Microsoft has announced that it will begin blocking outdated TLS connections for POP and IMAP email clients in Exchange Online starting in July 2026.
The change targets older security protocols TLS 1.0 and TLS 1.1, which are now considered outdated and insecure. These versions were first introduced in 1999 and 2006, and no longer meet modern security standards for protecting internet traffic.
Microsoft says most customers will not be affected because the majority of POP3 and IMAP4 traffic to Exchange Online already uses TLS 1.2 or newer versions. Most modern email apps already support these updated protocols.
Once the change takes effect, POP3 and IMAP4 connections using TLS 1.0 or TLS 1.1 will fail. Older applications, outdated devices, and custom embedded systems that still rely on these protocols may stop connecting to Exchange Online.
Microsoft is urging customers to review their email clients, devices, and internal applications before July 2026. Any software still using legacy TLS should be upgraded to support TLS 1.2 or later to avoid service disruptions.
The company noted that some organizations previously continued using these older protocols through special opt-in support, but that exception is now ending completely.
This move is part of a wider industry effort to remove weak encryption standards. In 2018, Apple, Google, Mozilla, and Microsoft jointly announced plans to retire TLS 1.0 and TLS 1.1.
Microsoft also began enabling TLS 1.3 by default in early Windows 10 Insider builds in 2020.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The National Security Agency has also published guidance encouraging organizations to replace outdated TLS versions and weak configurations to reduce cybersecurity risks.
