BEGIN:VCALENDAR VERSION:2.0 PRODID:-//KBY Technologies//Admin Deadlines//EN CALSCALE:GREGORIAN METHOD:PUBLISH X-WR-CALNAME:KBY admin deadlines (Intune\, iOS/iPadOS) X-WR-CALDESC:Microsoft and Apple retirements\, deprecations\, enforcement d ates and end-of-support dates for endpoint and identity admins. Each date is quoted from the vendor's own page. X-WR-TIMEZONE:UTC REFRESH-INTERVAL;VALUE=DURATION:P1D X-PUBLISHED-TTL:P1D URL;VALUE=URI:https://www.kbytechnologies.com/deadlines BEGIN:VEVENT UID:intune-ios-mam-sdk-warning@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20260601 DTEND;VALUE=DATE:20260602 SUMMARY:Warning for iOS apps built with an Intune MAM SDK older than 20.8.0 (June 2026) DESCRIPTION:Date: June 2026. The vendor has not published an exact day\, so this event sits on the first day of that month.\n\nMicrosoft · Change\n\ nWho is affected: Users of app-protected iOS apps (Microsoft and third-par ty\, including in-house line-of-business apps) built with an Intune MAM SD K earlier than 20.8.0. The warning can be dismissed.\n\nWhat to do:\n1. As k users to update Teams\, Outlook\, Edge\, OneDrive and other protected ap ps from the App Store.\n2. Rebuild in-house apps with a current Intune App SDK or App Wrapping Tool.\n3. Use the Min SDK version conditional launch setting to block apps still below 20.8.0.\n\nSources:\n- In development fo r Microsoft Intune (Microsoft Learn): https://learn.microsoft.com/en-us/in tune/intune-service/fundamentals/in-development\n "Starting in late June 2026\, users opening iOS apps built with an Intune MAM SDK version earlier than 20.8.0 will see a warning message recommending they update to a supp orted app version for the best experience and continued compatibility."\n\ nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps: //www.kbytechnologies.com/deadlines/intune-ios-mam-sdk-warning URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ios-mam-sdk- warning CATEGORIES:Microsoft,Change TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:intune-ios-ipados-18-minimum@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20260928 DTEND;VALUE=DATE:20260929 SUMMARY:Intune requires iOS/iPadOS 18 or later DESCRIPTION:Microsoft · End of support\n\nWho is affected: Organisations m anaging iPhone and iPad with Intune MDM\, Company Portal or app protection policies. Userless devices enrolled through automated device enrollment h ave a separate support statement.\n\nWhat to do:\n1. In Devices > All devi ces\, filter by OS and version to find iOS/iPadOS devices below 18.\n2. Fo r app protection users\, check Apps > Monitor > App protection status and filter by platform version.\n3. Use compliance minimum OS version or app p rotection conditional launch to warn\, then block\, older versions.\n\nSou rces:\n- What's new in Microsoft Intune (Microsoft Learn): https://learn.m icrosoft.com/en-us/intune/intune-service/fundamentals/whats-new\n "Micros oft Intune now requires iOS/iPadOS 18 or later for standard device-managem ent\, Company Portal\, and app-protection scenarios."\n\nChecked 2026-11-0 9. Dates move\; check the source before you act.\nhttps://www.kbytechnolog ies.com/deadlines/intune-ios-ipados-18-minimum URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ios-ipados-1 8-minimum CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:intune-macos-15-minimum@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261001 DTEND;VALUE=DATE:20261002 SUMMARY:Intune moves to macOS 15 and later (Q4 2026) DESCRIPTION:Date: Q4 2026. The vendor has not published an exact day\, so t his event sits on the first day of that quarter.\n\nMicrosoft · End of su pport\n\nWho is affected: Organisations enrolling Macs with Intune. New Ma cs on macOS 14 or earlier will not be able to enrol\; Macs already enrolle d stay enrolled but are no longer supported.\n\nWhat to do:\n1. Filter Dev ices > All devices by macOS and add the OS version column to find Macs on macOS 14.x or earlier.\n2. Upgrade those Macs to macOS 15 or later\, or re place hardware that cannot run it.\n3. Upgrade spare and new-stock Macs be fore they are handed out\, so enrolment does not fail.\n\nSources:\n- In d evelopment for Microsoft Intune (Microsoft Learn): https://learn.microsoft .com/en-us/intune/intune-service/fundamentals/in-development\n "Later in calendar year 2026\, we expect macOS Golden Gate 27 to be released by Appl e. Microsoft Intune\, the Company Portal app\, and the Intune mobile devic e management agent support macOS 15 and later."\n- In development for Micr osoft Intune (Microsoft Learn): https://learn.microsoft.com/en-us/intune/i ntune-service/fundamentals/in-development\n "Microsoft Intune will update its minimum supported macOS version after Apple releases macOS 27. Intune \, the Company Portal\, and the Intune management agent will support macOS 15 and later."\n\nChecked 2026-11-09. Dates move\; check the source befor e you act.\nhttps://www.kbytechnologies.com/deadlines/intune-macos-15-mini mum URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-macos-15-min imum CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-administrator-protection-baseline-default@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261001 DTEND;VALUE=DATE:20261002 SUMMARY:Administrator protection enabled by default in Windows 11 security baselines (October 2026) DESCRIPTION:Date: October 2026. The vendor has not published an exact day\, so this event sits on the first day of that month.\n\nMicrosoft · Change \n\nWho is affected: Organisations applying the Windows 11 security baseli ne (26H2\, 25H2 or 24H2) through Intune or Group Policy. Local admins get just-in-time elevation prompts instead of a standing admin token.\n\nWhat to do:\n1. Test the baseline on a pilot ring\, especially for apps and scr ipts that elevate.\n2. Adjust the two User Account Control baseline settin gs in Intune or Group Policy if you need a different behaviour.\n3. Brief the helpdesk on the new elevation prompt.\n\nSources:\n- Windows message c enter (Windows release health\, Microsoft Learn): https://learn.microsoft. com/en-us/windows/release-health/windows-message-center\n "If your organi zation uses Windows security baselines\, Administrator protection becomes enabled by default with the October 2026 Windows security update."\n\nChec ked 2026-11-09. Dates move\; check the source before you act.\nhttps://www .kbytechnologies.com/deadlines/windows-administrator-protection-baseline-d efault URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-administrat or-protection-baseline-default CATEGORIES:Microsoft,Change TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:intune-ade-setup-assistant-legacy-ended@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261026 DTEND;VALUE=DATE:20261027 SUMMARY:Intune ends Setup Assistant (legacy) authentication for Apple autom ated device enrollment DESCRIPTION:Microsoft · Retirement\n\nWho is affected: Organisations using Apple automated device enrollment (ADE) profiles with user affinity that still authenticated with Setup Assistant (legacy). Existing profiles move to modern authentication\; enrolled devices stay enrolled.\n\nWhat to do:\ n1. Open each ADE profile with user affinity and confirm it now shows Setu p Assistant with modern authentication.\n2. Enrol one test iPhone and one test Mac to check MFA and Conditional Access prompts during Setup Assistan t.\n3. Update enrolment guides and helpdesk scripts that describe the old sign-in screens.\n\nSources:\n- What's new in Microsoft Intune (Microsoft Learn): https://learn.microsoft.com/en-us/intune/intune-service/fundamenta ls/whats-new\n "Intune has ended support for Setup Assistant (legacy) aut hentication for iOS/iPadOS and macOS automated device enrollment (ADE) wit h user affinity to align with modern authentication standards."\n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps://www.kb ytechnologies.com/deadlines/intune-ade-setup-assistant-legacy-ended URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ade-setup-as sistant-legacy-ended CATEGORIES:Microsoft,Retirement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:intune-legacy-apple-software-update-removed@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261026 DTEND;VALUE=DATE:20261027 SUMMARY:Intune removes legacy Apple MDM software update policies DESCRIPTION:Microsoft · Retirement\n\nWho is affected: Intune admins who s till manage iOS/iPadOS or macOS updates with legacy MDM software update po licies or the update-delay restriction settings. Apple removed the underly ing commands and payloads in OS 27.\n\nWhat to do:\n1. Recreate update rul es as declarative device management (DDM) software update policies in the settings catalog.\n2. Check that every Apple device group is covered by a DDM update policy before deleting the old policies.\n3. Re-check deferral settings: the legacy restriction keys for delaying updates were removed in OS 27.\n\nSources:\n- What's new in Microsoft Intune (Microsoft Learn): h ttps://learn.microsoft.com/en-us/intune/intune-service/fundamentals/whats- new\n "Microsoft Intune is removing legacy Apple MDM software update work loads after Apple retired the underlying commands and payloads in OS 27. A dmins should use Apple declarative device management update policies to co ntinue managing software updates."\n- apple/device-management CHANGES.md ( Apple\, GitHub): https://raw.githubusercontent.com/apple/device-management /release/CHANGES.md\n "Removed: mdm/commands/system.update.schedule.yaml" \n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhtt ps://www.kbytechnologies.com/deadlines/intune-legacy-apple-software-update -removed URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-legacy-apple -software-update-removed CATEGORIES:Microsoft,Retirement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:intune-android-strong-integrity@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261031 DTEND;VALUE=DATE:20261101 SUMMARY:Intune enforces Google's updated Strong Integrity verdict for Andro id 13 and later DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Users on Android 1 3 or later targeted by app protection or compliance policies that require Strong Integrity. Devices without a security update in the past 12 months no longer meet it and can be blocked or marked noncompliant.\n\nWhat to do :\n1. Use the app protection status report to find devices with an old And roid security patch date.\n2. Set Min OS version and Min patch version con ditional launch settings to warn before you block.\n3. Set the Minimum sec urity patch level compliance setting and tell affected users to update.\n\ nSources:\n- In development for Microsoft Intune (Microsoft Learn): https: //learn.microsoft.com/en-us/intune/intune-service/fundamentals/in-developm ent\n "Microsoft Intune will enforce this change by October 31\, 2026."\n \nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps ://www.kbytechnologies.com/deadlines/intune-android-strong-integrity URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-android-stro ng-integrity CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:intune-apns-renewal-jit-reminder@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261101 DTEND;VALUE=DATE:20261102 SUMMARY:Intune November release: JIT registration reminder at APNs renewal and automatic JIT for eligible tenants (November 2026) DESCRIPTION:Date: November 2026. The vendor has not published an exact day\ , so this event sits on the first day of that month.\n\nMicrosoft · Chang e\n\nWho is affected: Intune tenants that manage iOS/iPadOS devices. Every tenant sees the acknowledgment when renewing the Apple MDM push certifica te\; eligible tenants also get just-in-time (JIT) registration switched on automatically.\n\nWhat to do:\n1. Check that your Apple MDM push certific ate renewal owner knows to expect the new acknowledgment.\n2. Review your iOS/iPadOS SSO extension policy and confirm the JIT registration configura tion.\n3. Test registration from a work app on one personal and one corpor ate iPhone.\n\nSources:\n- In development for Microsoft Intune (Microsoft Learn): https://learn.microsoft.com/en-us/intune/intune-service/fundamenta ls/in-development\n "Beginning with the November 2026 release\, Intune wi ll display a new acknowledgment when you renew an Apple MDM push certifica te in the Microsoft Intune admin center."\n- In development for Microsoft Intune (Microsoft Learn): https://learn.microsoft.com/en-us/intune/intune- service/fundamentals/in-development\n "Microsoft Intune will automaticall y enable just-in-time (JIT) registration for eligible iOS/iPadOS tenants w ith the 2611 release."\n\nChecked 2026-11-09. Dates move\; check the sourc e before you act.\nhttps://www.kbytechnologies.com/deadlines/intune-apns-r enewal-jit-reminder URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-apns-renewal -jit-reminder CATEGORIES:Microsoft,Change TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-11-23h2-enterprise-education-end@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261110 DTEND;VALUE=DATE:20261111 SUMMARY:Windows 11\, version 23H2 Enterprise and Education reach end of upd ates DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running Windows 11\, version 23H2 Enterprise\, Education or IoT Enterprise. The N ovember 2026 security update is the last one for these editions.\n\nWhat t o do:\n1. Find 23H2 devices (build 22631) in Intune's All devices list or your update reports.\n2. Move them to a supported version such as 25H2 or 26H2 with a feature update policy.\n3. Check safeguard holds and app compa tibility on a pilot ring first.\n\nSources:\n- Windows message center (Win dows release health\, Microsoft Learn): https://learn.microsoft.com/en-us/ windows/release-health/windows-message-center\n "On November 10\, 2026\, Windows 11\, version 23H2 Enterprise and Education editions will reach end of updates. The November 2026 Windows security update will be the last up date available for these editions."\n- Ending Support in 2026 (Microsoft L ifecycle): https://learn.microsoft.com/en-us/lifecycle/end-of-support/end- of-support-2026\n "Windows 11 Enterprise and Education\, Version 23H2 | W indows 11 IoT Enterprise\, Version 23H2 | November 10\, 2026"\n\nChecked 2 026-11-09. Dates move\; check the source before you act.\nhttps://www.kbyt echnologies.com/deadlines/windows-11-23h2-enterprise-education-end URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-23h2-ent erprise-education-end CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:intune-ios-web-based-enrollment-default@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:Web-based enrolment becomes the default for user-owned iPhone and i Pad (Q1 2027) DESCRIPTION:Date: Q1 2027. The vendor has not published an exact day\, so t his event sits on the first day of that quarter.\n\nMicrosoft · Change\n\ nWho is affected: Organisations that let users enrol personal iPhones and iPads in Intune. The source says early 2027 without a day\, so treat the q uarter as approximate.\n\nWhat to do:\n1. Configure JIT registration in yo ur iOS/iPadOS SSO extension policy before the change.\n2. Test web-based e nrolment for a personal device end to end\, including Conditional Access.\ n3. Update user-facing enrolment instructions that tell people to install Company Portal first.\n\nSources:\n- In development for Microsoft Intune ( Microsoft Learn): https://learn.microsoft.com/en-us/intune/intune-service/ fundamentals/in-development\n "This reminder will help you prepare for we b-based enrollment becoming the default for user-owned iOS and iPadOS devi ces in early 2027."\n\nChecked 2026-11-09. Dates move\; check the source b efore you act.\nhttps://www.kbytechnologies.com/deadlines/intune-ios-web-b ased-enrollment-default URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ios-web-base d-enrollment-default CATEGORIES:Microsoft,Change TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-11-24h2-enterprise-education-end@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20271012 DTEND;VALUE=DATE:20271013 SUMMARY:Windows 11\, version 24H2 Enterprise and Education reach end of ser vicing DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running Windows 11\, version 24H2 Enterprise\, Education or IoT Enterprise.\n\nWh at to do:\n1. Plan a feature update to 25H2 or 26H2 well before the date.\ n2. Use Intune feature update policies or Autopatch rings so devices do no t sit on 24H2.\n3. Note that 24H2 non-security preview updates already end ed in September 2026.\n\nSources:\n- Ending Support in 2027 (Microsoft Lif ecycle): https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-of -support-2027\n "Windows 11 Enterprise and Education\, Version 24H2 | Win dows 11 IoT Enterprise\, Version 24H2 | October 12\, 2027"\n- Windows mess age center (Windows release health\, Microsoft Learn): https://learn.micro soft.com/en-us/windows/release-health/windows-message-center\n "Windows 1 1\, version 24H2 Enterprise and Education remain supported until October 1 2\, 2027."\n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps://www.kbytechnologies.com/deadlines/windows-11-24h2-enterpris e-education-end URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-24h2-ent erprise-education-end CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT END:VCALENDAR