Microsoft announced that it will completely disable the old Transport Layer Security Protocol TLS 1.0 and TLS 1.1 in Exchange Online starting in July 2026, forcing all clients and services to upgrade to TLS 1.2 or higher to access email services. The decision marks a key step for Microsoft in retiring outdated security infrastructure.
As a widely used mail system in corporate and personal environments, Outlook's back-end infrastructure mainly relies on Exchange Online, and a few companies that prefer local deployment use Exchange Server. Microsoft has listed TLS 1.0 and TLS 1.1 as deprecated this time, especially for the POP3 and IMAP4 connection protocols. Microsoft explained that these older versions of the TLS protocol have been phased out by most companies in the industry. The vast majority of current email clients and libraries have adopted TLS 1.2 or higher, and Exchange Online traffic is mainly routed through these newer technologies.
Microsoft reminds users who are still using the old version of the protocol that they will be directly affected, and recommends IT administrators to verify as soon as possible whether the relevant infrastructure is still connecting to these deprecated endpoints. Any affected services should be updated to TLS 1.2 or higher as soon as possible. It is worth noting that Microsoft had blocked the old version of TLS as early as 2023, but at that time allowed customers to choose to continue using it. This complete lockdown will be implemented in a few months and will provide no escape route.
In fact, Microsoft has phased out older versions of the TLS protocol across multiple services. The protocol was turned off in Internet Explorer in 2022, removed from Windows 11 systems, and Azure services have been completely disabled. Microsoft believes that this old version of TLS deprecation reminder for Exchange Online will provide customers with sufficient time to prepare for the migration plan to TLS 1.2. For organizations still relying on older versions of the protocol, they may be at risk of sudden service outages if they do not take timely action.