SharePoint Azure ACS retirement
Microsoft's edit ·
Microsoft's commit message in SharePoint/sp-dev-docs · commit b3f990c · +71 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Azure ACS retirement in Microsoft 365
3
+description: Describes the details around the retirement of Azure ACS (Access Control Services) for SharePoint Online in Microsoft 365.
4
+ms.date: 11/13/2023
5
+ms.localizationpriority: high
6
+ms.service: sharepoint
7
+---
8
+
9
+# Azure ACS retirement in Microsoft 365
10
+
11
+Microsoft strives to deliver utmost value to our customers through modern, optimized, secure solutions in this newly evolved world focused on digital transformation. As part of this evolution of Microsoft 365 solutions we will be retiring the use of Azure ACS (Access Control Services) for SharePoint Online auth needs and believe Microsoft 365 customers will be better served by modern auth offered via [Microsoft Entra ID](https://learn.microsoft.com/en-us/azure/active-directory/develop/).
12
+
13
+Azure ACS will stop working for new tenants as of November 1st, 2024 and it will stop working for existing tenants and will be fully retired as of April 2nd, 2026. This applies to all environments including Government Clouds and Department of Defense.
14
+
15
+If you are using custom developed applications or are using SharePoint provider hosted Add-Ins, we recommend switching those applications to use Microsoft Entra ID for authorization and authentication needs. Aligned with the Azure ACS retirement also SharePoint Add-Ins are retired, check out this [support article](https://aka.ms/retirement/addins/support) for more information. There will not be an option to extend using Azure ACS with SharePoint Online beyond April 2nd, 2026.
16
+
17
+To learn more about how to migrate Azure ACS usage for SharePoint Online and how to migrate SharePoint Add-Ins to alternative solutions check out these [articles](https://aka.ms/retirement/addins/guidance) and accompanying [videos](https://aka.ms/sp/add-in/modernize/videos).
18
+
19
+## Overview
20
+
21
+### Azure ACS usage in SharePoint Online
22
+
23
+Azure ACS is used in SharePoint Online for providing auth for provider hosted SharePoint Add-Ins plus it’s used to grant applications access to SharePoint Online, optionally using application permissions and granular scopes.
24
+
25
+To learn more about the provider hosted Add-In use case please check out the respective retirement articles, granting applications access to SharePoint Online will need to be transitioned to [Microsoft Entra ID](https://learn.microsoft.com/en-us/azure/active-directory/develop/).
26
+
27
+### Azure ACS usage by SharePoint Server
28
+
29
+SharePoint Server running on-premises can, if configured by the farm admins, depend on Azure ACS for hybrid scenarios (e.g. hybrid search) and low trust auth for custom applications. The retirement of Azure ACS however is not impacting any of the SharePoint on-premises use cases and no action is required from SharePoint on-premises farm admins.
30
+
31
+### Azure ACS usage by Project Online
32
+
33
+Project Online is an extension on top of SharePoint Online and Project Online custom developments could also have used Azure ACS. The retirement of Azure ACS applies to Project Online as well, any Azure ACS usage in Project Online will follow the same retirement path as Azure ACS usage in SharePoint Online.
34
+
35
+## Call to Action Guidance
36
+
37
+### Microsoft 365 Assessment tool
38
+
39
+To understand if your organization is using Azure ACS or begin planning transition to Microsoft Entra ID, we recommend that customers run the [Microsoft 365 Assessment tool](https://aka.ms/assessment/addinsacs) to scan their tenants for Azure ACS usage. Using the Power BI [Azure ACS Report](https://aka.ms/assessment/addinsacsreport) generated by the scanner tool, you can:
40
+
41
+- Identify all used Azure ACS application principals with their key properties such as permission scopes and whether app-only was allowed or not
42
+- For each identified Azure ACS application principal see a list of all sites that can be accessed via the Azure ACS application principal
43
+
44
+Using the Azure ACS Report along with site information, tenant administrators together with developers can plan the transition of Azure ACS to Microsoft Entra ID as authentication model.
45
+
46
+### Turn off the use of Azure ACS on your tenant
47
+
48
+We recommend tenant admins to turn off the usage of Azure ACS app-only access once they’ve ensured there is no business relevant Azure ACS usage anymore. The assessment tool should give administrators the usage information to understand where and when Azure ACS principals are being used.
49
+
50
+```PowerShell
51
+Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
52
+Set-SPOTenant -DisableCustomAppAuthentication $true
53
+```
54
+
55
+This setting will not impact the Azure ACS usage by SharePoint provider hosted Add-Ins. You can use the same command to re-enable the usage Azure ACS app-only access if required.
56
+
57
+## How do I get help?
58
+
59
+You can use the following services and partner programs to help with your migration from SharePoint Azure ACS:
60
+
61
+- [Microsoft Solution Provider](https://www.microsoft.com/en-us/solution-providers/home)
62
+- Help on SharePoint Assessment tool: Open a support ticket
63
+
64
+## More information
65
+
66
+- Friendly link to the blog post: https://aka.ms/retirement/acs/update
67
+- Friendly link to this article: https://aka.ms/retirement/acs/support
68
+- Friendly link to SharePoint Add-In retirement article: https://aka.ms/retirement/addins/support
69
+- Friendly link to Migration Guidance: https://aka.ms/retirement/acs/guidance
70
+
71
+A Message Center post in the Microsoft 365 admin center is being sent to all tenants, and the post will be updated periodically with timelines.
Microsoft's Markdown source from SharePoint/sp-dev-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:29 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.