The protocol retirements: EWS, SMTP AUTH basic, and friends

EWS: the hard dates (verified)

• October 1, 2026: EWS traffic is BLOCKED unless the tenant has explicitly configured survival: EwsEnabled = $true at the org level plus an EWSAllowedAppIDs allow-list naming each app that may continue. No action = Microsoft flips EwsEnabled to false and every EWS app dies on schedule.
• April 1, 2027: full retirement — the allow-list stops working; EWS is gone. The allow-list buys six months of migration runway, not a reprieve.

What typically breaks: backup tools, migration tools, CRM/telephony integrations, room-panel vendors, line-of-business apps nobody documented. The census method: EWS usage is visible in sign-in/app telemetry per app id — enumerate BEFORE October, allow-list the laggards, migrate everything to Graph.

serv365 tie-in: this exact surface is our oldest verdict mapping — OrganizationConfig.EwsEnabled null means you're riding the default into the Oct 1 flip. The verdicts page has been saying so; the date now has teeth.

SMTP AUTH basic: the softened-but-real timeline (verified Jan 2026)

• Through Dec 2026: behaviour unchanged.
• End of Dec 2026: basic auth for SMTP client submission disabled by default for existing tenants — admins can re-enable (the escape hatch that makes this survivable), new tenants get no basic at all.
• 2H 2027: final removal date to be announced.

The affected population is every device and script doing username+password on port 587: MFPs/scanners, alarm systems, legacy apps. Paths out, per workload: OAuth SMTP (apps that can), Graph sendMail (the strategic answer), HVE for internal bulk (GA, billed $42/M recipients from Jun 2026, INTERNAL-only — external HVE was removed), ACS email for external app mail (what serv365 itself uses), or an on-prem relay for the hopeless hardware.

The tenant-side switches are per-mailbox and org-level (SmtpClientAuthenticationDisabled — already in our scan, and one of our verdict candidates' properties) — your current stance is a known, versioned fact.

The retirement playbook (works for both, and the next one)

1. Census from telemetry, not memory (app ids on the protocol).
2. Owner per consumer — every entry gets a name and a migration ticket.
3. Flags set deliberately (allow-list / re-enable) as RUNWAY with an internal expiry, never as the fix.
4. The drift guard: the controlling properties live in the nightly scan — if anything re-enables or a flag flips, it's a dated alert, not archaeology.

What to watch (proofs)

• EWS census: app-id-level usage reporting for EWS traffic — the list that becomes EWSAllowedAppIDs, sized against the Oct 1 clock.
• The org flags: Get-OrganizationConfig | fl EwsEnabled, EwsAllowList* and Get-TransportConfig | fl SmtpClientAuthenticationDisabled — current stance, and serv365 diffs them nightly.
• Basic-auth sign-ins: Entra sign-in logs filtered to legacy SMTP — the device census with IPs (walk the building with the list; the scanner in goods-in is on it).
• Post-flip canaries: after each date, the failed-auth/blocked-protocol trend — what the census missed announces itself here; better you read it than the helpdesk.