Microsoft 365 deadlines between now and April 2027
Microsoft retires a great deal that never affects a 30-person office. Five of the current batch do, and one of them needs action this month.
The Microsoft 365 message center produces a steady stream of retirement notices, most of which are irrelevant to a small business. Sorting the ones that matter from the ones that do not is a reasonable part of what an IT provider is for, so here is the current list with our read on each.
Three of the dates below have now passed. Passkey prompts started on 1 September, and both the EWS switch-off and the Entra ID Protection policy retirement began on 1 October. If those were missed, they are still fixable, and the sections below say how. Two new items are added at the end: Windows 10 Extended Security Updates and the change to how Copilot agents are billed.
Exchange Web Services, and why the date is this month
EWS is a twenty-year-old interface that plenty of third-party products still use to reach mailboxes. Microsoft is replacing it with Graph. From 1 October 2026 EWS gets switched off tenant by tenant, and unless the tenant has been configured otherwise, Microsoft sets it to disabled for you.
The bit worth acting on: tenants that configure an allow list and set EWS to enabled before the end of August 2026 are excluded from the automatic October change. Miss it and you can still re-enable afterwards, with an interruption in between. Everything stops permanently on 1 April 2027 regardless.
Who this affects: anyone running an email archiving, signature management, CRM integration or migration product that connects to Exchange Online. If you do not know whether you have one, the admin center reports EWS usage and it is a five-minute check.
Passkeys become the default from 1 September
Entra will start prompting users to register a passkey during sign-in. This is a good change and we would encourage letting it happen, but it will generate questions from staff who were not told, and that is worth getting ahead of with one short email.
The reason behind it is that SMS and voice codes are being retired entirely on 1 February 2027. If anyone in your organization still authenticates by text message, they need moving to an authenticator app or a passkey before then. Text codes have been the weakest common option for years, so this is overdue rather than disruptive.
Entra ID Protection risk policies move on 1 October
The user risk and sign-in risk policies configured inside Entra ID Protection are being retired as an interface. The capability continues, but it lives in Conditional Access now, and Microsoft is not migrating existing policies for you.
If someone set these up once and has not looked since, they will quietly stop enforcing. Rebuild them as risk-based Conditional Access policies before the date and confirm they are in report-only first, so you find out about the service account nobody remembers before it locks itself out.
Basic authentication for SMTP, end of December
SMTP AUTH with basic authentication gets disabled by default for existing tenants by the end of December 2026. In practice this means the multifunction printer that emails scans, the alarm system that sends notifications, and any line-of-business application that sends mail through your tenant with a username and password.
These are exactly the things nobody has a list of, and they fail silently. Scans stop arriving and it takes two weeks for someone to mention it. Worth auditing now rather than in January.
Office LTSC 2021 and Publisher, October
Office LTSC 2021 leaves support in October. If you have a handful of machines on a perpetual license rather than a subscription, they keep working and stop getting security updates, which is the same position as an unpatched browser.
Publisher also disappears from Microsoft 365 in October. A small number of companies use it for one recurring document, and Microsoft's advice is to convert those files before the application goes. Nobody will do this until the day it matters, so if it applies to you, it is a ten-minute job to do now.
Windows 10 Extended Security Updates, Year 1 ends 13 October
Windows 10 left support in October 2025. Businesses that bought the first year of Extended Security Updates get their last patch under that year on 13 October 2026. Year 2 is a separate purchase at double the Year 1 price.
For most small offices that money is better spent on replacement machines, or on a Windows 11 upgrade for the ones whose hardware qualifies. Paying for Year 2 makes sense for a machine running one application that will not run on Windows 11, and very little else.
Copilot agents now bill by usage
On 25 September Microsoft split Copilot into two commercial models. Chat and the Office integrations stay on the per-user license you already budget for. The newer agent features, Cowork, Code and Autopilot, bill in Copilot Credits according to how much they consume, at US$0.01 per credit on pay-as-you-go. Microsoft says usage-based services stay off until an admin creates a spending policy in the Microsoft 365 admin center.
Leave them off until someone has decided who may run agents and what the monthly ceiling is. Usage billing behaves like cloud compute: quiet for three weeks, then one person sets an agent running on a recurring job and the invoice moves. The cost management page under Copilot in the admin center shows consumption by user and by agent, and somebody should be looking at it.
What we would do with this list
Two of these need a decision this month: what happens to any Windows 10 machines after 13 October, and whether anyone may run Copilot agents. SMS codes have until 1 February and SMTP basic authentication until the end of December, so schedule both now. If EWS or the risk policies slipped past 1 October, check those first, because they fail quietly.
We track these for the tenants we manage and act on them without being asked. If nobody is doing that for yours, the message center in the admin center is where they appear, and it is worth someone reading it monthly.