(Updated) Exchange Online token deprecation plan

Starting February 17, 2025, legacy Exchange Online user identity and callback tokens will be turned off for all Microsoft 365 tenants, affecting Outlook add-ins. Identify impacted add-ins, contact publishers for updates, and consider opting out if necessary. For more information, refer to the provided resources and FAQ links.

Updated February 3, 2025: We have updated the content. 

This is a reminder that starting February 17th, legacy Exchange Online user identity and callback tokens will be turned off across all Microsoft 365 tenants. This impacts all Outlook add-ins that request a legacy Exchange Online token to identify the user or make Exchange web services (EWS) calls. This change only applies to Exchange Online and doesn’t apply to Exchange on-premises.

Recommended actions

• Identify any add-ins that are impacted. Determine if your tenant has any deployed Outlook add-ins that are impacted by this change. For more information, see Which add-ins in my Organization are impacted.
• Contact add-in publishers. Microsoft has worked with many Outlook add-in publishers to update their add-ins to use Entra ID tokens and Microsoft Graph. If you identify any impacted add-ins on your tenant, we recommend that you reach out to the publishers of those add-ins to learn more about their plans to update.

Can I opt out of this change?

You can opt out of the February 17th change if all the following are true.

• Your tenant has add-ins impacted by this change.
• The impacted add-ins will not be updated to no longer use legacy Exchange Online tokens by February 17th.
• The add-ins are necessary for your organization.

To opt out, run a command to set legacy Exchange Online tokens to remain on. It takes up to 24 hours for the command to take effect. If you turn tokens on before February 17th, your tenant will be exempt from the February 17th change. Tokens will remain on until June 2025 or until you explicitly turn them off.

What happens on February 17th?

Microsoft will begin deploying a change to all users worldwide in Microsoft 365 tenants that will turn off the issuance of legacy Exchange online tokens. The deployment will take several weeks to deploy to all users. If an Outlook add-in requests a legacy Exchange token, and token issuance is turned off, the add-in will receive an error. Outlook add-ins that still request legacy Exchange Online tokens will be broken by this change. Please note that even after legacy tokens are turned off, already issued legacy tokens will continue to be valid for approximately 24 hours.

Note that since the change is applied per user, and deployed over several weeks, you could see some user’s affected while others are not.

Where do I get more information?

The Outlook legacy tokens deprecation FAQ is updated regularly and contains information about tools and how to upgrade add-ins. We recommend you refer to the Q&A section for Microsoft 365 administrators. We also recommend you share the FAQ with any developers in your organization that need to update LOB Outlook add-ins using legacy Exchange Online tokens.

Additional resources

• Turn legacy Exchange Online tokens on or off
• Legacy Exchange Online token deprecation FAQ
• Enable single sign-on in an Office Add-in with nested app authentication
• NAA Outlook sample