Microsoft retired Azure Access Control Service (ACS) authentication and SharePoint 2013 workflows on April 2, and blocked the creation of new Project Online instances the day before. The full data-access shutdown doesn’t arrive until September 30, but the April retirements already broke the integrations many organisations depend on: dashboards authenticating through ACS are returning errors, approval workflows running on the SharePoint 2013 engine have stopped executing, and teams are only now realising that the foundations underneath their working processes were on a different deprecation timeline to the product itself.
Project Online is the specific product being decommissioned, but the pattern it exposes is older and more structural than any single platform retirement. Organisations built critical project management workflows on top of Microsoft-controlled extensibility points: SharePoint Add-Ins, Azure ACS, the SharePoint 2013 workflow engine. These were the tools Microsoft provided, and using them wasn’t a mistake, but treating them as permanent infrastructure was.
Microsoft’s official messaging centres on September 30 as the retirement date. That framing gives organisations a false sense of remaining runway. The April 2 retirements already broke the parts of their environment that sat outside the default product: anything authenticating through ACS stopped working, and any process running on the SharePoint 2013 workflow engine stopped executing. Migration partners consistently estimate three to six months for a Project Online transition. Anyone who started planning after the April breakages is working against a timeline that was already tight before the auth layer disappeared.
The same pattern keeps repeating
The same dynamic repeats across every platform that offers extensibility through proprietary mechanisms. Integrations become invisible load-bearing walls. Nobody maps them because they work, and nobody tests what happens when the platform beneath them moves. This is what played out with App-V, where organisations built application delivery pipelines around a virtualisation technology Microsoft subsequently deprioritised. It played out with InfoPath, where forms and data collection workflows built over years became migration liabilities when Microsoft announced the end of life. SharePoint Add-Ins more broadly are going through it right now, as the entire legacy extensibility model gets replaced.
In each case, the organisations that got caught were using the vendor’s recommended approach at the time. The risk wasn’t in the technology choice but in the failure to treat platform extensibility as a dependency that requires the same lifecycle management as any other architectural component.
Migration doesn’t fix the underlying problem
Microsoft’s recommended replacements each carry trade-offs that the retirement announcement doesn’t fully surface. Planner Premium is the most prominent successor, but it doesn’t yet replicate all of Project Online’s enterprise capabilities, and filling the gaps in resource management and portfolio planning means building on Power Platform. Organisations that want a closer feature match can move to Project Server Subscription Edition, but that’s an on-premises deployment with its own support lifecycle ending in 2031, so they’re signing up for another migration within five years. Dynamics 365 Project Operations exists as an option but is priced significantly higher and built for a different use case than most PMOs need.
None of these paths automatically migrate the integrations that organisations built around Project Online. Those have to be rebuilt, and rebuilding them means first understanding what they are.
When Microsoft announced the Azure ACS deprecation in late 2023, organisations had over two years to migrate their authentication. The ones scrambling now either didn’t know they had ACS dependencies or didn’t treat the deprecation notice as actionable. Both failures come from the same place: integrations get built by project teams, maintained informally, and rarely documented in a way that connects them back to the platform layers they depend on. When a vendor retires an authentication mechanism or a workflow engine, the teams who need to respond often don’t find out until something breaks.
Automated, continuous discovery of what’s running, what it connects to, and which vendor-controlled layers sit underneath it is the only version of this that scales. Organisations with that visibility can treat a deprecation notice as a planning input rather than an incident.
If your organisation hasn’t inventoried what its Project Online integrations actually depend on, September is five months away and the auth and workflow layers underneath the platform are already gone.
