Microsoft 365 and Azure: 40 dated changes admins must act on by spring 2027

Microsoft 365 and Azure: 40 dated changes admins must act on by spring 2027

Our news desk has published 40 dated Microsoft changes since 1 September 2026 that a Microsoft 365 or Azure administrator has to decide about or work around, and ten of them switch something on by default. Eight of those ten leave the admin an opt-out, a setting to reapply or a limit to lower. Two, the 180-day expiry of Planner plans made from Teams meetings and the new script restrictions on Entra sign-in pages, come with no setting at all.

Sixteen of the 40 retire or restrict something, and 12 more are licence, billing, permission, time-zone or update changes that are neither on nor off. Two are security updates to install. Seventeen touch a security or compliance control: a policy default, a role, a retention rule, a sign-in path or a data-processing choice. Nine are price or licence changes, from the end of reseller promotions on 30 September to a second-year Windows 10 security-update price that doubles to $122 a device.

Sixteen of the 40 come with a single stated day, and for those the warning between our item and the change date had a median of 29.5 days. Four gave nine days or fewer, and the shortest gave two. The longest, the Exchange Online PowerShell module change, gave 181 days. The rest give a window such as "late October" or are already in effect, so we do not put a notice figure on them.

The busiest week is 19 to 25 October, with three stated days: the Entra sign-in deadline on the 19th, the end of new Azure Communication Services sign-ups on the 23rd and the Teams reporting opt-out deadline on the 25th. Eleven of the 40 have a stated date or window that reaches into the second half of October, which is why that fortnight is the one to clear in your diary. Three more weeks hold two stated days each: 12 to 18 October, 2 to 8 November, and 9 to 15 November.

Settings that turn on unless you act

Ten changes arrive switched on. They are listed here in the order their dates fall.

The Windows settings backup policy has been on since 29 September for Windows 11 version 26H2 devices where the policy was left at Not Configured, outside privacy-sensitive regions and sovereign clouds. Devices where an admin has set the policy either way are untouched. Set it deliberately on shared, kiosk and regulated machines, and remember that restore stays off. Windows 11 26H2 settings backup on by default

Outlook on the web and the new Outlook began enforcing Conditional Access on attachments on 29 September. A user on a non-compliant device or blocked location can still read mail but cannot download, preview or upload classic attachments. An exclusion for Exchange Online does not carry over: you create a service principal for OwaDownloadAttachments and exclude that. Expect help-desk tickets before you see a policy change. Outlook attachments now enforce Conditional Access

Security Copilot has been part of Microsoft 365 E5 and E7 licences since the notice of 24 September, at 400 Security Compute Units a month per 1,000 licences up to 10,000. Its access to Microsoft 365 data such as Purview is on by default, while sharing data with Microsoft for human review is off. The notice names no admin switch to refuse the entitlement, only a request to support. Open the Owner settings, confirm where prompts and responses are stored and processed, and trim inherited owner access. Security Copilot in E5 and E7

Planner plans created from Teams meetings start expiring in a rollout that began in early October and should finish by mid-October. A plan with 180 consecutive days without a task being created, edited or deleted is deleted; viewing does not count. Only plans created after the rollout are covered, so the first possible deletions fall in spring 2027. The meeting organiser alone gets warnings at 30 and 7 days, and recovery takes a support request within 30 days. Move anything that is a record into a standard plan or a list. Planner meeting plans deleted after 180 days

From mid-October, Entra ID sign-in pages at login.microsoftonline.com apply a Content Security Policy, with the rollout complete by late October and 19 October as the act-by date. Scripts injected by browser extensions, session-recording tools or custom branding hacks stop running; sign-in itself still works, and MSAL flows are unaffected. There is no tenant setting to postpone it. Entra ID sign-in pages block injected scripts

Teams user reporting in Defender for Office 365 switches on after 25 October for tenants with Defender Plan 1 or 2 or an E5 licence. The settings move to their own Defender portal page on 7 October, and changes made after that take effect in the week of 15 October. Decide before the 25th whether reports go to Microsoft, to your reporting mailbox or to both, and tell any managed provider that Teams reports are coming. Teams message reporting in Defender for Office 365

Promotions tagging in Defender for Office 365 completes its worldwide rollout by late October (late November for GCC, GCC High and DoD) and stays on for every tenant. The move into a Promotions folder happens only where "Bulk moves enabled" is set in the anti-spam policy, so that is the real decision, and a pilot group is the sensible start. Marketing teams should keep invoices and password resets out of campaign sends. Promotions tagging in Defender for Office 365

File sharing in external Teams chats starts switching on in late October and should be complete by late November. Microsoft states that it applies even where the setting was previously Disabled. If you need it off, reapply the block after the rollout reaches you, with Set-CsTeamsFilesPolicy and the FileSharingInChatsWithExternalUsers parameter set to Disabled. SharePoint, OneDrive and Entra sharing settings remain the real limit on what an outsider can open. Teams external chat file sharing

On 2 November, new Microsoft 365 Copilot Business licences bought through a Cloud Solution Provider get pay-as-you-go billing switched on, with a preset monthly limit. Find out who owns the Azure subscription that receives the bill and lower the limit if you want to. CSP promotions end and Copilot Business billing

In early to mid-November, Outlook on the web and new Outlook for Windows add .msix and .msixbundle to the blocked file types in every OWA mailbox policy. If your developers or installers mail these packages, add the extensions to AllowedFileTypes on the relevant policies before the rollout starts. Classic Outlook is not named. Outlook blocks .msix attachments

Things that stop working or lose coverage

Eleven of the 16 changes that retire or restrict something sit here, along with two permission and sign-in changes. The other five are client and runtime end dates, further down. The earliest items here have the least slack.

Exchange Web Services is the largest. Microsoft's page says disablement starts globally in October 2026 and finishes in April 2027, and a further notice makes an EWSAllowedAppIDs list mandatory from 10 October. Microsoft fills in each affected tenant's list on 8 and 9 October from the previous 60 days of EWS activity, so an application used only quarterly or at year end can be missing. The enforcement rollout runs to early July 2027. Run the EWS usage reports, build your own list, ask each vendor for a Graph date in writing, and check the Mac built-in apps, which still sync through EWS. EWS switch-off timeline and the 10 October allow list

SharePoint's own one-time passcode for external users retires from mid-October to the end of November. An outsider without a matching Entra B2B guest account who opens an older "specific people" link sees access denied until a guest account exists or the item is shared again. List the external sharing that still relies on it and warn the people affected. The same notice covers the allow list above. SharePoint one-time passcode retirement

The SharePoint Page Agent, a Frontier preview feature, retires from mid-October to mid-November. Pages already made with it stay put; authors move to Copilot in SharePoint. Teams Events, Purview DSPM and Page Agent changes

Defender for Cloud Apps moves App Governance to Unified RBAC from mid-October to late October. Compliance Administrators lose the ability to manage App Governance policies or switch it on and off, Compliance Data Administrators lose the on/off switch, and Cloud App Security Administrators and custom Unified RBAC roles gain access. Re-assign whoever runs app-consent policy before it lands. App Governance roles

On 23 October new customers can no longer sign up for the Azure Communication Services features being retired, including email, SMS, WhatsApp messaging, chat, Rooms and Job Router. Existing customers have until 30 September 2028, in maintenance mode, after which the standalone services stop and the calling features survive only alongside a Teams-aligned service. Ask your suppliers whether they build on it, and start no new project there. Azure Communication Services retirement

In late October the Device state rule and its health alerts in the Teams admin centre retire, with no migration of rules, and webhooks stop receiving payloads. Rebuild the alerting in the Teams Rooms Pro Management portal first and repoint your ticketing integrations. Teams device state rule retirement

Legacy Teams retention policies stop covering Microsoft 365 Copilot interactions from late October, with completion expected by mid-November. The Copilot data is then governed only by whatever else covers it, so create a policy for the Microsoft Copilot experiences location beforehand and agree its period with records and legal. Legacy Teams retention and Copilot

On 3 November, Entra ID stops processing dynamic groups, dynamic administrative units and entitlement-management auto-assignment policies that use the MemberOf operator. They freeze in their last state, so new starters may miss access and leavers may keep it, and Conditional Access that depends on those groups acts on stale lists. Find the rules and replace the operator before the 3rd. Entra ID MemberOf rules stop

The classic Purview DSPM and DSPM for AI experiences retire from late November to late December, and Microsoft asks you to be on the unified experience before 31 December. DSPM classic retirement

Targeted Release goes in two steps. Changes to enrolment are disabled in November 2026, and from January 2027 its assignments no longer deliver features. Choose Standard, Deferred (about 30 days after Standard) or Frontier for each group before November, since what you hold then is what you keep. Frontier is the only early-access option left. Targeted Release retirement

The ExchangeOnlineManagement PowerShell module must be at 3.10.1 or later before strict logon enforcement begins on 31 March 2027, with an act-by date of 26 March. Older versions may fail in some interactive scenarios, notably PowerShell 7 with Web Account Manager disabled. Certificate-based authentication is listed as unaffected, which makes it the safer choice for scheduled scripts. Exchange Online PowerShell module 3.10.1

One change is optional but worth a decision. From mid-October to late October, Entra adds a way to change a password in My Sign-Ins without the current one when the user proves identity with a passkey or FIDO2 key. It is off by default and tenant-wide only, so you cannot pilot it on a group. Entra passkey password change

A short aside on GitHub, which Microsoft owns. GitHub removes six Copilot models on 19 October, applies a new default policy from 22 October that turns on any generally available Copilot feature nobody has configured in Business and Enterprise, and deprecated four more models on 2 October with no notice period. We leave these out of the 40. Six models removed, default policy and four models gone

Prices, licences and billing

Nine changes touch what you pay or what a licence includes. Two of them, Security Copilot and Copilot Business billing, appear above because they arrive switched on.

The reseller promotions on Microsoft 365 E5, E7 and Copilot ended on 30 September, replaced on 1 October by a partner reward scheme called growth margins. Three distributors had said the E7 promotion ran to 31 December, while Microsoft's own notice lists it among those ending on 30 September, so get the date for any E7 quote in writing. Growth margin goes to the partner, not the customer, so ask what it does to your renewal. CSP promotions end

Nonprofits buying Copilot through a CSP can stack a 15, 20, 30 or 40 per cent commercial promotion on the existing 15 per cent nonprofit offer until 31 December. Ask your partner which promotion ID and base product the quote uses. Nonprofit Copilot stacking

Windows 10 Extended Security Updates for organisations cost $61 a device in year one, and Microsoft's rule is that the price doubles each year for up to three years. That makes year two $122 and year three $244, with the renewal from 14 October. Devices must be on Windows 10 22H2. Windows 10 ESU year two

Teams Events now has two tiers, with the rollout in late September. Foundational features come with eligible Teams licences and advanced ones with Teams Enterprise; the new Teams Premium licence does not provide Teams Events capabilities. Engagement is capped at 1,000 attendees on the foundational tier and 3,000 on the advanced one, and bigger events need capacity packs. Teams Events licensing

Dataverse storage limits for Dynamics 365 are enforced on Dataverse-only tenants in a staged rollout from 9 November to 4 December. Over entitlement, creating, copying, restoring and recovering environments is blocked at once, sandboxes go to administrators-only after 30 days and are disabled after 60. Production keeps running. Sandboxes with pay-as-you-go billing are exempt. Check capacity before the clock can start. Dataverse storage enforcement

OneDrive pay-as-you-go storage is in public preview for commercial tenants, with general availability rolling out from early November to early December. Admins choose which accounts may exceed their licensed quota and be billed for usage. The notice gives no price per gigabyte, and an enabled account has no ceiling in it. OneDrive pay-as-you-go

From 30 September, two more AI models from outside providers reach Microsoft 365 Copilot, and each needs the matching subprocessor switched on in your tenant. Cowork and Copilot Studio bill them by use; Word, Excel, PowerPoint and Chat include them under the licence with limits Microsoft does not state. That is a data-protection decision as much as a billing one. Two more Copilot models

One pricing change we cannot date. Microsoft's new Copilot model keeps the per-user licence for everyday use, adds usage limits to it and moves Cowork, Code and Autopilot to usage-based billing with Copilot Credits. It says billing stays off until an admin creates a spending policy. No limit, credit price or start date has been published, so it is outside our count. Copilot pricing model

Security fixes and updates to hold

Exchange Server's September 2026 security updates were re-released as V2 on 2 October to add a fix for CVE-2026-96940, rated Important with a CVSS score of 8.8. A signed-in user could read other mailboxes in the same organisation. Anyone who installed the first release still needs V2. The fixed builds are KB5129955 for Subscription Edition RTM, KB5129956 for 2019 CU15, KB5129957 for 2019 CU14 and KB5129958 for 2016 CU23. Exchange 2016 and 2019 updates are only available to organisations in the Period 2 Extended Security Update programme. Exchange September V2 update and what the flaw allows

SharePoint Server CVE-2026-65660 was fixed in the 11 August updates, then reported as exploited and added to the CISA known-exploited list on 25 September. Check every farm, including test and recovery ones, for the August build and look for new files and accounts since then. SharePoint Online is not affected. SharePoint flaw exploited and the federal deadline

Two updates went wrong. KB5002907, an optional update for out-of-date Microsoft 365 Apps, was paused on 26 September after it left Office 2016 and 2019 unlicensed or removed; hold it where you manage updates centrally. KB5002907 paused And since 24 September, Windows 11 26H1, 25H2 and 24H2 updates have left some Azure Virtual Desktop sessions on a black screen, with a Known Issue Rollback policy as the managed-estate workaround. Azure Virtual Desktop black screen

Clients, devices and runtimes reaching the end

The Microsoft 365 companion apps for Windows 11, Calendar, People and Files, retire by 16 December. They already receive no updates or fixes, security included. Delete the Intune assignments before you uninstall, clear the auto-install setting in the Microsoft 365 Apps admin centre, and remove one app to remove all three. Companion apps retire

Microsoft's lifecycle page puts a cluster of end dates on 13 October: servicing for Windows 11 Home and Pro 24H2, Windows Server 2012 and 2012 R2 Extended Security Updates Year 3, and mainstream support for Windows Server 2022, plus Business Central on-premises version 26.x. Azure Anomaly Detector, Metrics Advisor and Personalizer retired on 1 October. On 10 November come Windows 11 Enterprise and Education 23H2, .NET 8, PowerShell 7.4 and Azure IoT Edge 1.5. October and November lifecycle dates

Azure Functions ends support for .NET 8, .NET 9 and PowerShell 7.4 on 10 November. Apps keep running but get no security updates. In-process .NET apps must first move to the isolated worker model, and Linux Consumption apps must move to Flex Consumption. Node.js 22 follows on 30 April 2027. Azure Functions runtimes

Windows gains two new time zones for Alberta and British Columbia, which stop changing clocks on 1 November. The September preview update carries them for Windows 11, and the 13 October security update brings them to all remaining supported versions, Windows Server included. Devices set by hand need the new zone selected. Alberta and British Columbia time zones

Edge on Windows retires its legacy sign-in code in early November and moves profiles to OneAuth, with version 157 the point at which the new behaviour is enforced. Check edge://signin-internals for unmigrated profiles and test on Edge 155 or later. Edge legacy sign-in

OneDrive for iPhone and iPad says it will stop supporting iOS 18 and iPadOS 18 "soon", with no date. The devices stuck on iOS 18 are the iPhone XS, XS Max and XR and the seventh-generation iPad, according to heise. This is the second undated item outside our count. OneDrive on iOS 18

The dated checklist

Dates are as the items state them. Where an item gives only a month or a window, the entry says so.

• 8 and 9 October: Microsoft fills in each tenant's EWS allow list from 60 days of activity. Check it. (EWS allow list)
• 10 October: EWSAllowedAppIDs becomes required. Confirm every application you depend on is on the list. (same item)
• 13 October: Windows 11 24H2 Home and Pro, Windows Server 2012 ESU Year 3 and Windows Server 2022 mainstream support end; the time-zone update ships. (lifecycle dates)
• 14 October: Windows 10 ESU year two at $122 a device. Budget it. (ESU year two)
• Mid-October to late October (window): Entra sign-in script blocking, App Governance roles, passkey password change, SharePoint one-time passcode and Page Agent retirements begin. (Entra sign-in, App Governance)
• 19 October: act-by date for tools that inject scripts into Entra sign-in. (Entra sign-in)
• 23 October: Azure Communication Services closes to new customers. (ACS)
• 25 October: last day to choose where Teams user reports go. (Teams reporting)
• Late October (window): Teams external file sharing starts to switch on, the Device state rule retires, legacy Teams retention stops covering Copilot, Promotions tagging completes. (file sharing, device rule, retention, Promotions)
• 1 November: Alberta and British Columbia stop changing clocks. (time zones)
• 2 November: pay-as-you-go billing on by default for new Copilot Business licences bought through CSP. (CSP and Copilot Business)
• 3 November: Entra MemberOf rules stop processing. (MemberOf)
• Early November (window): Edge legacy sign-in retires, .msix blocking begins, OneDrive pay-as-you-go reaches general availability, Targeted Release enrolment is locked. (Edge, .msix, OneDrive, Targeted Release)
• 9 November: Dataverse storage enforcement starts, completing by 4 December. (Dataverse)
• 10 November: .NET 8, .NET 9 and PowerShell 7.4 lose support on Azure Functions. (Functions)
• Late November to late December (window): Purview DSPM classic retires; move before 31 December. (DSPM)
• 16 December: companion apps retire. (companion apps)
• 31 December: nonprofit Copilot promotion stacking ends. (nonprofit stacking)
• January 2027: Targeted Release assignments stop delivering features. (Targeted Release)
• 26 and 31 March 2027: act-by and enforcement for Exchange Online PowerShell 3.10.1. (PowerShell)
• April 2027: EWS fully disabled in Exchange Online; first possible Planner meeting-plan deletions in spring. (EWS, Planner)

How we counted

The data is as of 8 October 2026. We started from the 50 items we have published since 1 September 2026 whose address names a Microsoft product and kept those about a change Microsoft made or announced to its own products, licensing or prices. We dropped items about other vendors, an item about Microsoft job cuts, and the GitHub items, which appear only as an aside. Where two of our items cover one change, such as the Exchange Server update, we count it once. Each change is counted once, on the first date the item gives; later dates in the same notice sit inside the entry. Dates are as the items state them. Where an item gives a window such as "mid-October to late October", we say so and do not put a day on it. The notice figure covers the 16 changes with a single stated day and is the gap between our item's publication and that day.

Points you could not guess from any single notice

The fortnight from 12 to 25 October is the hard one. It holds five stated days and, with the windows that reach into it, 11 changes that start or finish in the second half of the month. Several land on the same people: the identity team meets the Entra script blocking, App Governance roles and the passkey option together, while the messaging team gets Teams reporting, file sharing and Promotions tagging.

Some defaults beat what you set. External Teams file sharing overrides a previous Disabled setting, so a block applied last year has to be applied again after the rollout, not before. The Windows settings backup default reaches only devices left at Not Configured, so setting any value is what protects you. The passkey password option is tenant-wide, so it cannot be piloted on a group. The Entra sign-in script block has no setting at all.

The EWS allow list is built from the 60 days before it is filled in, and the filling happens on 8 and 9 October, the day before enforcement. A rarely used integration is the likeliest to be missing. Separately, patching Exchange before 2 October does not mean you are covered, because the V2 package adds the fix the first release lacks.

Planner's expiry is quieter than it looks. It applies to new meeting plans only, the first deletions cannot come before spring 2027, and the warnings at 30 and 7 days go to the organiser, not the plan members, so a leaver's plans can expire unseen.

Two usage-billed meters arrive in the first week of November: Copilot Business billing switches on by default on 2 November, and OneDrive pay-as-you-go reaches general availability from early November. One has a preset limit and the other has no price published yet.

Finally, the end-of-support dates are not all in one place. Windows Server 2022 leaves mainstream support on 13 October, a date easily missed beside the Server 2012 news, and the 10 November runtime cut-off for Azure Functions also catches Windows 11 Enterprise and Education 23H2 on the same day.

Related on TrustList:

• Edge devices are attacked first, application servers after the patch
• Microsoft 365 will retire Targeted Release in January 2027
• Apple patches an exploited CoreGraphics flaw: push iOS 26.7.1, iPadOS 26.7.1 and the macOS updates to managed devices