ACS Retirement and SharePoint App Permissions‎ impact

Question

ACS Retirement and SharePoint App Permissions‎ impact

LAHOUAZI Ferhat 20

Dear all

We recently came across a Microsoft note mentioning the retirement of Azure Access Control Service (ACS) for SharePoint and referencing the following scenarios:

• Apps that were registered in SharePoint via AppRegNew.aspx (also known as SharePoint app-only service principals) and granted permissions in SharePoint via AppInv.aspx

• Apps that were registered in Azure (Entra ID) and granted permissions in SharePoint via AppInv.aspx

Based on this information, we understand that Microsoft plans to remove ACS-based authentication as well as the related pages appprincipals.aspx, AppRegNew.aspx and AppInv.aspx in SharePoint.

Could you please confirm whether this information is correct? We would also like clarification on the following points:

Will the existing access for applications already configured and visible in /_layouts/15/appprincipals.aspx continue to work after this change?
If so, does this mean that only new applications configured after early April will be blocked, while existing ones will remain functional?

Currently, in our environment:

    • We are using App Registrations created manually in Entra ID 
    • These applications have Application permissions with Sites.Selected API permissions 
   • Permissions on SharePoint sites were granted using AppInv.aspx

Given this setup, will our applications be impacted by the ACS retirement?

If yes: • What is the supported method or workaround going forward to grant application permissions to specific SharePoint sites?

is theses command are still working and will not déprecated after 2 april : Grant-PnPAzureADAppSitePermission -Site "<PII removed> " -AppId "<PII remmoved>" -DisplayName "<PII removed>" -Permissions "Write"

New-MgSitePermission -SiteId $site.Id -BodyParameter $params

What confuses me is that when I run these two commands, the access granted through these PnP or MgGraph commands appears on the page: /_layouts/15/appprincipals.aspx.

Thank you in advance for your clarification.

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hi @LAHOUAZI Ferhat

Thank you for posting your question in the Microsoft Q&A forum.

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.

Microsoft has confirmed that Azure Access Control Service (ACS) for SharePoint Online will be fully retired on April 2, 2026, with no extension. After this date, any ACS‑based access will stop working.

ACS includes scenarios such as:

-Apps registered via AppRegNew.aspx

-Permissions granted via AppInv.aspx

-SharePoint Add-in / App-only model using client ID + secret issued by ACS

You mentioned:

-App created in Microsoft Entra ID > Supported

-Permission: Sites.Selected > Supported

-Site permissions granted using AppInv.aspx > Legacy method

This is a mixed configuration. Even if an application is registered in Microsoft Entra ID, site permissions granted through AppInv.aspx rely on the legacy SharePoint Add‑In / ACS permission model, which Microsoft has announced will stop working after April 2, 2026.

Microsoft’s only supported model going forward is:

-App Registration in Entra ID

-Application permissions with Sites.Selected (granular, site‑scoped)

-Grant site permission using:

Microsoft Graph
PnP PowerShell

-Certificate‑based authentication

The following commands are part of this modern, supported model and are not deprecated:

Grant-PnPAzureADAppSitePermission
New-MgSitePermission

Although permissions granted using these methods may still appear on /_layouts/15/appprincipals.aspx, this page is not limited to ACS‑based apps. It serves as a visualization layer for all application principals with site permissions, including those granted via the modern Graph‑based authorization model. Therefore, seeing an application listed on appprincipals.aspx does not imply that ACS authentication is being used.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Teddie-D 13,285 Reputation points Microsoft External Staff Moderator

2026-03-16T00:18:07.0566667+00:00

Hi @LAHOUAZI Ferhat
Just checking in to see if the information above was useful to you. If you have any additional updates or need further assistance, don't hesitate to reach out. Warm thanks!
LAHOUAZI Ferhat 20 Reputation points

2026-03-16T08:08:37.8733333+00:00

Hi @Teddie-D

Thank you very much for your detailed reply. Your explanation is very clear and helps clarify the situation regarding the ACS retirement.

I do have one additional question regarding the authentication method you mentioned. Is certificate-based authentication mandatory, or is it simply recommended? In other words, would it still be supported to authenticate using a client secret, or should we plan to move entirely to certificate-based authentication for these scenarios?

Also, do you know if this change has any impact on existing SharePoint Add-ins, such as “Gantt Chart by Virto” or similar third-party add-ins that historically relied on the SharePoint Add-In model?

Thank you again for your help and clarification.
Teddie-D 13,285 Reputation points Microsoft External Staff Moderator

2026-03-17T02:00:57.9166667+00:00

Hi @LAHOUAZI Ferhat

Certificate‑based authentication is strongly recommended but not mandatory. Microsoft Entra ID continues to support client‑secret–based authentication for confidential client applications, including those accessing SharePoint via Microsoft Graph after ACS retirement. There has been no announcement that client secrets will be deprecated; however, certificates are recommended for production due to security and lifecycle benefits.

Regarding SharePoint Add‑Ins, the entire SharePoint Add‑In model (both SharePoint‑hosted and provider‑hosted) is being retired and will stop working for all tenants on April 2, 2026. This applies equally to third‑party add‑ins such as Gantt Chart by Virto if they rely on the Add‑In framework or ACS. Vendors must provide a modern replacement; otherwise, those add‑ins will cease to function after the retirement date.

Share via

ACS Retirement and SharePoint App Permissions‎ impact

0 additional answers

Your answer