Microsoft SharePoint: Retirement of IDCRL authentication protocol and enforcement of OpenID Connect and OAuth protocols

Introduction:

As part of the Microsoft Secure Future Initiative (SFI) and in alignment with the “Secure by Default” principle, we’re retiring the legacy IDCRL (Identity Client Run Time Library) authentication protocol in SharePoint Online and OneDrive for Business. This change helps strengthen your organization’s security posture by enforcing modern authentication standards—OpenID Connect and OAuth—which reduce exposure to outdated and vulnerable authentication methods.

When this will happen:

• Starting January 31, 2026: Legacy client authentication will be blocked by default. Organizations may temporarily re-enable it using PowerShell until April 30, 2026.
• Starting May 1, 2026: Legacy client authentication will be permanently blocked and cannot be re-enabled.

How this affects your organization:

Who is affected:

• Organizations using clients, scripts, or applications that rely on the legacy IDCRL authentication protocol to access SharePoint Online or OneDrive for Business.

• Legacy authentication calls using IDCRL will be blocked by default starting January 31, 2026.
• Temporary re-enablement is possible via PowerShell until April 30, 2026.
• After May 1, 2026, IDCRL authentication will be permanently retired and cannot be re-enabled.
• Applications using IDCRL will fail to authenticate unless updated to use modern protocols.

What you can do to prepare:

We recommend migrating from legacy authentication protocols to modern authentication as soon as possible. 

To prepare for this retirement:

• Migrate all clients, scripts, and applications to use OpenID Connect or OAuth protocols. 
• Review current configurations for IDCRL authentication.
• Notify IT admins, app owners, and security teams about the upcoming retirement.
• Update internal documentation to reflect the new authentication defaults.
• Use telemetry to identify usage of legacy authentication protocols and monitor migration progress.
• Use PowerShell to manage legacy authentication settings if needed:
  • Set AllowLegacyAuthProtocolsEnabledSetting and LegacyAuthProtocolsEnabled to TRUE to temporarily allow legacy authentication until April 30, 2026.
• Learn more:
  • Migrating from IDCRL authentication to modern authentication in SharePoint | Microsoft 365 Developer Blog | Microsoft Dev Blogs
  • Set-SPOTenant (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn

Compliance considerations:

No compliance considerations identified, review as appropriate for your organization.