KBY Technologies Logo

Admin deadlines

What Microsoft and Apple are retiring, changing or enforcing, and when

One list for endpoint and identity admins: Intune, Entra ID, Exchange Online, Windows, PowerShell and Apple device management. Each entry says who is affected and what to do, and quotes the vendor line that gives the date.

Next 90 days
4
Upcoming in total
5
Passed in the last 6 months
6

Each date is quoted from the vendor’s own page. Dates move; check the source before you act. Where a vendor gives only a month or a rough period, we show that, not a made-up day. Checked 9 Nov 2026.

Clear

Upcoming (filtered)

November 2026

Q4 2026This quarterMicrosoftEnd of supportVendor gives an approximate period only

Intune moves to macOS 15 and later

IntunemacOS

Who is affected
Organisations enrolling Macs with Intune. New Macs on macOS 14 or earlier will not be able to enrol; Macs already enrolled stay enrolled but are no longer supported.
What to do
  1. Filter Devices > All devices by macOS and add the OS version column to find Macs on macOS 14.x or earlier.
  2. Upgrade those Macs to macOS 15 or later, or replace hardware that cannot run it.
  3. Upgrade spare and new-stock Macs before they are handed out, so enrolment does not fail.
Source
Plan for change: Intune is moving to support macOS 15 and higher later this year“Later in calendar year 2026, we expect macOS Golden Gate 27 to be released by Apple. Microsoft Intune, the Company Portal app, and the Intune mobile device management agent support macOS 15 and later.”
In development for Microsoft Intune (Microsoft Learn)
Updated minimum supported version for macOS“Microsoft Intune will update its minimum supported macOS version after Apple releases macOS 27. Intune, the Company Portal, and the Intune management agent will support macOS 15 and later.”
In development for Microsoft Intune (Microsoft Learn)

On KBY:Intune vs Jamf for Mac management

Checked 9 Nov 2026 Link to this deadline

This monthMicrosoftChangeVendor gives the month only

Intune November release: JIT registration reminder at APNs renewal and automatic JIT for eligible tenants

IntuneiOS/iPadOS

Who is affected
Intune tenants that manage iOS/iPadOS devices. Every tenant sees the acknowledgment when renewing the Apple MDM push certificate; eligible tenants also get just-in-time (JIT) registration switched on automatically.
What to do
  1. Check that your Apple MDM push certificate renewal owner knows to expect the new acknowledgment.
  2. Review your iOS/iPadOS SSO extension policy and confirm the JIT registration configuration.
  3. Test registration from a work app on one personal and one corporate iPhone.
Source
JIT registration reminder during Apple MDM push certificate renewal for iOS and iPadOS“Beginning with the November 2026 release, Intune will display a new acknowledgment when you renew an Apple MDM push certificate in the Microsoft Intune admin center.”
In development for Microsoft Intune (Microsoft Learn)
Just-in-time registration automatically enabled for eligible iOS/iPadOS tenants“Microsoft Intune will automatically enable just-in-time (JIT) registration for eligible iOS/iPadOS tenants with the 2611 release.”
In development for Microsoft Intune (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

TomorrowMicrosoftEnd of support

Windows 11, version 23H2 Enterprise and Education reach end of updates

WindowsIntune

Who is affected
Devices running Windows 11, version 23H2 Enterprise, Education or IoT Enterprise. The November 2026 security update is the last one for these editions.
What to do
  1. Find 23H2 devices (build 22631) in Intune's All devices list or your update reports.
  2. Move them to a supported version such as 25H2 or 26H2 with a feature update policy.
  3. Check safeguard holds and app compatibility on a pilot ring first.
Source
30-Day Reminder: Windows 11, version 23H2 Enterprise and Education editions reach end of updates on November 10, 2026“On November 10, 2026, Windows 11, version 23H2 Enterprise and Education editions will reach end of updates. The November 2026 Windows security update will be the last update available for these editions.”
Windows message center (Windows release health, Microsoft Learn)
End of Servicing“Windows 11 Enterprise and Education, Version 23H2 | Windows 11 IoT Enterprise, Version 23H2 | November 10, 2026”
Ending Support in 2026 (Microsoft Lifecycle)

Checked 9 Nov 2026 Link to this deadline

January 2027

Q1 2027In 53 daysMicrosoftChangeVendor gives an approximate period only

Web-based enrolment becomes the default for user-owned iPhone and iPad

IntuneiOS/iPadOS

Who is affected
Organisations that let users enrol personal iPhones and iPads in Intune. The source says early 2027 without a day, so treat the quarter as approximate.
What to do
  1. Configure JIT registration in your iOS/iPadOS SSO extension policy before the change.
  2. Test web-based enrolment for a personal device end to end, including Conditional Access.
  3. Update user-facing enrolment instructions that tell people to install Company Portal first.
Source
JIT registration reminder during Apple MDM push certificate renewal for iOS and iPadOS“This reminder will help you prepare for web-based enrollment becoming the default for user-owned iOS and iPadOS devices in early 2027.”
In development for Microsoft Intune (Microsoft Learn)

On KBY:Microsoft Entra ID with Microsoft Intune

Checked 9 Nov 2026 Link to this deadline

October 2027

In 337 daysMicrosoftEnd of support

Windows 11, version 24H2 Enterprise and Education reach end of servicing

WindowsIntune

Who is affected
Devices running Windows 11, version 24H2 Enterprise, Education or IoT Enterprise.
What to do
  1. Plan a feature update to 25H2 or 26H2 well before the date.
  2. Use Intune feature update policies or Autopatch rings so devices do not sit on 24H2.
  3. Note that 24H2 non-security preview updates already ended in September 2026.
Source
End of Servicing“Windows 11 Enterprise and Education, Version 24H2 | Windows 11 IoT Enterprise, Version 24H2 | October 12, 2027”
Ending Support in 2027 (Microsoft Lifecycle)
Windows 11, version 24H2 (Home and Pro) and Windows 10 LTSB 2016 have reached end of updates“Windows 11, version 24H2 Enterprise and Education remain supported until October 12, 2027.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

Put these dates in your calendar

The calendar feed uses the filter you have selected and refreshes daily in Outlook, Apple Calendar and Google Calendar. Each event carries the actions and the source link.

Download .ics JSON

webcal://www.kbytechnologies.com/deadlines/calendar.ics?products=intune,android

Embed the next deadlines on your intranet

Paste this into a SharePoint embed web part or any page that allows iframes. Add &limit=10 to the URL for more rows.

<iframe src="https://www.kbytechnologies.com/deadlines/embed?products=intune,android" title="Upcoming Microsoft and Apple admin deadlines" width="400" height="460" loading="lazy" style="width:100%;max-width:480px;border:1px solid #e2e8f0;border-radius:12px"></iframe>

Recently passed

Dates from the last 6 months. If one of these still applies to you, you are already past the vendor’s date.

9 days agoMicrosoftEnforcement

Intune enforces Google's updated Strong Integrity verdict for Android 13 and later

IntuneAndroid

Who is affected
Users on Android 13 or later targeted by app protection or compliance policies that require Strong Integrity. Devices without a security update in the past 12 months no longer meet it and can be blocked or marked noncompliant.
What to do
  1. Use the app protection status report to find devices with an old Android security patch date.
  2. Set Min OS version and Min patch version conditional launch settings to warn before you block.
  3. Set the Minimum security patch level compliance setting and tell affected users to update.
Source
Plan for Change: Google Play strong integrity definition update for Android 13 or above“Microsoft Intune will enforce this change by October 31, 2026.”
In development for Microsoft Intune (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

14 days agoMicrosoftRetirement

Intune removes legacy Apple MDM software update policies

IntunemacOSiOS/iPadOS

Who is affected
Intune admins who still manage iOS/iPadOS or macOS updates with legacy MDM software update policies or the update-delay restriction settings. Apple removed the underlying commands and payloads in OS 27.
What to do
  1. Recreate update rules as declarative device management (DDM) software update policies in the settings catalog.
  2. Check that every Apple device group is covered by a DDM update policy before deleting the old policies.
  3. Re-check deferral settings: the legacy restriction keys for delaying updates were removed in OS 27.
Source
Week of October 26, 2026 (Service release 2610)“Microsoft Intune is removing legacy Apple MDM software update workloads after Apple retired the underlying commands and payloads in OS 27. Admins should use Apple declarative device management update policies to continue managing software updates.”
What's new in Microsoft Intune (Microsoft Learn)
Changes in 27.0“Removed: mdm/commands/system.update.schedule.yaml”
apple/device-management CHANGES.md (Apple, GitHub)

On KBY:Intune vs Jamf for Mac management

Checked 9 Nov 2026 Link to this deadline

14 days agoMicrosoftRetirement

Intune ends Setup Assistant (legacy) authentication for Apple automated device enrollment

IntunemacOSiOS/iPadOS

Who is affected
Organisations using Apple automated device enrollment (ADE) profiles with user affinity that still authenticated with Setup Assistant (legacy). Existing profiles move to modern authentication; enrolled devices stay enrolled.
What to do
  1. Open each ADE profile with user affinity and confirm it now shows Setup Assistant with modern authentication.
  2. Enrol one test iPhone and one test Mac to check MFA and Conditional Access prompts during Setup Assistant.
  3. Update enrolment guides and helpdesk scripts that describe the old sign-in screens.
Source
Week of October 26, 2026 (Service release 2610)“Intune has ended support for Setup Assistant (legacy) authentication for iOS/iPadOS and macOS automated device enrollment (ADE) with user affinity to align with modern authentication standards.”
What's new in Microsoft Intune (Microsoft Learn)

On KBY:Intune vs Jamf for Mac management

Checked 9 Nov 2026 Link to this deadline

Passed (October 2026)MicrosoftChangeVendor gives the month only

Administrator protection enabled by default in Windows 11 security baselines

WindowsIntune

Who is affected
Organisations applying the Windows 11 security baseline (26H2, 25H2 or 24H2) through Intune or Group Policy. Local admins get just-in-time elevation prompts instead of a standing admin token.
What to do
  1. Test the baseline on a pilot ring, especially for apps and scripts that elevate.
  2. Adjust the two User Account Control baseline settings in Intune or Group Policy if you need a different behaviour.
  3. Brief the helpdesk on the new elevation prompt.
Source
Manage Administrator protection within Windows 11 security baseline“If your organization uses Windows security baselines, Administrator protection becomes enabled by default with the October 2026 Windows security update.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

42 days agoMicrosoftEnd of support

Intune requires iOS/iPadOS 18 or later

IntuneiOS/iPadOS

Who is affected
Organisations managing iPhone and iPad with Intune MDM, Company Portal or app protection policies. Userless devices enrolled through automated device enrollment have a separate support statement.
What to do
  1. In Devices > All devices, filter by OS and version to find iOS/iPadOS devices below 18.
  2. For app protection users, check Apps > Monitor > App protection status and filter by platform version.
  3. Use compliance minimum OS version or app protection conditional launch to warn, then block, older versions.
Source
Week of September 28, 2026 (Service release 2609)“Microsoft Intune now requires iOS/iPadOS 18 or later for standard device-management, Company Portal, and app-protection scenarios.”
What's new in Microsoft Intune (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

Passed (June 2026)MicrosoftChangeVendor gives the month only

Warning for iOS apps built with an Intune MAM SDK older than 20.8.0

IntuneiOS/iPadOS

Who is affected
Users of app-protected iOS apps (Microsoft and third-party, including in-house line-of-business apps) built with an Intune MAM SDK earlier than 20.8.0. The warning can be dismissed.
What to do
  1. Ask users to update Teams, Outlook, Edge, OneDrive and other protected apps from the App Store.
  2. Rebuild in-house apps with a current Intune App SDK or App Wrapping Tool.
  3. Use the Min SDK version conditional launch setting to block apps still below 20.8.0.
Source
Warning notifications for iOS apps running unsupported SDK versions“Starting in late June 2026, users opening iOS apps built with an Intune MAM SDK version earlier than 20.8.0 will see a warning message recommending they update to a supported app version for the best experience and continued compatibility.”
In development for Microsoft Intune (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

How this list is made

  • Only dates stated on Microsoft Learn, Microsoft Lifecycle, Windows release health, Apple Developer or Apple’s published device management schema are included.
  • The quoted line is copied from that page. Where the date is only in a table, the row is quoted with cells separated by “|”.
  • Items without a vendor-stated date are left out, even when they are widely reported.
  • Days remaining are counted in UK time. A month or quarter counts as due for the whole period.