In almost every SharePoint Online environment I've looked at recently, the upcoming SharePoint Add-ins retirement and the end of Azure ACS app-only access are a real source of concern. The deadline is 2 April 2026, now only two months away. Still, I regularly come across legacy add-ins or integrations quietly running in the background, often undocumented or simply forgotten. Some of them support critical business processes, and if they break overnight, things get messy fast. Few tenants have a clear picture of what's still active, so acting now really matters.

Classic add-ins and ACS app-only access both stop working

The retirement covers both the classic SharePoint Add-ins (the ones registered via appregnew.aspx or appinv.aspx) and the Azure Access Control Service (ACS) app-only model for SharePoint Online. After 2 April 2026, neither will work anymore. You already can't deploy new add-ins, and every existing one stops functioning on the cutoff date (Microsoft's Add-ins retirement announcement, details on the ACS app-only retirement). Third-party integrations and custom solutions built into business workflows are hit hardest. In many environments I work in, these old mechanisms still carry a large share of the automation or data exchange.

The PnP Assessment Tool finds every add-in and ACS app

You can't migrate until you know what's actually running, so a complete inventory comes first. The most thorough option is the Microsoft 365 Assessment Tool (PnP), run from an admin workstation. It needs an Entra ID app registration with Sites.FullControl.All and Directory.Read.All permissions, and you pass that app's client ID and secret to the scan. This is how I usually run it (PowerShell 7, Microsoft365DSC module required):

# Prerequisite: Entra app registration with Sites.FullControl.All, Directory.Read.All
# Run on admin workstation with PowerShell 7 and Microsoft365DSC module
Connect-M365Assessment -ClientId '<yourClientId>' -TenantId '<yourTenantId>'
Export-M365AssessmentReport -OutputFolder 'C:\Reports' -AssessmentType SharePointAddIns

The report lists every SharePoint Add-in and ACS app along with its permissions and usage. I regularly turn up leftover add-ins from old migration projects or ISV integrations nobody remembers. If you've never run this assessment, be prepared for a few surprises.

Registrations made via appregnew and appinv often go unnoticed

A lot of older add-ins were registered directly in SharePoint through /_layouts/15/appregnew.aspx and /_layouts/15/appinv.aspx. They don't appear in Entra ID (formerly Azure AD), so if you only check app registrations, you'll miss them. The Microsoft 365 Assessment Tool does pick up these old registrations and shows which sites they access. You can also look through the App Catalog in the SharePoint admin center, or go to site contents → "Apps for SharePoint" on individual sites. Don't dismiss an entry just because it has a dull name like “MigrationTool” or “WorkflowApp”. Those can turn out to be critical.

Practical tip: Most inventories I do turn up add-ins that still hold permissions but haven't been used in years. Removing them cuts technical debt and closes security gaps at the same time.

Modern Entra app registrations with Sites.Selected replace the old model

The target model is Entra app registrations (formerly Azure AD) with certificate-based authentication and Sites.Selected permissions. That gives you precise access to specific sites, assigned by an admin, which is a big step up for security. The migration itself is rarely trivial, though:

  • Existing app logic has to move to Graph API and modern auth
  • Authentication switches from shared secrets to certificates
  • A SharePoint admin has to grant Sites.Selected permissions explicitly (via PowerShell or the admin center)
  • Provider-hosted add-ins usually need a complete rebuild as SharePoint Framework (SPFx) or another integration model
  • ISVs should be contacted now about supported migration paths

For home-grown solutions there's usually no shortcut, and a full rewrite is needed. Provider-hosted add-ins in particular can't just be "patched" because they need a new platform. SPFx is mature and well supported by now, but if you're only starting the migration today, you're up against the clock.

The flowchart below shows how a typical move from ACS to an Entra app registration with Sites.Selected plays out:

flowchart TD
    Inventory["Inventory Add-ins/ACS"] --> Review["Review usage/permissions"]
    Review --> Decide["Retire or migrate?"]
    Decide -->|"Retire"| Remove["Remove/disable"]
    Decide -->|"Migrate"| EntraApp["Entra app registration (cert auth)"]
    EntraApp --> SitesSelected["Sites.Selected permission"]
    SitesSelected --> SPFx["(Optional) Migrate to SPFx"]

Figure: Migration path from SharePoint Add-ins/ACS to Entra app registration with Sites.Selected.

Vendors and in-house developers need to hear from you now

Early, clear communication with everyone involved makes a big difference. Many ISVs now offer modern Entra-based integrations, but unless you ask, the old setup usually stays in place. I recommend contacting every vendor whose product relies on SharePoint Add-ins or ACS and asking for migration documentation or an updated version. Sometimes the integration turns out to be obsolete and can be removed altogether. For internal solutions, you need to set aside developer time now, because a simple reconfiguration is almost never enough.

I think there is no time left to lose

With two months to go, it's now or never for SharePoint environments that still run legacy add-ins or ACS app-only flows. If you haven't run the Microsoft 365 Assessment Tool yet, do that first. The real work starts afterwards, with the inventory, talking to stakeholders, planning the migration and carrying it out. In my experience, the steps people underestimate most are Sites.Selected permission assignments and the switch to certificate auth. Talking openly with vendors and having a detailed migration plan are essential. Wait any longer and you'll be firefighting in April 2026. For more technical background, see my related post /blog/azure-ad-graph-retirement-migrate-apps.