Enable EWS for Add it (Microsoft 365 / Exchange Online)

Brief summary — Microsoft is gradually shutting down Exchange Web Services (EWS) starting October 1, 2026. To ensure that calendar, contacts, and email sync between Microsoft 365 and the app continues to work, your Microsoft 365 administrator runs a pre-made script in Azure Cloud Shell. The script displays the current state, adds the Add it app to the list of allowed apps, enables EWS, and verifies the result. This takes about 10 minutes.


Who does this?	Whoever is your Microsoft 365/Exchange administrator
Time	About 10 minutes, plus up to 24 hours before the change takes effect
Tool	Azure Cloud Shell (Bash)
Script file	`activate-add-it-ews.sh`
App	Add it
Application ID	`c55ca600-29f4-42b5-8c9a-a2d53153f8a2`

Do you need to do this?

Yes, if you use the connection between the app and Microsoft 365 for calendar, contacts or email. Make the change well in advance before October 1, 2026 – then your users will not notice the transition at all.

Has sync already stopped working? Then Microsoft has reached your environment. The same steps in this guide will restore the connection. Telephony and other functions in the app are not affected.

What does this apply to – and what does it not apply to?

Applies to: the Microsoft 365 account that each user connects to their personal app for calendar, email, and contacts .

Does not apply to: email addresses linked to Contact Center .

Does not apply: activity status (presence) sync and Microsoft Teams connection – they do not use EWS and continue to function as usual.

Does not apply to: telephony, call history and other functions in the app.

Temporary solution — Microsoft will permanently close EWS on April 1, 2027 without exception. We are building the next generation of the Microsoft connector on Microsoft Graph in parallel, and we will contact you with instructions well in advance.

Read this before running the script

EwsEnabled = True doesn't mean "EWS is on for everything" – it means EWS is on only for the apps in the AppID list .

If the current status is Null (not explicitly set) with an empty app list, all EWS apps will work for you today. If you then enable EWS with just Add it in the list, other EWS apps will stop working immediately – not in October. This may apply to backup, archiving, migration tools, room booking, CRM connections, older Outlook add-ins and some Microsoft services.

Therefore: always start with step 0 and enter all the App IDs you use – not just Add its.

Technical principle — The script is launched from Bash but uses Microsoft's official Exchange Online PowerShell module in the background. The settings are not available as equivalent pure Bash commands.

Preparations

Complete the steps together with an administrator for the Microsoft 365 tenant where Add it will be used.

Claim	Control
Administrator account	The Exchange Administrator or Organization Management role is required to connect to Exchange Online and change the organization configuration.
The right tenant	The administrator must sign in to the Microsoft 365 tenant where Add it will be used.
Exchange Online	The user's mailbox must be in Exchange Online. The guide does not apply to on-premises Exchange Server.
Script file	Download `activate-add-it-ews.sh` in step 1 below, before starting the session.
Identifier	Only the Application ID is used. The Object ID is tenant-specific and should not be specified.
EWS mapping	Do step 0 first, so you know which other apps use EWS on your system.

Cloud Shell can be ephemeral — "Ephemeral" means that uploaded files may disappear when the session ends. Any saved Exchange settings are not affected.

No Azure subscription? — Azure Cloud Shell may require an Azure subscription. The script works just as well locally: install PowerShell 7 () and the Exchange Online module with , and run the same flow from there.pwshInstall-Module ExchangeOnlineManagement

Check that you have the correct file.

The "Add it" application has Application ID c55ca600-29f4-42b5-8c9a-a2d53153f8a2.

SHA-256 for activate-add-it-ews.sh:

This is how you calculate the sum yourself (Linux/macOS/Cloud Shell):

On Windows: Get-FileHash .\activate-add-it-ews.sh -Algorithm SHA256

941352e1927ca129b3cd5b17326e4e426b98d47e60a262a7ae23d24ffc6fd31e

sha256sum activate-add-it-ews.sh

Start and run the script

Run the file from the Bash prompt. The prompt should not start with "PS".

Step 0 – Map your EWS usage

This step is mandatory if your app list is empty today.

The report shows which Application IDs are using EWS on your site, call volume and recent activity.

Write down all the App IDs that have traffic – backup, archiving, migration, room booking, CRM, Outlook add-ins, and Microsoft services.

If you have apps in the list outside of Add it: contact our support before running the script, and we will help you add all App IDs in the same round.

Do not skip step 0 — Apps that have never been in the AppID list are not preserved by the script, as they never needed to be there. They must be actively added.

Step 1 – Download the script file

Download the file below to your computer. Save it without changing the name.

Download

activate-add-it-ews.sh 5.0 kB

Please compare the file's SHA-256 sum with the value in the preparations above before running it.

Step 2 - Open Azure Cloud Shell

Go to portal.azure.com , select Cloud Shell (the >_ icon in the top menu), and launch Bash . If the prompt starts with PS, type exit and switch to Bash.

Step 3 – Upload the script file

Use the upload function in Cloud Shell and select activate-add-it-ews.sh. Verify that the file came up:

ls

This is what you should see: the file name in the list.activate-add-it-ews.sh

Step 4 – Make the file executable

Step 5 – Start the script

Start the entire flow with one command. Don't paste the PowerShell parts line by line.

chmod +x activate-add-it-ews.sh

./activate-add-it-ews.sh

If you see "PS /home/…" — You are in an interactive PowerShell prompt. Type and run the file from Bash. Do not continue pasting code when PowerShell displays .exit.sh>>

Login and approval

The script pauses Microsoft device sign-in and displays the status before the change.

Step 6 – Complete device sign-in

Open the address provided, enter the one-time code, and log in with the customer's administrator account. Do not share the code with anyone else.

Step 7 – Read the status before the change

This is what you should see: a status report, something like this:

EWS-status: INTE UTTRYCKLIGEN SATT (Null)
EWSAllowedAppIDs: Applistan är tom.
Add it finns i applistan: NEJ

Step 8 – Review the proposed list

Add its Application ID should appear in the suggested list. Existing App IDs in the list should also remain – the script will preserve them.

Compare the list with the App IDs you wrote down in step 0. If anything is missing – do not answer YES , but contact us first.

Save the current state before proceeding — Copy the entire "STATUS BEFORE CHANGE" printout to a text file. It's your only trace of the original state if something needs to be restored.

Step 9 – Approve the change

Type exactly YES and press Enter. Blank or other answers will cancel without change.

Skriv JA för att uppdatera applistan och aktivera EWS:
JA

What YES means — When EWS is enabled, EWS is restricted to exactly the apps listed . Apps not listed will lose their EWS access immediately. Check one last time that the list contains everything from step 0 before answering YES.

Active approval required — The script will not make any changes until the administrator has reviewed the list and typed YES.

Verification

After the change, the script rereads the configuration and prints a final result.

This is what a successful result looks like:

STATUS EFTER ÄNDRING
EWS-status: AKTIVERAD (True)
[OK] Add it: c55ca600-29f4-42b5-8c9a-a2d53153f8a2
Add it finns i applistan: JA
SLUTRESULTAT: GODKÄNT

Checklist

EWS status is ENABLED (True) .

Add it appears with the correct Application ID.

All other App IDs from step 0 remain in the list.

Your other EWS-based services (backup, archiving, room booking, etc.) will still work.

Wait up to 24 hours if necessary – the AppID list is cached in Exchange.

Test Add it in your exchange client by disconnecting your email account and adding it again.

Troubleshooting

Symptom	Probable cause	Measure
The prompt starts with `PS` or shows `>>`	You are in an interactive PowerShell prompt	Type `exit`, go back to Bash and run `./activate-add-it-ews.sh`
`Permission denied` when the script is started	The file is not executable.	Run `chmod +x activate-add-it-ews.sh` and try again
The script file is not visible with `ls`	The session has ended and the file disappeared (ephemeral)	Re-upload `activate-add-it-ews.sh`
Error 403 Forbidden	Permissions, Conditional Access or mailbox blocking	Check Entra ID permissions, Conditional Access, that the mailbox is active, and that EWS is on at the mailbox level
Sync still doesn't work right after the change	The Exchange cache has not been updated yet.	Wait up to 24 hours and test again.
The final result was not APPROVED.	Approval was canceled or the account is not authorized.	Run the script again with an account that is allowed to change the organization configuration and answer YES
Another EWS app stopped working immediately after the change	The app was not in the AppID list when EWS was enabled	Get the app's Application ID (EWS report or provider), add it to the list, and run the verification again
One individual user is out of sync, the others are working	EWS turned off at the mailbox level, or the mailbox is not in Exchange Online	Check the mailbox EWS setting with your Exchange administrator.

Legacy EWS policy is separate — / is based on User Agent and is not the same as . If such a policy is used, the app must pass both checks.EwsApplicationAccessPolicyEWSAllowListEWSAllowedAppIDs

What happens next?

October 1, 2026 – Microsoft will begin phasing out EWS in customer environments.

Until April 1, 2027 – The steps in this guide keep the connection going.

April 1, 2027 – EWS will be permanently closed. The new Microsoft connection is in place and we will return with more information.

Do you need help?

Contact our support – we will be happy to help with the setup and send you the script file.

Frequently asked questions

What parts of the app are affected by turning off EWS?

Only the personal Microsoft 365 connection in the user's app – that is, syncing calendar, email and contacts . Syncing of activity status (presence) and the Microsoft Teams connection are not affected, nor are telephony, call history or other functions.

Does activity status or Teams connection stop working?

No. Activity status (presence) sync and Microsoft Teams connectivity are not based on EWS. They will continue to work as before, whether or not you make this change.

Are the email addresses associated with Contact Center affected?

No. Email addresses associated with Contact Center are handled differently and are not affected by the EWS decommissioning. You do not need to do anything with them.

Why a script instead of individual commands?

The script does the same thing every time: displays the current state, preserves existing App IDs, adds Add it after your approval, activates EWS, and verifies the result. This reduces the risk of accidentally overwriting the app list.

Can we review the script before running it?

Yes. Open the file in a text editor and compare the SHA-256 sum in the preparation with the file you received. The script will not make any changes until you type YES .

Can the activation affect our other apps that use EWS?

Yes, if they are not in the AppID list. When EWS is activated, only the apps in the list apply. If you currently have Null and an empty list, all EWS apps will work, and an activation without mapping will immediately disable them. Therefore, the guide starts with step 0: map in the EWS report and enter all App IDs that are used.

Does each user need to do something themselves?

No. Your Microsoft 365 administrator will make the change once for the entire organization. For testing, it may be enough to disconnect and add the email account back to the app.

What happens if we do nothing?

When Microsoft's shutdown reaches your environment, calendar, email, and contacts syncing will stop working in the app. It will be restored as soon as the script has been run through with a successful outcome.

Is it safe to allow the Add it app?

Yes. Add it only has access to what is required for syncing, and only for users who have connected their Microsoft 365 account in the app.

We use local Exchange Server – does the guide apply to us?

No. The guide applies to mailboxes in Exchange Online. Contact our support if you are running Exchange on-premises or in hybrid mode.

Official Microsoft sources

Exchange Online EWS, Your Time is Almost Up

Introducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement

Table of contents