Expiring certificates, hardening with enforcement phases, retired protocols and services, end of support – with date, countdown and when we last checked the date.
Dates often move. We check each dated change with its source again 90, 30 and 7 days before. Microsoft gives times in Pacific Time – the calendar day is shown.
Microsoft plans to automatically migrate Windows Health Attestation compliance evaluation in Intune from the Device Health Attestation (DHA) service to Microsoft Azure Attestation (MAA) in the first half of 2027. It affects Windows 11 devices managed with Intune. Network, firewall, proxy and endpoint access must allow the new endpoints to avoid interruptions. No exact date has been announced.
From January 15, 2027, Microsoft Intune no longer supports auto-discovery of the enrollment service via the EnterpriseEnrollment DNS CNAME record in Windows MDM-only enrollment. Users may then have to enter the enrollment server URL manually. Windows MDM-only enrollment itself remains supported and existing enrolled devices are not affected.
On 2027-02-10 Let's Encrypt moves all subscribers to certificates with a 64-day lifetime by default. Certificates issued or renewed on or after that date are affected; valid certificates are not revoked. Renewal jobs with hard-coded timings may fail to renew in time.
Let's Encrypt is shortening the validity of its certificates in stages, as required by the CA/Browser Forum Baseline Requirements. On 2027-02-10 the default classic profile moves to 64-day certificates. Users see the shorter validity at their next renewal after each date. Staging changes are deployed about one month earlier.
Microsoft plans to begin enforcing stricter logon requirements for the Exchange Online PowerShell module on 31 March 2027. Module versions older than 3.10.1 may fail to authenticate in certain interactive scenarios. Version 3.10.1 and newer continue to work normally.
Microsoft · ExchangeOnlineManagement PowerShell module
Microsoft will disable Exchange Web Services (EWS) in Exchange Online in phases starting October 2026 and fully in April 2027. Free/Busy and MailTips from an Exchange Server organization to a different organization's Exchange Online tenant via an EWS-dependent Organization Relationship are affected. Microsoft is still evaluating a replacement path and has asked for feedback.
Certificates used to establish trusted connections to Windows Update expire on May 17, 2027 and June 19, 2027. Devices without the replacement certificates will lose access to Windows Update. Most up-to-date, supported devices need no action. Devices receiving updates from WSUS (Windows Server Update Services) are not affected.
Microsoft has started deprecating Exchange Web Services (EWS) in Exchange Online. In the multi-tenant (WW) cloud, EWSEnabled = True alone no longer keeps EWS working; an app ID allow list (EWSAllowedAppIDs) is required. Microsoft is disabling EWS in tenants where both settings are empty. Tenants already set to EWSEnabled = True are not changed until April 2027.
Canonical updated the CA certificates in the nss package (USN-8947-1, published 2026-10-21). The update removes the root certificates "emSign ECC Root CA - G3" and "Comodo AAA Services root" because intermediate CA certificates were compromised. A standard system update applies the change.
Canonical updated the ca-certificates package. The CA certificate "emSign ECC Root CA - G3" is removed because intermediate CA certificates were compromised. On Ubuntu 22.04, 24.04 and 26.04 LTS the certificates are also refreshed to Mozilla CA bundle version 2.90. A standard system update applies the changes.
Debian found that several eMudhra intermediate CA certificates have been compromised. Security advisory DSA-6572-1 (published 2026-10-20) provides updated ca-certificates packages that remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" root certificates. Once the update is installed, certificates chaining to these roots are no longer trusted.
Since the October 2026 security update (released 2026-10-13), Windows 11 (26H2, 26H1, 25H2, 24H2) and Windows Server 2025 block the generation of NTLMv1-derived credentials for Single Sign-On by default. This applies only to devices with Credential Guard disabled and the BlockNtlmv1SSO registry value not set. Microsoft states this is a planned hardening change, not a known issue. The change is now live.
With the October 13, 2026 Windows security update, Microsoft moved the ACL (access control list) hardening of the AD FS Distributed Key Manager (DKM) container into Enforcement mode. It addresses the elevation of privilege vulnerability CVE-2026-56155. On supported Windows Server versions, AD FS remediates insecure ACLs automatically unless administrators opted out. Windows Server 2012 and 2012 R2 require manual remediation. The change is live.
Exchange Web Services (EWS) changes in Exchange Online start between October 2026 and April 2027. Two on-premises scenarios are affected: hybrid setups with on-premises mailboxes that have online archives, and on-premises organizations with rich coexistence to a different Exchange Online organization. EWS is not deprecated on-premises.
If your organization uses Windows security baselines, Administrator protection became enabled by default with the October 2026 Windows security update. This applies to Windows 11 versions 26H2, 25H2 and 24H2. Microsoft recommends reviewing and testing the baseline configuration.
As EWS is deprecated in Exchange Online from 2026-10-01, cross-tenant Free/Busy, MailTips and calendar sharing with other Microsoft 365 organizations must move to the Microsoft 365 Cross-Tenant Access Policy (Message Center MC1446796). Only tenants that have set up such sharing are affected. According to the vendor's update of 2026-10-29, the feature is not yet fully available and rollout dates are given in a table in the blog post.
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.
