked
- Invalid credentials errors
Microsoft officially retired Basic Authentication for Exchange Online services, including EWS.
Learn more:
2. EWS Application Access Policies
Exchange administrators can explicitly control which applications use EWS.
Organizations often implement:
- EWS allow lists
- EWS block lists
- Application ID restrictions
- Organization-wide EWS disablement
Therefore, a recently deployed security policy may suddenly block an application that previously worked without issues.
Run the following PowerShell command to review organization settings:
PowerShell
Get-OrganizationConfig | Select EwsEnabledIf EWS is disabled, affected clients cannot connect.
3. Mailbox-Level Restrictions
Sometimes the problem affects only specific users.
This situation usually indicates mailbox-level EWS restrictions rather than organization-wide restrictions.
Check mailbox settings with:
PowerShell
Get-CASMailbox user@domain.com | Select EwsEnabledIf the value is set to False, EWS remains blocked for that mailbox even when organization settings allow access.
4. Microsoft’s EWS Retirement Initiative
Microsoft announced the retirement of Exchange Web Services in Exchange Online and continues encouraging organizations to migrate toward Microsoft Graph.
According to Microsoft:
- EWS stopped receiving feature investments years ago.
- Security concerns accelerated retirement planning.
- Organizations should migrate applications to Microsoft Graph.
Relevant resources:
Consequently, organizations using outdated integrations face increasing service disruptions.
Common Symptoms of EWS Request Blocked Errors
Before fixing the issue, identify the exact symptoms.
Typical warning signs include:
- Mail synchronization failure
- Missing calendars
- Contact synchronization errors
- Repeated password prompts
- Application connection failures
- Exchange credential errors
- Unexpected mailbox access denials
Additionally, administrators may notice failures in:
- Service account workflows
- Shared mailbox automation
- CRM email integrations
- Backup jobs
- Reporting tools
Understanding the affected workload helps narrow troubleshooting efforts significantly.
How to Troubleshoot EWS Request Blocked Errors
Step 1: Verify Authentication Method
Start with authentication.
Determine whether the application uses:
- Basic Authentication
- Modern Authentication (OAuth 2.0)
If the application still relies on Basic Authentication, migration becomes necessary.
Modern Authentication provides:
- Multi-factor authentication support
- Token-based security
- Conditional Access compatibility
- Stronger identity protection
Most vendors now provide OAuth-compatible versions of their software.
Step 2: Review Exchange Online Settings
Next, inspect organization-level EWS settings.
PowerShell
Get-OrganizationConfigPay close attention to:
- EwsEnabled
- EwsApplicationAccessPolicy
- EwsAllowList
- EwsBlockList
- EwsAllowedAppIDs
These settings frequently explain blocked requests.
Step 3: Check Mailbox Configuration
If only certain users experience problems, investigate mailbox-level settings.
PowerShell
Get-CASMailbox user@domain.comReview:
- EwsEnabled
- ActiveSync settings
- Authentication configuration
Mailbox overrides often cause confusion because organization-wide settings may appear correct.
Step 4: Examine Azure and Microsoft Entra Logs
Authentication logs provide valuable clues.
Review:
- Sign-in logs
- Conditional Access logs
- Application registration logs
- OAuth consent history
Look for:
- Blocked sign-ins
- Token failures
- Legacy authentication attempts
- Conditional Access denials
These logs often reveal precisely why Microsoft blocked the request.
Step 5: Verify Application Registration
Modern applications should use Microsoft Entra app registrations.
Check whether:
- The application exists in Entra ID
- Required permissions are granted
- Admin consent is approved
- OAuth tokens are issued successfully
Incorrectly configured registrations frequently generate EWS connectivity issues.
Fixing EWS Request Blocked Errors
Solution 1: Upgrade the Email Client
This solution resolves many cases immediately. Replace unsupported clients with current versions such as:
- Outlook for Microsoft 365
- Outlook on the web
- Outlook Mobile
- Supported third-party clients
Older clients often lack Modern Authentication support.
Solution 2: Enable OAuth Authentication
If the software supports OAuth, configure it immediately. Benefits include:
- Better security
- Microsoft compliance alignment
- Longer-term support
- Reduced authentication failures
Most vendors now provide migration guides for OAuth implementation.
Solution 3: Adjust EWS Access Policies
If policy restrictions caused the issue, modify the configuration carefully. Examples include:
PowerShell
Set-OrganizationConfig -EwsEnabled $trueOr updating approved applications:
PowerShell
Set-OrganizationConfig -EwsAllowedAppIDsAlways validate configuration changes in a test environment before production deployment.
⚠️ Warning: Do not broadly enable EWS access without understanding security implications. A misconfigured policy can expose mailbox data to unauthorized applications.
Solution 4: Update Third-Party Integrations
Many vendors released EWS retirement updates. Contact application providers and verify:
- Supported authentication methods
- Microsoft Graph support
- Exchange Online compatibility
- Product lifecycle status
If the software no longer receives updates, replacement may be the safest option.
Solution 5: Migrate to Microsoft Graph
This is Microsoft’s recommended long-term solution.
Microsoft Graph provides:
- Modern API architecture
- Enhanced security
- Ongoing support
- Expanded cloud capabilities
Organizations planning future migrations should prioritize Graph adoption now rather than later.
How to Identify Applications Still Using EWS
Many organizations underestimate how many systems still depend on EWS.
Begin by reviewing:
- Service accounts
- Scheduled tasks
- Middleware platforms
- CRM systems
- Backup software
- HR applications
- ERP integrations
Next, review application inventory records and Exchange logs.
Additionally, engage software owners throughout the organization. Hidden dependencies often surface during migration projects.
💡 Pro-Tip: Perform an EWS dependency assessment before making policy changes. Many rarely used applications run monthly or quarterly. Therefore, they may not appear during basic testing.
Best Practices to Prevent Future EWS Blocking Issues
A proactive approach reduces future disruptions. Follow these best practices:
Maintain Current Software
Keep all email clients and integrations updated. Newer versions generally support:
- OAuth
- Conditional Access
- MFA
- Microsoft Graph
Monitor Microsoft Announcements
Microsoft regularly publishes updates affecting Exchange Online services. Useful resources include:
Implement Least Privilege Access
Only grant permissions required by the application. Doing so improves security while reducing compliance risks.
Audit Authentication Methods
Review sign-in activity regularly. Specifically identify:
- Legacy authentication traffic
- Unsupported clients
- Dormant applications
- Unapproved integrations
Plan EWS Retirement Projects Early
Organizations waiting until the final deadline often face rushed migrations. Instead, build a phased migration roadmap that prioritizes business-critical workloads first.
Final Thoughts
The EWS Request Blocked error is rarely a random Exchange Online problem. Instead, it usually indicates a security policy, authentication issue, or application compatibility problem.
In many environments, the root cause involves outdated mail clients still relying on Basic Authentication. In other cases, organizations have implemented EWS restrictions to improve security and inadvertently blocked required applications. Meanwhile, Microsoft’s ongoing retirement of Exchange Web Services adds further urgency for organizations that still depend on legacy integrations.
Fortunately, most issues can be resolved by reviewing authentication methods, checking EWS policies, updating software, and adopting Modern Authentication. More importantly, migrating toward Microsoft Graph provides a long-term path that aligns with Microsoft’s future platform strategy.
Organizations that act now will reduce support incidents, improve security, and avoid disruption as EWS retirement milestones continue approaching.
Have you encountered an EWS Request Blocked error in your environment? Share your experience in the comments, help fellow administrators, and spread this guide across your IT community. Your insight could save someone hours of troubleshooting.