Microsoft starts enforcing the retirement of Exchange Web Services (EWS) in Exchange Online on October 1, 2026, and EWS is fully disabled in April 2027. For an MSP running client tenants, the work is in the backup, archiving, security, sync and reporting tools that still read mailboxes over EWS. This guide is written by Atriomail, a per-mailbox email hosting platform for resellers, for the MSPs and hosting resellers who have to act on that change in every tenant they manage.

Be clear about what Atriomail is not in this story. It is not a quick exit before October 1, and its IMAP migration tool cannot sign in to Microsoft 365 or Exchange Online mailboxes, because Microsoft no longer allows password sign-in over IMAP. The EWS work in your existing tenants has to be done either way. What Atriomail can change is what you quote next, for a new client or a renewal where the client only needs email and not Teams, SharePoint or Office.

Table of Contents

Key Takeaways

PointDetails
Enforcement starts October 1, 2026Microsoft begins disabling EWS across Exchange Online tenants in a phased rollout. A tenant whose EWSEnabled setting is still at its default null value can be switched to false, and the EWS apps in it stop working.
EWSEnabled set to true is no longer enoughFrom October 1, EWS also needs an EWSAllowedAppIDs allow list naming each app that may keep using it. Apps that are not on the list lose access.
April 1, 2027 is finalMicrosoft says EWS access is then removed permanently, with no re-enablement. The allow list only buys time until that date.
Vendors are at different stagesVeeam's KB4820 still needs EWS for Exchange Online backups while it waits on Microsoft Graph features. MailStore says Exchange Online archive mailboxes and public folders cannot be archived after April 2027.
Email-only clients are a separate decisionAtriomail sells mailboxes at $1.39 per mailbox per month with 15 GB included. Its IMAP tool cannot sign in to Microsoft 365 mailboxes, because Microsoft no longer allows password sign-in over IMAP; talk to us before you quote moving a tenant.

Pricing an email-only client while you work through EWS? Atriomail charges $1.39 per mailbox per month with 15 GB included, billed monthly with no contract. Creating an account is free and needs no card; mailboxes are billed from the first one.

Create a free account   See pricing

What Changes on October 1, 2026

Microsoft's Learn page on the deprecation (checked September 2026) gives two milestones: EWS starts to be disabled globally in October 2026, and it is fully disabled in April 2027. After the Midnight Blizzard incident in January 2024, the effort widened to Microsoft's own apps, including Outlook, Teams and Dynamics 365.

The rules that decide what happens in a tenant you manage come from Microsoft's message center notices, checked September 2026:

  • EWSEnabled left at null. As enforcement reaches the tenant, Microsoft may set it to false, and the EWS apps in that tenant stop working (MC1227454).
  • EWSEnabled set to true, with an allow list. Apps whose App IDs are on the EWSAllowedAppIDs list keep EWS access until the final shutdown. Setting the list replaces the existing one, so every required App ID has to go in at once, and changes can take up to 24 hours to apply (MC1447678).
  • EWSEnabled set to true, with no allow list. Before October this allowed all EWS traffic. After October 1, MC1447678 says all EWS traffic is blocked apart from cross-tenant organization relationships.
  • Microsoft-generated lists. The September notice MC1469960 says Microsoft will not overwrite a list you configured, but where none exists it may build one from the last 60 days of usage, and it warns that such a list may omit applications that run infrequently. It describes the rollout as starting in early October 2026 and finishing in late April 2027.

Microsoft's own advice in MC1227454 was to configure the allow list before the end of August 2026, so a client tenant that is not done yet is behind Microsoft's schedule, not early. Plan around the hard stop too: on April 1, 2027, EWS access is removed permanently with no re-enablement, whatever the tenant settings say.

Build the EWS Inventory Across Client Tenants

Start with data, not memory. Microsoft points admins to the EWS Usage Reports in the Microsoft 365 admin center, and to its EWS Analyzer tool for code your team owns (Microsoft Learn, checked September 2026). For each client tenant, list every App ID that called EWS, then sort each one into a bucket:

  • Backup and archiving products that read mailboxes on a schedule.
  • Security and filtering services that act on mail inside the mailbox.
  • Sync and business connectors, such as CRM plugins and ticketing systems that file mail.
  • Reporting and your own scripts, including the ones nobody remembers writing.

Then hunt for jobs that will not appear in 60 days of usage, like a quarterly export or a year-end script; MC1469960 warns a generated list can miss them. When one fails, it reaches you as a ticket, so have a written client support process for email tickets ready.

The real cost for an MSP is repetition. The allow list is set per tenant, so an MSP with 30 client tenants does the inventory, the list and the 24-hour check 30 times. If you are already managing email for many client domains, budget that time per tenant, not per product.

For the mailboxes it hosts, Atriomail gives your tooling one interface to plan around. Your scripts, portal or billing system call its REST API with an API key sent in the X-API-KEY header, covering domains, mailboxes, forwarders, catch-alls, mailbox storage, customer accounts and DNS record checks. A key carries the full permissions of the account that created it, can be given an expiry date, and can be switched off or regenerated, so treat it like an admin credential. The guide to email API integration for resellers covers the common patterns.

What Backup, Archiving and Security Vendors Say

Veeam. Veeam's KB4820 (last updated September 11, 2026, checked September 2026) says Veeam Backup for Microsoft 365 and Veeam Data Cloud for Microsoft 365 still use EWS for Exchange Online, because Microsoft has not yet delivered every Graph capability Veeam needs, specifically delta sync for incremental backups. For Veeam Backup for Microsoft 365 it lists four steps: assign the Microsoft Graph permissions in Entra ID, set EwsEnabled to true before October 1, add Veeam's App IDs to the allow list, and upgrade to a release still in development. If nothing is done, mailbox backups fail, and restoring access later means a full resync.

MailStore. MailStore's EWS migration help page (checked September 2026) says that from version 26.1, new archiving profiles for regular mailboxes use Microsoft Graph, while profiles for archive mailboxes and public folders still use EWS because Graph cannot reach them. After April 2027, it says, archiving Exchange Online archive mailboxes and Exchange Online public folders will no longer be possible. Microsoft's roadmap targets archive import and export for the fourth quarter of 2026, so recheck both pages before you tell a compliance client it is a dead end.

Mimecast. Mimecast's EWS retirement FAQ (checked September 2026) says several Mimecast services depend on EWS and are affected from October 2026, and that a tenant-level configuration can keep EWS available for them until March 31, 2027. That setting applies to every EWS-dependent service in the tenant, not only Mimecast's.

For every other vendor in your inventory, ask the same three questions in writing: which App IDs belong on the allow list, which release moves the product to Graph, and what stops working on April 1, 2027. File the answers with each client's email security baseline.

Finish the vendor list first, then decide what to sell next. For new clients who only need mail, Atriomail mailboxes work with standard mail apps over IMAP, POP3 and SMTP, include webmail, and can be managed from your own scripts through a REST API.

Create your account   See the per-mailbox price

The Graph Gaps Microsoft Will Not Close

Microsoft's deprecation page lists the capabilities it is still bringing to Microsoft Graph, such as archive and public folder import and export, mostly targeted for the second half of 2026 with dates it says might change. It also lists three that will not be added: generic read and write access to public folders, the same for Microsoft 365 Group mailboxes, and access to legacy Discovery Mailboxes. For a client whose workflow runs on public folders, that means a redesign before April 2027, not a patch.

Email-Only Clients Are a Separate Decision

Once the inventory is done, look at what each client actually uses. Some tenants live in Teams and SharePoint. Others hold a few mailboxes on Exchange Online Plan 1 and still carry the same allow list and vendor checks. Microsoft's Exchange Online plans page (checked September 2026) lists Plan 1 at $4.00 per user per month, paid yearly on an annual subscription, with a 50 GB mailbox. Microsoft 365 Business Basic went from $6.00 to $7.00 per user per month on July 1, 2026, according to Microsoft's pricing update announcement (checked September 2026).

If reseller email hosting is new to your team, the model is simple: you buy mailboxes wholesale, set your own resale price, and bill the client yourself. Here is how the two options compare for that kind of client.

Exchange Online vs Atriomail for resellers

DimensionExchange Online Plan 1Atriomail
Price per mailbox$4.00 per user per month, paid yearly (Microsoft list price)$1.39 per mailbox per month; you set the resale price
Included storage50 GB mailbox15 GB per mailbox
Contract or minimumAnnual subscription that auto-renewsNo contract and no minimum; billed monthly, starting from one mailbox
What the client getsEmail, calendar and contacts in Exchange OnlineMailboxes with webmail, plus IMAP, POP3 and SMTP for standard mail apps; not a suite with Teams, SharePoint or Office
API for your own toolsEWS until April 1, 2027; Microsoft Graph going forwardREST API with an API key in the X-API-KEY header, up to 30 requests per minute
Moving mail inIMAP migration in the Exchange admin center copies mail folders from other IMAP systems; contacts, calendar items and tasks are not moved (Microsoft Learn)Free IMAP migration of mail and folders from servers that allow password sign-in. It cannot sign in to Microsoft 365 or Exchange Online mailboxes: Microsoft no longer allows password sign-in over IMAP, so moving a Microsoft 365 tenant needs a different route; talk to us before you quote it
BrandingCompany branding (logo, background, favicon) on the Microsoft 365 sign-in page through Microsoft EntraPaid white-label add-on with a one-time setup fee and a monthly fee: the control panel on your hostname shows your product name and favicon; some layers, such as the webmail interior and system emails, stay neutral or show the platform

For a client who only needs mail, Atriomail is the better fit for a reseller for a reason you can check: the wholesale cost is $1.39 per mailbox instead of $4.00, billed monthly with no contract, and the spread above it is yours. Price large mailboxes honestly, though. Extra storage on Atriomail is $0.60 per 5 GB block, so a 50 GB mailbox costs $5.59 a month, more than Plan 1, and the breakdown of per-mailbox pricing is worth running per client before you quote.

When Exchange Online Makes Sense

  • The client uses Teams, SharePoint, OneDrive or the Office apps. Email is one part of what they pay for, and the EWS work does not change that value.
  • Compliance runs on Microsoft Purview, holds or eDiscovery. Those are Microsoft features the client would give up by leaving.
  • The contract requires an uptime service level agreement. Microsoft publishes financially backed service level agreements for its online services; Atriomail has no uptime SLA.
  • Shared calendars, meeting rooms and contacts drive the working day. Exchange Online is built around them.
  • Your CSP arrangement already earns a margin you are happy with. The comparison of the Microsoft 365 CSP program with white-label email covers that trade-off in detail.

Where Atriomail Fits

Take a 200-mailbox book of email-only clients and price both options at the same $5.00 per mailbox per month to the client, which brings in $1,000.00 a month. On Exchange Online Plan 1 at Microsoft's $4.00 list price, your cost is $800.00 a month and the spread is $200.00. On Atriomail at $1.39, your cost is $278.00 a month and the spread is $722.00. Both figures are arithmetic before card fees, support time and any white-label fee, and CSP pricing on the Microsoft side can differ from list, so use your own cost.

The Microsoft side also carries the tooling work this guide started with, repeated per tenant. The Atriomail side has conditions worth stating before you quote: mailboxes are billed from the first one, each includes 15 GB, bulk and cold email are not allowed because sending runs through Amazon SES on shared infrastructure, and support is available during business hours. If clients should see your product name on the control panel, white-label is a separate paid add-on; the guide to white-label email for agencies explains what it covers.

So decide client by client. Keep Exchange Online for clients who use the suite or its compliance tools, and finish their EWS inventory now. Offer Atriomail to new clients who only need email; if you bill through WHMCS 9, its v3 module handles Create, Suspend, Unsuspend, Terminate and Change Package. For clients still on cPanel, Plesk or DirectAdmin mail, the free IMAP tool applies, and the agency playbook for moving client mailboxes covers the sequencing. For an existing Microsoft 365 tenant, do not assume that path. Check the per-mailbox pricing, then create an Atriomail account: it is free and needs no card, and mailboxes are billed from the first one.

Weighing a move for a client with 50 or more Microsoft 365 mailboxes? Moving a Microsoft 365 tenant needs a different route than our IMAP tool; talk to us before you quote it.

Work out your margin   Talk to the team

Frequently Asked Questions

What happens to a client tenant that does nothing before October 1, 2026?

Once Microsoft's phased enforcement reaches it, a tenant with EWSEnabled still at null can be switched to false, and every EWS app in it stops working. The exact day varies by tenant, which is not a reason to wait.

Can EWS keep working after April 2027?

No. Microsoft's message center notice says EWS access is removed permanently on April 1, 2027, with no re-enablement. EWSEnabled and the EWSAllowedAppIDs list only matter until then. Anything that still depends on EWS has to move to Microsoft Graph, a vendor update, or a different tool.

Can Atriomail move a client's mailboxes out of Microsoft 365 or Exchange Online?

Not with its built-in tool. Atriomail's IMAP tool signs in to the old server with a password, and Microsoft no longer allows password sign-in over IMAP, so moving a Microsoft 365 tenant needs a different route; talk to us before you quote it. The tool does work for typical hosting mail on cPanel, Plesk or DirectAdmin servers, and for Gmail and Google Workspace with an app password (Google requires 2-Step Verification for app passwords, and a Workspace admin can block them). It moves mail and folders, not calendars or contacts.

Can I bill Atriomail mailboxes from WHMCS?

Yes, on WHMCS 9. The v3 module comes from the Plugins page in the Atriomail control panel and handles Create, Suspend, Unsuspend, Terminate and Change Package. It creates the first mailbox only if the domain clears the security check during the order, and it shows clients the DNS records rather than publishing them. Mailboxes and storage added in the WHMCS client area are billed in WHMCS; changes made in the panel or through the API do not sync, and the recurring charges it creates are titled "AtrioMail mailboxes".

How are DNS records set up for a client domain on Atriomail?

On Cloudflare and Namecheap, connect the DNS account, let Atriomail import its domains, then add the domain. Once it clears the security check, Atriomail writes the MX, SPF, DMARC, autodiscover and autoconfig records and the DKIM key. The Amazon SES verification records are not published automatically, and writing the MX moves the domain's mail, so add the domain only when you are ready to switch. On any other DNS host, add the records from the DNS Setup dialog. The guide to automating client email setup covers the wider onboarding workflow.

Latest from the blog