BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//KBY Technologies//Admin Deadlines//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:KBY admin deadlines
X-WR-CALDESC:Microsoft and Apple retirements\, deprecations\, enforcement d
 ates and end-of-support dates for endpoint and identity admins. Each date 
 is quoted from the vendor's own page.
X-WR-TIMEZONE:UTC
REFRESH-INTERVAL;VALUE=DURATION:P1D
X-PUBLISHED-TTL:P1D
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines
BEGIN:VEVENT
UID:entra-connect-block-hard-match-privileged-users@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20260601
DTEND;VALUE=DATE:20260602
SUMMARY:Entra Connect and Cloud Sync blocked from hard-matching users who h
 old Entra roles
DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Hybrid identity te
 ams that hard-match new Active Directory users to existing cloud users. Ma
 tching is now refused when the cloud user holds a Microsoft Entra role\; s
 oft match and existing synced users are not affected.\n\nWhat to do:\n1. R
 emove Entra role assignments from a cloud user before you hard-match it\, 
 then reassign them.\n2. Check sync error reports for hard-match failures s
 ince June 2026.\n3. Keep privileged admin accounts cloud-only rather than 
 synced from Active Directory.\n\nSources:\n- Microsoft Entra releases and 
 announcements (Microsoft Learn): https://learn.microsoft.com/en-us/entra/f
 undamentals/whats-new\n  "Beginning June 1\, 2026\, Microsoft Entra ID wil
 l block any attempt by Entra Connect Sync or Cloud Sync from hard-matching
  a new user object from Active Directory to an existing cloud-managed Entr
 a ID user object that holds Microsoft Entra roles."\n\nChecked 2026-11-09.
  Dates move\; check the source before you act.\nhttps://www.kbytechnologie
 s.com/deadlines/entra-connect-block-hard-match-privileged-users
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-connect-block
 -hard-match-privileged-users
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-ios-mam-sdk-warning@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20260601
DTEND;VALUE=DATE:20260602
SUMMARY:Warning for iOS apps built with an Intune MAM SDK older than 20.8.0
  (June 2026)
DESCRIPTION:Date: June 2026. The vendor has not published an exact day\, so
  this event sits on the first day of that month.\n\nMicrosoft · Change\n\
 nWho is affected: Users of app-protected iOS apps (Microsoft and third-par
 ty\, including in-house line-of-business apps) built with an Intune MAM SD
 K earlier than 20.8.0. The warning can be dismissed.\n\nWhat to do:\n1. As
 k users to update Teams\, Outlook\, Edge\, OneDrive and other protected ap
 ps from the App Store.\n2. Rebuild in-house apps with a current Intune App
  SDK or App Wrapping Tool.\n3. Use the Min SDK version conditional launch 
 setting to block apps still below 20.8.0.\n\nSources:\n- In development fo
 r Microsoft Intune (Microsoft Learn): https://learn.microsoft.com/en-us/in
 tune/intune-service/fundamentals/in-development\n  "Starting in late June 
 2026\, users opening iOS apps built with an Intune MAM SDK version earlier
  than 20.8.0 will see a warning message recommending they update to a supp
 orted app version for the best experience and continued compatibility."\n\
 nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps:
 //www.kbytechnologies.com/deadlines/intune-ios-mam-sdk-warning
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ios-mam-sdk-
 warning
CATEGORIES:Microsoft,Change
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:configuration-manager-2409-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20260606
DTEND;VALUE=DATE:20260607
SUMMARY:Configuration Manager version 2409 reaches end of servicing
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Configuration M
 anager current branch sites still on version 2409.\n\nWhat to do:\n1. Chec
 k the site version in the console under Administration > Updates and Servi
 cing.\n2. Install the latest current branch update\; each version is suppo
 rted for 18 months from release.\n\nSources:\n- Ending Support in 2026 (Mi
 crosoft Lifecycle): https://learn.microsoft.com/en-us/lifecycle/end-of-sup
 port/end-of-support-2026\n  "Microsoft Configuration Manager\, Version 240
 9 | June 6\, 2026"\n\nChecked 2026-11-09. Dates move\; check the source be
 fore you act.\nhttps://www.kbytechnologies.com/deadlines/configuration-man
 ager-2409-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/configuration-manag
 er-2409-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:secure-boot-2011-kek-and-uefi-ca-expiry@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20260624
DTEND;VALUE=DATE:20260625
SUMMARY:Secure Boot 2011 certificates start expiring (KEK CA 2011 and UEFI 
 CA 2011)
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Windows PCs\, s
 ervers and virtual machines with Secure Boot that do not yet have the 2023
  certificates. They keep booting\, but cannot apply future Secure Boot upd
 ates signed with the new authorities.\n\nWhat to do:\n1. Check certificate
  status per device\, for example with the Secure Boot status report in Win
 dows Autopatch.\n2. Keep devices on current monthly updates\, which delive
 r the new certificates in phases.\n3. Ask OEMs and hypervisor vendors for 
 firmware or template updates where the update cannot apply.\n\nSources:\n-
  Manage Secure Boot certificate updates (Microsoft Learn): https://learn.m
 icrosoft.com/en-us/azure-stack/operator/secure-boot-certificates?view=azs-
 2604\n  "Microsoft Corporation KEK CA 2011 | June 24\, 2026 | Microsoft Co
 rporation KEK 2K CA 2023 | Stored in KEK | Signs updates to DB and DBX."\n
 - Manage Secure Boot certificate updates (Microsoft Learn): https://learn.
 microsoft.com/en-us/azure-stack/operator/secure-boot-certificates?view=azs
 -2604\n  "Microsoft UEFI CA 2011 * | June 27\, 2026 | Microsoft UEFI CA 20
 23 | Stored in DB | Signs third-party boot loaders and EFI applications."\
 n- Windows message center (Windows release health\, Microsoft Learn): http
 s://learn.microsoft.com/en-us/windows/release-health/windows-message-cente
 r\n  "Secure Boot certificates start expiring in June of 2026."\n\nChecked
  2026-11-09. Dates move\; check the source before you act.\nhttps://www.kb
 ytechnologies.com/deadlines/secure-boot-2011-kek-and-uefi-ca-expiry
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/secure-boot-2011-ke
 k-and-uefi-ca-expiry
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:entra-mandatory-mfa-phase-2-postponement-ends@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20260701
DTEND;VALUE=DATE:20260702
SUMMARY:Azure mandatory MFA Phase 2: last postponement date
DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Tenants that postp
 oned Phase 2. User accounts that create\, update or delete Azure resources
  through Azure CLI\, Azure PowerShell\, the Azure mobile app\, IaC tools o
 r REST APIs must complete MFA.\n\nWhat to do:\n1. Move automation that sig
 ns in as a user account to managed identities or service principals.\n2. R
 equire MFA with a Conditional Access policy so users satisfy it before the
 y hit errors.\n3. Give break-glass accounts a passkey (FIDO2) or certifica
 te-based authentication.\n\nSources:\n- Planning for mandatory Microsoft E
 ntra multifactor authentication (Microsoft Learn): https://learn.microsoft
 .com/en-us/entra/identity/authentication/concept-mandatory-multifactor-aut
 hentication\n  "Microsoft allows customers with complex environments or te
 chnical barriers to postpone the enforcement of Phase 2 for their tenants 
 until July 1st\, 2026."\n\nChecked 2026-11-09. Dates move\; check the sour
 ce before you act.\nhttps://www.kbytechnologies.com/deadlines/entra-mandat
 ory-mfa-phase-2-postponement-ends
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-mandatory-mfa
 -phase-2-postponement-ends
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-kerberos-rc4-enforcement@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20260701
DTEND;VALUE=DATE:20260702
SUMMARY:Kerberos RC4 protections move to enforcement on domain controllers 
 (July 2026)
DESCRIPTION:Date: July 2026. The vendor has not published an exact day\, so
  this event sits on the first day of that month.\n\nMicrosoft · Enforceme
 nt\n\nWho is affected: Active Directory domains with service accounts or a
 pplications that still depend on RC4 Kerberos tickets. Audit mode and the 
 temporary rollback registry setting were removed with this update.\n\nWhat
  to do:\n1. Review domain controller events for service tickets still requ
 ested with RC4.\n2. Enable AES on the affected service accounts and reset 
 their passwords so AES keys exist.\n3. Retire or upgrade applications and 
 appliances that cannot use AES.\n\nSources:\n- Windows message center (Win
 dows release health\, Microsoft Learn): https://learn.microsoft.com/en-us/
 windows/release-health/windows-message-center\n  "The July 2026 Windows se
 curity update enables Enforcement mode across Windows domain controllers f
 or Kerberos RC4 protections related to CVE‑2026‑20833."\n\nChecked 202
 6-11-09. Dates move\; check the source before you act.\nhttps://www.kbytec
 hnologies.com/deadlines/windows-kerberos-rc4-enforcement
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-kerberos-rc
 4-enforcement
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-ios-ipados-18-minimum@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20260928
DTEND;VALUE=DATE:20260929
SUMMARY:Intune requires iOS/iPadOS 18 or later
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Organisations m
 anaging iPhone and iPad with Intune MDM\, Company Portal or app protection
  policies. Userless devices enrolled through automated device enrollment h
 ave a separate support statement.\n\nWhat to do:\n1. In Devices > All devi
 ces\, filter by OS and version to find iOS/iPadOS devices below 18.\n2. Fo
 r app protection users\, check Apps > Monitor > App protection status and 
 filter by platform version.\n3. Use compliance minimum OS version or app p
 rotection conditional launch to warn\, then block\, older versions.\n\nSou
 rces:\n- What's new in Microsoft Intune (Microsoft Learn): https://learn.m
 icrosoft.com/en-us/intune/intune-service/fundamentals/whats-new\n  "Micros
 oft Intune now requires iOS/iPadOS 18 or later for standard device-managem
 ent\, Company Portal\, and app-protection scenarios."\n\nChecked 2026-11-0
 9. Dates move\; check the source before you act.\nhttps://www.kbytechnolog
 ies.com/deadlines/intune-ios-ipados-18-minimum
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ios-ipados-1
 8-minimum
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:exchange-online-ews-disablement-begins@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261001
DTEND;VALUE=DATE:20261002
SUMMARY:Exchange Web Services (EWS) phased disablement begins in Exchange O
 nline
DESCRIPTION:Microsoft · Retirement\n\nWho is affected: Any application\, s
 cript\, add-in or device that reads or writes Exchange Online mailboxes th
 rough EWS\, including third-party backup\, archiving\, CRM and room-bookin
 g tools.\n\nWhat to do:\n1. Run the EWS usage reports in the Microsoft 365
  admin center to find apps still calling EWS.\n2. Ask each vendor for its 
 Microsoft Graph release and date\; migrate in-house code to Graph.\n3. Rec
 ord apps with no Graph path yet and plan an alternative before April 2027.
 \n\nSources:\n- Exchange Online service description (Microsoft Learn): htt
 ps://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-onli
 ne-service-description/exchange-online-service-description\n  "Phased disa
 blement begins October 1\, 2026\, with permanent retirement on April 1\, 2
 027."\n- Deprecation of Exchange Web Services in Exchange Online (Microsof
 t Learn): https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in
 -exchange-online/deprecation-of-ews-exchange-online\n  "October 2026: EWS 
 starts to be disabled globally for all organizations."\n\nChecked 2026-11-
 09. Dates move\; check the source before you act.\nhttps://www.kbytechnolo
 gies.com/deadlines/exchange-online-ews-disablement-begins
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/exchange-online-ews
 -disablement-begins
CATEGORIES:Microsoft,Retirement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-macos-15-minimum@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261001
DTEND;VALUE=DATE:20261002
SUMMARY:Intune moves to macOS 15 and later (Q4 2026)
DESCRIPTION:Date: Q4 2026. The vendor has not published an exact day\, so t
 his event sits on the first day of that quarter.\n\nMicrosoft · End of su
 pport\n\nWho is affected: Organisations enrolling Macs with Intune. New Ma
 cs on macOS 14 or earlier will not be able to enrol\; Macs already enrolle
 d stay enrolled but are no longer supported.\n\nWhat to do:\n1. Filter Dev
 ices > All devices by macOS and add the OS version column to find Macs on 
 macOS 14.x or earlier.\n2. Upgrade those Macs to macOS 15 or later\, or re
 place hardware that cannot run it.\n3. Upgrade spare and new-stock Macs be
 fore they are handed out\, so enrolment does not fail.\n\nSources:\n- In d
 evelopment for Microsoft Intune (Microsoft Learn): https://learn.microsoft
 .com/en-us/intune/intune-service/fundamentals/in-development\n  "Later in 
 calendar year 2026\, we expect macOS Golden Gate 27 to be released by Appl
 e. Microsoft Intune\, the Company Portal app\, and the Intune mobile devic
 e management agent support macOS 15 and later."\n- In development for Micr
 osoft Intune (Microsoft Learn): https://learn.microsoft.com/en-us/intune/i
 ntune-service/fundamentals/in-development\n  "Microsoft Intune will update
  its minimum supported macOS version after Apple releases macOS 27. Intune
 \, the Company Portal\, and the Intune management agent will support macOS
  15 and later."\n\nChecked 2026-11-09. Dates move\; check the source befor
 e you act.\nhttps://www.kbytechnologies.com/deadlines/intune-macos-15-mini
 mum
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-macos-15-min
 imum
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-administrator-protection-baseline-default@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261001
DTEND;VALUE=DATE:20261002
SUMMARY:Administrator protection enabled by default in Windows 11 security 
 baselines (October 2026)
DESCRIPTION:Date: October 2026. The vendor has not published an exact day\,
  so this event sits on the first day of that month.\n\nMicrosoft · Change
 \n\nWho is affected: Organisations applying the Windows 11 security baseli
 ne (26H2\, 25H2 or 24H2) through Intune or Group Policy. Local admins get 
 just-in-time elevation prompts instead of a standing admin token.\n\nWhat 
 to do:\n1. Test the baseline on a pilot ring\, especially for apps and scr
 ipts that elevate.\n2. Adjust the two User Account Control baseline settin
 gs in Intune or Group Policy if you need a different behaviour.\n3. Brief 
 the helpdesk on the new elevation prompt.\n\nSources:\n- Windows message c
 enter (Windows release health\, Microsoft Learn): https://learn.microsoft.
 com/en-us/windows/release-health/windows-message-center\n  "If your organi
 zation uses Windows security baselines\, Administrator protection becomes 
 enabled by default with the October 2026 Windows security update."\n\nChec
 ked 2026-11-09. Dates move\; check the source before you act.\nhttps://www
 .kbytechnologies.com/deadlines/windows-administrator-protection-baseline-d
 efault
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-administrat
 or-protection-baseline-default
CATEGORIES:Microsoft,Change
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-ntlmv1-sso-hardening@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261001
DTEND;VALUE=DATE:20261002
SUMMARY:NTLMv1-derived credentials for single sign-on restricted by default
  (October 2026)
DESCRIPTION:Date: October 2026. The vendor has not published an exact day\,
  so this event sits on the first day of that month.\n\nMicrosoft · Enforc
 ement\n\nWho is affected: Windows 11 (24H2\, 25H2\, 26H2) and Windows Serv
 er 2025 devices with Credential Guard disabled that connect to Wi-Fi\, Eth
 ernet or VPN using MS-CHAPv2. Single sign-on to those networks can fail.\n
 \nWhat to do:\n1. Find Wi-Fi\, wired 802.1X and VPN profiles that use MS-C
 HAPv2 (PEAP-MSCHAPv2).\n2. Move them to certificate-based authentication\,
  for example EAP-TLS with Intune-issued certificates.\n3. Use the temporar
 y allow-and-audit registry setting in KB5066470 only while you migrate.\n\
 nSources:\n- Windows message center (Windows release health\, Microsoft Le
 arn): https://learn.microsoft.com/en-us/windows/release-health/windows-mes
 sage-center\n  "Beginning with the October 2026 security update\, Windows 
 11\, versions 26H2\, 25H2\, and 24H2\, along with Windows Server 2025\, en
 force restrictions on generating NTLMv1-derived credentials for Single Sig
 n-On by default."\n\nChecked 2026-11-09. Dates move\; check the source bef
 ore you act.\nhttps://www.kbytechnologies.com/deadlines/windows-ntlmv1-sso
 -hardening
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-ntlmv1-sso-
 hardening
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:office-2021-and-ltsc-2021-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261013
DTEND;VALUE=DATE:20261014
SUMMARY:Office 2021 and Office LTSC 2021 reach end of support
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running
  perpetual Office 2021 or Office LTSC 2021 apps (Word\, Excel\, Outlook\, 
 PowerPoint\, Access\, Project\, Visio and related products).\n\nWhat to do
 :\n1. Inventory Office 2021 and LTSC 2021 installs with Intune or Configur
 ation Manager app inventory.\n2. Move users to Microsoft 365 Apps or a sup
 ported Office LTSC release.\n\nSources:\n- Ending Support in 2026 (Microso
 ft Lifecycle): https://learn.microsoft.com/en-us/lifecycle/end-of-support/
 end-of-support-2026\n  "Office 2021 | October 13\, 2026"\n- Ending Support
  in 2026 (Microsoft Lifecycle): https://learn.microsoft.com/en-us/lifecycl
 e/end-of-support/end-of-support-2026\n  "Office LTSC 2021 | October 13\, 2
 026"\n\nChecked 2026-11-09. Dates move\; check the source before you act.\
 nhttps://www.kbytechnologies.com/deadlines/office-2021-and-ltsc-2021-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/office-2021-and-lts
 c-2021-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-10-esu-year-1-ends@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261013
DTEND;VALUE=DATE:20261014
SUMMARY:Windows 10 Extended Security Updates: Year 1 ends
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Organisations w
 hose Windows 10 Enterprise\, Education or Pro (commercial use) devices wer
 e covered only by Year 1 of ESU. Without Year 2\, those devices stop recei
 ving security updates.\n\nWhat to do:\n1. List Windows 10 devices still in
  use and confirm which ones have a Year 2 ESU key activated.\n2. Buy Year 
 2 for devices that cannot move yet\; ESU is cumulative\, so a late start s
 till pays for Year 1.\n3. Prioritise upgrading or replacing the devices th
 at have no ESU coverage.\n\nSources:\n- Extended Security Updates FAQ (Mic
 rosoft Lifecycle): https://learn.microsoft.com/en-us/lifecycle/faq/extende
 d-security-updates\n  "Windows 10*** | October 14\, 2025 | October 13\, 20
 26 | October 12\, 2027 | October 10\, 2028 | Critical\, Important"\n\nChec
 ked 2026-11-09. Dates move\; check the source before you act.\nhttps://www
 .kbytechnologies.com/deadlines/windows-10-esu-year-1-ends
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-10-esu-year
 -1-ends
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-11-24h2-home-pro-and-ltsb-2016-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261013
DTEND;VALUE=DATE:20261014
SUMMARY:Windows 11\, version 24H2 Home and Pro\, and Windows 10 Enterprise 
 LTSB 2016 reach end of updates
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices on Wind
 ows 11\, version 24H2 Home or Pro\, and devices on Windows 10 Enterprise L
 TSB 2016. Windows 11\, version 24H2 Enterprise and Education stay supporte
 d until October 12\, 2027.\n\nWhat to do:\n1. Update Windows 11 Pro device
 s on 24H2 to 25H2 or 26H2.\n2. Move LTSB 2016 devices to Windows 11 Enterp
 rise LTSC 2024\, or buy ESU while you migrate.\n3. Remember that Home and 
 Pro editions get 24 months of updates per version\, against 36 for Enterpr
 ise and Education.\n\nSources:\n- Windows message center (Windows release 
 health\, Microsoft Learn): https://learn.microsoft.com/en-us/windows/relea
 se-health/windows-message-center\n  "Today\, October 13\, 2026\, Windows 1
 1\, version 24H2 Home and Pro\, and Windows 10 Enterprise LTSB 2016 have r
 eached end of updates."\n\nChecked 2026-11-09. Dates move\; check the sour
 ce before you act.\nhttps://www.kbytechnologies.com/deadlines/windows-11-2
 4h2-home-pro-and-ltsb-2016-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-24h2-hom
 e-pro-and-ltsb-2016-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:secure-boot-windows-production-pca-2011-expiry@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261019
DTEND;VALUE=DATE:20261020
SUMMARY:Secure Boot: Microsoft Windows Production PCA 2011 expires
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Windows devices
  whose boot manager still relies on the 2011 Windows Production PCA. The r
 eplacement is Windows UEFI CA 2023\, which signs the Windows boot loader.\
 n\nWhat to do:\n1. Confirm devices report the Windows UEFI CA 2023 certifi
 cate in the Secure Boot database.\n2. Expect one extra restart on some dev
 ices when the Secure Boot certificate update applies.\n3. Refresh boot med
 ia\, PXE images and VM templates so they boot with the new certificate cha
 in.\n\nSources:\n- Manage Secure Boot certificate updates (Microsoft Learn
 ): https://learn.microsoft.com/en-us/azure-stack/operator/secure-boot-cert
 ificates?view=azs-2604\n  "Microsoft Windows Production PCA 2011 | October
  19\, 2026 | Windows UEFI CA 2023 | Stored in DB | Used for signing the Wi
 ndows boot loader."\n\nChecked 2026-11-09. Dates move\; check the source b
 efore you act.\nhttps://www.kbytechnologies.com/deadlines/secure-boot-wind
 ows-production-pca-2011-expiry
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/secure-boot-windows
 -production-pca-2011-expiry
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-ade-setup-assistant-legacy-ended@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261026
DTEND;VALUE=DATE:20261027
SUMMARY:Intune ends Setup Assistant (legacy) authentication for Apple autom
 ated device enrollment
DESCRIPTION:Microsoft · Retirement\n\nWho is affected: Organisations using
  Apple automated device enrollment (ADE) profiles with user affinity that 
 still authenticated with Setup Assistant (legacy). Existing profiles move 
 to modern authentication\; enrolled devices stay enrolled.\n\nWhat to do:\
 n1. Open each ADE profile with user affinity and confirm it now shows Setu
 p Assistant with modern authentication.\n2. Enrol one test iPhone and one 
 test Mac to check MFA and Conditional Access prompts during Setup Assistan
 t.\n3. Update enrolment guides and helpdesk scripts that describe the old 
 sign-in screens.\n\nSources:\n- What's new in Microsoft Intune (Microsoft 
 Learn): https://learn.microsoft.com/en-us/intune/intune-service/fundamenta
 ls/whats-new\n  "Intune has ended support for Setup Assistant (legacy) aut
 hentication for iOS/iPadOS and macOS automated device enrollment (ADE) wit
 h user affinity to align with modern authentication standards."\n\nChecked
  2026-11-09. Dates move\; check the source before you act.\nhttps://www.kb
 ytechnologies.com/deadlines/intune-ade-setup-assistant-legacy-ended
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ade-setup-as
 sistant-legacy-ended
CATEGORIES:Microsoft,Retirement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-legacy-apple-software-update-removed@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261026
DTEND;VALUE=DATE:20261027
SUMMARY:Intune removes legacy Apple MDM software update policies
DESCRIPTION:Microsoft · Retirement\n\nWho is affected: Intune admins who s
 till manage iOS/iPadOS or macOS updates with legacy MDM software update po
 licies or the update-delay restriction settings. Apple removed the underly
 ing commands and payloads in OS 27.\n\nWhat to do:\n1. Recreate update rul
 es as declarative device management (DDM) software update policies in the 
 settings catalog.\n2. Check that every Apple device group is covered by a 
 DDM update policy before deleting the old policies.\n3. Re-check deferral 
 settings: the legacy restriction keys for delaying updates were removed in
  OS 27.\n\nSources:\n- What's new in Microsoft Intune (Microsoft Learn): h
 ttps://learn.microsoft.com/en-us/intune/intune-service/fundamentals/whats-
 new\n  "Microsoft Intune is removing legacy Apple MDM software update work
 loads after Apple retired the underlying commands and payloads in OS 27. A
 dmins should use Apple declarative device management update policies to co
 ntinue managing software updates."\n- apple/device-management CHANGES.md (
 Apple\, GitHub): https://raw.githubusercontent.com/apple/device-management
 /release/CHANGES.md\n  "Removed: mdm/commands/system.update.schedule.yaml"
 \n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhtt
 ps://www.kbytechnologies.com/deadlines/intune-legacy-apple-software-update
 -removed
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-legacy-apple
 -software-update-removed
CATEGORIES:Microsoft,Retirement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-android-strong-integrity@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261031
DTEND;VALUE=DATE:20261101
SUMMARY:Intune enforces Google's updated Strong Integrity verdict for Andro
 id 13 and later
DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Users on Android 1
 3 or later targeted by app protection or compliance policies that require 
 Strong Integrity. Devices without a security update in the past 12 months 
 no longer meet it and can be blocked or marked noncompliant.\n\nWhat to do
 :\n1. Use the app protection status report to find devices with an old And
 roid security patch date.\n2. Set Min OS version and Min patch version con
 ditional launch settings to warn before you block.\n3. Set the Minimum sec
 urity patch level compliance setting and tell affected users to update.\n\
 nSources:\n- In development for Microsoft Intune (Microsoft Learn): https:
 //learn.microsoft.com/en-us/intune/intune-service/fundamentals/in-developm
 ent\n  "Microsoft Intune will enforce this change by October 31\, 2026."\n
 \nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps
 ://www.kbytechnologies.com/deadlines/intune-android-strong-integrity
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-android-stro
 ng-integrity
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:entra-sap-successfactors-basic-auth@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261101
DTEND;VALUE=DATE:20261102
SUMMARY:SAP SuccessFactors provisioning: move from basic auth to workload i
 dentity (November 2026)
DESCRIPTION:Date: November 2026. The vendor has not published an exact day\
 , so this event sits on the first day of that month.\n\nMicrosoft · Depre
 cation\n\nWho is affected: Organisations using Entra provisioning from SAP
  SuccessFactors to Active Directory or Entra ID\, or writeback to SuccessF
 actors\, with basic authentication.\n\nWhat to do:\n1. Open each SuccessFa
 ctors provisioning app and check which authentication method it uses.\n2. 
 Switch the connectivity settings to workload identity-based authentication
  and test a provisioning cycle.\n3. Remove the stored SuccessFactors servi
 ce account password once the switch works.\n\nSources:\n- Microsoft Entra 
 releases and announcements (Microsoft Learn): https://learn.microsoft.com/
 en-us/entra/fundamentals/whats-new\n  "If you are currently using basic au
 thentication for any of the above SAP SuccessFactors provisioning integrat
 ions\, you must upgrade to workload identity-based authentication before N
 ovember 2026 to ensure uninterrupted operation of the integrations."\n\nCh
 ecked 2026-11-09. Dates move\; check the source before you act.\nhttps://w
 ww.kbytechnologies.com/deadlines/entra-sap-successfactors-basic-auth
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-sap-successfa
 ctors-basic-auth
CATEGORIES:Microsoft,Deprecation
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-apns-renewal-jit-reminder@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261101
DTEND;VALUE=DATE:20261102
SUMMARY:Intune November release: JIT registration reminder at APNs renewal 
 and automatic JIT for eligible tenants (November 2026)
DESCRIPTION:Date: November 2026. The vendor has not published an exact day\
 , so this event sits on the first day of that month.\n\nMicrosoft · Chang
 e\n\nWho is affected: Intune tenants that manage iOS/iPadOS devices. Every
  tenant sees the acknowledgment when renewing the Apple MDM push certifica
 te\; eligible tenants also get just-in-time (JIT) registration switched on
  automatically.\n\nWhat to do:\n1. Check that your Apple MDM push certific
 ate renewal owner knows to expect the new acknowledgment.\n2. Review your 
 iOS/iPadOS SSO extension policy and confirm the JIT registration configura
 tion.\n3. Test registration from a work app on one personal and one corpor
 ate iPhone.\n\nSources:\n- In development for Microsoft Intune (Microsoft 
 Learn): https://learn.microsoft.com/en-us/intune/intune-service/fundamenta
 ls/in-development\n  "Beginning with the November 2026 release\, Intune wi
 ll display a new acknowledgment when you renew an Apple MDM push certifica
 te in the Microsoft Intune admin center."\n- In development for Microsoft 
 Intune (Microsoft Learn): https://learn.microsoft.com/en-us/intune/intune-
 service/fundamentals/in-development\n  "Microsoft Intune will automaticall
 y enable just-in-time (JIT) registration for eligible iOS/iPadOS tenants w
 ith the 2611 release."\n\nChecked 2026-11-09. Dates move\; check the sourc
 e before you act.\nhttps://www.kbytechnologies.com/deadlines/intune-apns-r
 enewal-jit-reminder
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-apns-renewal
 -jit-reminder
CATEGORIES:Microsoft,Change
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:powershell-7-4-and-7-5-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261110
DTEND;VALUE=DATE:20261111
SUMMARY:PowerShell 7.4 (LTS) and 7.5 reach end of support
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Admin workstati
 ons\, automation servers and scheduled tasks running PowerShell 7.4 or 7.5
 \, including scripts that use the Microsoft Graph PowerShell SDK or Exchan
 ge Online module. Windows PowerShell 5.1 has its own lifecycle.\n\nWhat to
  do:\n1. Run $PSVersionTable on automation hosts and build agents to find 
 7.4 and 7.5.\n2. Install PowerShell 7.6 (LTS) and re-test scheduled script
 s and module imports.\n3. Update any pinned PowerShell versions in deploym
 ent packages or container images.\n\nSources:\n- PowerShell Support Lifecy
 cle (Microsoft Learn): https://learn.microsoft.com/en-us/powershell/script
 ing/install/powershell-support-lifecycle\n  "The current LTS release is Po
 werShell 7.6.6. The previous LTS release\, PowerShell 7.4.20\, is still su
 pported until 10-Nov-2026."\n- PowerShell Support Lifecycle (Microsoft Lea
 rn): https://learn.microsoft.com/en-us/powershell/scripting/install/powers
 hell-support-lifecycle\n  "PowerShell 7.5 | 23-Jan-2025 | 10-Nov-2026 | .N
 ET 9.0"\n\nChecked 2026-11-09. Dates move\; check the source before you ac
 t.\nhttps://www.kbytechnologies.com/deadlines/powershell-7-4-and-7-5-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/powershell-7-4-and-
 7-5-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-11-23h2-enterprise-education-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261110
DTEND;VALUE=DATE:20261111
SUMMARY:Windows 11\, version 23H2 Enterprise and Education reach end of upd
 ates
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running
  Windows 11\, version 23H2 Enterprise\, Education or IoT Enterprise. The N
 ovember 2026 security update is the last one for these editions.\n\nWhat t
 o do:\n1. Find 23H2 devices (build 22631) in Intune's All devices list or 
 your update reports.\n2. Move them to a supported version such as 25H2 or 
 26H2 with a feature update policy.\n3. Check safeguard holds and app compa
 tibility on a pilot ring first.\n\nSources:\n- Windows message center (Win
 dows release health\, Microsoft Learn): https://learn.microsoft.com/en-us/
 windows/release-health/windows-message-center\n  "On November 10\, 2026\, 
 Windows 11\, version 23H2 Enterprise and Education editions will reach end
  of updates. The November 2026 Windows security update will be the last up
 date available for these editions."\n- Ending Support in 2026 (Microsoft L
 ifecycle): https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-
 of-support-2026\n  "Windows 11 Enterprise and Education\, Version 23H2 | W
 indows 11 IoT Enterprise\, Version 23H2 | November 10\, 2026"\n\nChecked 2
 026-11-09. Dates move\; check the source before you act.\nhttps://www.kbyt
 echnologies.com/deadlines/windows-11-23h2-enterprise-education-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-23h2-ent
 erprise-education-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-ios-web-based-enrollment-default@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270101
DTEND;VALUE=DATE:20270102
SUMMARY:Web-based enrolment becomes the default for user-owned iPhone and i
 Pad (Q1 2027)
DESCRIPTION:Date: Q1 2027. The vendor has not published an exact day\, so t
 his event sits on the first day of that quarter.\n\nMicrosoft · Change\n\
 nWho is affected: Organisations that let users enrol personal iPhones and 
 iPads in Intune. The source says early 2027 without a day\, so treat the q
 uarter as approximate.\n\nWhat to do:\n1. Configure JIT registration in yo
 ur iOS/iPadOS SSO extension policy before the change.\n2. Test web-based e
 nrolment for a personal device end to end\, including Conditional Access.\
 n3. Update user-facing enrolment instructions that tell people to install 
 Company Portal first.\n\nSources:\n- In development for Microsoft Intune (
 Microsoft Learn): https://learn.microsoft.com/en-us/intune/intune-service/
 fundamentals/in-development\n  "This reminder will help you prepare for we
 b-based enrollment becoming the default for user-owned iOS and iPadOS devi
 ces in early 2027."\n\nChecked 2026-11-09. Dates move\; check the source b
 efore you act.\nhttps://www.kbytechnologies.com/deadlines/intune-ios-web-b
 ased-enrollment-default
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ios-web-base
 d-enrollment-default
CATEGORIES:Microsoft,Change
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-refs-removable-media-enforcement@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270101
DTEND;VALUE=DATE:20270102
SUMMARY:ReFS volumes on removable media: enforcement phase (January 2027)
DESCRIPTION:Date: January 2027. The vendor has not published an exact day\,
  so this event sits on the first day of that month.\n\nMicrosoft · Enforc
 ement\n\nWho is affected: Devices that use ReFS on externally attached or 
 removable storage. The October 2026 update started the audit phase\; the J
 anuary 2027 update can block affected volumes.\n\nWhat to do:\n1. Review t
 he audit events added by the October 2026 update to find external ReFS vol
 umes.\n2. Reformat or move data off unsupported external ReFS configuratio
 ns before January 2027.\n\nSources:\n- Windows message center (Windows rel
 ease health\, Microsoft Learn): https://learn.microsoft.com/en-us/windows/
 release-health/windows-message-center\n  "January 2027 Windows security up
 date (Enforcement phase)"\n\nChecked 2026-11-09. Dates move\; check the so
 urce before you act.\nhttps://www.kbytechnologies.com/deadlines/windows-re
 fs-removable-media-enforcement
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-refs-remova
 ble-media-enforcement
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-10-enterprise-ltsc-2021-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270112
DTEND;VALUE=DATE:20270113
SUMMARY:Windows 10 Enterprise LTSC 2021 reaches end of updates
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running
  Windows 10 Enterprise LTSC 2021\, often kiosks\, shop-floor and medical o
 r lab devices. The January 2027 security update is the last one.\n\nWhat t
 o do:\n1. Inventory LTSC 2021 devices and the line-of-business software ea
 ch one runs.\n2. Test the workload on Windows 11 Enterprise LTSC 2024 and 
 schedule the rebuilds.\n3. Buy ESU for devices that cannot move before Jan
 uary 12\, 2027.\n\nSources:\n- Windows message center (Windows release hea
 lth\, Microsoft Learn): https://learn.microsoft.com/en-us/windows/release-
 health/windows-message-center\n  "On January 12\, 2027\, Windows 10 Enterp
 rise LTSC 2021 will reach end of updates. The January 2027 Windows securit
 y update will be the last update available for this version."\n\nChecked 2
 026-11-09. Dates move\; check the source before you act.\nhttps://www.kbyt
 echnologies.com/deadlines/windows-10-enterprise-ltsc-2021-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-10-enterpri
 se-ltsc-2021-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-server-2016-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270112
DTEND;VALUE=DATE:20270113
SUMMARY:Windows Server 2016 (and WSUS on it) reaches end of updates
DESCRIPTION:Microsoft · End of support\n\nWho is affected: All editions of
  Windows Server 2016\, including servers that host WSUS\, Configuration Ma
 nager site roles\, certificate services or other endpoint management infra
 structure.\n\nWhat to do:\n1. List Windows Server 2016 machines that suppo
 rt endpoint management (WSUS\, distribution points\, NDES\, connectors).\n
 2. Rebuild or upgrade them to Windows Server 2025.\n3. Buy ESU for Standar
 d and Datacenter servers that cannot move in time.\n\nSources:\n- Windows 
 message center (Windows release health\, Microsoft Learn): https://learn.m
 icrosoft.com/en-us/windows/release-health/windows-message-center\n  "On Ja
 nuary 12\, 2027\, Windows Server 2016 will reach end of updates."\n- Endin
 g Support in 2027 (Microsoft Lifecycle): https://learn.microsoft.com/en-us
 /lifecycle/end-of-support/end-of-support-2027\n  "Windows Server 2016 | Wi
 ndows Server Update Services for Windows Server 2016 | January 12\, 2027"\
 n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhttp
 s://www.kbytechnologies.com/deadlines/windows-server-2016-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-server-2016
 -end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:apple-developer-id-sub-ca-expiry@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270201
DTEND;VALUE=DATE:20270202
SUMMARY:Original Apple Developer ID Sub-CA expires: affected .pkg installer
 s stop installing
DESCRIPTION:Apple · Retirement\n\nWho is affected: Mac admins who deploy i
 nstaller packages signed with a Developer ID certificate issued by the ori
 ginal Sub-CA\, including in-house packages and older third-party packages 
 in Intune\, Jamf or other MDM. Notarised apps with a secure timestamp keep
  working.\n\nWhat to do:\n1. Run pkgutil --check-signature on every .pkg y
 ou deploy and note which ones chain to the original Developer ID Certifica
 tion Authority.\n2. Re-sign in-house packages with a certificate from Deve
 loper ID Certification Authority (G2) and re-upload them.\n3. Ask vendors 
 for re-signed packages and replace cached copies in your MDM before Februa
 ry 1\, 2027.\n\nSources:\n- Upcoming expiration of Developer ID Certificat
 ion Authority (Sub-CA) (Apple Developer News): https://developer.apple.com
 /news/?id=w4atic4c\n  "The original Developer ID Certification Authority (
 Sub-CA) expires on February 1\, 2027. Certificates issued by this authorit
 y will stop working on that date."\n- Upcoming expiration of Developer ID 
 Certification Authority (Sub-CA) (Apple Developer News): https://developer
 .apple.com/news/?id=w4atic4c\n  "Installer packages (.pkg): Starting Febru
 ary 1\, 2027\, .pkg files signed with an affected certificate will no long
 er install."\n\nChecked 2026-11-09. Dates move\; check the source before y
 ou act.\nhttps://www.kbytechnologies.com/deadlines/apple-developer-id-sub-
 ca-expiry
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/apple-developer-id-
 sub-ca-expiry
CATEGORIES:Apple,Retirement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:entra-connect-sync-2-5-190-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270202
DTEND;VALUE=DATE:20270203
SUMMARY:Entra Connect Sync 2.5.190.0 reaches end of support
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Sync servers st
 ill on Entra Connect Sync 2.5.190.0. Version 2.6.1.0 follows on 10 Mar 202
 7\; each 2.x version retires 12 months after a newer one is released.\n\nW
 hat to do:\n1. Upgrade to the latest Entra Connect Sync release from the M
 icrosoft Entra admin center.\n2. If you edited miiserver.exe.config\, chec
 k the known upgrade issue on the version history page first.\n\nSources:\n
 - Microsoft Entra Connect: Version release history (Microsoft Learn): http
 s://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-conn
 ect-version-history\n  "2.5.190.0 | 02 Feb 2027 (12 months after release o
 f 2.6.1.0) | 19 Nov 2025"\n- Microsoft Entra Connect: Version release hist
 ory (Microsoft Learn): https://learn.microsoft.com/en-us/entra/identity/hy
 brid/connect/reference-connect-version-history\n  "2.6.1.0 | 10 Mar 2027 (
 12 months after release of 2.6.3.0) | 2 Feb 2026"\n\nChecked 2026-11-09. D
 ates move\; check the source before you act.\nhttps://www.kbytechnologies.
 com/deadlines/entra-connect-sync-2-5-190-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-connect-sync-
 2-5-190-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:exchange-online-ews-retired@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270401
DTEND;VALUE=DATE:20270402
SUMMARY:Exchange Web Services (EWS) fully disabled in Exchange Online
DESCRIPTION:Microsoft · Retirement\n\nWho is affected: Every remaining EWS
  client of Exchange Online. On-premises Exchange is not part of this retir
 ement.\n\nWhat to do:\n1. Confirm the EWS usage report shows no remaining 
 production callers.\n2. Check the parity-gap roadmap on the EWS deprecatio
 n page for features your apps still need.\n\nSources:\n- Exchange Online s
 ervice description (Microsoft Learn): https://learn.microsoft.com/en-us/of
 fice365/servicedescriptions/exchange-online-service-description/exchange-o
 nline-service-description\n  "Phased disablement begins October 1\, 2026\,
  with permanent retirement on April 1\, 2027."\n- Deprecation of Exchange 
 Web Services in Exchange Online (Microsoft Learn): https://learn.microsoft
 .com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-e
 ws-exchange-online\n  "April 2027: EWS is fully disabled."\n\nChecked 2026
 -11-09. Dates move\; check the source before you act.\nhttps://www.kbytech
 nologies.com/deadlines/exchange-online-ews-retired
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/exchange-online-ews
 -retired
CATEGORIES:Microsoft,Retirement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:entra-connect-sync-application-authentication-required@kbytechnologies.
 com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270407
DTEND;VALUE=DATE:20270408
SUMMARY:Entra Connect Sync: upgrade to 2.6.84.0 or later and use applicatio
 n-based authentication
DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Every organisation
  running Microsoft Entra Connect Sync. Synchronisation stops after this da
 te on servers that have not been upgraded and switched to application-base
 d authentication.\n\nWhat to do:\n1. Check the installed Entra Connect Syn
 c version on every sync server\, including staging servers.\n2. Download t
 he current build from the Microsoft Entra admin center and upgrade.\n3. Co
 nfigure application-based authentication and confirm .NET Framework 4.7.2 
 and TLS 1.2 are in place.\n\nSources:\n- Microsoft Entra Connect: Version 
 release history (Microsoft Learn): https://learn.microsoft.com/en-us/entra
 /identity/hybrid/connect/reference-connect-version-history\n  "Mandatory u
 pgrade required: Upgrade Microsoft Entra Connect Sync to version 2.6.84.0 
 or later and configure application-based authentication by April 7\, 2027.
 "\n\nChecked 2026-11-09. Dates move\; check the source before you act.\nht
 tps://www.kbytechnologies.com/deadlines/entra-connect-sync-application-aut
 hentication-required
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-connect-sync-
 application-authentication-required
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-update-certificate-rotation-may-2027@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270517
DTEND;VALUE=DATE:20270518
SUMMARY:Windows Update certificate rotation: Windows 10 Enterprise 2019 LTS
 C\, Windows Server 2019 and 2016
DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Windows 10 Enterpr
 ise 2019 LTSC\, Windows Server 2019 and Windows Server 2016 devices that g
 et updates directly from Windows Update. Devices updated through WSUS are 
 not affected by this change.\n\nWhat to do:\n1. Install the July 2026 secu
 rity update or later on these devices before May 17\, 2027.\n2. Find devic
 es that have stopped patching: without the replacement certificates they l
 ose access to Windows Update.\n\nSources:\n- Windows message center (Windo
 ws release health\, Microsoft Learn): https://learn.microsoft.com/en-us/wi
 ndows/release-health/windows-message-center\n  "Windows 10 Enterprise 2019
  LTSC\, Windows Server 2019\, and Windows Server 2016: Install the July 20
 26 security update or later before May 17\, 2027."\n\nChecked 2026-11-09. 
 Dates move\; check the source before you act.\nhttps://www.kbytechnologies
 .com/deadlines/windows-update-certificate-rotation-may-2027
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-update-cert
 ificate-rotation-may-2027
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-update-certificate-rotation-june-2027@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270619
DTEND;VALUE=DATE:20270620
SUMMARY:Windows Update certificate rotation: Windows 11\, Windows Server 20
 22/2025 and other in-support Windows 10
DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: In-support Windows
  11\, Windows Server 2022 and 2025\, and in-support Windows 10 devices tha
 t are behind on monthly updates. Windows 11\, version 25H2 and later need 
 no action.\n\nWhat to do:\n1. Windows 11\, version 24H2 and Windows Server
  2025: install the September 2025 security update or later.\n2. Other in-s
 upport Windows 11\, Windows Server 2022 and Windows 10: install the July 2
 026 security update or later.\n3. Upgrade any out-of-support Windows versi
 on\, which will lose access to Windows Update.\n\nSources:\n- Windows mess
 age center (Windows release health\, Microsoft Learn): https://learn.micro
 soft.com/en-us/windows/release-health/windows-message-center\n  "Certifica
 tes used to establish trusted connections to Windows Update will expire on
  May 17\, 2027 and June 19\, 2027. Devices must contain the replacement ce
 rtificates to continue receiving updates after the applicable expiration d
 ate."\n\nChecked 2026-11-09. Dates move\; check the source before you act.
 \nhttps://www.kbytechnologies.com/deadlines/windows-update-certificate-rot
 ation-june-2027
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-update-cert
 ificate-rotation-june-2027
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:teams-displays-retirement@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270903
DTEND;VALUE=DATE:20270904
SUMMARY:Microsoft Teams Displays retire
DESCRIPTION:Microsoft · Retirement\n\nWho is affected: Organisations with 
 Microsoft Teams Display devices on desks or in shared spaces.\n\nWhat to d
 o:\n1. List Teams Display devices in the Teams admin center device invento
 ry.\n2. Budget and plan replacements before the retirement date.\n\nSource
 s:\n- Ending Support in 2027 (Microsoft Lifecycle): https://learn.microsof
 t.com/en-us/lifecycle/end-of-support/end-of-support-2027\n  "Microsoft Tea
 ms Displays | September 3\, 2027"\n\nChecked 2026-11-09. Dates move\; chec
 k the source before you act.\nhttps://www.kbytechnologies.com/deadlines/te
 ams-displays-retirement
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/teams-displays-reti
 rement
CATEGORIES:Microsoft,Retirement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-10-esu-year-2-ends@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20271012
DTEND;VALUE=DATE:20271013
SUMMARY:Windows 10 Extended Security Updates: Year 2 ends
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Organisations p
 aying for Windows 10 ESU Year 2. Year 3 is the last year available and run
 s to October 10\, 2028.\n\nWhat to do:\n1. Decide before renewal which rem
 aining Windows 10 devices justify a Year 3 purchase.\n2. Set a migration d
 ate for every remaining Windows 10 device and track it.\n3. Check that ESU
  keys are activated on the devices that need them\, not just purchased.\n\
 nSources:\n- Extended Security Updates FAQ (Microsoft Lifecycle): https://
 learn.microsoft.com/en-us/lifecycle/faq/extended-security-updates\n  "Wind
 ows 10*** | October 14\, 2025 | October 13\, 2026 | October 12\, 2027 | Oc
 tober 10\, 2028 | Critical\, Important"\n\nChecked 2026-11-09. Dates move\
 ; check the source before you act.\nhttps://www.kbytechnologies.com/deadli
 nes/windows-10-esu-year-2-ends
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-10-esu-year
 -2-ends
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-11-24h2-enterprise-education-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20271012
DTEND;VALUE=DATE:20271013
SUMMARY:Windows 11\, version 24H2 Enterprise and Education reach end of ser
 vicing
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running
  Windows 11\, version 24H2 Enterprise\, Education or IoT Enterprise.\n\nWh
 at to do:\n1. Plan a feature update to 25H2 or 26H2 well before the date.\
 n2. Use Intune feature update policies or Autopatch rings so devices do no
 t sit on 24H2.\n3. Note that 24H2 non-security preview updates already end
 ed in September 2026.\n\nSources:\n- Ending Support in 2027 (Microsoft Lif
 ecycle): https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-of
 -support-2027\n  "Windows 11 Enterprise and Education\, Version 24H2 | Win
 dows 11 IoT Enterprise\, Version 24H2 | October 12\, 2027"\n- Windows mess
 age center (Windows release health\, Microsoft Learn): https://learn.micro
 soft.com/en-us/windows/release-health/windows-message-center\n  "Windows 1
 1\, version 24H2 Enterprise and Education remain supported until October 1
 2\, 2027."\n\nChecked 2026-11-09. Dates move\; check the source before you
  act.\nhttps://www.kbytechnologies.com/deadlines/windows-11-24h2-enterpris
 e-education-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-24h2-ent
 erprise-education-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-11-25h2-home-pro-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20271012
DTEND;VALUE=DATE:20271013
SUMMARY:Windows 11\, version 25H2 Home and Pro reach end of updates
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices on Wind
 ows 11\, version 25H2 Home\, Pro\, Pro Education or Pro for Workstations. 
 Enterprise and Education editions of 25H2 are supported for a further year
 .\n\nWhat to do:\n1. Identify Pro-edition devices in your fleet\; they fol
 low the 24-month lifecycle\, not the 36-month one.\n2. Plan their move to 
 26H2 during 2027.\n\nSources:\n- Windows 11 release information (Microsoft
  Learn): https://learn.microsoft.com/en-us/windows/release-health/windows1
 1-release-information\n  "25H2 | General Availability Channel | 2025-09-30
  | 2027-10-12 | 2028-10-10"\n\nChecked 2026-11-09. Dates move\; check the 
 source before you act.\nhttps://www.kbytechnologies.com/deadlines/windows-
 11-25h2-home-pro-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-25h2-hom
 e-pro-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
END:VCALENDAR