MC1184649 – M365 Change Digest

One-line summary

SharePoint Online and OneDrive for Business will block legacy IDCRL authentication by default from Feb 16, 2026; permanent blocking takes effect May 1, 2026. Migrate clients to modern auth protocols.

Similar updates

Details

Summary

Microsoft is retiring the legacy IDCRL authentication protocol in SharePoint Online and OneDrive for Business by May 1, 2026, enforcing modern OpenID Connect and OAuth protocols. Legacy authentication will be blocked starting February 16, 2026, with temporary re-enablement via PowerShell until April 30, 2026. Organizations must migrate to modern authentication.

Body (from Message Center)

Updated February 5, 2026: We have updated the timeline. Thank you for your patience.

[Introduction:]

As part of the Microsoft Secure Future Initiative (SFI) and in alignment with the “Secure by Default” principle, we’re retiring the legacy IDCRL (Identity Client Run Time Library) authentication protocol in SharePoint Online and OneDrive for Business. This change helps strengthen your organization’s security posture by enforcing modern authentication standards—OpenID Connect and OAuth—which reduce exposure to outdated and vulnerable authentication methods.

[When this will happen:]

Starting February 16, 2026: Legacy client authentication will be blocked by default. Organizations may temporarily re-enable it using PowerShell until April 30, 2026.
Starting May 1, 2026: Legacy client authentication will be permanently blocked and cannot be re-enabled.

[How this affects your organization:]

Who is affected:

Organizations using clients, scripts, or applications that rely on the legacy IDCRL authentication protocol to access SharePoint Online or OneDrive for Business.

What will happen:

Legacy authentication calls using IDCRL will be blocked by default starting February 16, 2026.
Temporary re-enablement is possible via PowerShell until April 30, 2026.
After May 1, 2026, IDCRL authentication will be permanently retired and cannot be re-enabled.
Applications using IDCRL will fail to authenticate unless updated to use modern protocols.

[What you can do to prepare:]

We recommend migrating from legacy authentication protocols to modern authentication as soon as possible.

To prepare for this retirement:

Migrate all clients, scripts, and applications to use OpenID Connect or OAuth protocols.
Review current configurations for IDCRL authentication.
Notify IT admins, app owners, and security teams about the upcoming retirement.
Update internal documentation to reflect the new authentication defaults.
Use telemetry to identify usage of legacy authentication protocols and monitor migration progress.
Use PowerShell to manage legacy authentication settings if needed:
- Set AllowLegacyAuthProtocolsEnabledSetting and LegacyAuthProtocolsEnabled to TRUE to temporarily allow legacy authentication until April 30, 2026.
Learn more:
- Migrating from IDCRL authentication to modern authentication in SharePoint | Microsoft 365 Developer Blog | Microsoft Dev Blogs
- Set-SPOTenant (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": "2026-01-30T08:00:00Z",
    "ai_action_required_by": null,
    "ai_actions": [
      "Identify and migrate clients, scripts, and applications using IDCRL to modern auth",
      "Notify relevant teams",
      "Monitor legacy auth usage",
      "Update documentation",
      "Use PowerShell to temporarily re-enable legacy auth if needed until Apr 30, 2026"
    ],
    "ai_master_tags": [
      "Admin",
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "SharePoint Online and OneDrive for Business will block legacy IDCRL authentication by default from Feb 16, 2026; permanent blocking takes effect May 1, 2026. Migrate clients to modern auth protocols.",
    "ai_topics": [
      "SharePoint",
      "OneDrive"
    ],
    "category": "planForChange",
    "details_map": {
      "Summary": "Microsoft is retiring the legacy IDCRL authentication protocol in SharePoint Online and OneDrive for Business by May 1, 2026, enforcing modern OpenID Connect and OAuth protocols. Legacy authentication will be blocked starting February 16, 2026, with temporary re-enablement via PowerShell until April 30, 2026. Organizations must migrate to modern authentication."
    },
    "id": "MC1184649",
    "importance": 5,
    "is_major_change": true,
    "last_modified": "2026-02-05T17:48:51Z",
    "ms_products": [
      "SharePoint",
      "OneDrive"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "SharePoint Online",
      "Microsoft OneDrive"
    ],
    "severity": "normal",
    "tags": [
      "Updated message",
      "User impact",
      "Admin impact",
      "Retirement"
    ],
    "title": "Microsoft SharePoint: Retirement of IDCRL authentication protocol and enforcement of OpenID Connect and OAuth protocols"
  }
}