Sign in with Microsoft
Sign in or create an account.
Select a different account.
You have multiple accounts
Choose the account you want to sign in with.


In Microsoft Exchange Server 2019 or Exchange Server 2016, assume that you try to prevent client applications from using REST and EWS by using the EwsAllowList parameter in the Set-OrganizationConfig cmdlet. However, you experience an issue that the application doesn't honor the EwsAllowList parameter. The client application can still use the REST and EWS to connect to Exchange Server even if the value of EwsAllowList is set to null (it prevents all client applications from using REST and EWS).


This issue occurs because all users have the EWSEnabled parameter set to null by default in on-premises Exchange. This setting allows all clients that have null set in EWSEnabled to access without checking EwsAllowList. 


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.


To fix this issue, install one of the following updates:For Exchange Server 2019, install the Cumulative Update 1 for Exchange Server 2019 or a later cumulative update for Exchange Server 2019.

For Exchange Server 2016, install the Cumulative Update 12 for Exchange Server 2016 or a later cumulative update for Exchange Server 2016.


Learn about the terminology that Microsoft uses to describe software updates.

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.

Was this information helpful?

What affected your experience?

Thank you for your feedback!