User-Agent string of CodeTwo apps in Exchange Online

Problem:

You need a User Agent string of a CodeTwo application to create an "allow list" – a list of Entra ID applications that will be able to use Exchange Web Services (EWS) in your Microsoft 365 organization.

Solution:  

All CodeTwo apps have a similar User Agent string: ExchangeServicesClient/<version no.>. A Microsoft 365 admin with access to Exchange online can use the following cmdlet and the ExchangeServicesClient/* wildcard to add all CodeTwo apps to the list:

Set-OrganizationConfig -EwsApplicationAccessPolicy:EnforceAllowList -EwsAllowList:"ExchangeServicesClient/*" 

However, if there are other, non-CodeTwo apps that use a similar User Agent string, they will also be allowed to use EWS. If that's not acceptable, you can use a program-specific User Agent instead. Here are the current ones:

• CodeTwo Email Signatures On-prem / CodeTwo Exchange Rules family of products (applies to the Sent Items Update service): ExchangeServicesClient/15.00.0913.015
• CodeTwo Office 365 Migration / CodeTwo Exchange Migration: ExchangeServicesClient/1.2.5.0
• CodeTwo Backup: ExchangeServicesClient/1.2.6.0

Keep in mind that using User Agent is not a recommended way to control EWS access, as it is possible to spoof a User Agent, as specified in this Microsoft article. The most reliable way to control the use of EWS in your organization is to use a specific list of app IDs (EWSAllowedAppIDs). Starting from October 1, 2026, even if you use the Allow List described above, you also need to whitelist an application by using its app ID.

There are multiple ways to block or allow the use of EWS in your tenant. Learn more about how they work in this knowledge base article.

See also:

Microsoft's article on controlling access to EWS in Exchange