Microsoft Is Shutting Off an Old Connection Behind Your Email. Here Is What Could Break in October

In January 2024, Microsoft disclosed that a Russian state-sponsored group it tracks as Midnight Blizzard had broken into a small number of its own corporate email accounts. The attackers got in through an old connection, not a new one, and part of what they used was Exchange Web Services, a programming interface Microsoft built back in 2007 to let other software read and send mail on a mailbox's behalf. That break-in did not invent the retirement plan Microsoft had already announced years before, but it turned a slow, low-priority cleanup into a company-wide deadline, and it is why the shutdown now reaches into Microsoft's own products, not just third-party add-ons.

If your business has never written a line of code, this can still land on your desk, because Exchange Web Services is quietly built into a surprising number of ordinary small business tools: the backup product that copies your mailboxes overnight, the multifunction printer that scans straight to an inbox, the CRM that logs sent emails against a customer record, and some older phone and calendar sync apps. None of that has to be exotic or custom-built to be affected, and most owners have no reason to know the plumbing behind those everyday tools has a name, let alone a shutoff date. A properly managed Microsoft 365 tenant should already have this on a checklist; a lot of them do not yet.

Quick answers

Why a break-in at Microsoft became your deadline

Microsoft first told developers it planned to stop investing in Exchange Web Services back in 2018, and it set a firm disablement date for 2023, well before the Midnight Blizzard incident. For years, that gave third-party vendors a slow, unhurried runway to migrate at their own pace, and most small businesses never heard about it because it lived entirely in developer documentation.

The Midnight Blizzard breach changed the priority, not the plan. Once Microsoft's own security team traced part of a nation-state intrusion back to the same old connection method it had already scheduled for retirement, the project stopped being a housekeeping item and became a security mandate that now covers Microsoft's own apps too, including Outlook, Teams and Dynamics 365. The company's own guidance on the incident is public, and it is the clearest evidence that this retirement is a genuine security decision, not an arbitrary cutoff aimed at pushing you toward a newer product for its own sake.

Which of your everyday tools could actually be affected?

Nobody buys "Exchange Web Services" on purpose. It arrives bundled inside other software, so the honest way to answer this question is to look at categories rather than trying to remember a product name. The tools worth checking are the ones that quietly talk to a mailbox in the background:

• Mailbox backup and archiving products that copy Outlook data overnight, particularly older or self-hosted backup agents rather than newer cloud-native ones.
• Multifunction printers and scanners configured to scan directly into a shared inbox, a setup common in small offices that never went through a formal IT rollout.
• CRM and helpdesk software that logs customer emails automatically or lets staff send from within the CRM itself.
• Older mobile device management and calendar sync tools, especially anything set up more than four or five years ago and left untouched since.
• Custom scripts or automations built years ago by a former employee or contractor, often the hardest category to even find, let alone fix.

A Microsoft 365 security assessment typically surfaces this kind of forgotten dependency as a matter of course, precisely because nobody keeps a running inventory of what quietly connects to a mailbox over the years.

The three dates that matter

This retirement applies only to Exchange Online, the cloud mailboxes behind Microsoft 365. If any part of your business still runs an on-premises Exchange server, that side of the setup is not affected by this particular change, though it carries its own separate patching obligations that a Microsoft 365 migration would resolve at the same time.

How to check your own tenant in about ten minutes

You do not need to guess, and you do not need to wait for something to break in October to find out whether it applies to you. Microsoft's admin center already shows, by tenant, exactly which applications have called Exchange Web Services in the past week.

1. Open the Microsoft 365 admin center and go to the EWS Usage Report under activity reports, or reach it directly through admin.cloud.microsoft.
2. Note every application name and account listed. Anything unfamiliar is worth a five-minute search or a call to whoever set it up originally.
3. For each match, check whether the vendor has already published a version that uses Microsoft Graph instead. Most mainstream backup and CRM products released or updated in the last two years already have.
4. For anything custom-built or abandoned by a vendor that no longer exists, treat it as a genuine project with a deadline, not a background task, and plan its replacement now rather than in September 2026.

Businesses without in-house IT tend to discover this list is shorter than they feared, which is the reassuring outcome, or longer and older than they realized, which is the one worth acting on early. Either way, this is exactly the kind of forgotten integration that ongoing managed cloud administration is meant to catch before a vendor's shutdown notice does it for you.

What migration actually looks like for a small business

For most small companies, this is not a rebuild. It is a version check and a reconfiguration, done tool by tool rather than all at once. A backup product that already supports Microsoft Graph usually needs nothing more than a permissions update and a reconnection, not a new backup strategy. A scan-to-email printer often has a firmware update available, or can be pointed at a different, still-supported sending method with a short reconfiguration. The genuinely difficult cases are the custom scripts and one-off integrations nobody has touched since whoever built them left the company, and those are worth flagging early precisely because they take longer to even locate than to fix.

The mistake to avoid is treating this as an IT department problem to revisit later. Microsoft's own phrase for the outcome of doing nothing is blunt: requests are blocked, without exception, once April 2027 arrives. A mailbox backup that silently stops running is far more dangerous than one that visibly fails, because nobody notices until the day a restore is actually needed, and by then the gap in coverage may already be months old.