Skip to content

[NAA] - FAQ update #5238

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

[NAA] - FAQ update #5238

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7e2fe21
Minor edits
davidchesnut Jun 18, 2025
81b6ee5
edit
davidchesnut Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions docs/outlook/faq-nested-app-auth-outlook-legacy-tokens.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ description: Nested app authentication and Outlook legacy tokens deprecation FAQ
ms.service: microsoft-365
ms.subservice: add-ins
ms.topic: faq
ms.date: 05/22/2025
ms.date: 06/18/2025
---

# Nested app authentication and Outlook legacy tokens deprecation FAQ
Expand All @@ -24,7 +24,7 @@ Legacy Exchange online tokens have already been turned off for most tenants. We'
| Date | Legacy tokens status |
| -------- | ------------------------------------------------------ |
| Now | Legacy tokens turned off for most tenants. Admins can reenable legacy tokens via PowerShell. |
| Jun 2025 | Legacy tokens turned off for all tenants. Admins can no longer reenable legacy tokens via PowerShell. Admins can request an exception through Microsoft Support at [https://aka.ms/LegacyTokensByOctober](https://aka.ms/LegacyTokensByOctober) (this link requires you to sign in to your tenant). |
| June 16 2025 - July 2025 | Legacy tokens are turned off for all tenants. This process will take several weeks to complete. Admins can no longer reenable legacy tokens via PowerShell. Admins can request an exception through Microsoft Support at [https://aka.ms/LegacyTokensByOctober](https://aka.ms/LegacyTokensByOctober) (this link requires you to sign in to your tenant). |
| Oct 2025 | Legacy tokens turned off for all tenants. Exceptions are no longer allowed. |

### When is NAA generally available for my channel?
Expand Down Expand Up @@ -419,6 +419,15 @@ Be sure to handle admin consent properly. See [Publish an add-in that requires a

For additional deployment details, see [Make your solutions available in Microsoft AppSource and within Office](/partner-center/marketplace-offers/submit-to-appsource-via-partner-center). If you update your add-in (change the manifest) you need to go through the [certification process again](../publish/publish-nested-app-auth-add-in.md). You can update your web server code any time without a need for review.

### Users get an unexplained error when signing in

When your add-in requests a token, users may see a sign-in popup dialog showing one of the following errors.

- **Something went wrong.** [*error code*]
- **You can't get there from here**

Check to see if the admin has any conditional access policies applied that enforce specific client restrictions, such as mobile location, or platform type. Also the **approved client app Conditional Access grant** is deprecated and will cause these errors with NAA token requests. An admin must completely remove this policy and switch over to the newer **application protection policy grant** for NAA to work. For more information, see [Migrate approved client app to application protection policy in Conditional Access](/entra/identity/conditional-access/migrate-approved-client-app).

## Related content

- [Enable SSO in an Office Add-in using nested app authentication](../develop/enable-nested-app-authentication-in-your-add-in.md).
Expand Down