IDCRL retirement in SharePoint Online: migrating to modern authentication

Introduction

Microsoft has announced the retirement of IDCRL (Identity Client Run Time Library) authentication in SharePoint Online, a further step towards the exclusive use of modern authentication protocols such as OAuth 2.0 and OpenID Connect. Since 2018, standard access to SharePoint and OneDrive has already relied on these secure protocols, but some API calls continued to support IDCRL for backwards compatibility.

This change requires proactive action from IT administrators to ensure business continuity for applications and scripts that still use the legacy protocol.

What IDCRL authentication is

IDCRL (Identity Client Run Time Library) is a legacy authentication protocol used to access SharePoint Online and OneDrive for Business. Microsoft is removing this legacy support entirely to ensure that every authentication call uses modern protocols only.

Why Microsoft is removing IDCRL

IDCRL authentication has security weaknesses that make it unfit for today’s protection standards. Modern protocols offer:

• Better protection against phishing attacks and credential theft
• Native support for MFA (Multi-Factor Authentication)
• Access tokens with a limited lifetime instead of persistent credentials
• Granular control over application permissions

Retirement timeline

Microsoft has set out a precise roadmap:

Temporarily postponing the retirement

Administrators can temporarily re-enable IDCRL until 30 April 2026:

# Abilitare temporaneamente IDCRL
Set-SPOTenant -AllowLegacyAuthProtocolsEnabledSetting $true -LegacyAuthProtocolsEnabled $true

# Verificare lo stato corrente
Get-SPOTenant | Select AllowLegacyAuthProtocolsEnabledSetting, LegacyAuthProtocolsEnabled

⚠️ Warning: This is a temporary workaround. From 1 May 2026 it will no longer be possible to re-enable legacy authentication.

Checking IDCRL usage

Microsoft also provides auditing tools to find out whether your organisation uses IDCRL.

Accessing the monitoring tools via Microsoft Purview

Roles with access:

• Global Administrator
• Compliance Administrator
• Purview Compliance Administrator
• Role Management Role
• Collection Admin, Data Curator, Data Reader

Procedure:

1. Sign in to Microsoft Purview or the Purview Portal
2. Go to Audit in the side panel
3. Under “Activities – operations name” select “IDCRLSuccessSignIn”
4. Apply additional filters if needed
5. Click Search

The results will show every IDCRL call, letting you identify which applications or scripts need updating.

Which calls use IDCRL

There are two categories of IDCRL calls:

Category 1: Use of the SharePointOnlineCredentials library

Any use of the SharePointOnlineCredentials library in your code means IDCRL calls, because this library uses the IDCRL protocol under the hood.

// Esempio di codice che usa IDCRL (DA AGGIORNARE)
SharePointOnlineCredentials credentials = new SharePointOnlineCredentials(username, password);

Category 2: Direct calls to the IDCRL endpoints

Every call to these endpoints uses the IDCRL protocol:

• https://login.microsoftonline.com/rst2.srf (to obtain a SAML BinarySecurityToken)
• https://TENANT.sharepoint.com/_vti_bin/idcrl.svc (to exchange tokens for an SPOIDCRL cookie)

Migration options

Option 1: Microsoft Authentication Library (MSAL) - Recommended solution

MSAL is Microsoft’s primary recommended solution for acquiring OAuth tokens that work for both Category 1 and Category 2 calls.

Technical resources:

• Using modern authentication with CSOM for .NET Standard
• Configuring an application in Azure AD

OAuth and MSAL documentation:

• What Is OAuth? | Microsoft Security
• OAuth 2.0 authorization code flow
• Overview of MSAL

Option 2: Updating the CSOM NuGet package

Microsoft has released an updated version of the NuGet package that enables the transition from IDCRL to OAuth.

Download: Microsoft.SharePointOnline.CSOM on NuGet

Required code changes

Deprecated GetAuthenticationCookie method:

The method is replaced by AcquireTokenAsync, which acquires OAuth tokens.

Handling Multi-Factor Authentication:

If Multi-Factor Authentication is enabled, you need to pass a new parameter to the SharePointOnlineCredentials constructor. Here is how the code should be changed:

SharePointOnlineCredentials credentials = new SharePointOnlineCredentials(
    username, 
    password, 
    useModernAuth: true, 
    interactiveAuth: true  // Abilita autenticazione interattiva per MFA
);

App-Only Authentication (no user interaction):

For automated scenarios with no user involvement, configure App-Only Authentication when registering the app in Microsoft Entra.

Admin checklist

• Check for IDCRL calls via Microsoft Purview Audit
• Identify every application that uses SharePointOnlineCredentials
• Plan the migration to MSAL/OAuth for each application
• Test implementations in a dev/staging environment
• If needed, enable the temporary postponement via PowerShell
• Complete the migration by 30 April 2026

Conclusions

Removing IDCRL authentication is a necessary step towards improving SharePoint Online security. Administrators have until 30 April 2026 to complete the migration, but it is wise to start the assessment and planning straight away.

The temporary postponement via PowerShell gives you a safety buffer, but remember that from 1 May 2026 there will be no alternatives left: modern authentication will become mandatory.

References:

• Migrating from IDCRL authentication to modern authentication in SharePoint