Vendor deadlines, with the source attached.

Starting with Intune’s October 2026 (2610) service release, the legacy Apple MDM software-update policies and related reports are removed from the Intune admin center. Devices that still depend on those MDM update commands can fail to update.

Dynamic groups, dynamic administrative units, and entitlement-management auto-assignment policies that use the memberOf operator stop updating and stay in their last known state. Access, licensing, and Conditional Access that depend on those memberships can go stale.

Legacy SCEP profiles stop issuing new client certificates to ChromeOS devices. Version pinning does not keep the mandatory server-side components running. Wi-Fi or other sign-in that needs a newly issued certificate fails for devices that have not moved to the Certificate Provisioning API.

New Microsoft 365 Copilot Business purchases through CSP, including standalone offers and bundles, enable usage-based billing by default. Pay-as-you-go is the default billing configuration, with a default spending limit of 4,000 Copilot Credits per user per month unless an admin changes it.

Windows Server 2016 reaches end of updates. After that, the standard lifecycle no longer provides security updates, non-security updates, or assisted support for the release.

Certificates issued or renewed on the default classic profile on or after February 10, 2027 are valid for 64 days instead of 90. A renewal job hard-coded to 60, 80, or 83 days before expiry can miss the window. Authorization reuse drops from 30 days to 10 days.

Publicly trusted TLS subscriber certificates issued on or after March 15, 2027 cannot be valid longer than 100 days. Domain and IP address validation reuse is also capped at 100 days. Certificates already issued keep the lifetime they were given.

Microsoft Learn says EWS is fully disabled in April 2027. Applications that still depend on Exchange Web Services in Exchange Online lose that API, including ones that were kept alive on an allow list until then.

The classic ACME profile issues 45-day certificates, and the authorization reuse period drops to 7 hours. Clients that were only adjusted for the 64-day lifetime need another renewal-window change.

Publicly trusted TLS subscriber certificates issued on or after March 15, 2029 cannot be valid longer than 47 days. Domain and IP validation reuse is capped at 10 days on the same date.

For affected Worldwide tenants with EWS enabled, EWSEnabled set to true is no longer enough. Applications that are not on EWSAllowedAppIDs may lose Exchange Web Services access.

Microsoft says Microsoft 365 subscribers will not be able to open or edit Publisher files in Publisher on or shortly after October 1, 2026, as the removal update rolls out.