The Microsoft 365 2026 Deprecation Deadline Tracker

Microsoft is retiring more of Microsoft 365 in 2026 than in any recent year: Exchange Web Services, basic-auth SMTP client submission, risk-based Identity Protection policies, Azure ACS, a Conditional Access control, several legacy authentication paths and a long tail of Teams, SharePoint and Office features all reach end of the road. Miss one and something breaks silently — a mail-enabled app stops sending, a line-of-business integration loses access, a scheduled script fails at 2 a.m. This tracker lists every material 2026 deadline in date order, tells you what breaks, and gives you the one action that keeps you ahead of it. Treat it as a living checklist and confirm each item against your tenant's Microsoft 365 Message Center, since Microsoft occasionally moves these dates.

The 2026 deprecation calendar at a glance

Dates are as announced at time of writing. Bookmark this and work it top to bottom.

Identity and access (Entra ID)

Two identity changes carry real blast radius. First, the "Require approved client app" Conditional Access grant is deprecated (31 March 2026); Microsoft's replacement is the Require app protection policy grant, backed by Intune app protection (MAM) policies. Any CA policy still using the old control needs to be rebuilt around app protection before the deadline, or mobile access enforcement quietly changes behaviour. Second, the legacy risk-based policies in Entra ID Protection retire (October 2026) — the standalone "user risk" and "sign-in risk" policies configured inside Identity Protection. Their function moves into Conditional Access, where you set risk-based grants directly. Recreate them as CA policies (require MFA on medium+ sign-in risk, secure password change on high user risk) and confirm coverage before the old ones stop enforcing. If you have not audited your CA estate recently, our Entra ID Conditional Access gaps guide is the companion to this section. Note too that legacy per-user MFA management already retired on 30 September 2025 — if any accounts still carry per-user "enabled/enforced" flags, migrate them to CA now.

Exchange Online and email

This is where the highest-impact breakage lives, because email integrations are everywhere and often undocumented. Exchange Web Services (EWS) is deprecated for Exchange Online on 1 October 2026 — any application, connector or device that still calls EWS must move to Microsoft Graph before then, and this is frequently the deadline teams discover too late because the calling app is a third-party tool nobody maps to EWS. SMTP AUTH basic authentication for client submission becomes unavailable in December 2026; printers, scanners, alerting scripts and line-of-business apps that relay mail with a username and password need OAuth, a certificate-based flow, or the high-volume email / SMTP relay path instead. Legacy Message Trace on the Reporting Web Service is deprecated (18 March 2026) — replace any reporting scripts with the Get-MessageTraceV2 and Get-MessageTraceDetailV2 cmdlets. And Exchange ActiveSync below version 16.1 is unsupported from 1 March 2026, so older mobile mail clients must update to keep syncing. If mail deliverability is already on your radar, pair this with our guide to why emails go to spam and the complete SPF, DKIM and DMARC setup guide before the basic-auth cutoff bites.

SharePoint, Teams and collaboration

The collaboration stack sheds several legacy pieces. Azure ACS retires on 2 April 2026, ending SharePoint 2013 workflows and ACS-based add-ins — inventory any surviving SharePoint add-ins and re-platform them onto Microsoft Entra app registrations and Power Automate. Office 365 connectors in Microsoft Teams retire on 31 March 2026; migrate existing connector webhooks to the Workflows (Power Automate) app, because incoming-webhook posts from the old connectors will stop. The legacy SharePoint CDN domain (publiccdn.sharepointonline.com) is retired on the same date, and SharePoint Alerts fully retire in July 2026 — move alert-driven notifications to Power Automate flows. IDCRL authentication in SharePoint and OneDrive ends 31 January 2026, so any older automation still using it must move to modern authentication.

Windows, Office and SecOps

Beyond identity and mail: Office LTSC 2021 reaches end of support in October 2026 and Microsoft Publisher hits end of support in the same month — plan Office estate upgrades and find replacements for any Publisher-dependent workflows. The Microsoft Store installation type for Microsoft 365 Apps loses support in December 2026; move those deployments to the Click-to-Run / Microsoft 365 Apps deployment path, ideally through Intune. And for security teams, Microsoft Sentinel's Azure-portal experience retires in July 2026, moving management into the Microsoft Defender portal — a migration with its own set of gotchas that we cover in depth in Microsoft Sentinel is leaving the Azure portal. This one also intersects with the broader Windows 10 end-of-support fallout from October 2025, which continues to drive fleet upgrades into 2026.

How to stay ahead of the next one

Deprecations do not arrive on a neat annual schedule — they land continuously in the Microsoft 365 Message Center, usually with 6 to 12 months' notice. Make three habits routine: assign someone to review Message Center posts weekly and file the ones tagged "retirement" or "act by"; keep a live inventory of what talks to your tenant over legacy protocols (EWS, SMTP AUTH, ActiveSync, ACS) so you know your blast radius before a date lands; and re-check this tracker each quarter, because dates shift and new retirements are announced. The teams that get surprised are not the ones without tooling — they are the ones without a standing process to read the notices.

Frequently asked questions

What is the biggest Microsoft 365 deprecation in 2026?

For most organisations it is the deprecation of Exchange Web Services (EWS) for Exchange Online on 1 October 2026, because email integrations that call EWS are common and often undocumented. Applications and connectors must migrate to Microsoft Graph before that date. The removal of SMTP AUTH basic authentication for client submission in December 2026 is a close second for anyone relaying mail from printers, scanners or scripts.

Is basic authentication for SMTP going away in 2026?

SMTP AUTH basic authentication for client submission becomes unavailable in December 2026. Devices and apps that send mail with a username and password must move to OAuth or certificate-based authentication, or use the appropriate high-volume email / SMTP relay path instead.

What happens to Entra ID Protection risk policies in 2026?

The standalone risk-based policies configured inside Entra ID Protection retire in October 2026. Their function moves into Conditional Access, where you configure sign-in-risk and user-risk grants directly. Recreate the equivalent policies in Conditional Access and confirm coverage before the legacy policies stop enforcing.

Do I need to replace Exchange Web Services before October 2026?

Yes. EWS is deprecated for Exchange Online on 1 October 2026. Any application, add-in or device that uses EWS should be migrated to Microsoft Graph. The hardest part is usually discovery — identifying every third-party tool that calls EWS on your behalf — so start that inventory early.

Where does Microsoft publish deprecation deadlines?

The Microsoft 365 Message Center (in the Microsoft 365 admin center) is the authoritative source, typically giving 6 to 12 months' notice with a "retirement" or "act by" tag. Because dates can change, always confirm against the Message Center for your tenant before acting on any third-party summary, including this one.