BEGIN:VCALENDAR VERSION:2.0 PRODID:-//KBY Technologies//Admin Deadlines//EN CALSCALE:GREGORIAN METHOD:PUBLISH X-WR-CALNAME:KBY admin deadlines (Entra ID\, Active Directory) X-WR-CALDESC:Microsoft and Apple retirements\, deprecations\, enforcement d ates and end-of-support dates for endpoint and identity admins. Each date is quoted from the vendor's own page. X-WR-TIMEZONE:UTC REFRESH-INTERVAL;VALUE=DURATION:P1D X-PUBLISHED-TTL:P1D URL;VALUE=URI:https://www.kbytechnologies.com/deadlines BEGIN:VEVENT UID:entra-connect-block-hard-match-privileged-users@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20260601 DTEND;VALUE=DATE:20260602 SUMMARY:Entra Connect and Cloud Sync blocked from hard-matching users who h old Entra roles DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Hybrid identity te ams that hard-match new Active Directory users to existing cloud users. Ma tching is now refused when the cloud user holds a Microsoft Entra role\; s oft match and existing synced users are not affected.\n\nWhat to do:\n1. R emove Entra role assignments from a cloud user before you hard-match it\, then reassign them.\n2. Check sync error reports for hard-match failures s ince June 2026.\n3. Keep privileged admin accounts cloud-only rather than synced from Active Directory.\n\nSources:\n- Microsoft Entra releases and announcements (Microsoft Learn): https://learn.microsoft.com/en-us/entra/f undamentals/whats-new\n "Beginning June 1\, 2026\, Microsoft Entra ID wil l block any attempt by Entra Connect Sync or Cloud Sync from hard-matching a new user object from Active Directory to an existing cloud-managed Entr a ID user object that holds Microsoft Entra roles."\n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps://www.kbytechnologie s.com/deadlines/entra-connect-block-hard-match-privileged-users URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-connect-block -hard-match-privileged-users CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:entra-mandatory-mfa-phase-2-postponement-ends@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20260701 DTEND;VALUE=DATE:20260702 SUMMARY:Azure mandatory MFA Phase 2: last postponement date DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Tenants that postp oned Phase 2. User accounts that create\, update or delete Azure resources through Azure CLI\, Azure PowerShell\, the Azure mobile app\, IaC tools o r REST APIs must complete MFA.\n\nWhat to do:\n1. Move automation that sig ns in as a user account to managed identities or service principals.\n2. R equire MFA with a Conditional Access policy so users satisfy it before the y hit errors.\n3. Give break-glass accounts a passkey (FIDO2) or certifica te-based authentication.\n\nSources:\n- Planning for mandatory Microsoft E ntra multifactor authentication (Microsoft Learn): https://learn.microsoft .com/en-us/entra/identity/authentication/concept-mandatory-multifactor-aut hentication\n "Microsoft allows customers with complex environments or te chnical barriers to postpone the enforcement of Phase 2 for their tenants until July 1st\, 2026."\n\nChecked 2026-11-09. Dates move\; check the sour ce before you act.\nhttps://www.kbytechnologies.com/deadlines/entra-mandat ory-mfa-phase-2-postponement-ends URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-mandatory-mfa -phase-2-postponement-ends CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-kerberos-rc4-enforcement@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20260701 DTEND;VALUE=DATE:20260702 SUMMARY:Kerberos RC4 protections move to enforcement on domain controllers (July 2026) DESCRIPTION:Date: July 2026. The vendor has not published an exact day\, so this event sits on the first day of that month.\n\nMicrosoft · Enforceme nt\n\nWho is affected: Active Directory domains with service accounts or a pplications that still depend on RC4 Kerberos tickets. Audit mode and the temporary rollback registry setting were removed with this update.\n\nWhat to do:\n1. Review domain controller events for service tickets still requ ested with RC4.\n2. Enable AES on the affected service accounts and reset their passwords so AES keys exist.\n3. Retire or upgrade applications and appliances that cannot use AES.\n\nSources:\n- Windows message center (Win dows release health\, Microsoft Learn): https://learn.microsoft.com/en-us/ windows/release-health/windows-message-center\n "The July 2026 Windows se curity update enables Enforcement mode across Windows domain controllers f or Kerberos RC4 protections related to CVE‑2026‑20833."\n\nChecked 202 6-11-09. Dates move\; check the source before you act.\nhttps://www.kbytec hnologies.com/deadlines/windows-kerberos-rc4-enforcement URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-kerberos-rc 4-enforcement CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:entra-sap-successfactors-basic-auth@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261101 DTEND;VALUE=DATE:20261102 SUMMARY:SAP SuccessFactors provisioning: move from basic auth to workload i dentity (November 2026) DESCRIPTION:Date: November 2026. The vendor has not published an exact day\ , so this event sits on the first day of that month.\n\nMicrosoft · Depre cation\n\nWho is affected: Organisations using Entra provisioning from SAP SuccessFactors to Active Directory or Entra ID\, or writeback to SuccessF actors\, with basic authentication.\n\nWhat to do:\n1. Open each SuccessFa ctors provisioning app and check which authentication method it uses.\n2. Switch the connectivity settings to workload identity-based authentication and test a provisioning cycle.\n3. Remove the stored SuccessFactors servi ce account password once the switch works.\n\nSources:\n- Microsoft Entra releases and announcements (Microsoft Learn): https://learn.microsoft.com/ en-us/entra/fundamentals/whats-new\n "If you are currently using basic au thentication for any of the above SAP SuccessFactors provisioning integrat ions\, you must upgrade to workload identity-based authentication before N ovember 2026 to ensure uninterrupted operation of the integrations."\n\nCh ecked 2026-11-09. Dates move\; check the source before you act.\nhttps://w ww.kbytechnologies.com/deadlines/entra-sap-successfactors-basic-auth URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-sap-successfa ctors-basic-auth CATEGORIES:Microsoft,Deprecation TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:entra-connect-sync-2-5-190-end@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20270202 DTEND;VALUE=DATE:20270203 SUMMARY:Entra Connect Sync 2.5.190.0 reaches end of support DESCRIPTION:Microsoft · End of support\n\nWho is affected: Sync servers st ill on Entra Connect Sync 2.5.190.0. Version 2.6.1.0 follows on 10 Mar 202 7\; each 2.x version retires 12 months after a newer one is released.\n\nW hat to do:\n1. Upgrade to the latest Entra Connect Sync release from the M icrosoft Entra admin center.\n2. If you edited miiserver.exe.config\, chec k the known upgrade issue on the version history page first.\n\nSources:\n - Microsoft Entra Connect: Version release history (Microsoft Learn): http s://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-conn ect-version-history\n "2.5.190.0 | 02 Feb 2027 (12 months after release o f 2.6.1.0) | 19 Nov 2025"\n- Microsoft Entra Connect: Version release hist ory (Microsoft Learn): https://learn.microsoft.com/en-us/entra/identity/hy brid/connect/reference-connect-version-history\n "2.6.1.0 | 10 Mar 2027 ( 12 months after release of 2.6.3.0) | 2 Feb 2026"\n\nChecked 2026-11-09. D ates move\; check the source before you act.\nhttps://www.kbytechnologies. com/deadlines/entra-connect-sync-2-5-190-end URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-connect-sync- 2-5-190-end CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:entra-connect-sync-application-authentication-required@kbytechnologies. com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20270407 DTEND;VALUE=DATE:20270408 SUMMARY:Entra Connect Sync: upgrade to 2.6.84.0 or later and use applicatio n-based authentication DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Every organisation running Microsoft Entra Connect Sync. Synchronisation stops after this da te on servers that have not been upgraded and switched to application-base d authentication.\n\nWhat to do:\n1. Check the installed Entra Connect Syn c version on every sync server\, including staging servers.\n2. Download t he current build from the Microsoft Entra admin center and upgrade.\n3. Co nfigure application-based authentication and confirm .NET Framework 4.7.2 and TLS 1.2 are in place.\n\nSources:\n- Microsoft Entra Connect: Version release history (Microsoft Learn): https://learn.microsoft.com/en-us/entra /identity/hybrid/connect/reference-connect-version-history\n "Mandatory u pgrade required: Upgrade Microsoft Entra Connect Sync to version 2.6.84.0 or later and configure application-based authentication by April 7\, 2027. "\n\nChecked 2026-11-09. Dates move\; check the source before you act.\nht tps://www.kbytechnologies.com/deadlines/entra-connect-sync-application-aut hentication-required URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/entra-connect-sync- application-authentication-required CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT END:VCALENDAR