The retirement of Exchange Web Services (EWS) in Microsoft 365 and Google Workspace’s authentication requirements reflect a shift in how major tech platforms let applications access corporate email. Although both measures respond to security and modernization needs, they are not equivalent: Microsoft is retiring a programming interface used by mail clients and other applications, while Google requires more secure authentication mechanisms to access Gmail from external services.
Key facts about corporate email access in 30 seconds
- Microsoft began disabling EWS in Exchange Online on October 1, 2026, and plans to complete the retirement by April 1, 2027.
- Apple is working on migrating Mail, Calendar, Contacts, Notes and Reminders to Microsoft Graph.
- Google Workspace has required OAuth for external client access to Gmail since May 1, 2025.
- Thunderbird and MailMaven already offer Microsoft Graph compatibility, though not all features are available in both.
- Businesses need to review their mail clients, automations and integrations before an old connection stops working.
The changes affect a largely invisible part of productivity tools: the interfaces and authentication methods that connect programs to cloud services. For the end user, the result can be as simple as a sync error. For the IT department, the problem can extend to internal applications, shared calendars, contacts and automated processes.
The case of Apple Mail illustrates the risk. The app relies on compatibility with Microsoft’s services to manage corporate Exchange Online accounts. Apple has announced it is working with Microsoft to adopt Graph, but the update was not included in the initial release of macOS 27, according to information published by Jonathan Harbourne on September 22, 2026.
Microsoft 365: the end of EWS forces integrations to be updated
Exchange Web Services has for years let external applications access Exchange data, including messages, calendars and contacts. Microsoft has long recommended that developers abandon this interface in favor of Microsoft Graph, an API that provides access to Microsoft 365 data and features.
The retirement timeline sets the start of EWS deactivation in Exchange Online for October 1, 2026, with final shutdown on April 1, 2027. The measure affects applications that still use that interface to connect to mailboxes hosted in Microsoft’s cloud. On-premises Exchange servers follow a different timeline.
The migration requires work from developers. It’s not enough to simply rename the API: each application must adapt its requests, manage the necessary permissions and verify that the features it used are still available. It must also review the differences between the old and new interfaces.
Apple has confirmed it is working with Microsoft to move Mail, Calendar, Contacts, Notes and Reminders to Microsoft Graph in a future macOS 27 update. The documentation also includes a declarative configuration option for enterprise device management.
The announcement matters because it covers more applications than the mail client alone. However, it doesn’t set a specific release date for the update. If an organization has already blocked EWS, access through Apple Mail may keep failing until the app incorporates the new integration or the administrator enables a temporary alternative.
Classic Outlook and third-party apps are affected too
Apple isn’t the only company that has to adapt its software. Classic Outlook for Mac also relies on EWS for certain connections to Exchange Online and is affected by the retirement. Microsoft recommends using the current version of Outlook for Mac.
The change has another consequence for those who work with automations. Harbourne notes that Microsoft has dropped AppleScript support in the new Outlook for Mac, a feature that had previously been under consideration. Users who rely on scripts to organize messages or run tasks may need to redesign those processes.
Meanwhile, Thunderbird added Microsoft Graph support in version 154, although the support described is limited to email. MailMaven, a paid macOS client, also offers Graph and AppleScript integration. The specific capabilities should be checked for each version, since supporting an API doesn’t guarantee every feature of a client is available.
Google Workspace: OAuth changes how apps connect to Gmail
Google Workspace has also changed the access conditions for external applications, but the change follows a different logic. Since May 1, 2025, Workspace corporate accounts no longer support apps that access Gmail by directly requesting a username and password. Google requires OAuth for this type of access.
OAuth is an authorization mechanism that lets an application be granted specific permissions without having to be given the account’s main password. The user or administrator can authorize access according to the service’s policies and the permissions requested.
This change doesn’t mean Google has retired an API equivalent to EWS, nor that every external client has stopped working. Applications that support OAuth can keep connecting to Gmail, as long as their configuration and the account’s permissions comply with the organization’s policies.
Google states that current versions of Apple Mail and Microsoft Outlook can use OAuth to connect to Gmail. So using a desktop client doesn’t by itself mean losing access to a Google Workspace account. The problem arises when an older application relies on an authentication method that is no longer allowed.
The difference between the two providers matters for diagnosing issues. In Microsoft 365, the administrator must identify connections that still use EWS and prepare their migration to Graph. In Google Workspace, they must check that external clients use OAuth and comply with the access policies defined for corporate accounts.
What businesses using both platforms need to review
Organizations that combine Microsoft 365 and Google Workspace need to maintain an up-to-date inventory of the applications that access email and the mechanisms they use. The client’s name alone isn’t always enough to determine whether a connection is ready: the same application may offer different access methods depending on the version, account type and configuration.
In Microsoft 365, the first step is identifying applications that depend on EWS. Usage reports can help locate active connections, although systems used sporadically may go unnoticed. It’s also worth reviewing internal integrations and automations that access mailboxes, calendars or contacts.
The temporary exceptions Microsoft has planned can help keep certain services running during the transition, but they don’t replace the final migration. The April 2027 cutoff date requires planning updates with enough lead time.
In Google Workspace, the priority is verifying that applications use OAuth and that the permissions granted are appropriate. Companies should also review access policies, authorized applications and account recovery processes to reduce issues during the transition.
In both environments, testing should be done before retiring old connections. A migration can preserve email access and still leave out features such as calendar management, shared contacts or automations. Checking each workflow prevents a seemingly technical change from ending up disrupting everyday tasks.
Businesses already managing Microsoft 365 data protection, such as through Sophos and Rubrik’s integrated Microsoft 365 backup, should factor these access changes into their broader Microsoft 365 governance planning.
Frequently asked questions
When does Exchange Web Services stop working in Microsoft 365?
Microsoft began disabling EWS in Exchange Online on October 1, 2026, and plans to complete the retirement by April 1, 2027. The impact depends on each organization’s applications and configuration.
Does Google Workspace also block external email apps?
Google has required OAuth to access Gmail from external clients on Workspace corporate accounts since May 1, 2025. Applications that support this method can keep working.
What’s the difference between Microsoft Graph and OAuth?
Microsoft Graph is an API for accessing Microsoft 365 data and services. OAuth is an authorization mechanism that lets an application obtain permissions without relying on the user’s main password.
What should IT administrators do?
In Microsoft 365, they should identify applications using EWS and plan their migration to Graph. In Google Workspace, they should verify OAuth compatibility and review external applications’ permissions.
Source: Appleismo
