Edytuj

Udostępnij za pośrednictwem

Turn legacy Exchange Online tokens on or off

  • Artykuł

Legacy Exchange Online tokens are deprecated and will be turned off across Microsoft 365 tenants starting February 17th, 2025. If you're a developer migrating your Outlook add-in from legacy tokens to Entra ID tokens and nested app authentication, you'll need to test updates to your add-in. Use the Exchange Online PowerShell cmdlets to turn off legacy tokens in a test tenant to confirm that your updated Outlook add-in is working correctly.

For more information about deprecation of legacy Exchange Online tokens, see Nested app authentication and Outlook legacy tokens deprecation FAQ.

Connect to Exchange Online PowerShell

To run the commands you need to connect to Exchange Online PowerShell.

  1. Open PowerShell.
  2. Run the command Import-Module -Name ExchangeOnlineManagement. For more information about this command, see Exchange Online PowerShell.
  3. To be sure you are on the latest version of the module, run the command Update-Module -Name ExchangeOnlineManagement.
  4. Run the command Connect-ExchangeOnline. Sign in with your Microsoft 365 administrator credentials.

Turn off legacy Exchange Online tokens

The Set-AuthenticationPolicy command controls the issuance of legacy Exchange Online tokens. When issuance is turned off, add-ins can no longer request user identity tokens or callback tokens. Existing tokens already issued will continue to work until they expire. It can take up to 24 hours before all request from Outlook add-ins for legacy Exchange Online tokens are blocked.

To turn legacy tokens off, run the following command.

Set-AuthenticationPolicy –BlockLegacyExchangeTokens -Identity "LegacyExchangeTokens"

The command turns off legacy tokens for the entire tenant. If an Outlook add-in requests a legacy token, it won’t be issued a token.

Note

If you've confirmed that your tenant is not using any add-ins that require legacy Exchange Online tokens, we recommend you turn off legacy Exchange Online tokens as a security best practice. For more information on how to determine if you tenant has add-ins using legacy tokens, see the Nested app authentication and Outlook legacy tokens deprecation FAQ.

Turn on legacy Exchange Online tokens

To turn legacy tokens on, run the following command. It can take up to 24 hours before all requests from Outlook add-ins for legacy tokens are allowed.

Set-AuthenticationPolicy –AllowLegacyExchangeTokens -Identity "LegacyExchangeTokens"

Important notes about this command.

  • Legacy Exchange tokens issued to Outlook add-ins before token blocking was implemented in your organization will remain valid until they expire.
  • If you turn on legacy Exchange Online tokens, then they won't be turned off in February 2025 when Microsoft turns them off for all tenants. For more information, see Nested app authentication and Outlook legacy tokens deprecation FAQ.
  • You’ll only be able to turn tokens back on until June 2025 when all legacy tokens in all tenants will be forced off. For more information, see the Nested app authentication and Outlook legacy tokens deprecation FAQ.
  • Although the -Identity parameter is required, it doesn't affect any specific authentication policy. The command always applies to the entire organization regardless of what value you use. We show the value as LegacyExchangeTokens in the examples to keep the intent clear.

Get the status of legacy Exchange Online tokens and add-ins that use them

To view the status of legacy Exchange Online tokens, run the following command.

Get-AuthenticationPolicy -AllowLegacyExchangeTokens

The command returns whether AllowLegacyExchangeTokens is true or false, such as the following example in PowerShell.

PS C:\> Get-AuthenticationPolicy -AllowLegacyExchangeTokens
AllowLegacyExchangeTokens: False
Allowed: []
Blocked: []
PS C:\>

We've been working to enable this command to report any add-ins using legacy Exchange Online tokens in the Allowed and Blocked lists. Unfortunately, we've had difficulties rolling out this update due to the complexities of capturing specific token usage in the Microsoft 365 ecosystem. We continue to work on this update and will provide new information in this article when it is available.

Note

The Get-AuthenticationPolicy -AllowLegacyExchangeTokens command is the only way to view legacy token status. Other commands, such as Get-AuthenticationPolicy | Format-Table -Auto Name, don't return the legacy token status.

The Get-AuthenticationPolicy command only shows the legacy token status as set by the administrator. If the administrator has never changed the settings, the command returns (Not Set). If the token status is (Not Set) when the February deployment by Microsoft to turn off legacy tokens is implemented, the token status will still be (Not Set) even though legacy tokens are off. The following table shows the behavior of legacy Exchange Online tokens based on the token status when the change is applied.

Legacy token admin setting Legacy token behavior before February change Legacy token behavior after February change Legacy token behavior after June change
(Not Set) Tokens on Tokens off Tokens off
False Tokens off Tokens off Tokens off
True Tokens on Tokens on Tokens off

See also