MC1184649 – M365 Change Digest

One-line summary

Legacy IDCRL authentication in SharePoint Online and OneDrive for Business will be blocked by default on Jan 31, 2026, and permanently retired on May 1, 2026; migrate to modern authentication protocols.

Similar updates

Details

Summary

Microsoft is retiring the legacy IDCRL authentication protocol in SharePoint Online and OneDrive for Business by January 31, 2026, enforcing modern OpenID Connect and OAuth protocols. Legacy authentication will be blocked by default, with temporary re-enablement via PowerShell until April 30, 2026, and permanent retirement from May 1, 2026. Organizations should migrate to modern authentication promptly.

Body (from Message Center)

Updated December 9, 2025: We are updating this post as a reminder. Thank you for your patience.

[Introduction:]

As part of the Microsoft Secure Future Initiative (SFI) and in alignment with the “Secure by Default” principle, we’re retiring the legacy IDCRL (Identity Client Run Time Library) authentication protocol in SharePoint Online and OneDrive for Business. This change helps strengthen your organization’s security posture by enforcing modern authentication standards—OpenID Connect and OAuth—which reduce exposure to outdated and vulnerable authentication methods.

[When this will happen:]

Starting January 31, 2026: Legacy client authentication will be blocked by default. Organizations may temporarily re-enable it using PowerShell until April 30, 2026.
Starting May 1, 2026: Legacy client authentication will be permanently blocked and cannot be re-enabled.

[How this affects your organization:]

Who is affected:

Organizations using clients, scripts, or applications that rely on the legacy IDCRL authentication protocol to access SharePoint Online or OneDrive for Business.

What will happen:

Legacy authentication calls using IDCRL will be blocked by default starting January 31, 2026.
Temporary re-enablement is possible via PowerShell until April 30, 2026.
After May 1, 2026, IDCRL authentication will be permanently retired and cannot be re-enabled.
Applications using IDCRL will fail to authenticate unless updated to use modern protocols.

[What you can do to prepare:]

We recommend migrating from legacy authentication protocols to modern authentication as soon as possible.

To prepare for this retirement:

Migrate all clients, scripts, and applications to use OpenID Connect or OAuth protocols.
Review current configurations for IDCRL authentication.
Notify IT admins, app owners, and security teams about the upcoming retirement.
Update internal documentation to reflect the new authentication defaults.
Use telemetry to identify usage of legacy authentication protocols and monitor migration progress.
Use PowerShell to manage legacy authentication settings if needed:
- Set AllowLegacyAuthProtocolsEnabledSetting and LegacyAuthProtocolsEnabled to TRUE to temporarily allow legacy authentication until April 30, 2026.
Learn more:
- Migrating from IDCRL authentication to modern authentication in SharePoint | Microsoft 365 Developer Blog | Microsoft Dev Blogs
- Set-SPOTenant (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": "2026-01-30T08:00:00Z",
    "ai_action_required_by": null,
    "ai_actions": [
      "Migrate clients and apps to OpenID Connect or OAuth",
      "Review and update configurations using IDCRL",
      "Notify IT and app owners",
      "Update internal documentation",
      "Monitor legacy protocol usage",
      "Use PowerShell to manage legacy auth if needed"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Legacy IDCRL authentication in SharePoint Online and OneDrive for Business will be blocked by default on Jan 31, 2026, and permanently retired on May 1, 2026; migrate to modern authentication protocols.",
    "ai_topics": [
      "SharePoint",
      "OneDrive"
    ],
    "category": "planForChange",
    "details_map": {
      "Summary": "Microsoft is retiring the legacy IDCRL authentication protocol in SharePoint Online and OneDrive for Business by January 31, 2026, enforcing modern OpenID Connect and OAuth protocols. Legacy authentication will be blocked by default, with temporary re-enablement via PowerShell until April 30, 2026, and permanent retirement from May 1, 2026. Organizations should migrate to modern authentication promptly."
    },
    "id": "MC1184649",
    "importance": 5,
    "is_major_change": true,
    "last_modified": "2025-12-09T17:47:23Z",
    "ms_products": [
      "SharePoint",
      "OneDrive"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "SharePoint Online",
      "Microsoft OneDrive"
    ],
    "severity": "normal",
    "tags": [
      "Updated message",
      "User impact",
      "Admin impact",
      "Retirement"
    ],
    "title": "Microsoft SharePoint: Retirement of IDCRL authentication protocol and enforcement of OpenID Connect and OAuth protocols"
  }
}