BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//KBY Technologies//Admin Deadlines//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:KBY admin deadlines (Windows\, Intune)
X-WR-CALDESC:Microsoft and Apple retirements\, deprecations\, enforcement d
 ates and end-of-support dates for endpoint and identity admins. Each date 
 is quoted from the vendor's own page.
X-WR-TIMEZONE:UTC
REFRESH-INTERVAL;VALUE=DURATION:P1D
X-PUBLISHED-TTL:P1D
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines
BEGIN:VEVENT
UID:intune-ios-mam-sdk-warning@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20260601
DTEND;VALUE=DATE:20260602
SUMMARY:Warning for iOS apps built with an Intune MAM SDK older than 20.8.0
  (June 2026)
DESCRIPTION:Date: June 2026. The vendor has not published an exact day\, so
  this event sits on the first day of that month.\n\nMicrosoft · Change\n\
 nWho is affected: Users of app-protected iOS apps (Microsoft and third-par
 ty\, including in-house line-of-business apps) built with an Intune MAM SD
 K earlier than 20.8.0. The warning can be dismissed.\n\nWhat to do:\n1. As
 k users to update Teams\, Outlook\, Edge\, OneDrive and other protected ap
 ps from the App Store.\n2. Rebuild in-house apps with a current Intune App
  SDK or App Wrapping Tool.\n3. Use the Min SDK version conditional launch 
 setting to block apps still below 20.8.0.\n\nSources:\n- In development fo
 r Microsoft Intune (Microsoft Learn): https://learn.microsoft.com/en-us/in
 tune/intune-service/fundamentals/in-development\n  "Starting in late June 
 2026\, users opening iOS apps built with an Intune MAM SDK version earlier
  than 20.8.0 will see a warning message recommending they update to a supp
 orted app version for the best experience and continued compatibility."\n\
 nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps:
 //www.kbytechnologies.com/deadlines/intune-ios-mam-sdk-warning
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ios-mam-sdk-
 warning
CATEGORIES:Microsoft,Change
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:secure-boot-2011-kek-and-uefi-ca-expiry@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20260624
DTEND;VALUE=DATE:20260625
SUMMARY:Secure Boot 2011 certificates start expiring (KEK CA 2011 and UEFI 
 CA 2011)
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Windows PCs\, s
 ervers and virtual machines with Secure Boot that do not yet have the 2023
  certificates. They keep booting\, but cannot apply future Secure Boot upd
 ates signed with the new authorities.\n\nWhat to do:\n1. Check certificate
  status per device\, for example with the Secure Boot status report in Win
 dows Autopatch.\n2. Keep devices on current monthly updates\, which delive
 r the new certificates in phases.\n3. Ask OEMs and hypervisor vendors for 
 firmware or template updates where the update cannot apply.\n\nSources:\n-
  Manage Secure Boot certificate updates (Microsoft Learn): https://learn.m
 icrosoft.com/en-us/azure-stack/operator/secure-boot-certificates?view=azs-
 2604\n  "Microsoft Corporation KEK CA 2011 | June 24\, 2026 | Microsoft Co
 rporation KEK 2K CA 2023 | Stored in KEK | Signs updates to DB and DBX."\n
 - Manage Secure Boot certificate updates (Microsoft Learn): https://learn.
 microsoft.com/en-us/azure-stack/operator/secure-boot-certificates?view=azs
 -2604\n  "Microsoft UEFI CA 2011 * | June 27\, 2026 | Microsoft UEFI CA 20
 23 | Stored in DB | Signs third-party boot loaders and EFI applications."\
 n- Windows message center (Windows release health\, Microsoft Learn): http
 s://learn.microsoft.com/en-us/windows/release-health/windows-message-cente
 r\n  "Secure Boot certificates start expiring in June of 2026."\n\nChecked
  2026-11-09. Dates move\; check the source before you act.\nhttps://www.kb
 ytechnologies.com/deadlines/secure-boot-2011-kek-and-uefi-ca-expiry
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/secure-boot-2011-ke
 k-and-uefi-ca-expiry
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-ios-ipados-18-minimum@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20260928
DTEND;VALUE=DATE:20260929
SUMMARY:Intune requires iOS/iPadOS 18 or later
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Organisations m
 anaging iPhone and iPad with Intune MDM\, Company Portal or app protection
  policies. Userless devices enrolled through automated device enrollment h
 ave a separate support statement.\n\nWhat to do:\n1. In Devices > All devi
 ces\, filter by OS and version to find iOS/iPadOS devices below 18.\n2. Fo
 r app protection users\, check Apps > Monitor > App protection status and 
 filter by platform version.\n3. Use compliance minimum OS version or app p
 rotection conditional launch to warn\, then block\, older versions.\n\nSou
 rces:\n- What's new in Microsoft Intune (Microsoft Learn): https://learn.m
 icrosoft.com/en-us/intune/intune-service/fundamentals/whats-new\n  "Micros
 oft Intune now requires iOS/iPadOS 18 or later for standard device-managem
 ent\, Company Portal\, and app-protection scenarios."\n\nChecked 2026-11-0
 9. Dates move\; check the source before you act.\nhttps://www.kbytechnolog
 ies.com/deadlines/intune-ios-ipados-18-minimum
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ios-ipados-1
 8-minimum
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-macos-15-minimum@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261001
DTEND;VALUE=DATE:20261002
SUMMARY:Intune moves to macOS 15 and later (Q4 2026)
DESCRIPTION:Date: Q4 2026. The vendor has not published an exact day\, so t
 his event sits on the first day of that quarter.\n\nMicrosoft · End of su
 pport\n\nWho is affected: Organisations enrolling Macs with Intune. New Ma
 cs on macOS 14 or earlier will not be able to enrol\; Macs already enrolle
 d stay enrolled but are no longer supported.\n\nWhat to do:\n1. Filter Dev
 ices > All devices by macOS and add the OS version column to find Macs on 
 macOS 14.x or earlier.\n2. Upgrade those Macs to macOS 15 or later\, or re
 place hardware that cannot run it.\n3. Upgrade spare and new-stock Macs be
 fore they are handed out\, so enrolment does not fail.\n\nSources:\n- In d
 evelopment for Microsoft Intune (Microsoft Learn): https://learn.microsoft
 .com/en-us/intune/intune-service/fundamentals/in-development\n  "Later in 
 calendar year 2026\, we expect macOS Golden Gate 27 to be released by Appl
 e. Microsoft Intune\, the Company Portal app\, and the Intune mobile devic
 e management agent support macOS 15 and later."\n- In development for Micr
 osoft Intune (Microsoft Learn): https://learn.microsoft.com/en-us/intune/i
 ntune-service/fundamentals/in-development\n  "Microsoft Intune will update
  its minimum supported macOS version after Apple releases macOS 27. Intune
 \, the Company Portal\, and the Intune management agent will support macOS
  15 and later."\n\nChecked 2026-11-09. Dates move\; check the source befor
 e you act.\nhttps://www.kbytechnologies.com/deadlines/intune-macos-15-mini
 mum
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-macos-15-min
 imum
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-administrator-protection-baseline-default@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261001
DTEND;VALUE=DATE:20261002
SUMMARY:Administrator protection enabled by default in Windows 11 security 
 baselines (October 2026)
DESCRIPTION:Date: October 2026. The vendor has not published an exact day\,
  so this event sits on the first day of that month.\n\nMicrosoft · Change
 \n\nWho is affected: Organisations applying the Windows 11 security baseli
 ne (26H2\, 25H2 or 24H2) through Intune or Group Policy. Local admins get 
 just-in-time elevation prompts instead of a standing admin token.\n\nWhat 
 to do:\n1. Test the baseline on a pilot ring\, especially for apps and scr
 ipts that elevate.\n2. Adjust the two User Account Control baseline settin
 gs in Intune or Group Policy if you need a different behaviour.\n3. Brief 
 the helpdesk on the new elevation prompt.\n\nSources:\n- Windows message c
 enter (Windows release health\, Microsoft Learn): https://learn.microsoft.
 com/en-us/windows/release-health/windows-message-center\n  "If your organi
 zation uses Windows security baselines\, Administrator protection becomes 
 enabled by default with the October 2026 Windows security update."\n\nChec
 ked 2026-11-09. Dates move\; check the source before you act.\nhttps://www
 .kbytechnologies.com/deadlines/windows-administrator-protection-baseline-d
 efault
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-administrat
 or-protection-baseline-default
CATEGORIES:Microsoft,Change
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-ntlmv1-sso-hardening@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261001
DTEND;VALUE=DATE:20261002
SUMMARY:NTLMv1-derived credentials for single sign-on restricted by default
  (October 2026)
DESCRIPTION:Date: October 2026. The vendor has not published an exact day\,
  so this event sits on the first day of that month.\n\nMicrosoft · Enforc
 ement\n\nWho is affected: Windows 11 (24H2\, 25H2\, 26H2) and Windows Serv
 er 2025 devices with Credential Guard disabled that connect to Wi-Fi\, Eth
 ernet or VPN using MS-CHAPv2. Single sign-on to those networks can fail.\n
 \nWhat to do:\n1. Find Wi-Fi\, wired 802.1X and VPN profiles that use MS-C
 HAPv2 (PEAP-MSCHAPv2).\n2. Move them to certificate-based authentication\,
  for example EAP-TLS with Intune-issued certificates.\n3. Use the temporar
 y allow-and-audit registry setting in KB5066470 only while you migrate.\n\
 nSources:\n- Windows message center (Windows release health\, Microsoft Le
 arn): https://learn.microsoft.com/en-us/windows/release-health/windows-mes
 sage-center\n  "Beginning with the October 2026 security update\, Windows 
 11\, versions 26H2\, 25H2\, and 24H2\, along with Windows Server 2025\, en
 force restrictions on generating NTLMv1-derived credentials for Single Sig
 n-On by default."\n\nChecked 2026-11-09. Dates move\; check the source bef
 ore you act.\nhttps://www.kbytechnologies.com/deadlines/windows-ntlmv1-sso
 -hardening
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-ntlmv1-sso-
 hardening
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-10-esu-year-1-ends@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261013
DTEND;VALUE=DATE:20261014
SUMMARY:Windows 10 Extended Security Updates: Year 1 ends
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Organisations w
 hose Windows 10 Enterprise\, Education or Pro (commercial use) devices wer
 e covered only by Year 1 of ESU. Without Year 2\, those devices stop recei
 ving security updates.\n\nWhat to do:\n1. List Windows 10 devices still in
  use and confirm which ones have a Year 2 ESU key activated.\n2. Buy Year 
 2 for devices that cannot move yet\; ESU is cumulative\, so a late start s
 till pays for Year 1.\n3. Prioritise upgrading or replacing the devices th
 at have no ESU coverage.\n\nSources:\n- Extended Security Updates FAQ (Mic
 rosoft Lifecycle): https://learn.microsoft.com/en-us/lifecycle/faq/extende
 d-security-updates\n  "Windows 10*** | October 14\, 2025 | October 13\, 20
 26 | October 12\, 2027 | October 10\, 2028 | Critical\, Important"\n\nChec
 ked 2026-11-09. Dates move\; check the source before you act.\nhttps://www
 .kbytechnologies.com/deadlines/windows-10-esu-year-1-ends
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-10-esu-year
 -1-ends
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-11-24h2-home-pro-and-ltsb-2016-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261013
DTEND;VALUE=DATE:20261014
SUMMARY:Windows 11\, version 24H2 Home and Pro\, and Windows 10 Enterprise 
 LTSB 2016 reach end of updates
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices on Wind
 ows 11\, version 24H2 Home or Pro\, and devices on Windows 10 Enterprise L
 TSB 2016. Windows 11\, version 24H2 Enterprise and Education stay supporte
 d until October 12\, 2027.\n\nWhat to do:\n1. Update Windows 11 Pro device
 s on 24H2 to 25H2 or 26H2.\n2. Move LTSB 2016 devices to Windows 11 Enterp
 rise LTSC 2024\, or buy ESU while you migrate.\n3. Remember that Home and 
 Pro editions get 24 months of updates per version\, against 36 for Enterpr
 ise and Education.\n\nSources:\n- Windows message center (Windows release 
 health\, Microsoft Learn): https://learn.microsoft.com/en-us/windows/relea
 se-health/windows-message-center\n  "Today\, October 13\, 2026\, Windows 1
 1\, version 24H2 Home and Pro\, and Windows 10 Enterprise LTSB 2016 have r
 eached end of updates."\n\nChecked 2026-11-09. Dates move\; check the sour
 ce before you act.\nhttps://www.kbytechnologies.com/deadlines/windows-11-2
 4h2-home-pro-and-ltsb-2016-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-24h2-hom
 e-pro-and-ltsb-2016-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:secure-boot-windows-production-pca-2011-expiry@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261019
DTEND;VALUE=DATE:20261020
SUMMARY:Secure Boot: Microsoft Windows Production PCA 2011 expires
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Windows devices
  whose boot manager still relies on the 2011 Windows Production PCA. The r
 eplacement is Windows UEFI CA 2023\, which signs the Windows boot loader.\
 n\nWhat to do:\n1. Confirm devices report the Windows UEFI CA 2023 certifi
 cate in the Secure Boot database.\n2. Expect one extra restart on some dev
 ices when the Secure Boot certificate update applies.\n3. Refresh boot med
 ia\, PXE images and VM templates so they boot with the new certificate cha
 in.\n\nSources:\n- Manage Secure Boot certificate updates (Microsoft Learn
 ): https://learn.microsoft.com/en-us/azure-stack/operator/secure-boot-cert
 ificates?view=azs-2604\n  "Microsoft Windows Production PCA 2011 | October
  19\, 2026 | Windows UEFI CA 2023 | Stored in DB | Used for signing the Wi
 ndows boot loader."\n\nChecked 2026-11-09. Dates move\; check the source b
 efore you act.\nhttps://www.kbytechnologies.com/deadlines/secure-boot-wind
 ows-production-pca-2011-expiry
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/secure-boot-windows
 -production-pca-2011-expiry
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-ade-setup-assistant-legacy-ended@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261026
DTEND;VALUE=DATE:20261027
SUMMARY:Intune ends Setup Assistant (legacy) authentication for Apple autom
 ated device enrollment
DESCRIPTION:Microsoft · Retirement\n\nWho is affected: Organisations using
  Apple automated device enrollment (ADE) profiles with user affinity that 
 still authenticated with Setup Assistant (legacy). Existing profiles move 
 to modern authentication\; enrolled devices stay enrolled.\n\nWhat to do:\
 n1. Open each ADE profile with user affinity and confirm it now shows Setu
 p Assistant with modern authentication.\n2. Enrol one test iPhone and one 
 test Mac to check MFA and Conditional Access prompts during Setup Assistan
 t.\n3. Update enrolment guides and helpdesk scripts that describe the old 
 sign-in screens.\n\nSources:\n- What's new in Microsoft Intune (Microsoft 
 Learn): https://learn.microsoft.com/en-us/intune/intune-service/fundamenta
 ls/whats-new\n  "Intune has ended support for Setup Assistant (legacy) aut
 hentication for iOS/iPadOS and macOS automated device enrollment (ADE) wit
 h user affinity to align with modern authentication standards."\n\nChecked
  2026-11-09. Dates move\; check the source before you act.\nhttps://www.kb
 ytechnologies.com/deadlines/intune-ade-setup-assistant-legacy-ended
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ade-setup-as
 sistant-legacy-ended
CATEGORIES:Microsoft,Retirement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-legacy-apple-software-update-removed@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261026
DTEND;VALUE=DATE:20261027
SUMMARY:Intune removes legacy Apple MDM software update policies
DESCRIPTION:Microsoft · Retirement\n\nWho is affected: Intune admins who s
 till manage iOS/iPadOS or macOS updates with legacy MDM software update po
 licies or the update-delay restriction settings. Apple removed the underly
 ing commands and payloads in OS 27.\n\nWhat to do:\n1. Recreate update rul
 es as declarative device management (DDM) software update policies in the 
 settings catalog.\n2. Check that every Apple device group is covered by a 
 DDM update policy before deleting the old policies.\n3. Re-check deferral 
 settings: the legacy restriction keys for delaying updates were removed in
  OS 27.\n\nSources:\n- What's new in Microsoft Intune (Microsoft Learn): h
 ttps://learn.microsoft.com/en-us/intune/intune-service/fundamentals/whats-
 new\n  "Microsoft Intune is removing legacy Apple MDM software update work
 loads after Apple retired the underlying commands and payloads in OS 27. A
 dmins should use Apple declarative device management update policies to co
 ntinue managing software updates."\n- apple/device-management CHANGES.md (
 Apple\, GitHub): https://raw.githubusercontent.com/apple/device-management
 /release/CHANGES.md\n  "Removed: mdm/commands/system.update.schedule.yaml"
 \n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhtt
 ps://www.kbytechnologies.com/deadlines/intune-legacy-apple-software-update
 -removed
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-legacy-apple
 -software-update-removed
CATEGORIES:Microsoft,Retirement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-android-strong-integrity@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261031
DTEND;VALUE=DATE:20261101
SUMMARY:Intune enforces Google's updated Strong Integrity verdict for Andro
 id 13 and later
DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Users on Android 1
 3 or later targeted by app protection or compliance policies that require 
 Strong Integrity. Devices without a security update in the past 12 months 
 no longer meet it and can be blocked or marked noncompliant.\n\nWhat to do
 :\n1. Use the app protection status report to find devices with an old And
 roid security patch date.\n2. Set Min OS version and Min patch version con
 ditional launch settings to warn before you block.\n3. Set the Minimum sec
 urity patch level compliance setting and tell affected users to update.\n\
 nSources:\n- In development for Microsoft Intune (Microsoft Learn): https:
 //learn.microsoft.com/en-us/intune/intune-service/fundamentals/in-developm
 ent\n  "Microsoft Intune will enforce this change by October 31\, 2026."\n
 \nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps
 ://www.kbytechnologies.com/deadlines/intune-android-strong-integrity
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-android-stro
 ng-integrity
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-apns-renewal-jit-reminder@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261101
DTEND;VALUE=DATE:20261102
SUMMARY:Intune November release: JIT registration reminder at APNs renewal 
 and automatic JIT for eligible tenants (November 2026)
DESCRIPTION:Date: November 2026. The vendor has not published an exact day\
 , so this event sits on the first day of that month.\n\nMicrosoft · Chang
 e\n\nWho is affected: Intune tenants that manage iOS/iPadOS devices. Every
  tenant sees the acknowledgment when renewing the Apple MDM push certifica
 te\; eligible tenants also get just-in-time (JIT) registration switched on
  automatically.\n\nWhat to do:\n1. Check that your Apple MDM push certific
 ate renewal owner knows to expect the new acknowledgment.\n2. Review your 
 iOS/iPadOS SSO extension policy and confirm the JIT registration configura
 tion.\n3. Test registration from a work app on one personal and one corpor
 ate iPhone.\n\nSources:\n- In development for Microsoft Intune (Microsoft 
 Learn): https://learn.microsoft.com/en-us/intune/intune-service/fundamenta
 ls/in-development\n  "Beginning with the November 2026 release\, Intune wi
 ll display a new acknowledgment when you renew an Apple MDM push certifica
 te in the Microsoft Intune admin center."\n- In development for Microsoft 
 Intune (Microsoft Learn): https://learn.microsoft.com/en-us/intune/intune-
 service/fundamentals/in-development\n  "Microsoft Intune will automaticall
 y enable just-in-time (JIT) registration for eligible iOS/iPadOS tenants w
 ith the 2611 release."\n\nChecked 2026-11-09. Dates move\; check the sourc
 e before you act.\nhttps://www.kbytechnologies.com/deadlines/intune-apns-r
 enewal-jit-reminder
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-apns-renewal
 -jit-reminder
CATEGORIES:Microsoft,Change
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-11-23h2-enterprise-education-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20261110
DTEND;VALUE=DATE:20261111
SUMMARY:Windows 11\, version 23H2 Enterprise and Education reach end of upd
 ates
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running
  Windows 11\, version 23H2 Enterprise\, Education or IoT Enterprise. The N
 ovember 2026 security update is the last one for these editions.\n\nWhat t
 o do:\n1. Find 23H2 devices (build 22631) in Intune's All devices list or 
 your update reports.\n2. Move them to a supported version such as 25H2 or 
 26H2 with a feature update policy.\n3. Check safeguard holds and app compa
 tibility on a pilot ring first.\n\nSources:\n- Windows message center (Win
 dows release health\, Microsoft Learn): https://learn.microsoft.com/en-us/
 windows/release-health/windows-message-center\n  "On November 10\, 2026\, 
 Windows 11\, version 23H2 Enterprise and Education editions will reach end
  of updates. The November 2026 Windows security update will be the last up
 date available for these editions."\n- Ending Support in 2026 (Microsoft L
 ifecycle): https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-
 of-support-2026\n  "Windows 11 Enterprise and Education\, Version 23H2 | W
 indows 11 IoT Enterprise\, Version 23H2 | November 10\, 2026"\n\nChecked 2
 026-11-09. Dates move\; check the source before you act.\nhttps://www.kbyt
 echnologies.com/deadlines/windows-11-23h2-enterprise-education-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-23h2-ent
 erprise-education-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:intune-ios-web-based-enrollment-default@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270101
DTEND;VALUE=DATE:20270102
SUMMARY:Web-based enrolment becomes the default for user-owned iPhone and i
 Pad (Q1 2027)
DESCRIPTION:Date: Q1 2027. The vendor has not published an exact day\, so t
 his event sits on the first day of that quarter.\n\nMicrosoft · Change\n\
 nWho is affected: Organisations that let users enrol personal iPhones and 
 iPads in Intune. The source says early 2027 without a day\, so treat the q
 uarter as approximate.\n\nWhat to do:\n1. Configure JIT registration in yo
 ur iOS/iPadOS SSO extension policy before the change.\n2. Test web-based e
 nrolment for a personal device end to end\, including Conditional Access.\
 n3. Update user-facing enrolment instructions that tell people to install 
 Company Portal first.\n\nSources:\n- In development for Microsoft Intune (
 Microsoft Learn): https://learn.microsoft.com/en-us/intune/intune-service/
 fundamentals/in-development\n  "This reminder will help you prepare for we
 b-based enrollment becoming the default for user-owned iOS and iPadOS devi
 ces in early 2027."\n\nChecked 2026-11-09. Dates move\; check the source b
 efore you act.\nhttps://www.kbytechnologies.com/deadlines/intune-ios-web-b
 ased-enrollment-default
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/intune-ios-web-base
 d-enrollment-default
CATEGORIES:Microsoft,Change
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-refs-removable-media-enforcement@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270101
DTEND;VALUE=DATE:20270102
SUMMARY:ReFS volumes on removable media: enforcement phase (January 2027)
DESCRIPTION:Date: January 2027. The vendor has not published an exact day\,
  so this event sits on the first day of that month.\n\nMicrosoft · Enforc
 ement\n\nWho is affected: Devices that use ReFS on externally attached or 
 removable storage. The October 2026 update started the audit phase\; the J
 anuary 2027 update can block affected volumes.\n\nWhat to do:\n1. Review t
 he audit events added by the October 2026 update to find external ReFS vol
 umes.\n2. Reformat or move data off unsupported external ReFS configuratio
 ns before January 2027.\n\nSources:\n- Windows message center (Windows rel
 ease health\, Microsoft Learn): https://learn.microsoft.com/en-us/windows/
 release-health/windows-message-center\n  "January 2027 Windows security up
 date (Enforcement phase)"\n\nChecked 2026-11-09. Dates move\; check the so
 urce before you act.\nhttps://www.kbytechnologies.com/deadlines/windows-re
 fs-removable-media-enforcement
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-refs-remova
 ble-media-enforcement
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-10-enterprise-ltsc-2021-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270112
DTEND;VALUE=DATE:20270113
SUMMARY:Windows 10 Enterprise LTSC 2021 reaches end of updates
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running
  Windows 10 Enterprise LTSC 2021\, often kiosks\, shop-floor and medical o
 r lab devices. The January 2027 security update is the last one.\n\nWhat t
 o do:\n1. Inventory LTSC 2021 devices and the line-of-business software ea
 ch one runs.\n2. Test the workload on Windows 11 Enterprise LTSC 2024 and 
 schedule the rebuilds.\n3. Buy ESU for devices that cannot move before Jan
 uary 12\, 2027.\n\nSources:\n- Windows message center (Windows release hea
 lth\, Microsoft Learn): https://learn.microsoft.com/en-us/windows/release-
 health/windows-message-center\n  "On January 12\, 2027\, Windows 10 Enterp
 rise LTSC 2021 will reach end of updates. The January 2027 Windows securit
 y update will be the last update available for this version."\n\nChecked 2
 026-11-09. Dates move\; check the source before you act.\nhttps://www.kbyt
 echnologies.com/deadlines/windows-10-enterprise-ltsc-2021-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-10-enterpri
 se-ltsc-2021-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-update-certificate-rotation-may-2027@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270517
DTEND;VALUE=DATE:20270518
SUMMARY:Windows Update certificate rotation: Windows 10 Enterprise 2019 LTS
 C\, Windows Server 2019 and 2016
DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Windows 10 Enterpr
 ise 2019 LTSC\, Windows Server 2019 and Windows Server 2016 devices that g
 et updates directly from Windows Update. Devices updated through WSUS are 
 not affected by this change.\n\nWhat to do:\n1. Install the July 2026 secu
 rity update or later on these devices before May 17\, 2027.\n2. Find devic
 es that have stopped patching: without the replacement certificates they l
 ose access to Windows Update.\n\nSources:\n- Windows message center (Windo
 ws release health\, Microsoft Learn): https://learn.microsoft.com/en-us/wi
 ndows/release-health/windows-message-center\n  "Windows 10 Enterprise 2019
  LTSC\, Windows Server 2019\, and Windows Server 2016: Install the July 20
 26 security update or later before May 17\, 2027."\n\nChecked 2026-11-09. 
 Dates move\; check the source before you act.\nhttps://www.kbytechnologies
 .com/deadlines/windows-update-certificate-rotation-may-2027
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-update-cert
 ificate-rotation-may-2027
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-update-certificate-rotation-june-2027@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20270619
DTEND;VALUE=DATE:20270620
SUMMARY:Windows Update certificate rotation: Windows 11\, Windows Server 20
 22/2025 and other in-support Windows 10
DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: In-support Windows
  11\, Windows Server 2022 and 2025\, and in-support Windows 10 devices tha
 t are behind on monthly updates. Windows 11\, version 25H2 and later need 
 no action.\n\nWhat to do:\n1. Windows 11\, version 24H2 and Windows Server
  2025: install the September 2025 security update or later.\n2. Other in-s
 upport Windows 11\, Windows Server 2022 and Windows 10: install the July 2
 026 security update or later.\n3. Upgrade any out-of-support Windows versi
 on\, which will lose access to Windows Update.\n\nSources:\n- Windows mess
 age center (Windows release health\, Microsoft Learn): https://learn.micro
 soft.com/en-us/windows/release-health/windows-message-center\n  "Certifica
 tes used to establish trusted connections to Windows Update will expire on
  May 17\, 2027 and June 19\, 2027. Devices must contain the replacement ce
 rtificates to continue receiving updates after the applicable expiration d
 ate."\n\nChecked 2026-11-09. Dates move\; check the source before you act.
 \nhttps://www.kbytechnologies.com/deadlines/windows-update-certificate-rot
 ation-june-2027
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-update-cert
 ificate-rotation-june-2027
CATEGORIES:Microsoft,Enforcement
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-10-esu-year-2-ends@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20271012
DTEND;VALUE=DATE:20271013
SUMMARY:Windows 10 Extended Security Updates: Year 2 ends
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Organisations p
 aying for Windows 10 ESU Year 2. Year 3 is the last year available and run
 s to October 10\, 2028.\n\nWhat to do:\n1. Decide before renewal which rem
 aining Windows 10 devices justify a Year 3 purchase.\n2. Set a migration d
 ate for every remaining Windows 10 device and track it.\n3. Check that ESU
  keys are activated on the devices that need them\, not just purchased.\n\
 nSources:\n- Extended Security Updates FAQ (Microsoft Lifecycle): https://
 learn.microsoft.com/en-us/lifecycle/faq/extended-security-updates\n  "Wind
 ows 10*** | October 14\, 2025 | October 13\, 2026 | October 12\, 2027 | Oc
 tober 10\, 2028 | Critical\, Important"\n\nChecked 2026-11-09. Dates move\
 ; check the source before you act.\nhttps://www.kbytechnologies.com/deadli
 nes/windows-10-esu-year-2-ends
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-10-esu-year
 -2-ends
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-11-24h2-enterprise-education-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20271012
DTEND;VALUE=DATE:20271013
SUMMARY:Windows 11\, version 24H2 Enterprise and Education reach end of ser
 vicing
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running
  Windows 11\, version 24H2 Enterprise\, Education or IoT Enterprise.\n\nWh
 at to do:\n1. Plan a feature update to 25H2 or 26H2 well before the date.\
 n2. Use Intune feature update policies or Autopatch rings so devices do no
 t sit on 24H2.\n3. Note that 24H2 non-security preview updates already end
 ed in September 2026.\n\nSources:\n- Ending Support in 2027 (Microsoft Lif
 ecycle): https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-of
 -support-2027\n  "Windows 11 Enterprise and Education\, Version 24H2 | Win
 dows 11 IoT Enterprise\, Version 24H2 | October 12\, 2027"\n- Windows mess
 age center (Windows release health\, Microsoft Learn): https://learn.micro
 soft.com/en-us/windows/release-health/windows-message-center\n  "Windows 1
 1\, version 24H2 Enterprise and Education remain supported until October 1
 2\, 2027."\n\nChecked 2026-11-09. Dates move\; check the source before you
  act.\nhttps://www.kbytechnologies.com/deadlines/windows-11-24h2-enterpris
 e-education-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-24h2-ent
 erprise-education-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
BEGIN:VEVENT
UID:windows-11-25h2-home-pro-end@kbytechnologies.com
DTSTAMP:20261109T000000Z
LAST-MODIFIED:20261109T000000Z
DTSTART;VALUE=DATE:20271012
DTEND;VALUE=DATE:20271013
SUMMARY:Windows 11\, version 25H2 Home and Pro reach end of updates
DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices on Wind
 ows 11\, version 25H2 Home\, Pro\, Pro Education or Pro for Workstations. 
 Enterprise and Education editions of 25H2 are supported for a further year
 .\n\nWhat to do:\n1. Identify Pro-edition devices in your fleet\; they fol
 low the 24-month lifecycle\, not the 36-month one.\n2. Plan their move to 
 26H2 during 2027.\n\nSources:\n- Windows 11 release information (Microsoft
  Learn): https://learn.microsoft.com/en-us/windows/release-health/windows1
 1-release-information\n  "25H2 | General Availability Channel | 2025-09-30
  | 2027-10-12 | 2028-10-10"\n\nChecked 2026-11-09. Dates move\; check the 
 source before you act.\nhttps://www.kbytechnologies.com/deadlines/windows-
 11-25h2-home-pro-end
URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-25h2-hom
 e-pro-end
CATEGORIES:Microsoft,End of support
TRANSP:TRANSPARENT
STATUS:CONFIRMED
END:VEVENT
END:VCALENDAR