Microsoft deadline tracker

Every Microsoft deadline that changes what your users can do.

Retirement dates for Microsoft 365, sign-in and MFA, Windows, Windows Server and certificates, with who each one affects and what to do. Days left count down from today. Dates checked November 2, 2026.

Next 90 days 4 deadlines

Nov 7, 2026Saturday

Self-service password reset accepts only registered methods

Who is affected: Users who rely on a phone number or email typed into their profile but never registered for password reset. Rollout runs to mid-November.
What to do: Have users register at aka.ms/mysecurityinfo. Check who is not ready before the help desk finds out.
Attestry: Attestry checks this Microsoft 365 check lists users who will not be able to reset their own password

5days left

Nov 10, 2026Tuesday

Windows 11 23H2 Enterprise and Education reach end of servicing

Who is affected: Managed PCs held back on 23H2.
What to do: Release the feature update to the latest Windows 11 version.
Attestry: Attestry checks this AD Exit Planner support countdown, per computer

8days left

Dec 31, 2026Thursday

SMTP AUTH with basic authentication turned off by default in Exchange Online

Who is affected: Copiers and scanners that scan to email, line-of-business apps and scripts that send mail with a username and password.
What to do: Move each sender to OAuth, a connector, or a relay service. A final removal date is still to be announced (second half of 2027).
Attestry: Attestry checks this Microsoft 365 check lists mailboxes and apps still using SMTP AUTH

59days left

Jan 12, 2027Tuesday

Windows Server 2016 and Windows 10 Enterprise LTSC 2021 reach end of support

Who is affected: Domain controllers, file servers and Hyper-V hosts on Server 2016 (Hyper-V Server 2016 and WSUS on 2016 end the same day), and LTSC 2021 devices.
What to do: Plan the upgrade or replacement now. Domain controllers on 2016 are the most common case.
Attestry: Attestry checks this AD Exit Planner flags domain controllers and servers on 2016

71days left

Later 7 deadlines

Feb 1, 2027Monday

SMS and voice-call MFA retired for users (no opt-out)

Who is affected: Anyone whose only second factor is a text message or phone call. They will not be able to sign in.
What to do: Move each person to the Microsoft Authenticator app or a passkey, then remove the phone method.
Attestry: Attestry checks this Microsoft 365 check lists users whose only MFA method is SMS or voice

91days left

Mar 15, 2027Monday

Public TLS certificates limited to 100 days

Who is affected: Websites, VPNs, mail servers and appliances with manually installed public certificates.
What to do: Automate renewal (ACME) where possible; list the certificates that are renewed by hand.
Attestry: Not checked by Attestry yet

133days left

Apr 1, 2027Thursday

Exchange Web Services (EWS) disabled in Exchange Online

Who is affected: Older mail archivers, CRM plug-ins, backup tools and scripts that read mail through EWS.
What to do: Find each app, ask its vendor for a Microsoft Graph version, or replace it.
Attestry: Attestry checks this Microsoft 365 check lists apps with EWS permissions and recent EWS sign-ins

150days left

Apr 7, 2027Wednesday

Entra Connect Sync must be version 2.6.84.0 or later with application-based authentication

Who is affected: Every hybrid organization syncing on-premises Active Directory to Microsoft 365. Older servers stop syncing.
What to do: Upgrade Entra Connect Sync and switch it to application-based authentication.
Attestry: Attestry checks this Microsoft 365 check flags sync servers still on the old sign-in method

156days left

Jul 1, 2027Thursday

SMS and voice MFA retired for Global Administrators and external users

Who is affected: Admin accounts and guests still using text or call codes.
What to do: Give every admin a phishing-resistant method (passkey or FIDO2 key), including break-glass accounts.
Attestry: Attestry checks this Microsoft 365 check lists admin accounts without a strong method

241days left

Oct 12, 2027Tuesday

Windows 10 ESU year 2, SQL Server 2017 and Windows 11 25H2 Home/Pro end

Who is affected: Windows 10 PCs on Extended Security Updates (businesses can buy a third year to October 10, 2028), SQL Server 2017, Windows 11 25H2 Home and Pro, and Windows 11 24H2 Enterprise.
What to do: Finish Windows 10 replacement; plan SQL Server upgrades.
Attestry: Attestry checks this AD Exit Planner support countdown, per computer

344days left

Jan 9, 2029Tuesday

Windows Server 2019 and Windows 10 Enterprise LTSC 2019 reach end of support

Who is affected: The most common domain controller version in small and mid-sized organizations today.
What to do: Put it in the budget for 2028.
Attestry: Attestry checks this AD Exit Planner support countdown, per computer

799days left

Already passed 4 deadlines

October 2026

Exchange Server 2016 and 2019 extended security updates end

Who is affected: Organizations still running on-premises Exchange 2016 or 2019, including hybrid servers kept only for management.
What to do: Move to Exchange Server Subscription Edition or finish the move to Exchange Online and retire the servers.
Attestry: Attestry checks this AD Exit Planner finds Exchange servers registered in Active Directory

Passed19 days ago

Oct 13, 2026Tuesday

Server 2012/2012 R2 security updates end for good; Windows 10 ESU year 1 and Windows 11 24H2 Home/Pro end

Who is affected: Servers still on 2012 or 2012 R2 (there is no year 4 of extended updates). Windows 10 PCs not enrolled in year 2 of Extended Security Updates. Windows 11 24H2 Home and Pro. Office LTSC 2021.
What to do: Replace or isolate 2012-era servers. Enrol Windows 10 PCs in ESU year 2 (about $122 per device, and businesses that skipped year 1 pay for it too) or replace them. Move Windows 11 to the latest version, which is a free update.
Attestry: Attestry checks this AD Exit Planner lists every computer and server with its end date

Passed20 days ago

Jul 14, 2026Tuesday

SQL Server 2016 and SharePoint Server 2019 reach end of support

Who is affected: Line-of-business databases and on-premises SharePoint farms on those versions.
What to do: Upgrade, move to a supported version, or isolate them. No more security updates without a paid agreement.
Attestry: Not checked by Attestry yet

Passed111 days ago

June 2026

First Secure Boot certificates from 2011 begin to expire

Who is affected: Windows PCs and servers with Secure Boot that have not received Microsoft's 2023 certificates. More expire in October 2026.
What to do: Install current Windows updates and firmware, then confirm the 2023 certificates are in place using Microsoft's Secure Boot guidance.
Attestry: Not checked by Attestry yet

Passed131 days ago

Get the monthly deadline alert

One email a month: what changed, what's next, what to check. No calls, no other mail.

Missing a date?Email [email protected] and we'll add it.

Which of these hit your users?

The Microsoft 365 check and AD Exit Planner name the people, devices and apps each deadline affects.

Get early access