You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[Outlook](legacy tokens) Revised timeline for turning off Exchange tokens (#5017)
* new question on deployment guidance
* add more specific timeline information
* add details on command behaviors
* incorporate review feedback
* fix link
* Apply suggestions from code review
Co-authored-by: Linda Cannon <[email protected]>
---------
Co-authored-by: Linda Cannon <[email protected]>
Copy file name to clipboardExpand all lines: docs/outlook/faq-nested-app-auth-outlook-legacy-tokens.md
+42-11Lines changed: 42 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,12 +4,12 @@ description: Nested app authentication and Outlook legacy tokens deprecation FAQ
4
4
ms.service: microsoft-365
5
5
ms.subservice: add-ins
6
6
ms.topic: faq
7
-
ms.date: 01/31/2025
7
+
ms.date: 02/03/2025
8
8
---
9
9
10
10
# Nested app authentication and Outlook legacy tokens deprecation FAQ
11
11
12
-
Exchange [user identity tokens](authentication.md#exchange-user-identity-token) and [callback tokens](authentication.md#callback-tokens) are deprecated and will be turned off starting in February 2025. We recommend moving Outlook add-ins that use legacy Exchange tokens to nested app authentication.
12
+
Exchange [user identity tokens](authentication.md#exchange-user-identity-token) and [callback tokens](authentication.md#callback-tokens) are deprecated and will be turned off starting February 17th, 2025. We recommend moving Outlook add-ins that use legacy Exchange tokens to nested app authentication.
13
13
14
14
## General FAQ
15
15
@@ -19,14 +19,20 @@ Nested app authentication enables single sign-on (SSO) for applications nested i
19
19
20
20
### What is the timeline for shutting down legacy Exchange online tokens?
21
21
22
-
Microsoft begins turning off legacy Exchange online tokens in February 2025. From now until February 2025, existing and new tenants will not be affected. We'll provide tooling for administrators to reenable Exchange tokens for tenants and add-ins if those add-ins aren't yet migrated to NAA. See [Can I turn legacy tokens back on?](#can-i-turn-exchange-online-legacy-tokens-back-on) for more information.
22
+
Microsoft begins turning off legacy Exchange online tokens starting February 17th 2025. From now until February 17th 2025, existing and new tenants will not be affected. We've provided tooling for administrators to reenable Exchange tokens for tenants and add-ins if those add-ins aren't yet migrated to NAA. See [Can I turn legacy tokens back on?](#can-i-turn-exchange-online-legacy-tokens-back-on) for more information.
| Feb 2025 | Legacy tokens turned off for all tenants. Admins can reenable legacy tokens via PowerShell. |
26
+
| Feb 17th, 2025 | Legacy tokens turned off for all tenants. Admins can reenable legacy tokens via PowerShell. |
27
27
| Jun 2025 | Legacy tokens turned off for all tenants. Admins can no longer reenable legacy tokens via PowerShell and must contact Microsoft for any exception. |
28
28
| Oct 2025 | Legacy tokens turned off for all tenants. Exceptions are no longer allowed. |
29
29
30
+
#### What happens on February 17th?
31
+
32
+
Microsoft will begin deploying a change to all users worldwide in Microsoft 365 tenants that will turn off the issuance of legacy Exchange online tokens. The deployment will take several weeks to deploy to all users. If an Outlook add-in requests a legacy Exchange token, and token issuance is turned off, the add-in will receive an error. Outlook add-ins that still request legacy Exchange Online tokens will be broken by this change. Please note that even after legacy tokens are turned off, legacy tokens previously issued will continue to be valid for up to an hour.
33
+
34
+
Note that since the change is applied per user, and deployed over several weeks, you could see some users affected while others are not. If you need to opt out of this change, see [Can I turn legacy tokens back on?](#can-i-turn-exchange-online-legacy-tokens-back-on)
35
+
30
36
### When is NAA generally available for my channel?
31
37
32
38
The general availability (GA) date for NAA depends on which channel you are using.
@@ -35,9 +41,16 @@ The general availability (GA) date for NAA depends on which channel you are usin
| Nov 2024 | NAA is GA in Monthly Enterprise Channel. |
38
-
| Jan 2025 | NAA will GA in Semi-Annual Channel. |
44
+
| Jan 2025 | NAA is GA in Semi-Annual Channel build 16.0.17928.20392. |
39
45
| Jun 2025 | NAA will GA in Semi-Annual Extended Channel. |
40
46
47
+
### How do I handled legacy tokens turned off in Semi-Annual Extended Channel, which doesn't support NAA yet?
48
+
49
+
Semi-Annual Extended Channel won't support NAA until June 2025. This means even if add-ins are updated to support NAA, and no longer use legacy Exchange Online tokens, they won't function on this channel. If you are using Semi-Annual Extended Channel as an administrator, we recommend the following.
50
+
51
+
- Check if your tenant is using any add-ins that require legacy Exchange Online tokens. For more information, see [Find Outlook add-ins that use legacy Exchange Online tokens](https://github.com/OfficeDev/office-js/tree/release/add-in-ids).
52
+
- If you have deployed add-ins that require legacy Exchange Online tokens, and the add-ins are necessary for your organization, we recommend you turn on tokens now so that they are not turned off after February 17th, 2025. To turn tokens on, see [Turn legacy Exchange Online tokens on or off](turn-exchange-tokens-on-off.md).
53
+
41
54
### Are COM Add-ins affected by the deprecation of legacy Exchange Online tokens?
42
55
43
56
It's very unlikely any COM add-ins are affected by the deprecation of legacy Exchange Online tokens. Outlook web add-ins are primarily affected because they can use Office.js APIs that rely on Exchange tokens. For more information, see [How do i know if my outlook add in relies on legacy tokens](#how-do-i-know-if-my-outlook-add-in-relies-on-legacy-tokens). The Exchange tokens are used to access Exchange Web Services (EWS) or Outlook REST APIs, both of which are also deprecated. If you suspect a COM add-in might be affected, you can test it by using it on a tenant with Exchange tokens turned off. For more information, see [Turn legacy Exchange Online tokens on or off](turn-exchange-tokens-on-off.md).
@@ -48,11 +61,11 @@ It's very unlikely any COM add-ins are affected by the deprecation of legacy Exc
48
61
49
62
Yes, there are PowerShell commands you can use to turn legacy tokens on or off in any tenant. For more information on how to turn legacy tokens on or off, see [Turn legacy Exchange Online tokens on or off](turn-exchange-tokens-on-off.md). If you use the commands to enable legacy Exchange Online tokens, they will not be turned off in February 2025. They will remain on until June 2025, or until you use the tooling to turn them off.
50
63
51
-
In June 2025, legacy tokens will be turned off and you won't be able to turn them back on without a specific exception granted by Microsoft. In October 2025, it won't be possible to turn on legacy tokens and they'll be disabled for all tenants. We'll update this FAQ with additional information once the tool is available.
64
+
In June 2025, legacy tokens will be turned off and you won't be able to turn them back on without a specific exception granted by Microsoft. In October 2025, it won't be possible to turn on legacy tokens and they'll be disabled for all tenants. We'll update this FAQ with additional information once the exception process is ready.
52
65
53
66
### How does the admin consent flow work?
54
67
55
-
Independant software vendors (ISVs) are updating their add-ins to use Entra ID tokens and Microsoft Graph scopes. When the add-in requests an access token, it must have admin or user consent. If the administrator consents, all users on the tenant can use the add-in for the scopes the add-in requires. Otherwise, each end-user will be prompted for consent, if [user consent is enabled](/microsoft-365/admin/misc/user-consent). Completing admin consent provides a better experience because the users aren't prompted.
68
+
Independent software vendors (ISVs) are updating their add-ins to use Entra ID tokens and Microsoft Graph scopes. When the add-in requests an access token, it must have admin or user consent. If the administrator consents, all users on the tenant can use the add-in for the scopes the add-in requires. Otherwise, each end-user will be prompted for consent, if [user consent is enabled](/microsoft-365/admin/misc/user-consent). For a better experience because the users aren't prompted, complete admin consent.
56
69
57
70
One option for consent is that the ISV provides you with an admin consent URI.
58
71
@@ -93,10 +106,12 @@ If you rely on an ISV for your add-in, we recommend you contact them as soon as
93
106
94
107
Once the admin or a user consents, it will be listed in the Microsoft Entra admin center. You can find app registrations using the following steps.
95
108
96
-
1. Go to [https://entra.microsoft.com/#home](https://entra.microsoft.com/#home).
97
-
1. In the left navigation pane, select **Applications** > **App registrations**.
98
-
1. On the **App registrations** page, select **All applications**.
99
-
1. Now you can search for any app registration by name or ID.
109
+
1. Go to [https://entra.microsoft.com/#home](https://entra.microsoft.com/#home) and sign in as admin on your tenant.
110
+
1. In the left navigation pane, select **Applications** > **Enterprise applications**.
111
+
1. On the **Enterprise applications** page, in the **Manage** section, select **All applications**.
112
+
1. Select the Add-in. This will open an overview page.
113
+
In the overview page, select **Permissions**.
114
+
There are two views for permissions; Admin consent, and User consent. Select User consent to see any individual consents.
100
115
101
116
### Is there a list of publishers that have updated their add-ins?
102
117
@@ -254,6 +269,22 @@ It's very important that you always request an access token to your own services
254
269
255
270
You can determine if the signed-in user has an Exchange Online account or on-premise Exchange account by using the [Office.UserProfile.accountType](/javascript/api/outlook/office.userprofile) property. If the account type property value is **enterprise**, then the mailbox is on an on-premises Exchange server. Note that volume-licensed perpetual Outlook 2016 doesn’t support the **accountType** property. To work around this, call the [ResolveNames](/exchange/client-developer/web-service-reference/resolvenames-operation) operation in Exchange Web Service (EWS) in the Exchange on-premise server to get the recipient types.
256
271
272
+
## How do I deploy my add-in to Microsoft AppSource
273
+
274
+
If you're publishing a new add-in to Microsoft AppSource, it will need to go through a certification process. For more information, see [Publish your Office Add-in to Microsoft AppSource](../publish/publish-office-add-ins-to-appsource.md). If you're updating the manifest of an add-in that is already published to Microsoft AppSource, you need to go through the certification process again. You can update the add-in's source code on your web server any time without a need to go through the certification process.
275
+
276
+
If you're add-in uses SSO through NAA, your add-in must be in compliance with the following publishing guidelines.
Be sure to handle admin consent properly. See [Publish an add-in that requires admin consent for Microsoft Graph scopes](../publish/publish-nested-app-auth-add-in.md)
282
+
283
+
For more important details, see [Make your solutions available in Microsoft AppSource and within Office](/partner-center/marketplace-offers/submit-to-appsource-via-partner-center).
284
+
If you update your add-in (change the manifest) you need to go through the certification process again.
285
+
You can update your web server code any time without a need for review.
286
+
287
+
257
288
## Related content
258
289
259
290
-[Enable SSO in an Office Add-in using nested app authentication](../develop/enable-nested-app-authentication-in-your-add-in.md).
Copy file name to clipboardExpand all lines: docs/outlook/turn-exchange-tokens-on-off.md
+16-9Lines changed: 16 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,12 +4,12 @@ description: Turn legacy Exchange Online tokens on or off
4
4
ms.service: microsoft-365
5
5
ms.subservice: add-ins
6
6
ms.topic: how-to
7
-
ms.date: 01/24/2025
7
+
ms.date: 02/03/2025
8
8
---
9
9
10
10
# Turn legacy Exchange Online tokens on or off
11
11
12
-
Legacy Exchange Online tokens are deprecated and will begin being turned off across Microsoft 365 tenants in February 2025. If you are a developer migrating your Outlook add-in from legacy tokens to Entra ID tokens and nested app authentication, you'll need to test updates to your add-in. You can use the Exchange Online PowerShell cmdlets to turn legacy tokens on or off. Turn off legacy tokens in a test tenant to confirm that your updated Outlook add-in is working correctly.
12
+
Legacy Exchange Online tokens are deprecated and will be turned off across Microsoft 365 tenants starting February 17th, 2025. If you're a developer migrating your Outlook add-in from legacy tokens to Entra ID tokens and nested app authentication, you'll need to test updates to your add-in. Use the Exchange Online PowerShell cmdlets to turn off legacy tokens in a test tenant to confirm that your updated Outlook add-in is working correctly.
13
13
14
14
For more information about deprecation of legacy Exchange Online tokens, see [Nested app authentication and Outlook legacy tokens deprecation FAQ](https://aka.ms/NAAFAQ).
15
15
@@ -30,7 +30,7 @@ To turn legacy tokens off, run the following command.
The `-Identity` parameter must be set to `LegacyExchangeTokens`. The command turns off legacy tokens for the entire tenant. If an Outlook add-in requests a legacy token, it won’t be issued a token.
33
+
The command turns off legacy tokens for the entire tenant. If an Outlook add-in requests a legacy token, it won’t be issued a token.
34
34
35
35
> [!NOTE]
36
36
> If you've confirmed that your tenant is not using any add-ins that require legacy Exchange Online tokens, we recommend you turn off legacy Exchange Online tokens as a security best practice. For more information on how to determine if you tenant has add-ins using legacy tokens, see the [Nested app authentication and Outlook legacy tokens deprecation FAQ](faq-nested-app-auth-outlook-legacy-tokens.md).
@@ -41,13 +41,12 @@ To turn legacy tokens on, run the following command. It can take up to 24 hours
The `-Identity` parameter must be set to `LegacyExchangeTokens`. You’ll only be able to turn tokens back on until June 2025 when all legacy tokens in all tenants will be forced off. For more information, see the [Nested app authentication and Outlook legacy tokens deprecation FAQ](https://aka.ms/NAAFAQ).
44
+
Important notes about this command.
45
45
46
-
> [!NOTE]
47
-
> It might take up to 24 hours for the change to take effect across your entire organization. Legacy Exchange tokens issued to Outlook add-ins before token blocking was implemented in your organization will remain valid until they expire.
48
-
49
-
> [!NOTE]
50
-
> If you turn on legacy Exchange Online tokens, then they won't be turned off in February 2025 when Microsoft turns them off for all tenants. For more information, see [Nested app authentication and Outlook legacy tokens deprecation FAQ](faq-nested-app-auth-outlook-legacy-tokens.md).
46
+
- Legacy Exchange tokens issued to Outlook add-ins before token blocking was implemented in your organization will remain valid until they expire.
47
+
- If you turn on legacy Exchange Online tokens, then they won't be turned off in February 2025 when Microsoft turns them off for all tenants. For more information, see [Nested app authentication and Outlook legacy tokens deprecation FAQ](faq-nested-app-auth-outlook-legacy-tokens.md).
48
+
- You’ll only be able to turn tokens back on until June 2025 when all legacy tokens in all tenants will be forced off. For more information, see the [Nested app authentication and Outlook legacy tokens deprecation FAQ](https://aka.ms/NAAFAQ).
49
+
- Although the `-Identity` parameter is required, it doesn't affect any specific authentication policy. The command always applies to the entire organization regardless of what value you use. We show the value as `LegacyExchangeTokens` in the examples to keep the intent clear.
51
50
52
51
## Get the status of legacy Exchange Online tokens
53
52
@@ -68,6 +67,14 @@ PS C:\>
68
67
> [!NOTE]
69
68
> The previous command is the only way to view legacy token status. Other commands, such as `Get-AuthenticationPolicy | Format-Table -Auto Name` don't return the legacy token status.
70
69
70
+
This command only shows the legacy token status as set by the administrator. If the administrator has never changed the settings, the command returns `(Not Set)`. If the token status is `(Not Set)` when the February deployment by Microsoft to turn off legacy tokens is implemented, the token status will still be `(Not Set)` even though legacy tokens are off. The following table shows the behavior of legacy Exchange Online tokens based on the token status when the change is applied.
71
+
72
+
| Legacy token admin setting | Legacy token behavior before February change | Legacy token behavior after February change | Legacy token behavior after June change |
0 commit comments