Microsoft gives admins Exchange Online breathing room
Microsoft has delayed the removal of the -Credential parameter from Exchange Online PowerShell, pushing the retirement back to December 2026 to give system administrators more time to update scripts and automation that rely on it. The parameter allows admins to supply stored username and password credentials when connecting to Exchange Online PowerShell, but it is now discouraged in favour of more secure authentication methods as part of Microsoft's broader shift away from password-based access.
The parameter had originally been slated for removal in July 2026 from the Connect-ExchangeOnline and Connect-IppsSession cmdlets, but Microsoft cited customer feedback in granting the reprieve. Once an updated module version is installed from December 2026 onwards, scripts still using the parameter will break, though the underlying server-side authentication flow will only be retired at a later, unspecified date, after which the parameter will stop working entirely, even on older module versions. Microsoft has urged organisations not to wait until the deadline and to migrate away from the parameter as soon as possible.
In short
- Microsoft delays Exchange Online PowerShell -Credential parameter retirement to December 2026
- Change follows customer feedback; gives admins more time to fix scripts
- Server-side retirement will follow later, fully disabling the parameter
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Large organisations with complex hybrid environments and extensive automation built around basic authentication face genuine implementation challenges in migrating to modern authentication methods. Microsoft's five-month extension acknowledges that this is not merely a technical preference but a substantive operational burden for many customers; honouring such feedback demonstrates responsible stewardship of a critical service on which organisations depend.
The case against
Password-based authentication represents a documented security risk, and extending the parameter's availability merely prolongs the window of vulnerability across the entire customer base. Organisations have had years of advance warning; further delays primarily reward procrastination rather than incentivising timely migration, whilst the security benefits of enforcing modern authentication standards would be realised sooner if the original deadline held.
Explained simply
Exchange Online is Microsoft's cloud-based email service used by many organisations. System administrators use a technical tool called PowerShell to manage this service—essentially a command-line interface that lets them automate routine tasks and make broad changes across the email system.
One particular feature in PowerShell, the -Credential parameter, allows administrators to connect to Exchange Online using stored usernames and passwords. However, passwords are considered outdated for verifying identity, so Microsoft is promoting more secure authentication methods instead.
Microsoft had originally planned to remove this password-based login option in July 2026, which would have required administrators to update their systems. The company has now pushed that deadline back to December 2026, giving IT teams more time to make these changes before their existing tools stop working.