365Fanatic / Microsoft 365 Message Center / MC1477180
Tenant announcements

Microsoft Defender for Cloud Apps: Retirement of EWS detections in App Governance

MC1477180

All Microsoft 365 Message Center posts · Daily summary

SummaryDetailedTimelineProduct updatesThis weekMC SummaryMC DetailedPnP Search
About this page These posts come from a tenant in West Europe and are shown as a reference. Day-by-day digest: MC Summary. Linked to the roadmap via Roadmap ID when Microsoft names one. Items are kept for 12 months. Always check Message Center in your own environment for what applies to you.
Archive This post is no longer in the Microsoft 365 Message Center (last seen on 2 okt 2026). Microsoft removes posts after a while. We keep the last version here as an archive.
MC1477180
Microsoft Defender XDR

What and why

As announced in 2023, Exchange Web Services (EWS) in Exchange Online is being retired. Phased disablement will begin on October 1, 2026.

Starting October 15, 2026, Microsoft Defender for Cloud Apps app governance threat detections that rely on EWS activity signals will also be sunset.

For full details on the EWS retirement, see the Learn documentation: Deprecation of Exchange Web Services in Exchange Online | Microsoft Learn

Impact on your organization

Organizations that do not use EWS: No action is required. Microsoft Defender for Cloud Apps already provides threat protection for Microsoft Graph activity, and app governance detections that do not depend on EWS activity signals will continue to operate.

Organizations that plan to keep using EWS between October 15, 2026 and April 2027: Microsoft Defender for Cloud Apps customers who choose to continue using EWS after October 15th 2026 will no longer see app governance alerts for suspicious app behavior observed through EWS activity. To maintain protection, we recommend that you adhere to the guidance from the Exchange Online team and migrate away from EWS. For the full details on EWS retirement please see the learn docs here.

Learn more

  1. Exchange Online EWS, Your Time is Almost Up | Microsoft Community Hub
  2. Microsoft Defender for Cloud Apps app governance detections

This is in the weekly digest for week 39 · What changed this week? →