EWS access shuts off for Kiosk, F1, and F3 mailboxes on October 1
Share on LinkedIn!
#SimpleSharepoint #ExchangeOnline #Microsoft365 #ExchangeWebServices #M365Admins #FrontlineWorkers #Licensing #TenantAdmin #EmailSecurity #MicrosoftUpdates
Exchange admins — there’s an October deadline that’s worth starting on now.
Microsoft is finally enforcing a licensing limit that was always in the service terms but never switched on. Starting October 1, 2026, any mailbox licensed only with Exchange Online Kiosk, Microsoft 365 F1, or Office 365 F3 will be blocked from Exchange Web Services (EWS) — requests return an HTTP 403 error.
Who’s Affected: frontline and kiosk licenses never officially included EWS access; the restriction just wasn’t enforced. To keep EWS working, those users need a license with EWS rights — Exchange Online Plan 1 or 2, or Microsoft 365 E3 or E5.
Action Items:
• Report on mailboxes using Kiosk, F1, and F3 licenses.
• Identify any app, scanner, or backup tool still calling EWS with those identities.
• Reassign a license with EWS rights, or move the integration to Microsoft Graph before October 1.
One nuance to check now: a tenant-level EWSEnabled value left as null has already triggered early 403 errors for some third-party backup tools — set it deliberately rather than leaving it unset.
Not sure which frontline mailboxes still depend on Exchange Web Services? Let’s map your EWS surface and license exposure before the deadline.



