KBY Technologies Logo

Admin deadlines

What Microsoft and Apple are retiring, changing or enforcing, and when

One list for endpoint and identity admins: Intune, Entra ID, Exchange Online, Windows, PowerShell and Apple device management. Each entry says who is affected and what to do, and quotes the vendor line that gives the date.

Next 90 days
11
Upcoming in total
19
Passed in the last 6 months
17

Each date is quoted from the vendor’s own page. Dates move; check the source before you act. Where a vendor gives only a month or a rough period, we show that, not a made-up day. Checked 9 Nov 2026.

Upcoming

November 2026

Q4 2026This quarterMicrosoftEnd of supportVendor gives an approximate period only

Intune moves to macOS 15 and later

IntunemacOS

Who is affected
Organisations enrolling Macs with Intune. New Macs on macOS 14 or earlier will not be able to enrol; Macs already enrolled stay enrolled but are no longer supported.
What to do
  1. Filter Devices > All devices by macOS and add the OS version column to find Macs on macOS 14.x or earlier.
  2. Upgrade those Macs to macOS 15 or later, or replace hardware that cannot run it.
  3. Upgrade spare and new-stock Macs before they are handed out, so enrolment does not fail.
Source
Plan for change: Intune is moving to support macOS 15 and higher later this year“Later in calendar year 2026, we expect macOS Golden Gate 27 to be released by Apple. Microsoft Intune, the Company Portal app, and the Intune mobile device management agent support macOS 15 and later.”
In development for Microsoft Intune (Microsoft Learn)
Updated minimum supported version for macOS“Microsoft Intune will update its minimum supported macOS version after Apple releases macOS 27. Intune, the Company Portal, and the Intune management agent will support macOS 15 and later.”
In development for Microsoft Intune (Microsoft Learn)

On KBY:Intune vs Jamf for Mac management

Checked 9 Nov 2026 Link to this deadline

This monthMicrosoftDeprecationVendor gives the month only

SAP SuccessFactors provisioning: move from basic auth to workload identity

Entra ID

Who is affected
Organisations using Entra provisioning from SAP SuccessFactors to Active Directory or Entra ID, or writeback to SuccessFactors, with basic authentication.
What to do
  1. Open each SuccessFactors provisioning app and check which authentication method it uses.
  2. Switch the connectivity settings to workload identity-based authentication and test a provisioning cycle.
  3. Remove the stored SuccessFactors service account password once the switch works.
Source
Plan for change - Switch from basic auth to workload identity based auth for SAP SuccessFactors provisioning integrations“If you are currently using basic authentication for any of the above SAP SuccessFactors provisioning integrations, you must upgrade to workload identity-based authentication before November 2026 to ensure uninterrupted operation of the integrations.”
Microsoft Entra releases and announcements (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

This monthMicrosoftChangeVendor gives the month only

Intune November release: JIT registration reminder at APNs renewal and automatic JIT for eligible tenants

IntuneiOS/iPadOS

Who is affected
Intune tenants that manage iOS/iPadOS devices. Every tenant sees the acknowledgment when renewing the Apple MDM push certificate; eligible tenants also get just-in-time (JIT) registration switched on automatically.
What to do
  1. Check that your Apple MDM push certificate renewal owner knows to expect the new acknowledgment.
  2. Review your iOS/iPadOS SSO extension policy and confirm the JIT registration configuration.
  3. Test registration from a work app on one personal and one corporate iPhone.
Source
JIT registration reminder during Apple MDM push certificate renewal for iOS and iPadOS“Beginning with the November 2026 release, Intune will display a new acknowledgment when you renew an Apple MDM push certificate in the Microsoft Intune admin center.”
In development for Microsoft Intune (Microsoft Learn)
Just-in-time registration automatically enabled for eligible iOS/iPadOS tenants“Microsoft Intune will automatically enable just-in-time (JIT) registration for eligible iOS/iPadOS tenants with the 2611 release.”
In development for Microsoft Intune (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

TomorrowMicrosoftEnd of support

PowerShell 7.4 (LTS) and 7.5 reach end of support

PowerShell

Who is affected
Admin workstations, automation servers and scheduled tasks running PowerShell 7.4 or 7.5, including scripts that use the Microsoft Graph PowerShell SDK or Exchange Online module. Windows PowerShell 5.1 has its own lifecycle.
What to do
  1. Run $PSVersionTable on automation hosts and build agents to find 7.4 and 7.5.
  2. Install PowerShell 7.6 (LTS) and re-test scheduled scripts and module imports.
  3. Update any pinned PowerShell versions in deployment packages or container images.
Source
“The current LTS release is PowerShell 7.6.6. The previous LTS release, PowerShell 7.4.20, is still supported until 10-Nov-2026.”
PowerShell Support Lifecycle (Microsoft Learn)
End-of-support dates for current versions (columns: version, release date, end-of-support, .NET version)“PowerShell 7.5 | 23-Jan-2025 | 10-Nov-2026 | .NET 9.0”
PowerShell Support Lifecycle (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

TomorrowMicrosoftEnd of support

Windows 11, version 23H2 Enterprise and Education reach end of updates

WindowsIntune

Who is affected
Devices running Windows 11, version 23H2 Enterprise, Education or IoT Enterprise. The November 2026 security update is the last one for these editions.
What to do
  1. Find 23H2 devices (build 22631) in Intune's All devices list or your update reports.
  2. Move them to a supported version such as 25H2 or 26H2 with a feature update policy.
  3. Check safeguard holds and app compatibility on a pilot ring first.
Source
30-Day Reminder: Windows 11, version 23H2 Enterprise and Education editions reach end of updates on November 10, 2026“On November 10, 2026, Windows 11, version 23H2 Enterprise and Education editions will reach end of updates. The November 2026 Windows security update will be the last update available for these editions.”
Windows message center (Windows release health, Microsoft Learn)
End of Servicing“Windows 11 Enterprise and Education, Version 23H2 | Windows 11 IoT Enterprise, Version 23H2 | November 10, 2026”
Ending Support in 2026 (Microsoft Lifecycle)

Checked 9 Nov 2026 Link to this deadline

January 2027

Q1 2027In 53 daysMicrosoftChangeVendor gives an approximate period only

Web-based enrolment becomes the default for user-owned iPhone and iPad

IntuneiOS/iPadOS

Who is affected
Organisations that let users enrol personal iPhones and iPads in Intune. The source says early 2027 without a day, so treat the quarter as approximate.
What to do
  1. Configure JIT registration in your iOS/iPadOS SSO extension policy before the change.
  2. Test web-based enrolment for a personal device end to end, including Conditional Access.
  3. Update user-facing enrolment instructions that tell people to install Company Portal first.
Source
JIT registration reminder during Apple MDM push certificate renewal for iOS and iPadOS“This reminder will help you prepare for web-based enrollment becoming the default for user-owned iOS and iPadOS devices in early 2027.”
In development for Microsoft Intune (Microsoft Learn)

On KBY:Microsoft Entra ID with Microsoft Intune

Checked 9 Nov 2026 Link to this deadline

In 53 daysMicrosoftEnforcementVendor gives the month only

ReFS volumes on removable media: enforcement phase

WindowsWindows Server

Who is affected
Devices that use ReFS on externally attached or removable storage. The October 2026 update started the audit phase; the January 2027 update can block affected volumes.
What to do
  1. Review the audit events added by the October 2026 update to find external ReFS volumes.
  2. Reformat or move data off unsupported external ReFS configurations before January 2027.
Source
Hardening changes for ReFS volumes on removable media“January 2027 Windows security update (Enforcement phase)”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

In 64 daysMicrosoftEnd of support

Windows 10 Enterprise LTSC 2021 reaches end of updates

Windows

Who is affected
Devices running Windows 10 Enterprise LTSC 2021, often kiosks, shop-floor and medical or lab devices. The January 2027 security update is the last one.
What to do
  1. Inventory LTSC 2021 devices and the line-of-business software each one runs.
  2. Test the workload on Windows 11 Enterprise LTSC 2024 and schedule the rebuilds.
  3. Buy ESU for devices that cannot move before January 12, 2027.
Source
90-Day Reminder: Windows 10 Enterprise LTSC 2021 will reach end of updates on January 12, 2027“On January 12, 2027, Windows 10 Enterprise LTSC 2021 will reach end of updates. The January 2027 Windows security update will be the last update available for this version.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

In 64 daysMicrosoftEnd of support

Windows Server 2016 (and WSUS on it) reaches end of updates

Windows Server

Who is affected
All editions of Windows Server 2016, including servers that host WSUS, Configuration Manager site roles, certificate services or other endpoint management infrastructure.
What to do
  1. List Windows Server 2016 machines that support endpoint management (WSUS, distribution points, NDES, connectors).
  2. Rebuild or upgrade them to Windows Server 2025.
  3. Buy ESU for Standard and Datacenter servers that cannot move in time.
Source
90-Day Reminder: Windows Server 2016 will reach end of updates on January 12, 2027“On January 12, 2027, Windows Server 2016 will reach end of updates.”
Windows message center (Windows release health, Microsoft Learn)
Products reaching End of Support“Windows Server 2016 | Windows Server Update Services for Windows Server 2016 | January 12, 2027”
Ending Support in 2027 (Microsoft Lifecycle)

Checked 9 Nov 2026 Link to this deadline

February 2027

In 84 daysAppleRetirement

Original Apple Developer ID Sub-CA expires: affected .pkg installers stop installing

macOS

Who is affected
Mac admins who deploy installer packages signed with a Developer ID certificate issued by the original Sub-CA, including in-house packages and older third-party packages in Intune, Jamf or other MDM. Notarised apps with a secure timestamp keep working.
What to do
  1. Run pkgutil --check-signature on every .pkg you deploy and note which ones chain to the original Developer ID Certification Authority.
  2. Re-sign in-house packages with a certificate from Developer ID Certification Authority (G2) and re-upload them.
  3. Ask vendors for re-signed packages and replace cached copies in your MDM before February 1, 2027.
Source
“The original Developer ID Certification Authority (Sub-CA) expires on February 1, 2027. Certificates issued by this authority will stop working on that date.”
Upcoming expiration of Developer ID Certification Authority (Sub-CA) (Apple Developer News)
“Installer packages (.pkg): Starting February 1, 2027, .pkg files signed with an affected certificate will no longer install.”
Upcoming expiration of Developer ID Certification Authority (Sub-CA) (Apple Developer News)

On KBY:Intune vs Jamf for Mac management

Checked 9 Nov 2026 Link to this deadline

In 85 daysMicrosoftEnd of support

Entra Connect Sync 2.5.190.0 reaches end of support

Entra IDActive Directory

Who is affected
Sync servers still on Entra Connect Sync 2.5.190.0. Version 2.6.1.0 follows on 10 Mar 2027; each 2.x version retires 12 months after a newer one is released.
What to do
  1. Upgrade to the latest Entra Connect Sync release from the Microsoft Entra admin center.
  2. If you edited miiserver.exe.config, check the known upgrade issue on the version history page first.
Source
Retiring Microsoft Entra Connect 2.x versions (columns: version, end of support date, release date)“2.5.190.0 | 02 Feb 2027 (12 months after release of 2.6.1.0) | 19 Nov 2025”
Microsoft Entra Connect: Version release history (Microsoft Learn)
Retiring Microsoft Entra Connect 2.x versions (columns: version, end of support date, release date)“2.6.1.0 | 10 Mar 2027 (12 months after release of 2.6.3.0) | 2 Feb 2026”
Microsoft Entra Connect: Version release history (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

April 2027

In 143 daysMicrosoftRetirement

Exchange Web Services (EWS) fully disabled in Exchange Online

Exchange OnlineMicrosoft 365

Who is affected
Every remaining EWS client of Exchange Online. On-premises Exchange is not part of this retirement.
What to do
  1. Confirm the EWS usage report shows no remaining production callers.
  2. Check the parity-gap roadmap on the EWS deprecation page for features your apps still need.
Source
“Phased disablement begins October 1, 2026, with permanent retirement on April 1, 2027.”
Exchange Online service description (Microsoft Learn)
EWS deprecation timeline“April 2027: EWS is fully disabled.”
Deprecation of Exchange Web Services in Exchange Online (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

In 149 daysMicrosoftEnforcement

Entra Connect Sync: upgrade to 2.6.84.0 or later and use application-based authentication

Entra IDActive Directory

Who is affected
Every organisation running Microsoft Entra Connect Sync. Synchronisation stops after this date on servers that have not been upgraded and switched to application-based authentication.
What to do
  1. Check the installed Entra Connect Sync version on every sync server, including staging servers.
  2. Download the current build from the Microsoft Entra admin center and upgrade.
  3. Configure application-based authentication and confirm .NET Framework 4.7.2 and TLS 1.2 are in place.
Source
“Mandatory upgrade required: Upgrade Microsoft Entra Connect Sync to version 2.6.84.0 or later and configure application-based authentication by April 7, 2027.”
Microsoft Entra Connect: Version release history (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

May 2027

In 189 daysMicrosoftEnforcement

Windows Update certificate rotation: Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and 2016

WindowsWindows Server

Who is affected
Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 devices that get updates directly from Windows Update. Devices updated through WSUS are not affected by this change.
What to do
  1. Install the July 2026 security update or later on these devices before May 17, 2027.
  2. Find devices that have stopped patching: without the replacement certificates they lose access to Windows Update.
Source
Prepare for Windows Update certificate rotation in 2027“Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016: Install the July 2026 security update or later before May 17, 2027.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

June 2027

In 222 daysMicrosoftEnforcement

Windows Update certificate rotation: Windows 11, Windows Server 2022/2025 and other in-support Windows 10

WindowsWindows Server

Who is affected
In-support Windows 11, Windows Server 2022 and 2025, and in-support Windows 10 devices that are behind on monthly updates. Windows 11, version 25H2 and later need no action.
What to do
  1. Windows 11, version 24H2 and Windows Server 2025: install the September 2025 security update or later.
  2. Other in-support Windows 11, Windows Server 2022 and Windows 10: install the July 2026 security update or later.
  3. Upgrade any out-of-support Windows version, which will lose access to Windows Update.
Source
Prepare for Windows Update certificate rotation in 2027“Certificates used to establish trusted connections to Windows Update will expire on May 17, 2027 and June 19, 2027. Devices must contain the replacement certificates to continue receiving updates after the applicable expiration date.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

September 2027

October 2027

In 337 daysMicrosoftEnd of support

Windows 10 Extended Security Updates: Year 2 ends

Windows

Who is affected
Organisations paying for Windows 10 ESU Year 2. Year 3 is the last year available and runs to October 10, 2028.
What to do
  1. Decide before renewal which remaining Windows 10 devices justify a Year 3 purchase.
  2. Set a migration date for every remaining Windows 10 device and track it.
  3. Check that ESU keys are activated on the devices that need them, not just purchased.
Source
ESU Availability and End Dates (columns: product, ESU start, Year 1 end, Year 2 end, Year 3 end, update type)“Windows 10*** | October 14, 2025 | October 13, 2026 | October 12, 2027 | October 10, 2028 | Critical, Important”
Extended Security Updates FAQ (Microsoft Lifecycle)

Checked 9 Nov 2026 Link to this deadline

In 337 daysMicrosoftEnd of support

Windows 11, version 24H2 Enterprise and Education reach end of servicing

WindowsIntune

Who is affected
Devices running Windows 11, version 24H2 Enterprise, Education or IoT Enterprise.
What to do
  1. Plan a feature update to 25H2 or 26H2 well before the date.
  2. Use Intune feature update policies or Autopatch rings so devices do not sit on 24H2.
  3. Note that 24H2 non-security preview updates already ended in September 2026.
Source
End of Servicing“Windows 11 Enterprise and Education, Version 24H2 | Windows 11 IoT Enterprise, Version 24H2 | October 12, 2027”
Ending Support in 2027 (Microsoft Lifecycle)
Windows 11, version 24H2 (Home and Pro) and Windows 10 LTSB 2016 have reached end of updates“Windows 11, version 24H2 Enterprise and Education remain supported until October 12, 2027.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

In 337 daysMicrosoftEnd of support

Windows 11, version 25H2 Home and Pro reach end of updates

Windows

Who is affected
Devices on Windows 11, version 25H2 Home, Pro, Pro Education or Pro for Workstations. Enterprise and Education editions of 25H2 are supported for a further year.
What to do
  1. Identify Pro-edition devices in your fleet; they follow the 24-month lifecycle, not the 36-month one.
  2. Plan their move to 26H2 during 2027.
Source
Windows 11 current versions by servicing option (columns: version, servicing option, availability date, end of updates for Home/Pro/Pro Education/Pro for Workstations, end of updates for Enterprise/Education/IoT Enterprise/Enterprise multi-session)“25H2 | General Availability Channel | 2025-09-30 | 2027-10-12 | 2028-10-10”
Windows 11 release information (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

Put these dates in your calendar

The calendar feed includes every deadline and refreshes daily in Outlook, Apple Calendar and Google Calendar. Each event carries the actions and the source link.

Download .ics JSON

webcal://www.kbytechnologies.com/deadlines/calendar.ics

Embed the next deadlines on your intranet

Paste this into a SharePoint embed web part or any page that allows iframes. Add &limit=10 to the URL for more rows.

<iframe src="https://www.kbytechnologies.com/deadlines/embed" title="Upcoming Microsoft and Apple admin deadlines" width="400" height="460" loading="lazy" style="width:100%;max-width:480px;border:1px solid #e2e8f0;border-radius:12px"></iframe>

Recently passed

Dates from the last 6 months. If one of these still applies to you, you are already past the vendor’s date.

9 days agoMicrosoftEnforcement

Intune enforces Google's updated Strong Integrity verdict for Android 13 and later

IntuneAndroid

Who is affected
Users on Android 13 or later targeted by app protection or compliance policies that require Strong Integrity. Devices without a security update in the past 12 months no longer meet it and can be blocked or marked noncompliant.
What to do
  1. Use the app protection status report to find devices with an old Android security patch date.
  2. Set Min OS version and Min patch version conditional launch settings to warn before you block.
  3. Set the Minimum security patch level compliance setting and tell affected users to update.
Source
Plan for Change: Google Play strong integrity definition update for Android 13 or above“Microsoft Intune will enforce this change by October 31, 2026.”
In development for Microsoft Intune (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

14 days agoMicrosoftRetirement

Intune removes legacy Apple MDM software update policies

IntunemacOSiOS/iPadOS

Who is affected
Intune admins who still manage iOS/iPadOS or macOS updates with legacy MDM software update policies or the update-delay restriction settings. Apple removed the underlying commands and payloads in OS 27.
What to do
  1. Recreate update rules as declarative device management (DDM) software update policies in the settings catalog.
  2. Check that every Apple device group is covered by a DDM update policy before deleting the old policies.
  3. Re-check deferral settings: the legacy restriction keys for delaying updates were removed in OS 27.
Source
Week of October 26, 2026 (Service release 2610)“Microsoft Intune is removing legacy Apple MDM software update workloads after Apple retired the underlying commands and payloads in OS 27. Admins should use Apple declarative device management update policies to continue managing software updates.”
What's new in Microsoft Intune (Microsoft Learn)
Changes in 27.0“Removed: mdm/commands/system.update.schedule.yaml”
apple/device-management CHANGES.md (Apple, GitHub)

On KBY:Intune vs Jamf for Mac management

Checked 9 Nov 2026 Link to this deadline

14 days agoMicrosoftRetirement

Intune ends Setup Assistant (legacy) authentication for Apple automated device enrollment

IntunemacOSiOS/iPadOS

Who is affected
Organisations using Apple automated device enrollment (ADE) profiles with user affinity that still authenticated with Setup Assistant (legacy). Existing profiles move to modern authentication; enrolled devices stay enrolled.
What to do
  1. Open each ADE profile with user affinity and confirm it now shows Setup Assistant with modern authentication.
  2. Enrol one test iPhone and one test Mac to check MFA and Conditional Access prompts during Setup Assistant.
  3. Update enrolment guides and helpdesk scripts that describe the old sign-in screens.
Source
Week of October 26, 2026 (Service release 2610)“Intune has ended support for Setup Assistant (legacy) authentication for iOS/iPadOS and macOS automated device enrollment (ADE) with user affinity to align with modern authentication standards.”
What's new in Microsoft Intune (Microsoft Learn)

On KBY:Intune vs Jamf for Mac management

Checked 9 Nov 2026 Link to this deadline

21 days agoMicrosoftEnd of support

Secure Boot: Microsoft Windows Production PCA 2011 expires

WindowsWindows Server

Who is affected
Windows devices whose boot manager still relies on the 2011 Windows Production PCA. The replacement is Windows UEFI CA 2023, which signs the Windows boot loader.
What to do
  1. Confirm devices report the Windows UEFI CA 2023 certificate in the Secure Boot database.
  2. Expect one extra restart on some devices when the Secure Boot certificate update applies.
  3. Refresh boot media, PXE images and VM templates so they boot with the new certificate chain.
Source
Secure Boot certificates expiring in 2026“Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 | Stored in DB | Used for signing the Windows boot loader.”
Manage Secure Boot certificate updates (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

27 days agoMicrosoftEnd of support

Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 reach end of updates

Windows

Who is affected
Devices on Windows 11, version 24H2 Home or Pro, and devices on Windows 10 Enterprise LTSB 2016. Windows 11, version 24H2 Enterprise and Education stay supported until October 12, 2027.
What to do
  1. Update Windows 11 Pro devices on 24H2 to 25H2 or 26H2.
  2. Move LTSB 2016 devices to Windows 11 Enterprise LTSC 2024, or buy ESU while you migrate.
  3. Remember that Home and Pro editions get 24 months of updates per version, against 36 for Enterprise and Education.
Source
Windows 11, version 24H2 (Home and Pro) and Windows 10 LTSB 2016 have reached end of updates“Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of updates.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

27 days agoMicrosoftEnd of support

Windows 10 Extended Security Updates: Year 1 ends

Windows

Who is affected
Organisations whose Windows 10 Enterprise, Education or Pro (commercial use) devices were covered only by Year 1 of ESU. Without Year 2, those devices stop receiving security updates.
What to do
  1. List Windows 10 devices still in use and confirm which ones have a Year 2 ESU key activated.
  2. Buy Year 2 for devices that cannot move yet; ESU is cumulative, so a late start still pays for Year 1.
  3. Prioritise upgrading or replacing the devices that have no ESU coverage.
Source
ESU Availability and End Dates (columns: product, ESU start, Year 1 end, Year 2 end, Year 3 end, update type)“Windows 10*** | October 14, 2025 | October 13, 2026 | October 12, 2027 | October 10, 2028 | Critical, Important”
Extended Security Updates FAQ (Microsoft Lifecycle)

Checked 9 Nov 2026 Link to this deadline

27 days agoMicrosoftEnd of support

Office 2021 and Office LTSC 2021 reach end of support

OfficeMicrosoft 365

Who is affected
Devices running perpetual Office 2021 or Office LTSC 2021 apps (Word, Excel, Outlook, PowerPoint, Access, Project, Visio and related products).
What to do
  1. Inventory Office 2021 and LTSC 2021 installs with Intune or Configuration Manager app inventory.
  2. Move users to Microsoft 365 Apps or a supported Office LTSC release.
Source
Product Retirements“Office 2021 | October 13, 2026”
Ending Support in 2026 (Microsoft Lifecycle)
Products reaching End of Support“Office LTSC 2021 | October 13, 2026”
Ending Support in 2026 (Microsoft Lifecycle)

Checked 9 Nov 2026 Link to this deadline

Passed (October 2026)MicrosoftEnforcementVendor gives the month only

NTLMv1-derived credentials for single sign-on restricted by default

WindowsWindows Server

Who is affected
Windows 11 (24H2, 25H2, 26H2) and Windows Server 2025 devices with Credential Guard disabled that connect to Wi-Fi, Ethernet or VPN using MS-CHAPv2. Single sign-on to those networks can fail.
What to do
  1. Find Wi-Fi, wired 802.1X and VPN profiles that use MS-CHAPv2 (PEAP-MSCHAPv2).
  2. Move them to certificate-based authentication, for example EAP-TLS with Intune-issued certificates.
  3. Use the temporary allow-and-audit registry setting in KB5066470 only while you migrate.
Source
Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard“Beginning with the October 2026 security update, Windows 11, versions 26H2, 25H2, and 24H2, along with Windows Server 2025, enforce restrictions on generating NTLMv1-derived credentials for Single Sign-On by default.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

Passed (October 2026)MicrosoftChangeVendor gives the month only

Administrator protection enabled by default in Windows 11 security baselines

WindowsIntune

Who is affected
Organisations applying the Windows 11 security baseline (26H2, 25H2 or 24H2) through Intune or Group Policy. Local admins get just-in-time elevation prompts instead of a standing admin token.
What to do
  1. Test the baseline on a pilot ring, especially for apps and scripts that elevate.
  2. Adjust the two User Account Control baseline settings in Intune or Group Policy if you need a different behaviour.
  3. Brief the helpdesk on the new elevation prompt.
Source
Manage Administrator protection within Windows 11 security baseline“If your organization uses Windows security baselines, Administrator protection becomes enabled by default with the October 2026 Windows security update.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

39 days agoMicrosoftRetirement

Exchange Web Services (EWS) phased disablement begins in Exchange Online

Exchange OnlineMicrosoft 365

Who is affected
Any application, script, add-in or device that reads or writes Exchange Online mailboxes through EWS, including third-party backup, archiving, CRM and room-booking tools.
What to do
  1. Run the EWS usage reports in the Microsoft 365 admin center to find apps still calling EWS.
  2. Ask each vendor for its Microsoft Graph release and date; migrate in-house code to Graph.
  3. Record apps with no Graph path yet and plan an alternative before April 2027.
Source
“Phased disablement begins October 1, 2026, with permanent retirement on April 1, 2027.”
Exchange Online service description (Microsoft Learn)
EWS deprecation timeline“October 2026: EWS starts to be disabled globally for all organizations.”
Deprecation of Exchange Web Services in Exchange Online (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

42 days agoMicrosoftEnd of support

Intune requires iOS/iPadOS 18 or later

IntuneiOS/iPadOS

Who is affected
Organisations managing iPhone and iPad with Intune MDM, Company Portal or app protection policies. Userless devices enrolled through automated device enrollment have a separate support statement.
What to do
  1. In Devices > All devices, filter by OS and version to find iOS/iPadOS devices below 18.
  2. For app protection users, check Apps > Monitor > App protection status and filter by platform version.
  3. Use compliance minimum OS version or app protection conditional launch to warn, then block, older versions.
Source
Week of September 28, 2026 (Service release 2609)“Microsoft Intune now requires iOS/iPadOS 18 or later for standard device-management, Company Portal, and app-protection scenarios.”
What's new in Microsoft Intune (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

Passed (July 2026)MicrosoftEnforcementVendor gives the month only

Kerberos RC4 protections move to enforcement on domain controllers

Windows ServerActive Directory

Who is affected
Active Directory domains with service accounts or applications that still depend on RC4 Kerberos tickets. Audit mode and the temporary rollback registry setting were removed with this update.
What to do
  1. Review domain controller events for service tickets still requested with RC4.
  2. Enable AES on the affected service accounts and reset their passwords so AES keys exist.
  3. Retire or upgrade applications and appliances that cannot use AES.
Source
Enforcement phase for Kerberos RC4 protections begins with the July 2026 Windows security update“The July 2026 Windows security update enables Enforcement mode across Windows domain controllers for Kerberos RC4 protections related to CVE‑2026‑20833.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

131 days agoMicrosoftEnforcement

Azure mandatory MFA Phase 2: last postponement date

Entra IDPowerShell

Who is affected
Tenants that postponed Phase 2. User accounts that create, update or delete Azure resources through Azure CLI, Azure PowerShell, the Azure mobile app, IaC tools or REST APIs must complete MFA.
What to do
  1. Move automation that signs in as a user account to managed identities or service principals.
  2. Require MFA with a Conditional Access policy so users satisfy it before they hit errors.
  3. Give break-glass accounts a passkey (FIDO2) or certificate-based authentication.
Source
Request more time to prepare for Phase 2 MFA enforcement“Microsoft allows customers with complex environments or technical barriers to postpone the enforcement of Phase 2 for their tenants until July 1st, 2026.”
Planning for mandatory Microsoft Entra multifactor authentication (Microsoft Learn)

On KBY:Conditional Access deployment checklistSecurity keys for Microsoft 365 administrators

Checked 9 Nov 2026 Link to this deadline

138 days agoMicrosoftEnd of support

Secure Boot 2011 certificates start expiring (KEK CA 2011 and UEFI CA 2011)

WindowsWindows Server

Who is affected
Windows PCs, servers and virtual machines with Secure Boot that do not yet have the 2023 certificates. They keep booting, but cannot apply future Secure Boot updates signed with the new authorities.
What to do
  1. Check certificate status per device, for example with the Secure Boot status report in Windows Autopatch.
  2. Keep devices on current monthly updates, which deliver the new certificates in phases.
  3. Ask OEMs and hypervisor vendors for firmware or template updates where the update cannot apply.
Source
Secure Boot certificates expiring in 2026“Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 | Stored in KEK | Signs updates to DB and DBX.”
Manage Secure Boot certificate updates (Microsoft Learn)
Secure Boot certificates expiring in 2026“Microsoft UEFI CA 2011 * | June 27, 2026 | Microsoft UEFI CA 2023 | Stored in DB | Signs third-party boot loaders and EFI applications.”
Manage Secure Boot certificate updates (Microsoft Learn)
Tune in May 18 to ask Microsoft anything about Secure Boot“Secure Boot certificates start expiring in June of 2026.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

156 days agoMicrosoftEnd of support

Configuration Manager version 2409 reaches end of servicing

Configuration Manager

Who is affected
Configuration Manager current branch sites still on version 2409.
What to do
  1. Check the site version in the console under Administration > Updates and Servicing.
  2. Install the latest current branch update; each version is supported for 18 months from release.
Source
End of Servicing“Microsoft Configuration Manager, Version 2409 | June 6, 2026”
Ending Support in 2026 (Microsoft Lifecycle)

Checked 9 Nov 2026 Link to this deadline

Passed (June 2026)MicrosoftChangeVendor gives the month only

Warning for iOS apps built with an Intune MAM SDK older than 20.8.0

IntuneiOS/iPadOS

Who is affected
Users of app-protected iOS apps (Microsoft and third-party, including in-house line-of-business apps) built with an Intune MAM SDK earlier than 20.8.0. The warning can be dismissed.
What to do
  1. Ask users to update Teams, Outlook, Edge, OneDrive and other protected apps from the App Store.
  2. Rebuild in-house apps with a current Intune App SDK or App Wrapping Tool.
  3. Use the Min SDK version conditional launch setting to block apps still below 20.8.0.
Source
Warning notifications for iOS apps running unsupported SDK versions“Starting in late June 2026, users opening iOS apps built with an Intune MAM SDK version earlier than 20.8.0 will see a warning message recommending they update to a supported app version for the best experience and continued compatibility.”
In development for Microsoft Intune (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

161 days agoMicrosoftEnforcement

Entra Connect and Cloud Sync blocked from hard-matching users who hold Entra roles

Entra IDActive Directory

Who is affected
Hybrid identity teams that hard-match new Active Directory users to existing cloud users. Matching is now refused when the cloud user holds a Microsoft Entra role; soft match and existing synced users are not affected.
What to do
  1. Remove Entra role assignments from a cloud user before you hard-match it, then reassign them.
  2. Check sync error reports for hard-match failures since June 2026.
  3. Keep privileged admin accounts cloud-only rather than synced from Active Directory.
Source
Upcoming change – Microsoft Entra Connect security update to block hard match for users with Microsoft Entra roles“Beginning June 1, 2026, Microsoft Entra ID will block any attempt by Entra Connect Sync or Cloud Sync from hard-matching a new user object from Active Directory to an existing cloud-managed Entra ID user object that holds Microsoft Entra roles.”
Microsoft Entra releases and announcements (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

How this list is made

  • Only dates stated on Microsoft Learn, Microsoft Lifecycle, Windows release health, Apple Developer or Apple’s published device management schema are included.
  • The quoted line is copied from that page. Where the date is only in a table, the row is quoted with cells separated by “|”.
  • Items without a vendor-stated date are left out, even when they are widely reported.
  • Days remaining are counted in UK time. A month or quarter counts as due for the whole period.