EWS is a built-in component that is almost always enabled. It is a service that enables other applications and services to communicate with Exchange to obtain mailbox information such as calendaring and contact data. It can also be used for bulk data requests, such as moving data out of a mailbox during a migration. Users are usually unaware of EWS and are not familiar with it or what it provides.

While EWS is almost always enabled, it can be disabled (or not configured and thus not functional). Thus, if you are having EWS issues across your organization, you should find out if EWS is enabled at the organization level. To do so, run the Get-OrganizationConfig | Select EwsEnabled command. To enable EWS, run the Set-OrganizationConfig -EwsEnabled $True command. Beyond configuring EWS at the organization level, you can also configure it at the mailbox level. If you run into issues with a few (or just one) app or users having issues with EWS, you should look at the mailbox level to find out if EWS is disabled (not that if it isn’t configured, then the organization settings take precedence). If a user named Beth reports issues testing her app with EWS, check her mailbox by running the Get-CASMailbox Beth | Select EwsEnabled command. If it is blank or set to True and the organization level is enabled, then you don’t need to take further action. However, if EwsEnabled is set to False, then you should run the Set-CASMailbox Beth -EwsEnabled $Null command (optionally, you can also set EwsEnabled to $True to ensure that EWS is enabled for Beth, even if EWS later becomes disabled at the organization level).

After you’ve checked whether EWS is enabled, you can use the Remote Connectivity Analyzer to gather additional troubleshooting information. The Remote Connectivity Analyzer has two dedicated tests for EWS, as shown in the screen capture below.

The Synchronization, Notification, Availability, and Automatic Replies test performs EWS tasks to figure out if EWS is healthy. The Service Account Access (Developers) test uses a specified service account to test access. It is primarily used to validate the credentials and the service account rights.