Microsoft to Fully Disable Legacy TLS Protocol Connections in Exchange Online in July
Microsoft has announced that it will fully disable the legacy Transport Layer Security (TLS) protocols TLS 1.0 and TLS 1.1 in Exchange Online starting in July 2026, forcing all clients and services to upgrade to TLS 1.2 or higher to access email services. This decision marks a key step in Microsoft's efforts to phase out outdated security infrastructure.
As a widely used email system in both corporate and personal environments, the backend infrastructure of Outlook primarily relies on Exchange Online, while a small number of companies that prefer on-premises deployments use Exchange Server. Microsoft's designation of TLS 1.0 and TLS 1.1 as deprecated specifically targets the POP3 and IMAP4 connection protocols. Microsoft explains that these legacy TLS protocols have been phased out by most companies in the industry, with the vast majority of email clients and libraries now adopting TLS 1.2 or higher, and Exchange Online traffic is also primarily routed through these updated technologies.
Microsoft reminds users still using legacy protocols that they will be directly affected and advises IT administrators to promptly verify whether their relevant infrastructure is still connecting to these deprecated endpoints. Any affected services should be updated to TLS 1.2 or higher as soon as possible. It is worth noting that Microsoft had already blocked legacy TLS in 2023, but at that time allowed customers to choose to continue using it. This complete blocking will be implemented in a few months and will no longer offer a fallback option.
In fact, Microsoft has been gradually phasing out legacy TLS protocols in multiple services. The protocol was disabled in Internet Explorer in 2022, removed from the Windows 11 system, and fully disabled in Azure services. Microsoft believes that this reminder regarding the deprecation of legacy TLS for Exchange Online will provide customers with ample time to prepare a migration plan to TLS 1.2. Organizations that still rely on legacy protocols may face the risk of sudden service interruption if they do not take action promptly.