SharePoint ACS Is Being Retired on April 2, 2026. Here's How to Migrate to Entra ID.

What is ACS and why is it being retired?

Azure Access Control Service (ACS) is a legacy authentication service that allowed SharePoint Add-ins to obtain app-only access tokens. If you ever used the SharePoint pages /_layouts/15/appregnew.aspx to register an application and /_layouts/15/appinv.aspx to grant it permissions, you used ACS.

Important: ACS is not just about app-only tokens. Provider-hosted add-ins that run in a user context (user+app tokens) also go through ACS. If your frontend application redirects users through ACS to get a SharePoint access token, that flow will break too. Both app-only and user+app scenarios need to be migrated.

ACS was the standard approach for years. It was simple: you got a Client ID and Client Secret, and your code used those to obtain tokens. The problem? ACS is an old, limited service:

• Tenant-wide permissions only — you cannot scope access to specific site collections
• Client secrets expire — and when they do, your integration breaks silently
• No audit trail — limited visibility into what the application actually does
• No conditional access — no way to apply modern security policies

Microsoft officially retired ACS as a general Azure service back in November 2018, but kept the SharePoint-specific ACS endpoint (accounts.accesscontrol.windows.net) running. That grace period ends on April 2, 2026.

What will break on April 2, 2026

After the retirement date, the ACS token endpoint will stop issuing tokens. This means:

# Connect to SharePoint Online Management Shell
Connect-SPOService -Url https://yourtenant-admin.sharepoint.com

# List all ACS app principals
Get-SPOServicePrincipalPermissionGrant | Format-Table -AutoSize

Microsoft Entra ID: the replacement

Microsoft Entra ID (the new name for Azure Active Directory, or Azure AD) is the modern identity platform for all Microsoft 365 services. Instead of ACS client secrets, you use:

ACS vs Entra ID at a glance

Option 1: Automatic migration with PnP PowerShell

The fastest way to register a new Entra ID application is PnP PowerShell. One command handles everything: app registration, certificate creation, certificate upload, and permission configuration.

Install-Module -Name PnP.PowerShell -Scope CurrentUser

$app = Register-PnPAzureADApp \
  -ApplicationName "Your App Name" \
  -Store CurrentUser \
  -Tenant yourtenant.onmicrosoft.com \
  -Username "admin@yourtenant.onmicrosoft.com" \
  -Password (Read-Host -AsSecureString -Prompt "Enter Password") \
  -CertificatePassword (Read-Host -AsSecureString -Prompt "Enter Cert Password") \
  -OutPath .\

# Save these — you will need them in your code
$app.'AzureAppId/ClientId'
$app.'Certificate Thumbprint'

# Example: only Sites.ReadWrite.All instead of FullControl
Register-PnPAzureADApp \
  -ApplicationName "Your App Name" \
  -Store CurrentUser \
  -Tenant yourtenant.onmicrosoft.com \
  -Username "admin@yourtenant.onmicrosoft.com" \
  -Password (Read-Host -AsSecureString) \
  -CertificatePassword (Read-Host -AsSecureString) \
  -SharePointApplicationPermissions "Sites.ReadWrite.All" \
  -GraphApplicationPermissions "Sites.ReadWrite.All" \
  -OutPath .\

Option 2: Manual migration in Azure Portal

If you need more control, or your organization requires manual approval for each step, here is the step-by-step process in the Azure Portal.

$cert = New-PnPAzureCertificate \
  -CommonName "your-app-certificate" \
  -OutPfx .\your-app.pfx \
  -OutCert .\your-app.cer \
  -ValidYears 2 \
  -CertificatePassword (Read-Host -AsSecureString)

$cert.Thumbprint

Code changes: before and after

If you use PnP Framework (the most common library for SharePoint CSOM), the code changes are minimal. Here is a side-by-side comparison.

// ACS authentication — will break after April 2, 2026
var am = new AuthenticationManager();

using (var context = am.GetACSAppOnlyContext(
    siteUrl,
    clientId,
    clientSecret))   // <-- shared secret
{
    var list = context.Web.Lists.GetByTitle("Documents");
    context.Load(list, l => l.Title);
    await context.ExecuteQueryAsync();
    Console.WriteLine(list.Title);
}

// Entra ID authentication with X.509 certificate
var certificate = X509CertificateUtility.LoadCertificate(
    StoreName.My,
    StoreLocation.CurrentUser,
    certificateThumbprint);  // <-- certificate, not a secret

var am = AuthenticationManager.CreateWithCertificate(
    clientId,
    certificate,
    tenantId);

using (var context = am.GetContext(siteUrl))
{
    // Your CSOM code stays exactly the same
    var list = context.Web.Lists.GetByTitle("Documents");
    context.Load(list, l => l.Title);
    await context.ExecuteQueryAsync();
    Console.WriteLine(list.Title);
}

Configuration changes

Update your application settings (appsettings.json, environment variables, or Azure Key Vault):

// Before (ACS)
{
  "SharePoint": {
    "SiteUrl": "https://yourtenant.sharepoint.com/sites/yoursite",
    "ClientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "ClientSecret": "your-acs-client-secret"
  }
}

// After (Entra ID)
{
  "SharePoint": {
    "SiteUrl": "https://yourtenant.sharepoint.com/sites/yoursite",
    "ClientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "TenantId": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
    "CertificateThumbprint": "ABC123DEF456..."
  }
}

Migration checklist

FAQ