Microsoft Exchange Online EWS ilovalarini tuzatish usullarini e'lon qildi

Sergiu Gatlan

22-oktabr, 2026-yil

11:49

Microsoft ma'lum qilishicha, IT ma'murlari Exchange Online'da ishlamay qolgan EWS ilovalarini tuzatish uchun nafaqaga chiqqan Exchange Web Services (EWS) API'sini qayta yoqishlari mumkin.

EWS — bu Exchange Online va mahalliy Exchange serverlaridan pochta qutisi elementlariga (masalan, elektron pochta xabarlari, uchrashuvlar va kontaktlar) kirish imkonini beruvchi ilovalarni ishlab chiqish uchun mo'ljallangan API.

Ushbu API turli ilovalar, jumladan Outlook ish stoli qo'shimchalari, Windows uchun Outlook'ning eski versiyalari, macOS'dagi Apple Mail / Calendar va boshqa ko'plab ilovalar tomonidan ishlatiladi.

Fevral oyida kompaniya 2026-yil 1-oktabrdan boshlab EWS API'sini sukut bo'yicha bloklashni boshlashini, lekin IT ma'murlariga 2027-yil 1-aprelgacha yakuniy o'chirishgacha ilova ruxsat ro'yxati orqali kirishni vaqtincha saqlab qolish imkoniyatini berishini e'lon qilgan edi. Biroq, EWS o'chirilganda ilovalar EWS protokoli mavjud emasligi haqidagi ogohlantirishlardan tortib, foydalanuvchi nomi yoki parolni qayta-qayta kiritish so'rovlarigacha bo'lgan xatolarni ko'rsatadi.

Ushbu muammolardan qochish va endi ishlamay qolgan EWS ilovalarini tuzatish uchun Microsoft ma'lum qilishicha, ijarachi ma'murlari Microsoft 365 ma'mur markazidagi Baseline Security Mode'da "Butun tashkilotingizni EWS'dan foydalanishdan bloklash" bandini bekor qilish orqali EWS'ni qayta yoqishlari mumkin.

Yana bir variant — Exchange Online PowerShell'da "Set-OrganizationConfig -EWSEnabled $true" buyrug'ini bajarish, bu EWS'ni 4 soat ichida qayta yoqishi kerak.

"Biz hozir EWS o'chirilishining birinchi bosqichidamiz, bunda mijozlar hali ham EWS'ni qayta yoqishlari mumkin. EWS'ni qayta yoqish 2027-yil aprelda ishlamay qoladi," — dedi Microsoft.

"Uzoq muddatli yechim — ilovalaringizni EWS'dan foydalanmaydigan ilova versiyalariga yangilash. Yangilangan ilova versiyasini olish uchun ilova sotuvchingiz bilan bog'lanishingiz kerak, yoki agar ilovani o'zingiz yaratgan bo'lsangiz, kodni EWS'dan foydalanmaslikka o'zgartirishingiz kerak."

EWS nafaqaga chiqish jadvali (Microsoft)

Microsoft shuningdek, EWS API'dan foydalanadigan ilova ishlab chiquvchilariga EWS o'chirilishidan oldin Microsoft Graph API'ga o'tishni maslahat berdi, chunki u aksariyat holatlar uchun EWS bilan deyarli to'liq funksional moslikka ega.

Kompaniya shuningdek, EWS nafaqaga chiqish jarayoni faqat Microsoft 365 va Exchange Online muhitlariga ta'sir qilishini, API esa mahalliy Exchange Server o'rnatmalarida ishlashda davom etishini qo'shib qo'ydi.

EWS nafaqaga chiqish e'loni 2018-yilda EWS funksional yangilanishlarni qabul qilishni to'xtatishi haqidagi ogohlantirish va Microsoft'ning 2023-yil sentyabr oyida 2026-yil oktyabrda EWS API'ni o'chirishni boshlash rejasini e'lon qilishidan keyin sodir bo'ldi.

2021-yil oktyabrda Microsoft Exchange Online'dagi eng kam ishlatiladigan 25 ta EWS API'sini eskirgan deb e'lon qilgan va ularni 2022-yil mart oyida xavfsizlik sabablari bilan qo'llab-quvvatlashdan olib tashlagan edi.

Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% bloklanadi

Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanganda, oldini olish keskin pasayadi.

Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha himoya usullarini texnika bo'yicha o'lchaydi.

Hisobotni oling

Tegishli maqolalar:

Microsoft Outlook noyabrdan boshlab MSIX ilovalarini bloklaydi

Microsoft: Xitoylik xakerlar AQSh hukumatining Exchange elektron pochta hisoblarini buzib kirishdi

Exchange Online uzilishi elektron pochta kechikishlari, "Server band" xatolariga sabab bo'ldi

Exchange Online zaif mahalliy serverlardan kelgan elektron xabarlarni bloklaydi

Microsoft PowerToys CursorHide, Button Lock sichqoncha vositalarini qo'shdi

The original text is in EN, taken from the source site. Source ↗

Microsoft shares how to fix broken Exchange Online EWS apps

By Sergiu Gatlan

October 22, 2026

11:49 AM

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working.

EWS is an API for developing apps that can access Exchange mailbox items (e.g., email messages, meetings, and contacts) from Exchange Online and on-premises Exchange servers.

This API is used by various apps, including but not limited to Outlook desktop add-ins, older versions of Outlook for Windows, the Apple Mail / Calendar on macOS, and various other apps.

In February, the company announced it will start blocking the EWS API by default on October 1, 2026, but will let IT administrators temporarily maintain access via an app allowlist until the final shutdown on April 1, 2027. However, when EWS is disabled, the apps show errors ranging from alerts that the EWS protocol is unavailable to repeated prompts to enter the username or password.

To avoid these issues and fix EWS apps that are no longer working, Microsoft says tenant administrators can re-enable EWS in the Microsoft 365 admin center Baseline Security Mode by unchecking "Block your entire organization from using EWS" on the Baseline Security Mode page.

Another option is to use Exchange Online PowerShell to run the "Set-OrganizationConfig -EWSEnabled $true" command, which should re-enable EWS within 4 hours.

"We are now in the first stage of EWS disablement, where customers are still able to re-enable EWS. Re-enabling EWS will stop working in April 2027," Microsoft said.

"The long-term solution is to update your applications to the application versions that do not use EWS. You must contact your application vendor to get the updated application version, or if you created the application yourself, you must change the code to not use EWS anymore."

EWS retirement timeline (Microsoft)

Microsoft also advised app developers using the EWS API to switch to the Microsoft Graph API before EWS shuts down, since it has near-complete feature parity with EWS for most scenarios.

The company also added that the EWS retirement process affects only Microsoft 365 and Exchange Online environments, and the API will continue to work in on-premises Exchange Server installations.

The EWS retirement announcement followed a 2018 warning that EWS would stop receiving functionality updates and Microsoft's September 2023 announcement that it planned to begin shutting down the EWS API in October 2026.

In October 2021, Microsoft revealed that it had deprecated the 25 least-used EWS Exchange Online APIs and removed support for them in March 2022 for security reasons.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Microsoft Outlook to block MSIX attachments starting November

Microsoft: Chinese hackers breached US govt Exchange email accounts

Exchange Online outage causes email delays, 'Server busy' errors

Exchange Online to block emails from vulnerable on-prem servers

Microsoft PowerToys adds CursorHide, Button Lock mouse tools