Edited 26 March 2026 with latest fix packs and FAQs
Microsoft has announced the deprecation of Azure ACS (Access Control Services) for SharePoint Online, effective 2 April 2026. However, we are observing that some SharePoint Online tenants are already experiencing the impact of this deprecation ahead of the official retirement date.
In affected tenants:
- The K2 for SharePoint Registration Wizard fails during registration.
- Active Site Collections fail when trying to ensure the SharePoint token.
- SPFx Migration Tool fails on migrating event receivers.
- The failure presents as an SharePoint Auth Error.
- This appears to be related to ACS-based authentication no longer being accepted in certain SharePoint Online environments.
The recommended solution is to move to the K2 for SharePoint SPFx integration, and migrate existing SharePoint add-in solutions using the released migration tool. (https://help.nintex.com/en-US/K2cloud/userguide/current/Content/K2-for-SharePoint/MigrationTool.htm)
For Nintex K2 Cloud customers:
- A fix was released in K2 Cloud U22 Fix Pack 6 to prevent duplicate process instances triggered from the legacy remote event receivers. Another fix was released in K2 Cloud U22 Fix Pack 7 for an issue when activating a new SharePoint site. You can request this fix pack be applied to your K2 Cloud environment through a support ticket.
- The K2 for SharePoint SPFx Migration Tool v1.4 for K2 Cloud has also been released. For more information on migrating your K2 for SharePoint solutions and to download the SPFx migration tool, see the documentation at https://help.nintex.com/en-US/k2cloud/userguide/current/Content/K2-for-SharePoint/MigrationTool.htm
For Nintex K2 Five (on-prem) customers:
- A fix was released to configure a setting to correct object reference errors when interacting with ACS on the Registration Wizard and Activate Site Collection K2 pages. These fixes are available in:
* K2 (5.8) Fix Pack 27 (Download here)
* K2 (5.8.1) Fix Pack 14 (Download here)
* K2 (5.9) Fix Pack 04 (Download here) - A fix was released to resolve starting duplicate process instances. These fixes are available in:
* K2 (5.8) Fix Pack 29 (Download here)
* K2 (5.8.1) Fix Pack 15 (Download here)
* K2 (5.9) Fix Pack 06 (Download here) - The K2 for SharePoint SPFx Migration Tool v1.1 for K2 on-prem has also been released. For more information on migrating your K2 for SharePoint solutions and to download the SPFx migration tool, see the documentation at https://help.nintex.com/en-US/nintexautomation/userguide/current/Content/K2-for-SharePoint/MigrationTool.htm
We are continuing to work on fixes to address potential duplicate process instances being triggered from legacy remote event receivers. You can log a support ticket to receive manual workaround procedures if you are impacted.
This post will be updated when additional fixes are available. Last updated 19 March 2026.
Additional FAQ
Q. Does this ACS issue impact customers using Entra ID without SharePoint Online integration? For example, if you use Entra ID as a user directory and have deployed the app to register the integration, will you have to change anything if you do not actually integrate with SharePoint Online?
A. No, if you do not integrate with SharePoint Remote Event Receivers, you should not encounter this issue.
Q. How can I tell which version of K2 I am on?
A. There are several ways to see which version of K2 you are running, refer to:
Q. How can I tell if I’m using SharePoint Online vs. SharePoint on-prem?
A. Running a scan with the SharePoint SPFx Migration Tool will identify which K2 assets integrate with SharePoint Online. There are a few additional ways:
1. If your SharePoint site URLs end with “sharepoint.com” then you are integrating with SharePoint Online. If your SharePoint site URLs are something custom, like “sharepoint.mycompany.org” then you are integrating with SharePoint on-premises, and are not impacted by this Microsoft add-in deprecation.
2. If you want to see which K2 assets integrate with SharePoint Online, you can use the Package and Deployment tool. When you select a workflow or a form, the referenced SmartObjects are automatically included in the package. This allows you to see specific dependencies, and again, if the URL includes “sharepoint.com”, it’s SharePoint Online.
3. If you are a K2 on-premises customer, you can use the SmartObject Tester Tool and search for SmartObjects dependent on the SharePoint Online service instance.
Q. If we have a K2 development and production environment both integrated with SharePoint Online, will there be an impact to the production site collections while we test the migration on the development site collections?
A. No. The SPFx Migration Tool will only modify the settings contained in the K2 database on the respective environment. Each K2 DB is separate between K2 environments.
If there are no RERs (Remote Event Receivers) or Form URLs used, then nothing changes in SharePoint. Each site will have its own K2 settings list in SharePoint to point to the corresponding K2 environment.
If you want to control which sites get the new SPFx app, when you add the SPFx app select to not deploy to all site collections. Instead, add it directly to the app catalog, and then to each site collection on the SharePoint Online tenant as you run the migration tool.
Q. What if I’m only integrating SharePoint with K2 via SmartObjects and do not use any Remote Event Receivers or replaced any SharePoint forms with SmartForms?
A. In this scenario, the runtime will not impacted by this Microsoft add-in deprecation. Your K2 solutions will continue to run without any migration work needed. However, at design time, meaning the SharePoint app integration, the ribbon items, and integration on the SharePoint side must be migrated to the SPFx app. After Microsoft deprecates the add-in capabilities, you will not be able to activate or register new SharePoint sites without this.
Q. What if I embed K2 SmartForms in our SharePoint site using an iFrame? Is that impacted?
A. No, that is not impacted and will continue to function after the ACS deprecation.
Q. How can I tell if I’m even integrated with SharePoint at all? Is there a quick way to check?
A. Yes! In K2, if you do not have a category named SharePoint 2013, then you have never run a SharePoint registration wizard or activated any sites. You can see this in the K2 Designer or in K2 Management by expanding the categories node.
You can also go to Service Instances in K2 Management and use the Quick Search to search for items with “SharePoint 2013” as a service type. If there are service instances where the name includes “sharepoint.com”, then you have integrated with SharePoint Online and must run the Migration Tool to ensure your K2 solutions keep working.
Q. Can I get an extension from Nintex?
A. No, this deprecation is on the Microsoft side and not on the Nintex K2 side. We cannot impact when Microsoft will roll this out to your SharePoint Online tenant.