Ews

October 2026 for Microsoft admins: what changed on the 1st, and what ends on Patch Tuesday

Tomorrow is Patch Tuesday, and this one is more than a batch of fixes. Several products get their last update on the same day, three things already changed on 1 October, and a Secure Boot certificate expires six days later. Here is the month as a list, with what to check for each.

Already happened: 1 October

Exchange Web Services is off by default

Exchange Online now blocks Exchange Web Services (EWS) unless the tenant has asked for it to stay on. Microsoft’s message to admins was: “Beginning October 1, 2026, EWS will be blocked unless the tenant configures an AppID AllowList”, and without one “Microsoft will set EWSEnabled=False and EWS apps will stop working.” [1]