← Back
Retirement of external access token for actionable messages – moving to Microsoft Entra authentication
MC1189663 · build prod-20251231-200323
Category
planForChange
Severity
normal
Major change
True
Last modified
2025-11-25 00:06:04
Summary source
Azure OpenAI (gpt-4.1)
Action by (Graph)
2026-03-30 07:00:00
Action by (AI)
Services
Microsoft 365 apps
Tags
Admin impact, Retirement
Master tags
Security
Roadmap IDs

One-line summary

External access tokens for actionable messages retire on March 31, 2026; switch integrations to Microsoft Entra authentication to maintain functionality and improve security.

Similar updates

More like this
MC693863 (Updated) Azure ACS retirement in Microsoft 365
(Updated) Azure ACS retirement in Microsoft 365 Azure ACS will retire for SharePoint Online on April 2, 2026; update custom apps and integrations to use Microsoft Entra ID to maintain access. Updated October 3, 2025: This update serves as a reminder that Azure ACS in Microsoft 365 will reti... Since the first use of Azure Access Control Services.
MC1191924 Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection
Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection Microsoft Entra sign-in pages will enforce a stricter Content Security Policy in October 2026, blocking non-Microsoft scripts and injected code to enhance protection against XSS threats. Introduction As part of Microsoft’s Secure Future.
MC1029989 Reminder: "Require approved client app" control in Microsoft Entra Conditional Access will be retired in March 2026
Reminder: "Require approved client app" control in Microsoft Entra Conditional Access will be retired in March 2026 In March 2026, Entra ID and Intune will retire the 'Require approved client app' Conditional Access control; switch to 'Require application protection policy' instead. As mentioned in MC540749, in March 2026, Microsoft Entra ID.
MC1171846 Microsoft Teams: Agent and bot support for Entra authentication in group chats
Microsoft Teams: Agent and bot support for Entra authentication in group chats Agents and bots in Teams group chats can now request Entra authentication, prompting users to install Teams or grant consent as needed; feature enabled by default starting November 3, 2025. Agents and bots in Microsoft Teams group chats will now be able to.
MC1088732 Microsoft Teams: Important updates for Android-based Teams devices – Authentication changes coming soon
Microsoft Teams: Important updates for Android-based Teams devices – Authentication changes coming soon Teams Android devices must update to specified app versions for modern Entra ID authentication by Dec 31, 2025, or risk service disruption; enhanced security features will be e... To enhance security capabilities such as Continuous Access.
MC1024404 (Updated) Microsoft Entra: Browser access will be enabled by default for all Android users
(Updated) Microsoft Entra: Browser access will be enabled by default for all Android users Microsoft Entra ID device registration for Android will become hardware-bound, retiring the Enable Browser Access feature in Authenticator and Company Portal apps; change is automatic. ... Since the device identity will be hardware-bound, we will retire the.

Details

Summary
External access tokens for actionable messages will be retired by March 31, 2026, requiring organizations to switch to Microsoft Entra authentication. This change enhances security and compliance. Organizations should review and update their actionable message integrations before the deadline to avoid failures.

Body (from Message Center)

[Introduction]

We’re retiring the use of external access tokens for actionable messages and transitioning to Microsoft Entra-based authentication. This update enhances security and aligns with modern identity standards, providing a more robust and compliant experience for actionable messages.

[When this will happen]

This change takes effect on March 31, 2026. After this date, external access tokens will no longer be supported.

[How this affects your organization]

Who is affected:

Organizations using actionable messages that currently rely on external access tokens.

What will happen:

  • Actionable messages that depend on external access tokens will fail after March 31, 2026.
  • All integrations and workflows using actionable messages must adopt Microsoft Entra authentication.
  • This change improves security posture by leveraging Entra’s identity and access management capabilities.
[What you can do to prepare]
  • Review all actionable message implementations in your organization.
  • Update integrations to use Microsoft Entra authentication before March 31, 2026.

Learn more:

[Compliance considerations]

No compliance considerations identified, review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.
Show/hide raw
{
  "snapshot_item": {
    "action_required_by": "2026-03-30T07:00:00Z",
    "ai_action_required_by": null,
    "ai_actions": [
      "Review actionable message implementations",
      "Update integrations to use Entra authentication"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "External access tokens for actionable messages retire on March 31, 2026; switch integrations to Microsoft Entra authentication to maintain functionality and improve security.",
    "ai_topics": [
      "Microsoft 365 Apps",
      "Outlook",
      "Entra"
    ],
    "category": "planForChange",
    "details_map": {
      "Summary": "External access tokens for actionable messages will be retired by March 31, 2026, requiring organizations to switch to Microsoft Entra authentication. This change enhances security and compliance. Organizations should review and update their actionable message integrations before the deadline to avoid failures."
    },
    "id": "MC1189663",
    "importance": 5,
    "is_major_change": true,
    "last_modified": "2025-11-25T00:06:04Z",
    "ms_products": [
      "Microsoft 365 Apps"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Microsoft 365 apps"
    ],
    "severity": "normal",
    "tags": [
      "Admin impact",
      "Retirement"
    ],
    "title": "Retirement of external access token for actionable messages \u2013 moving to Microsoft Entra authentication"
  }
}