From 10 October, Apple Mail on Mac needs a Microsoft 365 EWS allow list, not just EWS switched back onFrom 10 October, Apple Mail on Mac needs a Microsoft 365 EWS allow list, not just EWS switched back on

Microsoft has told Exchange Online administrators that from 10 October an EWS allow list becomes required whenever Exchange Web Services is switched on, which changes what it takes to keep Apple Mail on the Mac working with Microsoft 365.

The notice, MC1485116 in the Microsoft 365 Message Center, was posted late on 1 October. It sets three dates for organisations that have EWSEnabled set to True but no list of permitted apps, called EWSAllowedAppIDs. On 2 October Microsoft identified those organisations. On 8 and 9 October it will build a list for each one from the apps that used EWS in the previous 60 days. From 10 October, the notice says, the list is required. Microsoft expects the whole rollout to finish by early July 2027.

Mail, Calendar, Contacts, Notes and Reminders on the Mac still reach Microsoft 365 accounts through EWS. Apple's deployment guide, last updated in April, says Apple is working with Microsoft to move them to the newer Graph interface in a future macOS 27 update. heise and MacRumors both report that the macOS 27.2 beta notes do not mention Graph, and AppleInsider, whose headline says Apple plans a fix, notes that Apple has not said when.

What should Microsoft 365 admins with Mac users do now?

• Check whether EWSEnabled is True and whether an EWSAllowedAppIDs list exists.
• If Microsoft builds the list from recent use, check Apple Mail is on it. It will be only if Macs in the organisation used EWS in the 60-day window.
• If you set EWSEnabled to True after 2 October, Microsoft says you must build the list yourself.
• LazyAdmin's guide gives Apple's app ID as f8d98a96-0999-43f5-8af3-69971c7bb423, matching a Microsoft admin notice quoted on Apple's community forums.

Organisations that never set EWSEnabled at all remain in Microsoft's phased retirement, the notice says, and will lose EWS on Microsoft's schedule. LazyAdmin reports they get seven days' warning first; we could not find that in Microsoft's notice.

Who is already seeing problems?

AppleInsider published an IT notice from Old Dominion University reporting problems with university email in Mail on the Mac and recommending Outlook. Southern Methodist University warned Mac Mail users on 30 September and told iPhone users no impact was expected. iPhone and iPad connect to Exchange Online through ActiveSync, a different protocol, and every outlet that has looked agrees they are unaffected.

Our take

This corrects advice we gave. In our 1 October explainer on the EWS cutoff and Apple Mail, we said the reprieve for an admin was to set EWSEnabled to True. From 10 October that is half the job. A tenant that switches EWS on and builds no list will find Mac Mail refused anyway, and the admin will reasonably believe they already fixed it.

The 60-day lookback is the trap. A Mac user who switched to Outlook in August, or a Mac that sat in a drawer, leaves no trace in the logs, so Apple Mail may not be on the list Microsoft builds. APPDOOK's advice is to add Apple's ID by hand rather than trust the generated list.

None of this is Apple's to fix in the short term, and that is the uncomfortable part. Microsoft's notice names Outlook for Mac and says nothing about Apple Mail, and Apple's only public word is an April promise with no date. Until a macOS update moves Mail to Graph, Mac users in Microsoft 365 organisations depend on an allow list someone else maintains, and universities are already telling them to use Outlook.