KBY Technologies Logo

Admin deadlines

What Microsoft and Apple are retiring, changing or enforcing, and when

One list for endpoint and identity admins: Intune, Entra ID, Exchange Online, Windows, PowerShell and Apple device management. Each entry says who is affected and what to do, and quotes the vendor line that gives the date.

Next 90 days
3
Upcoming in total
4
Passed in the last 6 months
2

Each date is quoted from the vendor’s own page. Dates move; check the source before you act. Where a vendor gives only a month or a rough period, we show that, not a made-up day. Checked 9 Nov 2026.

Clear

Upcoming (filtered)

November 2026

This monthMicrosoftDeprecationVendor gives the month only

SAP SuccessFactors provisioning: move from basic auth to workload identity

Entra ID

Who is affected
Organisations using Entra provisioning from SAP SuccessFactors to Active Directory or Entra ID, or writeback to SuccessFactors, with basic authentication.
What to do
  1. Open each SuccessFactors provisioning app and check which authentication method it uses.
  2. Switch the connectivity settings to workload identity-based authentication and test a provisioning cycle.
  3. Remove the stored SuccessFactors service account password once the switch works.
Source
Plan for change - Switch from basic auth to workload identity based auth for SAP SuccessFactors provisioning integrations“If you are currently using basic authentication for any of the above SAP SuccessFactors provisioning integrations, you must upgrade to workload identity-based authentication before November 2026 to ensure uninterrupted operation of the integrations.”
Microsoft Entra releases and announcements (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

TomorrowMicrosoftEnd of support

PowerShell 7.4 (LTS) and 7.5 reach end of support

PowerShell

Who is affected
Admin workstations, automation servers and scheduled tasks running PowerShell 7.4 or 7.5, including scripts that use the Microsoft Graph PowerShell SDK or Exchange Online module. Windows PowerShell 5.1 has its own lifecycle.
What to do
  1. Run $PSVersionTable on automation hosts and build agents to find 7.4 and 7.5.
  2. Install PowerShell 7.6 (LTS) and re-test scheduled scripts and module imports.
  3. Update any pinned PowerShell versions in deployment packages or container images.
Source
“The current LTS release is PowerShell 7.6.6. The previous LTS release, PowerShell 7.4.20, is still supported until 10-Nov-2026.”
PowerShell Support Lifecycle (Microsoft Learn)
End-of-support dates for current versions (columns: version, release date, end-of-support, .NET version)“PowerShell 7.5 | 23-Jan-2025 | 10-Nov-2026 | .NET 9.0”
PowerShell Support Lifecycle (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

February 2027

In 85 daysMicrosoftEnd of support

Entra Connect Sync 2.5.190.0 reaches end of support

Entra IDActive Directory

Who is affected
Sync servers still on Entra Connect Sync 2.5.190.0. Version 2.6.1.0 follows on 10 Mar 2027; each 2.x version retires 12 months after a newer one is released.
What to do
  1. Upgrade to the latest Entra Connect Sync release from the Microsoft Entra admin center.
  2. If you edited miiserver.exe.config, check the known upgrade issue on the version history page first.
Source
Retiring Microsoft Entra Connect 2.x versions (columns: version, end of support date, release date)“2.5.190.0 | 02 Feb 2027 (12 months after release of 2.6.1.0) | 19 Nov 2025”
Microsoft Entra Connect: Version release history (Microsoft Learn)
Retiring Microsoft Entra Connect 2.x versions (columns: version, end of support date, release date)“2.6.1.0 | 10 Mar 2027 (12 months after release of 2.6.3.0) | 2 Feb 2026”
Microsoft Entra Connect: Version release history (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

April 2027

In 149 daysMicrosoftEnforcement

Entra Connect Sync: upgrade to 2.6.84.0 or later and use application-based authentication

Entra IDActive Directory

Who is affected
Every organisation running Microsoft Entra Connect Sync. Synchronisation stops after this date on servers that have not been upgraded and switched to application-based authentication.
What to do
  1. Check the installed Entra Connect Sync version on every sync server, including staging servers.
  2. Download the current build from the Microsoft Entra admin center and upgrade.
  3. Configure application-based authentication and confirm .NET Framework 4.7.2 and TLS 1.2 are in place.
Source
“Mandatory upgrade required: Upgrade Microsoft Entra Connect Sync to version 2.6.84.0 or later and configure application-based authentication by April 7, 2027.”
Microsoft Entra Connect: Version release history (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

Put these dates in your calendar

The calendar feed uses the filter you have selected and refreshes daily in Outlook, Apple Calendar and Google Calendar. Each event carries the actions and the source link.

Download .ics JSON

webcal://www.kbytechnologies.com/deadlines/calendar.ics?products=entra-id,powershell

Embed the next deadlines on your intranet

Paste this into a SharePoint embed web part or any page that allows iframes. Add &limit=10 to the URL for more rows.

<iframe src="https://www.kbytechnologies.com/deadlines/embed?products=entra-id,powershell" title="Upcoming Microsoft and Apple admin deadlines" width="400" height="460" loading="lazy" style="width:100%;max-width:480px;border:1px solid #e2e8f0;border-radius:12px"></iframe>

Recently passed

Dates from the last 6 months. If one of these still applies to you, you are already past the vendor’s date.

131 days agoMicrosoftEnforcement

Azure mandatory MFA Phase 2: last postponement date

Entra IDPowerShell

Who is affected
Tenants that postponed Phase 2. User accounts that create, update or delete Azure resources through Azure CLI, Azure PowerShell, the Azure mobile app, IaC tools or REST APIs must complete MFA.
What to do
  1. Move automation that signs in as a user account to managed identities or service principals.
  2. Require MFA with a Conditional Access policy so users satisfy it before they hit errors.
  3. Give break-glass accounts a passkey (FIDO2) or certificate-based authentication.
Source
Request more time to prepare for Phase 2 MFA enforcement“Microsoft allows customers with complex environments or technical barriers to postpone the enforcement of Phase 2 for their tenants until July 1st, 2026.”
Planning for mandatory Microsoft Entra multifactor authentication (Microsoft Learn)

On KBY:Conditional Access deployment checklistSecurity keys for Microsoft 365 administrators

Checked 9 Nov 2026 Link to this deadline

161 days agoMicrosoftEnforcement

Entra Connect and Cloud Sync blocked from hard-matching users who hold Entra roles

Entra IDActive Directory

Who is affected
Hybrid identity teams that hard-match new Active Directory users to existing cloud users. Matching is now refused when the cloud user holds a Microsoft Entra role; soft match and existing synced users are not affected.
What to do
  1. Remove Entra role assignments from a cloud user before you hard-match it, then reassign them.
  2. Check sync error reports for hard-match failures since June 2026.
  3. Keep privileged admin accounts cloud-only rather than synced from Active Directory.
Source
Upcoming change – Microsoft Entra Connect security update to block hard match for users with Microsoft Entra roles“Beginning June 1, 2026, Microsoft Entra ID will block any attempt by Entra Connect Sync or Cloud Sync from hard-matching a new user object from Active Directory to an existing cloud-managed Entra ID user object that holds Microsoft Entra roles.”
Microsoft Entra releases and announcements (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

How this list is made

  • Only dates stated on Microsoft Learn, Microsoft Lifecycle, Windows release health, Apple Developer or Apple’s published device management schema are included.
  • The quoted line is copied from that page. Where the date is only in a table, the row is quoted with cells separated by “|”.
  • Items without a vendor-stated date are left out, even when they are widely reported.
  • Days remaining are counted in UK time. A month or quarter counts as due for the whole period.