Dynamics Community Forum Thread Details

SharePoint ACS (AppInv/AppRegNew) Retirement – Need Guidance on Migration to Azure AD / Graph

We have an integration between Microsoft Dynamics 365 Business Central (AL) and SharePoint Online for uploading and accessing files in document libraries.

Current Implementation

App Registration & Permissions

App created using:
/_layouts/15/appregnew.aspx

Permissions granted via:
/_layouts/15/appinv.aspx → “Trust It”

Current permission (overly broad):

this will give all tenant level access i.e. all sharepoint access so pls suggest ?

Authentication (ACS Token)

We generate access tokens using:

POST https://accounts.accesscontrol.windows.net/{tenant-id}/tokens/OAuth/2

SharePoint API Usage

We are using SharePoint REST API:

Upload file:

POST https://<org>.sharepoint.com/sites/<site>/_api/web/GetFolderByServerRelativeUrl('/sites/<site>/Shared Documents')/Files/add(url='file.pdf',overwrite=true)

Download / read files:

GET https://<org>.sharepoint.com/sites/<site>/_api/web/GetFileByServerRelativeUrl('/sites/<site>/Shared Documents')/Files...

Questions

After April 2026, will existing ACS-based integrations completely stop working, or only new registrations will be blocked?

What is the recommended modern approach for this scenario:
- Continue using SharePoint REST API with Azure AD token
- OR migrate fully to Microsoft Graph API
If we switch to Azure AD authentication:
- Can we continue using existing _api/web/... endpoints?
- Or is Graph API mandatory

What is the best way to restrict access to a single SharePoint site (avoid tenant-wide permissions like FullControl)?

For Business Central (AL), is there any recommended approach or pattern for:
- Generating Azure AD tokens (client credentials flow)
- Calling SharePoint / Graph APIs securel