BEGIN:VCALENDAR VERSION:2.0 PRODID:-//KBY Technologies//Admin Deadlines//EN CALSCALE:GREGORIAN METHOD:PUBLISH X-WR-CALNAME:KBY admin deadlines (Entra ID) X-WR-CALDESC:Microsoft and Apple retirements\, deprecations\, enforcement d ates and end-of-support dates for endpoint and identity admins. Each date is quoted from the vendor's own page. X-WR-TIMEZONE:UTC REFRESH-INTERVAL;VALUE=DURATION:P1D X-PUBLISHED-TTL:P1D URL;VALUE=URI:https://www.kbytechnologies.com/deadlines BEGIN:VEVENT UID:entra-connect-block-hard-match-privileged-users@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20260601 DTEND;VALUE=DATE:20260602 SUMMARY:Entra Connect and Cloud Sync blocked from hard-matching users who h old Entra roles DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Hybrid identity te ams that hard-match new Active Directory users to existing cloud users. Ma tching is now refused when the cloud user holds a Microsoft Entra role\; s oft match and existing synced users are not affected.\n\nWhat to do:\n1. R emove Entra role assignments from a cloud user before you hard-match it\, then reassign them.\n2. Check sync error reports for hard-match failures s ince June 2026.\n3. Keep privileged admin accounts cloud-only rather than synced from Active Directory.\n\nSources:\n- Microsoft Entra releases and announcements (Microsoft Learn): https://learn.microsoft.com/en-us/entra/f undamentals/whats-new\n "Beginning June 1\, 2026\, Microsoft Entra ID wil l block any attempt by Entra Connect Sync or Cloud Sync from hard-matching a new user object from Active Directory to an existing cloud-managed Entr a ID user object that holds Microsoft Entra roles."\n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps://www.kbytechnologie s.com/deadlines/entra-connect-block-hard-match-privileged-users URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-connect-block -hard-match-privileged-users CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:entra-mandatory-mfa-phase-2-postponement-ends@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20260701 DTEND;VALUE=DATE:20260702 SUMMARY:Azure mandatory MFA Phase 2: last postponement date DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Tenants that postp oned Phase 2. User accounts that create\, update or delete Azure resources through Azure CLI\, Azure PowerShell\, the Azure mobile app\, IaC tools o r REST APIs must complete MFA.\n\nWhat to do:\n1. Move automation that sig ns in as a user account to managed identities or service principals.\n2. R equire MFA with a Conditional Access policy so users satisfy it before the y hit errors.\n3. Give break-glass accounts a passkey (FIDO2) or certifica te-based authentication.\n\nSources:\n- Planning for mandatory Microsoft E ntra multifactor authentication (Microsoft Learn): https://learn.microsoft .com/en-us/entra/identity/authentication/concept-mandatory-multifactor-aut hentication\n "Microsoft allows customers with complex environments or te chnical barriers to postpone the enforcement of Phase 2 for their tenants until July 1st\, 2026."\n\nChecked 2026-11-09. Dates move\; check the sour ce before you act.\nhttps://www.kbytechnologies.com/deadlines/entra-mandat ory-mfa-phase-2-postponement-ends URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-mandatory-mfa -phase-2-postponement-ends CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:entra-sap-successfactors-basic-auth@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261101 DTEND;VALUE=DATE:20261102 SUMMARY:SAP SuccessFactors provisioning: move from basic auth to workload i dentity (November 2026) DESCRIPTION:Date: November 2026. The vendor has not published an exact day\ , so this event sits on the first day of that month.\n\nMicrosoft · Depre cation\n\nWho is affected: Organisations using Entra provisioning from SAP SuccessFactors to Active Directory or Entra ID\, or writeback to SuccessF actors\, with basic authentication.\n\nWhat to do:\n1. Open each SuccessFa ctors provisioning app and check which authentication method it uses.\n2. Switch the connectivity settings to workload identity-based authentication and test a provisioning cycle.\n3. Remove the stored SuccessFactors servi ce account password once the switch works.\n\nSources:\n- Microsoft Entra releases and announcements (Microsoft Learn): https://learn.microsoft.com/ en-us/entra/fundamentals/whats-new\n "If you are currently using basic au thentication for any of the above SAP SuccessFactors provisioning integrat ions\, you must upgrade to workload identity-based authentication before N ovember 2026 to ensure uninterrupted operation of the integrations."\n\nCh ecked 2026-11-09. Dates move\; check the source before you act.\nhttps://w ww.kbytechnologies.com/deadlines/entra-sap-successfactors-basic-auth URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-sap-successfa ctors-basic-auth CATEGORIES:Microsoft,Deprecation TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:entra-connect-sync-2-5-190-end@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20270202 DTEND;VALUE=DATE:20270203 SUMMARY:Entra Connect Sync 2.5.190.0 reaches end of support DESCRIPTION:Microsoft · End of support\n\nWho is affected: Sync servers st ill on Entra Connect Sync 2.5.190.0. Version 2.6.1.0 follows on 10 Mar 202 7\; each 2.x version retires 12 months after a newer one is released.\n\nW hat to do:\n1. Upgrade to the latest Entra Connect Sync release from the M icrosoft Entra admin center.\n2. If you edited miiserver.exe.config\, chec k the known upgrade issue on the version history page first.\n\nSources:\n - Microsoft Entra Connect: Version release history (Microsoft Learn): http s://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-conn ect-version-history\n "2.5.190.0 | 02 Feb 2027 (12 months after release o f 2.6.1.0) | 19 Nov 2025"\n- Microsoft Entra Connect: Version release hist ory (Microsoft Learn): https://learn.microsoft.com/en-us/entra/identity/hy brid/connect/reference-connect-version-history\n "2.6.1.0 | 10 Mar 2027 ( 12 months after release of 2.6.3.0) | 2 Feb 2026"\n\nChecked 2026-11-09. D ates move\; check the source before you act.\nhttps://www.kbytechnologies. com/deadlines/entra-connect-sync-2-5-190-end URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-connect-sync- 2-5-190-end CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:entra-connect-sync-application-authentication-required@kbytechnologies. com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20270407 DTEND;VALUE=DATE:20270408 SUMMARY:Entra Connect Sync: upgrade to 2.6.84.0 or later and use applicatio n-based authentication DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Every organisation running Microsoft Entra Connect Sync. Synchronisation stops after this da te on servers that have not been upgraded and switched to application-base d authentication.\n\nWhat to do:\n1. Check the installed Entra Connect Syn c version on every sync server\, including staging servers.\n2. Download t he current build from the Microsoft Entra admin center and upgrade.\n3. Co nfigure application-based authentication and confirm .NET Framework 4.7.2 and TLS 1.2 are in place.\n\nSources:\n- Microsoft Entra Connect: Version release history (Microsoft Learn): https://learn.microsoft.com/en-us/entra /identity/hybrid/connect/reference-connect-version-history\n "Mandatory u pgrade required: Upgrade Microsoft Entra Connect Sync to version 2.6.84.0 or later and configure application-based authentication by April 7\, 2027. "\n\nChecked 2026-11-09. Dates move\; check the source before you act.\nht tps://www.kbytechnologies.com/deadlines/entra-connect-sync-application-aut hentication-required URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-connect-sync- application-authentication-required CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT END:VCALENDAR