SharePoint ACS Retirement – Guidance Needed for Migration to Azure AD / Graph or Better if Available

We have an integration between Microsoft Dynamics 365 Business Central (AL) and SharePoint Online for uploading and accessing files in document libraries.

Current Implementation

App Registration & Permissions

App created using:
/_layouts/15/appregnew.aspx
Permissions granted via:
/_layouts/15/appinv.aspx → “Trust It”

Current permission (overly broad):

Authentication (ACS Token)

We generate access tokens using:

POST https://accounts.accesscontrol.windows.net/{tenant-id}/tokens/OAuth/2

SharePoint API Usage

We are using SharePoint REST API:

Upload file:

POST https://<org>.sharepoint.com/sites/<site>/_api/web/GetFolderByServerRelativeUrl('/sites/<site>/Shared Documents')/Files/add(url='file.pdf',overwrite=true)

Download / read files:

GET https://<org>.sharepoint.com/sites/<site>/_api/web/GetFileByServerRelativeUrl('/sites/<site>/Shared Documents')/Files...

Questions

After April 2026, will existing ACS-based integrations completely stop working, or only new registrations will be blocked?
What is the recommended modern approach for this scenario:
- Continue using SharePoint REST API with Azure AD token
- OR migrate fully to Microsoft Graph API
If we switch to Azure AD authentication:
- Can we continue using existing _api/web/... endpoints?
- Or is Graph API mandatory?
What is the best way to restrict access to a single SharePoint site (avoid tenant-wide permissions like FullControl)?
For Business Central (AL), is there any recommended approach or pattern for:
- Generating Azure AD tokens (client credentials flow)
- Calling SharePoint / Graph APIs securely

Any guidance, best practices, or migration examples would be highly appreciated.

If possible pls share some Blogs or resource when this overall new process is explain so that i can can a hit and start the development.

Forum Discussion