Get-EwsAppReadiness

READ-ONLY: this script changes nothing in your tenant. It only runs Get-* cmdlets and Graph GET requests.

 1. Tenant state (always): EwsEnabled, the EwsAllowedAppIDs allow list, the older user-agent policy
    (EwsApplicationAccessPolicy / EwsAllowList) and how many mailboxes have EWS turned off.
 2. -UsageCsv: the CSV you export from Microsoft 365 admin center > Reports > Usage > Exchange > EWS usage
    (Application ID, SOAP Action, Call Volume, Last Activity). This is what tells you which apps really call EWS.
 3. -ResolveNames: looks up each app ID in Microsoft Entra (Microsoft Graph, Application.Read.All) to get its
    name and publisher.

Every app is matched against a list of known apps with the vendor's own statement about Microsoft Graph
(Apple Mail, Outlook, Teams Rooms, Veeam, Mimecast, AvePoint, CodeTwo, Exclaimer, MigrationWiz and more).

It writes EwsApps-<date>.csv and EwsApps-<date>.html and prints a Set-OrganizationConfig -EwsAllowedAppIDs
command that merges your current list with the apps in use. The command is printed, never run: review it,
because setting the property replaces the whole list.