Cfx.re's deprecation of the xbl: and live: player identifiers takes effect today, April 27, 2026 — about two weeks after the announcement. If your FiveM server uses these identifier types in ban lists, anti-cheat scripts, or account linking, the IDs disappear from GetPlayerIdentifiers returns starting now. Most servers won't notice. The ones that will, will notice the moment a banned player walks back through the door.
Release Date
Cfx.re announced the deprecation on April 14, 2026 in a forum post titled "Deprecation Notice: Xbox Live and Microsoft Player Identifiers." The change goes live April 27, 2026. The two-week window was Cfx.re's deliberate runway for server owners to audit their resources.
What Changes Today
The GetPlayerIdentifiers native — the workhorse function every serious FiveM server uses to fingerprint connecting players — no longer returns:
xbl:— Xbox Live IDlive:— Microsoft PUID (Passport Unique Identifier)
Everything else stays. steam:, license:, license2:, discord:, fivem:, and ip: continue to work exactly as before. The function signature does not change; only the contents of the returned table do.
Why Cfx.re Is Removing These Identifiers
The official line from Cfx.re is "ongoing efforts to improve platform integrity and protect our players' privacy." Both identifiers originate from Microsoft's account system and have, over the years, become a vector for scraping and cross-referencing player accounts in ways that go well beyond the moderation use cases server owners care about. Removing them from the public surface narrows that exposure without touching the identifiers that actually do most of the work for ban systems.
Who's Affected — and Who Isn't
Cfx.re's own assessment is that "the majority of servers" will see no impact. Here's the rough breakdown:
- Not affected: Most ESX, QBCore, and qb-target frameworks. They lean on
license:andsteam:for primary identification. - Possibly affected: Custom ban scripts that hash and store every identifier returned, then check incoming connections against the full set. If your check logic uses
ORacross identifiers, the absence of the two won't break anything — it just narrows the match surface. - Definitely affected: Any resource that explicitly parses or requires
xbl:orlive:substrings. Older bespoke anti-cheats and a handful of multi-server account linkers fall into this bucket.
How to Audit Your Server in 30 Minutes
Open every resource that calls GetPlayerIdentifiers and grep for the two strings. A practical checklist:
- Run
grep -r "xbl:" resources/andgrep -r "live:" resources/across your full server directory. - Inspect every hit. Most will be in admin tools, ban systems, account linkers, or whitelists.
- For each hit, confirm the surrounding logic gracefully handles the identifier being absent. If it errors or silently returns false, you have work to do.
- Replace any single-identifier check with a fallback chain:
fivem:→discord:→license:.
If you store identifier history in a database, no migration is required — old xbl: and live: rows will simply stop receiving new entries. They remain valid lookups for prior bans, but new offenders won't generate them.
What to Use Instead
Cfx.re's recommended priority order, confirmed across the documentation and the deprecation thread:
fivem:— the Cfx.re User ID. Tied to the player's Cfx.re account, hardest to spoof or rotate.discord:— only present when the player has Discord running. Strong signal when available.license:— Rockstar Online Services hash. Rotates when the player reinstalls or changes regions, but still useful as a secondary check.steam:— only present for Steam launches. Solid for Steam-only communities.
Avoid relying on ip: for bans. It punishes household co-players and rotates on most ISPs.
The Bigger Picture: GTAV Enhanced and OneSync
This deprecation lands inside a larger Cfx.re push. The team is wrapping up FiveM support for GTAV Enhanced — Rockstar's modernized PC build — and that release rebuilds the platform around a refreshed OneSync that targets up to 2,048 players per server. Server owners can expect lower bandwidth and CPU per player, more stable sync at high counts, and parts of the FiveM codebase moving from open source to a closed, maintained core.
The identifier cleanup is a tidy preparatory step. Trimming legacy attack surface before a major platform shift means fewer compatibility footguns when the new build lands for general use.
What This Means for Your Server
- Audit window: today. The change is live; don't wait for a player report to discover something broke.
- No restart required. This is a server-side platform change, not a build update. Your artifacts version and game cache do not need touching.
- Test ban flows first. Issue a test ban against a staging player, reconnect, and confirm the ban triggers off
fivem:orlicense:rather thanxbl:. - Communicate to admins. Anyone who manually pulls identifier strings from logs should know which two will stop appearing.
- Plan for OneSync. If you've been considering a slot bump, the upcoming Enhanced build is the moment to plan capacity.
Verdict: A Small Change With Outsized Risk
On paper this is a two-line patch note. In practice it's the kind of change that surfaces every shortcut your community has accumulated over the years. Most servers will be fine. The ones that aren't will hear about it from the first banned player who slips back through the door — and by then the audit takes longer because you're hunting in production.
Spend thirty minutes today. Save your moderation team a weekend later.
Host Your FiveM Server with DoomHosting
DoomHosting runs FiveM on the latest CitizenFX artifacts with one-click txAdmin, full SSH/FTP, automatic backups, and DDoS protection on every node. Whether you're running a 32-slot RP server or planning the jump to OneSync at 2,048 slots, our infrastructure is built for it.
Today's identifier cleanup is a small thing. The platform shift it sits inside isn't.
