MICROSOFT BLOCKS LEGACY TLS IN EXCHANGE ONLINE
INDUSTRY DESK■ 2 MIN READ
TUE, APR 28, 2026■ AI-SUMMARIZED FROM 1 SOURCE BELOW
Microsoft will deprecate legacy TLS connections for POP and IMAP clients in Exchange Online starting July 2026. The move affects email clients still using outdated encryption protocols.
Microsoft announced it will begin blocking legacy TLS (Transport Layer Security) connections for POP and IMAP email protocols in Exchange Online from July 2026 onward.
The deprecation targets clients still relying on TLS 1.0 and TLS 1.1, which Microsoft considers security risks. Users and organizations with older email clients will need to upgrade to versions supporting TLS 1.2 or higher to maintain connectivity.
What's changing:
- POP and IMAP connections using TLS 1.0 and 1.1 will be blocked
- Affected clients must support minimum TLS 1.2
- Timeline begins July 2026
Who is affected:
Organizations running legacy email clients, particularly older versions of:
- Outlook for Windows and Mac
- Apple Mail
- Gmail clients
- Third-party email applications
Microsoft has emphasized the security necessity of this change. Legacy TLS versions contain known vulnerabilities that expose email communications to potential interception and compromise. The company previously deprecated TLS 1.0 and 1.1 for other Microsoft 365 services.
Recommended actions:
Organizations should audit their email client versions and plan upgrades accordingly. Microsoft recommends transitioning to modern email clients that support current TLS standards and modern authentication methods like OAuth 2.0.
This aligns with broader industry trends toward deprecating legacy protocols. Major email providers including Google and Apple have similarly phased out support for outdated TLS versions in recent years.
Microsoft will provide additional guidance and migration resources as the July 2026 deadline approaches. Organizations with large deployments of legacy systems should begin planning upgrades immediately to avoid service disruptions.
■ MORE FROM THE SECURITY DESK
The Supreme Court heard arguments Monday in Chatrie v. United States, a case that could determine whether police can use 'geofence warrants' to identify suspects based solely on their location data. The ruling will affect privacy protections for millions of American cellphone users.
1H AGO— Industry Desk
A US agency has closed an investigation into allegations that Meta can access encrypted WhatsApp messages, ending a law enforcement inquiry that challenged the company's privacy marketing claims.
2H AGO— AI Desk
Device manufacturers are increasingly locking down hardware and software, limiting users' ability to repair or modify their own phones. The trend raises questions about ownership and device longevity.
2H AGO— Industry Desk
The U.S. Commerce Department last week ordered multiple chip equipment manufacturers to stop certain shipments to Hua Hong, China's second-largest chipmaker. The action represents another escalation in U.S. restrictions targeting China's semiconductor capabilities.
2H AGO— Industry Desk