Azure ACS retirement in Microsoft 365 - legacy SharePoint REST API impacted?

Question

According to https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/retirement-announcement-for-azure-acs:

Azure ACS will stop working for new tenants as of November 1st, 2024 and it will stop working for existing tenants and will be fully retired as of April 2nd, 2026.

How will this affect the existing integrations using the legacy SharePoint REST API endpoints? I'm thinking about HTTP requests to SOAP web services (/_vti_bin/Lists.asmx) or REST API (/_api/).

E.g. Would a request in the browser to the URL https://myTenant.sharepoint.com/sites/mySite/_api/web/lists/getbytitle('Documents') still work?

Answer 1

I think these api's will continue to work because they don't authenticate using ACS. Only SharePoint add-in model apps making use of clientid/secret use ACS for authentication. "/_api/" in my opinion is not legacy. We use it a lot.

When opening "https://mytenant.sharepoint.com/sites/mySite/_api/web/lists/getbytitle(%27Documents%27)" in the browser you are being authenticated using oauth.

If you use custom code you have to authenticate another way. We use an Azure AD app registration with a certificate to authenticate against SharePoint online REST api

See this for example: https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins-modernize/from-acs-to-aad-apps#consuming-sharepoint-online-in-app-only-mode-via-an-azure-ad-registered-application