Deprecation notice: Low-trust SharePoint add-ins in SharePoint Server Subscription Edition
Microsoft is removing low-trust authorization for SharePoint Add-ins in SharePoint Server Subscription Edition, with support ending January 12, 2027. The January 2027 public update disables such add-ins by default, so provider-hosted add-ins and AppRegNew.aspx app-only principals must be replaced or retired first.
Key points
- Support for low-trust SharePoint Add-ins in SharePoint Server Subscription Edition ends January 12, 2027.
- The January 2027 public update turns low-trust add-ins off by default; installing it is what triggers the behaviour change.
- Provider-hosted add-ins using low-trust authorization and app-only principals created with AppRegNew.aspx are both in scope.
- SharePoint REST, CSOM and JSOM APIs are excluded from the deprecation.
- SPFx is the recommended client-side extensibility model; farm solutions stay supported.
- A separate hard code-removal date will be announced later and cannot be reversed once reached.
Microsoft is ending support for low-trust SharePoint Add-ins in SharePoint Server Subscription Edition on January 12, 2027. The January 2027 public update will ship with low-trust add-ins disabled by default, so any provider-hosted add-in or app-only principal registered through AppRegNew.aspx that relies on low-trust authorization stops working after that patch is installed.
The SharePoint REST, CSOM and JSOM APIs are explicitly excluded from the deprecation, so code that calls those endpoints keeps working. Microsoft points developers at SharePoint Framework (SPFx) as the client-side extensibility model on Subscription Edition, and farm solutions remain supported. Teams are told to inventory their farms now, retire or replace affected add-ins before the deadline, and avoid starting new work on low-trust authorization. A re-enable switch plus a separate hard code-removal date will be documented in that update.
Real-world use
- An on-premises SharePoint farm running provider-hosted add-ins that call back into SharePoint with low-trust tokens, which must be ported to SPFx or a farm solution.
- An internal tool that authenticates through an app-only principal created in AppRegNew.aspx and needs a new auth path before the January 2027 patch.
- An admin planning a patching window who has to decide whether to re-enable low-trust add-ins temporarily while migrations finish.
- A team documenting customizations on Subscription Edition to check whether REST, CSOM or JSOM based integrations stay safe.
Why it matters
Any custom SharePoint code that authenticates through low-trust app-only principals has a fixed cutoff: after the January 2027 patch it stops running unless it was migrated or explicitly re-enabled.