# EWS Access

> Enable Exchange Web Services (EWS) access to mailbox.

Enable Exchange Web Services (EWS) access to mailbox. This allows consented third party Apps to access mailbox data.

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline applies per user, through a user-level scheme or an Azure group rather than to
the tenant as a whole.

1. Add it directly to a user or an Azure group ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or
   bundle it into a user-level scheme and deploy that to many users or groups at once
   ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). See [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/) for how
   Octiga resolves which value a user gets when a Direct value, a scheme and a group all
   supply one.
2. Leave **EWS access** set to On. It's the only setting on this baseline, and it
   controls whether the mailbox accepts Exchange Web Services connections: the API used
   to read the mailbox by Outlook for Mac, older Outlook builds and any third-party app
   the user has consented to.
3. Save. With **Auto-remediation** on, Octiga switches EWS access back on whenever it's
   disabled for a user the baseline applies to, and any app or client relying on it
   regains access without anyone having to notice or ask.

## Check it worked

Passing means EWS access is enabled for the mailbox. Microsoft exposes this setting only
through Exchange Online PowerShell (`Get-CASMailbox` and `Set-CASMailbox`), which is how
Octiga reads and writes it; there's no admin-centre page for it. To check it yourself, run
`Get-CASMailbox -Identity <user> | Format-List EwsEnabled`. On the user roster or a group's
member list, Passing shows as a green dot for this baseline; Deviated (red) means it's
currently off; Excluded (grey) means the user or tenant isn't licensed for Exchange Online.
When access is off, any EWS-dependent app (Outlook for Mac, an older Outlook build, or a
consented third-party integration) loses access to the mailbox, while Outlook on the web and
Outlook desktop over MAPI keep working.

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)