Cross-Tenant Free/Busy After EWS : Migrating to Microsoft 365 Cross-Tenant Access Policy

Introduction

Sharing calendar availability between two Microsoft 365 organizations used to rely on Exchange Organization Relationships. Those relationships depend on Exchange Web Services (EWS), which Microsoft is retiring from Exchange Online. The replacement is the Microsoft 365 Cross-Tenant Access Policy (M365 XTAP), built on Entra ID and managed through Microsoft Graph.

1. Why EWS-Based Sharing Is Now Legacy

Date	Event
September 15, 2026	Free/Busy and MailTips via M365 XTAP rolled out (Worldwide)
October 1, 2026	EWS disablement begins, tenant by tenant
October 15, 2026	Calendar Sharing via M365 XTAP rolled out
April 1, 2027	EWS permanently shut down

Once EWS is disabled in your tenant, partners relying on Organization Relationships or Sharing Policies may lose visibility on your Free/Busy, MailTips, and shared calendars.

Out of scope: internal sharing, and Exchange Hybrid (which must move to the Dedicated Exchange Hybrid App). Setting EWSEnabled to True buys time until April 1, 2027, nothing more.

2. How the New Model Works

M365 XTAP has two layers:

1. Entra cross-tenant trust: a partner entry identified by Tenant ID, with m365CollaborationInbound enabled.
2. M365 capability: the feature exposed to the partner, optionally scoped to a security group.

Three rules to remember:

• It is inbound only. For bidirectional sharing, both tenants configure it.
• No domain lists. The Tenant ID covers all the partner’s domains.
• Legacy wins. An enabled Organization Relationship takes precedence until you disable it.

Legacy FreeBusyAccessLevel	M365 XTAP capability
AvailabilityOnly	crossTenantCalendarAvailabilityBasic (time only)
LimitedDetails	crossTenantCalendarAvailabilityLimitedDetails (time, subject, location)

3. Prerequisites

• Global Administrator for the Entra trust step (Exchange Admin is enough for capabilities)
• Partner Tenant ID
• Microsoft Graph PowerShell SDK (Microsoft.Graph.Identity.SignIns)
• Scopes: Policy.Read.All , Policy.ReadWrite.CrossTenantAccess , Policy.ReadWrite.CrossTenantCapability
• A partner admin ready to configure the mirror policy

4. Check Your Exposure

powershell :

Connect-ExchangeOnline
Get-OrganizationRelationship | Where-Object { $_.Enabled } |
  Format-List Name, DomainNames, FreeBusyAccessEnabled, FreeBusyAccessLevel, FreeBusyAccessScope, TargetSharingEpr

If FreeBusyAccessEnabled is True and the target points to outlook.com or office365.com, you are in scope. Note the access level and scope : they define your new capability and group.

5. Configure with Graph PowerShell

Script source : aymenjaz/PowerShell on GitHub.

Run it in Tenant A with Tenant B’s ID, then the reverse.

6. Validate and Clean Up

Coordinate with the partner admin, then in both tenants:

Set-OrganizationRelationship -Identity "<Name>" -Enabled $false

Test from Outlook’s Scheduling Assistant with a partner user. If it works, remove the legacy object with Remove-OrganizationRelationship. If not, re-enable it with -Enabled $true. Before removal, make sure the relationship is not also used for cross-tenant mailbox migration.

7. Best Practices and Pitfalls

• Default to crossTenantCalendarAvailabilityBasic unless subject and location are required.
• Scope sensitive populations (executives, HR, legal) with a security group.
• Never test with the Organization Relationship still enabled: you would be validating the legacy path.
• Configuring only one tenant gives one-way availability.
• Capability names are case-sensitive.

Conclusion

The EWS retirement turns cross-tenant Free/Busy into an identity policy managed in Entra ID: tenant-ID based, group-scoped, and automatable with Graph. With a quick inventory, a coordinated cutover, and the script above, migrating a partner takes minutes.

Thanks