Microsoft Defender for Cloud Apps: Retirement of EWS detections in App Governance

[What and Why:]

As announced in 2023, Exchange Web Services (EWS) in Exchange Online is being retired. Phased disablement will begin on October 1, 2026.

Starting October 15, 2026, Microsoft Defender for Cloud Apps app governance threat detections that rely on EWS activity signals will also be sunset.

For full details on the EWS retirement, see the Learn documentation: Deprecation of Exchange Web Services in Exchange Online | Microsoft Learn

[Impact on your organization:]

Organizations that do not use EWS: No action is required. Microsoft Defender for Cloud Apps already provides threat protection for Microsoft Graph activity, and app governance detections that do not depend on EWS activity signals will continue to operate.

Organizations that plan to keep using EWS between October 15, 2026 and April 2027: Microsoft Defender for Cloud Apps customers who choose to continue using EWS after October 15th 2026 will no longer see app governance alerts for suspicious app behavior observed through EWS activity. To maintain protection, we recommend that you adhere to the guidance from the Exchange Online team and migrate away from EWS. For the full details on EWS retirement please see the learn docs here.

Learn more

1. Exchange Online EWS, Your Time is Almost Up | Microsoft Community Hub
2. Microsoft Defender for Cloud Apps app governance detections