Legacy TLS tour continues with Exchange Online blocking old versions from July 2026
Summary
Microsoft has announced that it will begin blocking legacy TLS versions (TLS 1.0 and 1.1) for POP3 and IMAP4 connections to Exchange Online starting in July 2026. This move is part of an ongoing effort to deprecate older, less secure encryption protocols and improve overall security for its services.
IFF Assessment
This is good news for defenders as it forces users to adopt more secure encryption protocols, reducing the attack surface associated with outdated and vulnerable TLS versions.
Defender Context
This announcement means defenders need to ensure their clients and applications are updated to support TLS 1.2 or higher when connecting to Exchange Online via POP3 and IMAP4. Failure to do so will result in connection failures, impacting email delivery and retrieval for users still relying on legacy configurations.