Deadlines
Every dated obligation the weekly issues have carried — retirements, cutovers, KEV due dates. Repeats across weeks are folded into one entry, kept in the wording of the issue that reported it last. The countdown runs against your clock, not the build.
Still ahead · 7
-
3 Nov 2026 in 1 day
the Microsoft Entra memberOf rule operator retires, and Microsoft published a final reminder on 28 October for anyone who has not acted. After that date, dynamic membership groups, dynamic administrative units and entitlement management auto-assignment policies that still use the operator stop updating and stay frozen in their last known state. The consequence is not an error message, which is why this one slips: stale group membership silently becomes stale Teams and SharePoint access, outdated Conditional Access targeting, wrong group-based licensing and incorrect access package assignments, all of which look like working configuration. If you have not already replaced those rules, the realistic move in the time left is to inventory every use of the operator and accept that affected groups freeze rather than break. Microsoft's reason for pulling the preview is worth knowing when you argue for the migration work internally — it observed that a single memberOf rule can affect dynamic membership processing across an entire tenant.
-
10 Dec 2026 in 38 days
support ends for Azure Linux with OS Guard in Azure Kubernetes Service, with Azure Container Linux as the replacement. From that date you cannot create new OS Guard node pools, AKS stops producing node images for them, and existing node pools stop receiving security patches — the last part is the one that matters, because a node pool running a hardened OS image that no longer gets patches is worse than the ordinary image that does. On 10 March 2027 the images are removed outright, after which reimage, redeploy and scaling operations fail on affected node pools. Migration is either an in-place node image upgrade to Azure Container Linux or a new node pool plus workload validation and cutover.
-
14 Dec 2026 in 42 days
the Machines should have a vulnerability assessment solution recommendation is deprecated in Microsoft Defender for Cloud. Note the date: the 14 September issue carried 11 Oct 2026 for this obligation, off the 10 September announcement, and the 23 September release note now puts it at 14 December. You have two months more than you thought, and the work is unchanged — anything wired into that grouped recommendation breaks quietly rather than loudly when it disappears, so find every compliance report, exemption, governance rule and workflow automation referencing it and rebuild against the individual server vulnerability assessment recommendations.
-
1 Feb 2027 in 91 days
Microsoft-provided SMS and voice authentication retires in Entra ID, and the timeline was split on 23 September into two populations rather than one. Most users still hit 1 February 2027; Global Administrators and external users now get until 1 July 2027. Read the exception narrowly, because internal guest users are explicitly not in the July group and stay on the February date, which is the detail most likely to bite a tenant that reads the headline and relaxes. After each date, affected users whose only MFA method is SMS or voice get a blocking passkey registration prompt at sign-in with no opt-out. The temporary opt-out via the passkeyDynamicMigration property only covers the September 2026 to February 2027 auto-enablement window, not enforcement. Run the SMS and voice usage analyzer script now to get your actual population, and if a regulated segment genuinely needs telephony, note that provider selection through Microsoft Security Store opens on 30 October 2026 with Soprano and Telesign in private preview.
-
31 Mar 2027 in 149 days
Managing Microsoft Sentinel in the Azure portal is sunset (extended from 1 Jul 2026). Begin planning the move to the Defender portal now; new capabilities ship there only.
-
16 Aug 2027 in 287 days
the classic Defender for SQL APIs for Vulnerability Assessment and Advanced Threat Protection retire. Microsoft posted the retirement notice on 17 August 2026, giving twelve months of notice. If you have scripts, runbooks or automation that call those APIs to read SQL vulnerability assessment results or manage Advanced Threat Protection settings, migrate them to the supported configuration model before the date; anything left behind stops returning results rather than failing loudly.
-
9 Oct 2027 in 341 days
the Azure Key Vault Secrets Provider Extension for Azure Arc-enabled Kubernetes clusters retires, announced on 9 October. A year is plenty of time, but the migration target is a different extension rather than a version bump, so this is a change to plan rather than a patch to apply: move to the Azure Key Vault Secret Store extension before the retirement date. The reason to put it on the board now is inventory. Arc-enabled clusters tend to be the ones nobody in the SOC has a complete list of, and a secrets provider that silently stops reconciling is the kind of failure that shows up as an application outage first and a security finding much later.
No fixed date · 4
-
Jun 2026
Secure Boot 2023 certificates expire. Microsoft Secure Score now surfaces the "Ensure devices are updated to Secure Boot 2023 certificates and boot manager" recommendation so you can find endpoints that haven't transitioned; work the list before the expiration or affected devices lose Secure Boot trust.
-
November 2026
SAP SuccessFactors plans to deprecate basic authentication for its APIs, which breaks any Microsoft Entra provisioning job still authenticating to SuccessFactors with a username and password. Entra now supports Workload Identity-based authentication for SuccessFactors provisioning, replacing long-lived credentials with Entra-managed credentials and short-lived standards-based access tokens. The reason this is an Act by rather than a nice-to-have is the failure mode: a provisioning job that stops authenticating does not announce itself as a security problem, it announces itself as joiners and leavers not landing in the directory, which is a leaver still holding access. The upgrade path is deliberately gentle — you can change authentication in place on existing provisioning jobs without recreating or restarting them — and it covers inbound provisioning to Active Directory and to Entra ID as well as writeback. Find the jobs first, then convert them.
-
Summer 2026
The ASIM `ProcessEvent` parsers deprecate the legacy `targetusername` parameter of `_Im_ProcessCreate`; the documented name is now `targetusername_has`. Both are accepted today, so update analytic rules and hunting queries that call the process-create parser before the old parameter is removed.
-
Within 30 days of the banner
Defender for Identity is rolling out automatic sensor v3.x activation and automatic Windows auditing configuration to existing customers, and the default flips on by itself. Eligible organisations that are licensed for Defender for Identity and have an active workspace see a banner on the Sensor management tab of the On-premises settings page for 30 days. After that notice period, Automatic sensor v3.x activation and Automatic Windows auditing configuration are enabled by default through a very gradual rollout, including settings currently set to Off. If you deliberately turned those off, that decision expires unless somebody selects Opt out in the banner while it is still showing. Either outcome can be the right one — automatic auditing configuration is how the newer detections get the events they need, and v3.x is where the alert investment is going — but it should be a decision rather than a surprise, and the people who watch that settings page are not always the people who made the original call. Go to Advanced features from the banner to enable the settings yourself, or Opt out to prevent automatic enablement.
Passed · 26
-
1 Nov 2026 1 day ago
two Defender for Servers billing changes take effect, announced on 30 September. The first is good news if you have been paying for desktops: productivity and client devices such as Windows 10 and Windows 11 PCs are no longer billed as servers under Plan 1. The catch is in how classification works — Microsoft decides from operating-system and device information, not from how you use the machine, and anything it cannot clearly identify as a desktop or workstation is still classified as a server for billing. Ubuntu Desktop, Fedora Workstation, Mint and KDE neon count as desktops; Ubuntu Server, RHEL, SLES and the rest stay servers. The second change hits both Plan 1 and Plan 2: the service moves from checking for online machines once an hour to several times an hour, and counts each deployed machine separately, including machines cloned from a golden image that share an Azure Arc ID. That second one can push your billed server count up, so if you run image-based fleets, model the new count before the invoice arrives rather than after.
-
27 Oct 2026 6 days ago
Microsoft Defender for Cloud stops enabling Foundational CSPM by default on new Azure subscriptions and moves it to an opt-in model. Existing Azure subscriptions keep their current configuration and AWS and GCP environments are unaffected, so this is a question of what a newly created subscription looks like on day one rather than a change to what you already have. Foundational CSPM stays free and can be turned on at any time, but a subscription created after the cutover starts with no posture management until someone enables it, which is exactly the gap that gets missed when a project team spins up a subscription outside the usual process. If your landing-zone automation or subscription-vending pipeline assumes posture coverage arrives for free, add an explicit enablement step before late October.
-
26 Oct 2026 7 days ago
Microsoft Entra ID is retiring custom CSS positioning properties in company-branded sign-in pages. As of 21 July 2026, tenants not already using these properties can no longer configure them, and on 26 October 2026 the positioning properties are retired globally — logos, images, and text stay visible but revert to their default placement, with no migration path, so any tenant still relying on them must remove them before the cutover. Microsoft frames this as an anti-phishing measure: removing arbitrary layout control shrinks the room to build convincing look-alike sign-in pages. Inventory your branded sign-in configurations now, confirm whether any use positioning CSS, and plan the visual change ahead of enforcement rather than discovering it when the page shifts.
-
15 Oct 2026 18 days ago
the SaaS accounts integration between Microsoft Defender for Cloud Apps and Identity inventory stops being opt-in and switches to automatic enablement. Eligible tenants need to do nothing, which is exactly why this is worth reading before the date rather than after: SaaS account data starts flowing into the Identity inventory on its own, and anyone who deliberately left the integration off should decide now whether that decision still stands. The one carve-out is tenants that use the User group admin or App/instance admin roles, which are not in scope for automatic enablement. If you do want it, the useful consequence is that SaaS accounts from connected app connectors show up alongside Active Directory and Entra ID identities in the same inventory, so an investigation that starts on a person no longer stops at the directory boundary.
-
11 Oct 2026 22 days ago
the Machines should have a vulnerability assessment solution recommendation is deprecated in Microsoft Defender for Cloud, announced 10 September as part of the move from grouped to individual recommendations. If that recommendation is wired into a compliance report, an exemption, a governance rule or a workflow automation, those break quietly when it disappears rather than failing loudly. Rebuild against the individual server vulnerability assessment recommendations before the date.
-
30 Sep 2026 33 days ago
Entra Custom controls retire (end of life May 2027). Third-party MFA integrations wired through Custom controls must move to External MFA to stay supported. Existing configs keep working through the transition, but start migration planning now.
-
14 Sep 2026 49 days ago
today, connectors and tables that depend on the legacy HTTP Data Collector API stop being eligible for incident support in Microsoft Sentinel. Ingestion is not switched off at a stroke, but anything still on that path may see ingestion issues and Microsoft will not take an incident on it. The things to check are custom scripts or applications writing straight into a workspace, Azure Functions-based custom connectors, classic custom log tables (marked type: Classic), and any Content Hub connector whose description still mentions the HTTP Data Collector API. The two supported destinations are a Content Hub connector version labelled via Codeless Connector Framework, or the Azure Monitor Logs Ingestion API for your own pipelines. Budget for the tail: a CCF migration changes table names and schemas, so analytics rules, hunting queries, workbooks, playbooks and parsers pointing at the old Azure Function tables all need updating after the data starts flowing.
-
7 Sep 2026 56 days ago
Self-service password reset stops accepting authentication methods that were never explicitly registered. Directory-sourced phone numbers and email addresses will no longer work for SSPR — only registered methods. Drive users through the July registration campaign so they are not locked out of reset when this flips.
-
1 Sep 2026 62 days ago
Passkeys become the default authentication method in Microsoft Entra ID. From this date, users enabled for SMS or voice are automatically enabled and nudged to register a passkey at multifactor sign-in, and native SMS and voice authentication is then discontinued on 1 Feb 2027, after which affected users must register a passkey to sign in with no opt-out. Identify who still relies on telephony MFA, enable synced or device-bound passkeys, and run registration campaigns now rather than at cutover; monitor for bypass attempts during the transition.
-
25 Aug 2026 69 days ago
CISA added CVE-2026-68820, the actively exploited Windows WinSock driver elevation of privilege fixed on 11 August, to the Known Exploited Vulnerabilities catalogue on 11 August with a remediation due date of 25 August under BOD 26-04. Federal agencies are bound by that date; for everyone else it is a reasonable ceiling on how long an exploited local SYSTEM escalation should sit unpatched.
-
1 Aug 2026 93 days ago
The Microsoft Azure Network Adapter (MANA) rollout reaches MANA-eligible Intel v1–v4 VM sizes in the public cloud, the earliest date those VMs can be placed on MANA-capable hardware. Network Virtual Appliances — including third-party firewalls and other security appliances — depend directly on the underlying network hardware and drivers, so an NVA whose OS or vendor build doesn't support MANA can see degraded or interrupted traffic. If yours isn't confirmed MANA-compatible, apply and enable the LegacyVMNVA Azure Policy tag before this date to hold those VMs off MANA hardware (honored until 31 May 2027); the MANA-eligible Cobalt 100 and Intel v5 sizes already passed their 26 May 2026 date.
-
31 Jul 2026 94 days ago
Legacy grouped recommendations are removed from the Azure portal. They now show as "Set for deprecation"; the individual recommendations that replace them are GA. Re-point any automation, exemptions, or workbooks that key off the old grouped recommendation IDs before the cutoff.
-
14 Jul 2026 111 days ago
July's Patch Tuesday is the largest on record, fixing roughly 570 vulnerabilities including 59 critical and three zero-days. Two are already being exploited: CVE-2026-56155, an Active Directory Federation Services (AD FS) elevation-of-privilege flaw, and CVE-2026-56164, a missing-authentication elevation-of-privilege bug in SharePoint Server; the third, CVE-2026-50661, is a publicly disclosed BitLocker bypass requiring physical access. Prioritize the AD FS and SharePoint fixes on identity-federation and internet-facing systems now, and hunt for exploitation on those hosts rather than waiting for the full-fleet rollout.
-
6 Jul 2026 119 days ago
Conditional Access enforcement for the *Register security information* action extends to Windows Hello for Business provisioning and macOS Platform SSO registration, closing a long-standing gap where those flows were unenforced. The same week, an SSPR registration campaign begins. Test any CA policies scoped to registration flows in report-only mode before the rollout so device setup does not start failing for users who cannot satisfy the policy.
-
1 Jul 2026 124 days ago
Unified RBAC migration groundwork before the Defender-portal cutover (heads-up). Legacy Sentinel Azure roles do not carry into the Defender portal, so plan URBAC migration to avoid permission gaps; Workspace Manager deprecation pushes MSSPs toward CI/CD via GitHub or Azure DevOps.
-
1 Jul 2026 124 days ago
The `AIAgentsInfo` advanced hunting table is retired and replaced by the unified `AgentsInfo` table (public preview), which covers agent inventory and governance across Copilot Studio, Microsoft Foundry, M365 Copilot, third-party, and endpoint-discovered agents. Any saved hunts, custom detections, or workbooks still referencing `AIAgentsInfo` stop returning results after this date — repoint them to `AgentsInfo`.
-
1 Jul 2026 124 days ago
Sentinel standardizes the Account Name entity: the `Name` field now consistently holds only the UPN prefix (the part before `@`), with the full UPN and suffix moved to dedicated fields. Analytics rules, automation rules, playbooks, and hunting queries that compare `Name` against a full UPN silently stop matching. Rebuild the full value from `Name` + `UPNSuffix`, or use `coalesce()` to set a precedence order.
-
15 Jun 2026 140 days ago
Older Sentinel repositories (content-as-code) Source Control API versions become unsupported after today. CI/CD tooling that creates or manages repo connections must move to API version 2025-09-01, 2025-06-01, or 2025-07-01-preview; existing connections keep operating. If your team deploys analytics rules and playbooks from GitHub or Azure DevOps, confirm the pipeline is on a supported API version.
-
15 Jun 2026 140 days ago
Conditional Access enforcement for *All resources* policies that carry resource exclusions begins. Only tenants with such a policy are affected; if you own custom apps that request only OIDC or a limited set of directory scopes, confirm they can handle CA challenges (MFA / device compliance) before this date.
-
1 Jun 2026 154 days ago
Microsoft Entra ID begins blocking Entra Connect Sync and Cloud Sync from *hard-matching* a newly synced on-premises Active Directory user onto an existing cloud-managed Entra user that holds an Entra role. It closes a Source-of-Authority takeover path where an on-prem foothold manipulates AD attributes to seize a privileged cloud account. Soft match, and hard match for non-role-holding users, are unaffected. If you run hybrid sync, confirm no privileged cloud accounts still depend on hard-match behavior before today, or legitimate syncs will start throwing hard-match errors.
-
1 Jun 2026 154 days ago
Legacy Microsoft Sentinel repositories (content-as-code) API versions retire in June 2026, and Source Control create/manage calls on the old versions will start failing. If you drive repo connections through the REST API or pipelines, move to API version 2025-09-01, 2025-06-01, or 2025-07-01-preview before this date. Existing repository connections keep operating; only API calls on the retired versions break.
-
13 Apr 2026 203 days ago
Defender for Cloud deprecates the preview grouped container vulnerability recommendations (the "Containers running in Azure/AWS/GCP should have vulnerability findings resolved" set and their registry equivalents), replacing them with per-finding individual recommendations. If any governance rules, exemptions, workbooks, or automation query the old grouped recommendation keys, migrate them to the individual-recommendation format and `securityresources` KQL now, before the keys disappear.
-
1 Apr 2026 215 days ago
Microsoft Sentinel begins charging Security Compute Units (SCUs) for the entity analyzer tool in the Sentinel MCP data-exploration collection. If your team picked up entity analyzer for out-of-the-box URL and identity risk assessments after its RSAC-week GA, those runs now draw down SCUs; review MCP usage so agent-driven queries don't surprise your Sentinel bill.
-
1 Apr 2026 215 days ago
In Azure Government (Fairfax), Defender for Cloud announced an enhanced agent for the Defender for SQL Server on machines plan that uses existing SQL infrastructure instead of the Azure Monitor Agent (AMA). If you enabled this plan before April 2026, update the plan configuration; protection-status verification for your SQL instances is expected to start around May 2026.
-
16 Feb 2026 259 days ago
CISA's deadline for U.S. federal (FCEB) agencies to patch CVE-2026-21509, an actively exploited Microsoft Office security-feature-bypass zero-day that Microsoft fixed in an out-of-band update on 26 January. It isn't a legal mandate for private orgs, but it's a useful forcing function: the flaw affects Microsoft 365 Apps and Office 2016 / 2019 / LTSC 2021 / LTSC 2024 and sits on CISA's Known Exploited Vulnerabilities list. Prioritize pushing the out-of-band Office update across your estate.
-
13 Jan 2026 293 days ago
January Patch Tuesday shipped fixes for roughly 113 CVEs (trackers count 112–114 depending on how third-party items are tallied), including CVE-2026-20805, a Desktop Window Manager information-disclosure flaw Microsoft reports as exploited in the wild, plus two other publicly disclosed zero-days. The DWM bug scores only CVSS 5.5, but info-leak flaws like it are typically chained to defeat ASLR and turn an unreliable memory-corruption exploit into a repeatable one, so don't deprioritise it on score alone. Deploy the January cumulative update across your Windows fleet and use Defender Vulnerability Management to confirm which devices are still exposed.