r/SysAdminBlogs

EWS gets blocked in Exchange Online on October 1. If your tenant still needs it, access is now controlled by an AppID allow-list. Don't build one yourself and Microsoft generates it from the last 60 days of activity, which can quietly misses anything that runs monthly or quarterly.

The usage report only gives you AppIDs, not names. So I wrote two PowerShell scripts: one resolves every AppID from the report to a real app name, the other finds every app that still has EWS permission.

Full write-up with both scripts:

Microsoft has started showing license compliance warnings on the Conditional Access page in Entra ID. If your CA policies protect more users than you have P1 licenses for, you'll now see a warning banner.

The problem is that the license usage blade it links to only shows evaluated users, how many people actually triggered a CA policy last month. But you need a P1 license for every user targeted by a CA policy, whether they signed in or not.

In my dev tenant, the blade shows 2/25. The actual obligation is 114 users. Gap of 89 licenses that doesn't show up anywhere in the admin center.

I added a PowerShell script in the article that pulls your CA policy targeting, counts your P1/P2 licenses across all SKUs, and shows the real gap.

Full article with the script: