how to see users using ews in exchange

Question

how to see users using ews in exchange

Anonymous

how can i see which accounts are actively using ews?

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Anonymous

2025-03-21T09:45:33.2866667+00:00

Hello, @Allen, Jim

Is there any update on this thread? If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well. Thanks for your understanding.

Best Wishes,

Alex Zhang
Anonymous

2025-03-26T07:29:05.0733333+00:00

Hello, @Allen, Jim

Just circling back to check to see how things are going on with this thread. If the issue has been resolved, please mark the helpful replies as answers.

Best Wishes,

Alex Zhang
Anonymous

2025-04-01T01:48:30.0366667+00:00

Hello, @Allen, Jim

It has been a long time since your last update.

Just circling back to check to see how things are going on with this thread.

If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well.

Should you need more help on this, you can feel free to post back.

Best Wishes,

Alex Zhang

Answer accepted by question author

Anonymous

Hello, @Allen, Jim

Welcome to the Microsoft Q&A platform!

To see which accounts are actively using Exchange Web Services (EWS) in Exchange Online (EXO), you can use the Exchange Online PowerShell.

Here are the commands and test results:


Connect-ExchangeOnline


Get-CASMailbox | Select-Object DisplayName, EwsEnabled

User's image

For more detailed usage information, you might need to check the Azure AD sign-in logs to see which applications are using EWS.

If the answer is helpful, please click on “Accept answer” as it could help other members of the Microsoft Q&A community who have similar questions and are looking for solutions.

Thank you for your support and understanding.

Best Wishes,

Alex Zhang

Anonymous

2025-03-18T13:09:31.77+00:00

thanks, i understand how to see if it is enabled. I want to know what accounts are actively using EWS? I'd like to see sign-in logs or user activity that shows when EWS is used exclusively, so we know what will occur when EWS is disabled.
Anonymous

2025-03-19T05:37:56.48+00:00

To determine which accounts are actively using Exchange Web Services (EWS), you can indeed check the sign-in logs and user activity to see EWS usage.

You can utilize the Unified Audit Log in the Microsoft 365 Compliance Center. Navigate to "Audit" and search with the activity "EwsAccess" within your desired date range. This will show logs specifying which accounts have been accessing EWS. You can automate this with PowerShell using the Search-UnifiedAuditLog cmdlet to export relevant data into a CSV file for further analysis.

Azure Active Directory (Azure AD) sign-in logs also provide insights into EWS activity. In the Azure portal, go to "Azure Active Directory" > "Sign-ins" and apply filters for "Client App," selecting "Exchange Web Services." Review these logs to identify which users have been logging in via EWS and gather detailed sign-in information.

After gathering data from the Unified Audit Log and Azure AD sign-in logs, you'll be able to pinpoint which users are actively using EWS. With this information, you can communicate with those users and plan for alternative solutions if you decide to disable EWS, ensuring minimal disruption to their workflow.

If the answer is helpful, please click on “Accept answer” as it could help other members of the Microsoft Q&A community who have similar questions and are looking for solutions.

Thank you for your support and understanding.

Best Wishes,

Alex Zhang

1 additional answer

Anonymous

2025-03-21T09:45:33.2866667+00:00

Hello, @Allen, Jim

Is there any update on this thread? If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well. Thanks for your understanding.

Best Wishes,

Alex Zhang
Anonymous

2025-03-26T07:29:05.0733333+00:00

Hello, @Allen, Jim

Just circling back to check to see how things are going on with this thread. If the issue has been resolved, please mark the helpful replies as answers.

Best Wishes,

Alex Zhang
Anonymous

2025-04-01T01:48:30.0366667+00:00

Hello, @Allen, Jim

It has been a long time since your last update.

Just circling back to check to see how things are going on with this thread.

If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well.

Should you need more help on this, you can feel free to post back.

Best Wishes,

Alex Zhang
Anonymous

2025-03-18T13:09:31.77+00:00

thanks, i understand how to see if it is enabled. I want to know what accounts are actively using EWS? I'd like to see sign-in logs or user activity that shows when EWS is used exclusively, so we know what will occur when EWS is disabled.
Anonymous

2025-03-19T05:37:56.48+00:00

To determine which accounts are actively using Exchange Web Services (EWS), you can indeed check the sign-in logs and user activity to see EWS usage.

You can utilize the Unified Audit Log in the Microsoft 365 Compliance Center. Navigate to "Audit" and search with the activity "EwsAccess" within your desired date range. This will show logs specifying which accounts have been accessing EWS. You can automate this with PowerShell using the Search-UnifiedAuditLog cmdlet to export relevant data into a CSV file for further analysis.

Azure Active Directory (Azure AD) sign-in logs also provide insights into EWS activity. In the Azure portal, go to "Azure Active Directory" > "Sign-ins" and apply filters for "Client App," selecting "Exchange Web Services." Review these logs to identify which users have been logging in via EWS and gather detailed sign-in information.

After gathering data from the Unified Audit Log and Azure AD sign-in logs, you'll be able to pinpoint which users are actively using EWS. With this information, you can communicate with those users and plan for alternative solutions if you decide to disable EWS, ensuring minimal disruption to their workflow.

If the answer is helpful, please click on “Accept answer” as it could help other members of the Microsoft Q&A community who have similar questions and are looking for solutions.

Thank you for your support and understanding.

Best Wishes,

Alex Zhang

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more