Microsoft Announces Retirement of OWA Light Client in Exchange Server
What Happened — Microsoft confirmed that the lightweight Outlook Web Access (OWA) Light client will be disabled and removed from on‑premises Exchange Server in an update slated for August 2026. The change follows a deprecation that began in August 2024 and reflects a shift toward the full Outlook on the web experience.
Why It Matters for Compliance & Audit Readiness
- Legacy interfaces expand the attack surface; retiring OWA Light aligns with SOC 2 control CC6.1 (System Operations) and CC7.1 (Change Management) by reducing unnecessary code paths.
- The deprecation requires documented configuration changes; continuous evidence of the “Set‑OwaMailboxPolicy –OwaLightEnabled $false” command can serve as audit‑ready proof of control enforcement.
- Organizations must map this product‑life‑cycle event to their control inventory to demonstrate due diligence and maintain a defensible audit trail.
Who Is Affected – Enterprises and service providers that run on‑premises Exchange Server and still enable OWA Light for low‑bandwidth or kiosk scenarios (e.g., healthcare, finance, government, education).
Recommended Actions
- Inventory all Exchange Server mailboxes and verify whether OWA Light is enabled.
- Execute the recommended PowerShell commands to disable OWA Light immediately.
- Update your configuration‑management database (CMDB) and SOC 2 control mappings to reflect the removal of the legacy client.
- Capture the PowerShell execution logs as continuous compliance evidence for future audits.
Source: BleepingComputer
Technical Notes – The retirement is a product‑deprecation, not a vulnerability. No CVEs are associated. OWA Light lacks many modern security features (e.g., MFA enforcement, conditional access) that are present in the full Outlook on the web client. Source: same as above