In September 2026, NTLM support will be removed from libcurl, which Git uses for HTTPS operations. This directly impacts Azure DevOps Server (on-premises) customers who rely on NTLM authentication — including those who may unknowingly depend on it via SPNEGO/Negotiate silent fallback. The post explains how to detect whether your Git connections are using NTLM or Kerberos (via klist, GIT_TRACE_CURL, or a PowerShell token inspection snippet), and outlines migration steps: properly configuring Kerberos end-to-end with correct SPNs, IIS settings, and domain controller connectivity. For environments where Kerberos is not feasible (workgroup machines, non-domain-joined clients), SSH is recommended as an alternative. Downgrading Git or re-enabling NTLM after removal are explicitly discouraged.
