Microsoft 365 Change Oct 1: NC Invoice Emails at Risk

As of September 20, 2026: you have ten days before Microsoft starts making decisions about your email integrations for you. EWS is old plumbing, dating to 2007, that lets software log into a Microsoft 365 mailbox on its own with no person in front of it. Microsoft caps that pipe on October 1. Nothing here is a security flaw and nobody is being attacked.

The way it announces itself at a North Carolina plant is that invoices stop leaving the ERP, or the scanner stops delivering PDFs, and no error reaches anybody who could act on it.

Here is the part almost nobody has been told. If you do nothing you are not simply blocked. Microsoft writes the approved-application list for you, from what it saw your tenant doing over the previous 60 days. For a plant whose important jobs run monthly, quarterly or at year end, a 60-day snapshot is the wrong list.

Key takeaway: The deadline is not for fixing your integrations. It is for deciding who writes the list of what survives. Do nothing and Microsoft decides, from two months of traffic.

If you would rather hand this to somebody, Preferred Data Corporation is in High Point at (336) 886-3282.

What changes in Microsoft 365 on October 1, 2026?

Retirement enforcement begins in Exchange Online, and the tenant setting that governs EWS stops meaning what it used to. The 2023 announcement on the Microsoft 365 Developer Blog of September 19, 2023 framed this as blocking "EWS requests from non-Microsoft apps to Exchange Online," and that is where most summaries still stop. It has been overtaken twice. Microsoft's deprecation page now says the scope "was also widened from third party applications to include all Microsoft applications," and the switch doing the work is tenant-level rather than a vendor filter.

Date	What happens
July 2018	Microsoft announces EWS will get no further functionality updates
2023	The disablement date is set to October 2026
September 30, 2026	Microsoft's stated act-by date for configuring your own allow list
October 1, 2026	Enforcement begins; EWS starts being disabled, tenant by tenant
April 1, 2027	EWS is fully disabled

The July 2018, 2023 and October 2026 rows come from Microsoft's own EWS deprecation timeline, which calls October 2026 the month EWS "starts to be disabled globally for all organizations." The day-level dates come from elsewhere: October 1 from the 2023 announcement, and April 1, 2027 from Computerworld of February 6, 2026, which also describes the tenant setting, EWSEnabled, and its three values of true, false and null, with null converting to false as the rollout arrives.

September 30 is the date to act on, and it comes from Microsoft's own notice to administrators. Message Center post MC1447678 of August 5, 2026 introduces a setting called EWSAllowedAppIDs, a tenant-level list of the applications permitted to keep using EWS, and carries an act-by date of September 30, 2026. It also spells out the reversal that catches people: until October, EWSEnabled set to true with no list means everything is allowed. From October, the same configuration means everything is blocked apart from cross-tenant organization relationships. Microsoft adds that its own first-party applications "must also be included if they appear in your usage reporting."

Microsoft said in July 2018 that EWS would get no further functionality updates, so eight years on nobody gets to call this sudden. What makes it bite anyway is that the notice went to developers and administrators, and the software doing the calling in a 70-person fabrication shop was written by somebody who stopped invoicing you in 2019.

What happens if we do nothing at all?

Microsoft writes your list. Message Center post MC1469960 of September 9, 2026 is explicit: "If a customer-managed list does not exist, Microsoft will generate a list based on EWS application usage observed during the previous 60 days." A list an administrator has already configured is left alone, because Microsoft "will not modify an EWSAllowedAppIDs list that has already been configured by a tenant administrator."

That is considerate, and it is also the trap. Two things follow for a manufacturer specifically.

Sixty days of observation reaches back to roughly August 1. Anything that ran before that and has not run since is invisible to it. The month-end invoice run might scrape in. The quarterly job might not. The annual one will not, and it will fail in a quarter's time with nobody connecting it to a September decision.

The list cuts the other way too. Whatever was calling EWS during those 60 days gets approved, including the integration a former contractor left running that nobody would sign off on today. It preserves your accidents along with your essentials.

If you want somebody to read the list with you before the end of the month, call (336) 886-3282 or see Managed IT Services.

How do I tell what we are actually running?

Pull the EWS usage report in the Microsoft 365 admin center, under Reports, Usage, Exchange. Microsoft also ships an EWS Analyzer that reads your own source code and an EWS Usage Reporting tool, both linked from the deprecation page.

Know what it hands you first. The usage details table gives an Application ID, which is a Microsoft Entra GUID, plus the SOAP action, the call volume and a last-activity date. Microsoft says you cannot customize those columns, and there are no vendor names in them. Turning GUIDs into names means cross-referencing Enterprise Applications in Entra ID and Microsoft's list of first-party application IDs. That lookup, not the report, is the work.

Two limits do more damage than a low call count. The report only filters to the last 7, 30 or 90 days, so a job that runs once a year falls outside every window available to you. And Microsoft states that usage data "is collected and aggregated weekly, not daily" and that "it can take up to 10 days for usage to show in the report." A report you pull today does not describe last week.

Which is the same blind spot Microsoft's own 60-day generator has, from the same data. That is the argument for writing the list yourself: you know the job that runs every January, and the observation window does not.

Three things close this out. Pull the report, allow for the lag, and account separately for anything that only runs at month, quarter or year end. Do all three and you can stop thinking about it. Do only the first and you have swapped a deadline for a low-grade worry.

In the checks we run, the traffic is rarely coming from the system somebody named in the meeting beforehand. People expect the ERP. What turns up is a conference-room display, an archiving tool nobody has opened since a compliance scare, or a script a former controller wrote to file remittance advices.

Which systems in a Greensboro or Thomasville plant are worth checking?

Anything that touches a mailbox with nobody sitting in front of it. In a plant or distribution office that is usually five things:

The ERP or order system that emails invoices, order acknowledgements and advance ship notices.
Scan-to-email on the copiers, especially any set up to sign in as a real mailbox.
Anything that reads a shared mailbox, the orders@ or ap@ address, and files attachments somewhere else. This is where homemade scripts hide.
Whatever backs up or archives mailboxes, if it is separate from your main backup.
Any add-in bolted into Outlook for quoting, signatures or CRM.

None of these necessarily uses EWS. Newer versions use Microsoft Graph, and some vendors completed the move well ahead of the deadline.

What Graph is never getting

Many EWS scenarios already have a documented Graph equivalent and Microsoft publishes the mapping. Three are confirmed as never coming. From the deprecation page, under confirmed capabilities that will not be added:

Capability	Where you would run into it
Generic public folder create, read, update, delete	The shared folder tree older distributors run quotes and job files out of
Generic Microsoft 365 group mailbox item access	Tools that read and write items inside a group mailbox
Discovery mailbox access	Legacy hold and search workflows, now routed through Purview eDiscovery

If the report resolves to a tool doing generic item-level work in public folders, stop waiting for a patched version. Note the carve-outs before you write the vendor off: public folder and group mailbox import and export are treated as separate capabilities on the roadmap for the fourth quarter of 2026, and group conversations, threads and posts already have supported Graph APIs.

Read one more line on that roadmap, because it catches people out. Microsoft writes that if a capability "isn't listed in this roadmap table, don't plan on a corresponding Microsoft Graph or Exchange Admin API capability being available before EWS is fully disabled." So the unavailable set is three confirmed items plus anything absent from a thirteen-row table, whose 2026 targets Microsoft says "are targets and might change."

It is September 20. What are the options?

Four, and the first one is now cheap in a way it will not be in eleven days.

Option	Realistic effort	What it buys
Configure EWSAllowedAppIDs yourself before September 30	An afternoon of admin work plus the GUID lookups	Your judgment on the list, and Microsoft leaves it alone afterwards
Let Microsoft generate the list, then correct it	Nothing now, more later	Continuity for whatever ran recently. Infrequent jobs break
Vendor ships a Graph version you install	An upgrade fee plus a test window	The clean outcome, if their date is real
Move the process off the mailbox entirely	Development work, and the range here is wide	A path that survives the next retirement too

Get a written price against anything that involves paying somebody, including us.

The last option is the one nobody asks about, because it means admitting the mailbox was a workaround. If a script exists because somebody needed remittance PDFs out of a shared mailbox and into the ERP, the mailbox was never the requirement; a supplier portal or a direct ERP interface does the same job. We build that kind of connective work as custom software, so weigh that accordingly, then notice it is the only option with no expiry date on it.

Key takeaway: Read the list for what should not be on it, not only for what should. EWS was already on its way out when a forgotten, over-privileged app registration became the route into Microsoft's own corporate email in January 2024; Microsoft says that incident "elevated the urgency" and widened the scope to its own applications. An integration that needed one shared mailbox and was granted all of them is a finding whoever wrote your list.

What goes on the calendar this week

Do this first, Monday September 21: tell your controller and your customer service lead which outbound emails could stop. A shipping clerk who knows the acknowledgements might quit on October 1 raises it within the hour. Nobody else raises it at all, and it is the only item needing no phone call.
Monday September 21: pull the usage report, and check whether an EWSAllowedAppIDs list already exists.
Tuesday September 22: resolve the GUIDs to owners, and list separately anything that runs monthly, quarterly or annually. No observation window will find those for you.
Wednesday September 23: email the vendors, reply-by Friday September 25.
By Monday September 28: decide whether you configure the list or accept Microsoft's, and record who decided. Leaving it is a decision too, just an unrecorded one.

Frequently Asked Questions

Does this affect our on-premises Exchange server?

No. The retirement applies to Exchange Online, and Microsoft's 2023 announcement states there are no changes to EWS in Exchange Server. Microsoft's own products are a different matter, and the deprecation page is explicit that the scope widened to include them. If you run Exchange Server 2016 or 2019 you have a separate October 2026 problem, the end of extended security updates for those versions.

Will Outlook and Teams stop working on October 1?

Probably not, but the reason is work in progress rather than an exemption. Microsoft has been removing EWS dependencies from its own products, naming Outlook, Office, Teams and Dynamics 365. Because the switch is tenant-wide, the way to be sure is the report rather than the assumption, and Microsoft says its first-party applications belong on the allow list too if they show up in your usage data.

Do we already have an allow list?

Possibly, and it is worth ten minutes to find out. Microsoft generates one from observed usage where no administrator has configured it, and leaves a configured list untouched. If something is already there, read it before October: it is both a free integration inventory and a list of what your tenant will keep permitting.

How do we know if a vendor is telling us the truth about being ready?

Ask for a version number and a release date rather than a reassurance, then re-pull the usage report about two weeks after you install it. Not the week after: Microsoft aggregates weekly and warns of up to ten days of lag, so a report pulled sooner will still show pre-upgrade calls and will tell you a working upgrade failed.

What about the job that only runs at year end?

That is the case this whole exercise exists for, and no report window or observation period will surface it. Somebody has to remember it. Ask your controller what runs in January, ask your quality manager what runs at audit time, and put those applications on the list by hand.

Our IT is outsourced. Whose job is this?

Whoever administers your Microsoft 365 tenant should produce the usage report and tell you whether an allow list exists, and it is fair to ask for both in writing with the date they were run. Deciding what belongs on the list is a business call about processes and vendors, and that part stays with you.

Need this closed before the thirtieth? NCMEP counts 11,496 manufacturers in North Carolina, 90 percent of them under 100 employees on 2024 BLS data. That figure says nothing about integrations, and the inference is ours: under 100 employees rarely buys you somebody on staff to ask about the app a contractor installed, whether you are in Charlotte, Raleigh or the Piedmont Triad. Preferred Data Corporation has been in High Point since 1987. Call (336) 886-3282, email [email protected], or come by 1208 Eastchester Drive, Suite 131, High Point, NC 27265. We will pull the report, resolve the GUIDs to owners, and tell you what is missing from the 60 days Microsoft can see.