EWS Sunset Readiness Assessor

EWS Sunset Readiness Assessor is a security-focused, read-only identity and application risk assessment agent that helps organizations prepare for Exchange Web Services (EWS) retirement. It identifies and prioritizes integrations that may rely on EWS, reduces legacy exposure, and accelerates a safer transition to Microsoft Graph through an evidence-based readiness report.

Inputs (what data the agent consumes)

The agent consumes Microsoft Entra signals (via the Microsoft Entra plugin) such as:

• Applications and service principals inventory and details
• Sign-in logs (app/service principal activity indicators)
• Audit logs (directory and app-related events)
• App permissions and granted consents (permission footprint for integration posture)

Tasks (what the agent performs)

• Enumerates applications and service principals relevant to integration assessment
• Correlates sign-in and audit telemetry with app identities and permission grants
• Classifies dependency likelihood as Confirmed / Likely / Suspected using strict evidence rules
• Calculates exposure scoring and readiness prioritization (tenant-safe, bounded analysis)
• Produces retirement impact insights (what is most likely to break if EWS is disabled)
• Builds a Graph-first migration backlog with prioritized remediation steps
• Documents telemetry gaps and confidence drivers for auditability

Outputs (what results the agent generates)

A single consolidated readiness report (structured for both technical teams and leadership), including:

• Executive summary with confidence and top risks
• Observed applications/service principals and their classification (Confirmed/Likely/Suspected)
• Exposure scoring and prioritization drivers
• Retirement impact simulation (confirmed and likely affected integrations)
• Graph-first migration plan (actions, effort, owners, risk)
• Telemetry notes & gaps (missing signals, failures, confidence impact)

Estimated SCU consumption

Estimated consumption for a full assessment run:

Actual SCU usage varies primarily with the number of applications/service principals, sign-in/audit log volume in the lookback window, and how many entities require deeper enrichment during the assessment.

---

Change log

Version: 1.0.2

• Updated the agent setup experience by adding the assessment focus setting required for guided execution.
• Improved scope handling for EWS readiness assessment, Microsoft Entra application analysis, permissions review, sign-in and audit activity, and Microsoft Graph migration planning.