MC1184649 – M365 Change Digest

One-line summary

Legacy IDCRL authentication in SharePoint Online and OneDrive for Business will be retired; legacy auth blocked Feb 16, 2026, and permanently disabled after May 1, 2026. Migrate to modern auth now.

Similar updates

Details

Summary

Microsoft is retiring the legacy IDCRL authentication protocol in SharePoint Online and OneDrive for Business by May 1, 2026, enforcing modern protocols OpenID Connect and OAuth. Legacy authentication will be blocked starting February 16, 2026, with temporary re-enablement until April 30, 2026. Organizations must migrate promptly.

Body (from Message Center)

Updated May 13, 2026: We have initiated the deprecation rollout and expect to reach 100% production coverage in the next few weeks. We strongly recommend that customers transition to modern authentication at the earliest opportunity. Thank you for your patience.

[Introduction:]

As part of the Microsoft Secure Future Initiative (SFI) and in alignment with the “Secure by Default” principle, we’re retiring the legacy IDCRL (Identity Client Run Time Library) authentication protocol in SharePoint Online and OneDrive for Business. This change helps strengthen your organization’s security posture by enforcing modern authentication standards—OpenID Connect and OAuth—which reduce exposure to outdated and vulnerable authentication methods.

[When this will happen:]

Starting February 16, 2026: Legacy client authentication will be blocked by default. Organizations may temporarily re-enable it using PowerShell until April 30, 2026.
Starting May 1, 2026: Legacy client authentication will be permanently blocked and cannot be re-enabled.

[How this affects your organization:]

Who is affected:

Organizations using clients, scripts, or applications that rely on the legacy IDCRL authentication protocol to access SharePoint Online or OneDrive for Business.

What will happen:

Legacy authentication calls using IDCRL will be blocked by default starting February 16, 2026.
Temporary re-enablement is possible via PowerShell until April 30, 2026.
After May 1, 2026, IDCRL authentication will be permanently retired and cannot be re-enabled.
Applications using IDCRL will fail to authenticate unless updated to use modern protocols.

[What you can do to prepare:]

We recommend migrating from legacy authentication protocols to modern authentication as soon as possible.

To prepare for this retirement:

Migrate all clients, scripts, and applications to use OpenID Connect or OAuth protocols.
Review current configurations for IDCRL authentication.
Notify IT admins, app owners, and security teams about the upcoming retirement.
Update internal documentation to reflect the new authentication defaults.
Use telemetry to identify usage of legacy authentication protocols and monitor migration progress.
Use PowerShell to manage legacy authentication settings if needed:
- Set AllowLegacyAuthProtocolsEnabledSetting and LegacyAuthProtocolsEnabled to TRUE to temporarily allow legacy authentication until April 30, 2026.
Learn more:
- Migrating from IDCRL authentication to modern authentication in SharePoint | Microsoft 365 Developer Blog | Microsoft Dev Blogs
- Set-SPOTenant (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": "2026-01-30T08:00:00Z",
    "ai_action_required_by": null,
    "ai_actions": [
      "Identify applications using IDCRL",
      "Migrate all clients/scripts to OpenID Connect or OAuth",
      "Notify IT and app owners",
      "Update internal documentation",
      "Monitor for legacy auth usage",
      "Use PowerShell for temporary access if needed"
    ],
    "ai_master_tags": [
      "Admin",
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Legacy IDCRL authentication in SharePoint Online and OneDrive for Business will be retired; legacy auth blocked Feb 16, 2026, and permanently disabled after May 1, 2026. Migrate to modern auth now.",
    "ai_topics": [
      "SharePoint",
      "OneDrive"
    ],
    "category": "planForChange",
    "details_map": {
      "Summary": "Microsoft is retiring the legacy IDCRL authentication protocol in SharePoint Online and OneDrive for Business by May 1, 2026, enforcing modern protocols OpenID Connect and OAuth. Legacy authentication will be blocked starting February 16, 2026, with temporary re-enablement until April 30, 2026. Organizations must migrate promptly."
    },
    "id": "MC1184649",
    "importance": 5,
    "is_major_change": true,
    "last_modified": "2026-05-13T16:35:51Z",
    "ms_products": [
      "SharePoint",
      "OneDrive"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "SharePoint Online",
      "Microsoft OneDrive"
    ],
    "severity": "normal",
    "tags": [
      "Updated message",
      "User impact",
      "Admin impact",
      "Retirement"
    ],
    "title": "Microsoft SharePoint: Retirement of IDCRL authentication protocol and enforcement of OpenID Connect and OAuth protocols"
  }
}