Security standards never stand still and neither does the ecosystem that supports them. Beginning in September 2026, Git’s underlying HTTP library, libcurl, will remove support for NTLM authentication. This change has important implications for organizations running Azure DevOps Server that still rely on NTLM for Git authentication.
About NTLM
NTLM is a legacy Windows authentication protocol that has been gradually phased out across the industry in favor of stronger, more modern authentication mechanisms. As part of that broader security effort, the libcurl project is removing NTLM support entirely.
Because Git uses libcurl for HTTPS operations, future Git releases will no longer be able to authenticate with Azure DevOps Server using NTLM. Once those versions are adopted, Git operations such as clone, fetch, pull, and push over HTTPS will fail in environments that depend on NTLM authentication. Instead, validation will be done using Kerberos. Kerberos is more secure and is widely used in enterprise environments.
This change impacts Azure DevOps Server teams using Git over HTTPS with NTLM authentication or environments in which Kerberos is not fully enabled, validated, or configured. If you’re using Azure DevOps Services, this announcement does not affect you.
It’s also worth noting that some organizations may believe they’re already using Kerberos when, in reality, authentication silently falls back to NTLM. That means it’s worth validating your configuration now rather than assuming you’re unaffected.
Planning Ahead
Authentication changes can be deceptively quiet. Everything works until a routine Git upgrade suddenly breaks developer workflows. Although the removal doesn’t take effect until September 2026, this is a great opportunity to verify your authentication configuration. It’s also an opportunity to plan any required changes before developers encounter unexpected failures.
Here are some recommendations for Azure DevOps Server administrators:
- Verify whether Git clients are currently authenticating with NTLM.
- Confirm that Kerberos is configured correctly rather than relying on NTLM fallback.
- Migrate environments that still depend on NTLM to supported authentication methods well before the deadline.
- Test developer workflows with updated Git clients to ensure authentication continues to work as expected.
Taking time now to validate your environment gives you the opportunity to identify hidden NTLM dependencies, update your configuration on your own schedule, and avoid last-minute disruptions as newer Git versions become standard across developer machines and build agents. For more information or to get started validating your environment, contact our team of experts here at PRAKTIK.