Dated obligations across Microsoft 365: CISA KEV remediation dates, retirements / removals, and API deprecations — soonest first. Informational roadmap availability targets are excluded. Subscribe via the iCal feed below.
betaMicrosoft GraphFiles
⏰ Update before removal Sep 28, 2026 · passed 45d ago
Deprecated the viewer parameter on the preview method. The parameter will be removed on September 28, 2026. Call preview without this parameter. Deprecated the chromeless parameter on the preview method. The parameter will be removed on September 28, 2026. Call preview without this parameter. Deprecated the allowEdit parameter on the preview method. The parameter will be removed on September 28, 2026. Call preview without this parameter.
In developmentDynamics 365 Customer Service
⏰ Act before October CY2026 · overdue
<p>Supervisors can create volume spike alerts that compare real-time conversation volume with the forecast linked to a shift plan. When volume remains above forecast for the configured number of intervals, selected recipients receive an in-app notification.</p>
<p>The capability includes the following features:</p>
<ul>
<li>Administrators can enable workforce alerts in Copilot Service admin center by going to <strong>Workforce management</strong> > <strong>Intraday management</strong> > <strong>Workforce alerts</strong>.</li>
<li>Supervisors can create and manage alerts from Workforce alerts in the Copilot Service workspace site map.</li>
<li>Each alert references a shift plan and monitors the queues associated with its linked capacity plan.</li>
<li>Supervisors can specify the percentage by which actual volume must exceed forecast volume.</li>
<li>Supervisors can specify the number of consecutive intervals during which the deviation must continue before an alert is raised. The forecast determines whether an interval is 15, 30, or 60 minutes.</li>
<li>Supervisors can set an expiration date to limit an alert to a campaign, season, or known event.</li>
<li>Supervisors can select one or more notification recipients for each alert.</li>
<li>Active alerts are evaluated on a recurring schedule. Notifications are sent when the configured threshold and duration are met.</li>
<li>Recipients can select a notification to open the alert details. The details include the queue and alert name, detection time, current and forecast volumes, spike percentage, and an interval-by-interval breakdown.</li>
</ul>
<h3>Access and prerequisites</h3>
<ul>
<li>An administrator must install the Workforce Management for Customer Service package from Power Platform admin center.</li>
<li>Forecasting and scheduling must be configured.</li>
<li>The selected shift plan must have a linked capacity plan and forecast.</li>
<li>Real-time conversation data must be available for the monitored queues.</li>
</ul>
<p>Business Value:</p>
<p>Contact centers plan staffing based on forecasted demand, but actual demand can change quickly. When conversation volume rises significantly above forecast, queues can grow and service levels can decline before supervisors have time to respond.</p>
<p>Workforce alerts help supervisors identify unusual intraday volume changes without continuously monitoring a dashboard. Supervisors define the deviation and duration that represent a volume spike and select who should be notified when those conditions are met.</p>
<p>The notification provides information about the spike, including how far actual volume is above forecast and whether the deviation is continuing. Supervisors can use this information to decide whether to shift capacity, offer overtime, or defer offline work while these actions can still help protect the customer experience.</p>
<p>Enabled for:</p>
<p>Enabled by admins/makers/marketers for end users</p>
In developmentDynamics 365 Commerce
⏰ Act before October CY2026 · overdue
<p>The Customer Data Platform panel in Store Commerce has been rebuilt using React, replacing the legacy implementation with a modern, responsive layout optimized for both desktop and mobile form factors.</p>
<p><strong>What's new in the modernized CDP panel</strong></p>
<ul>
<li><strong>Mobile-optimized layout</strong>: The panel uses a vertical scroll pattern that works naturally on tablets and handheld devices used by store associates on the floor.</li>
<li><strong>Customer summary at a glance</strong>: Loyalty points, purchase frequency, average spend, and contact details are prominently displayed at the top of the panel.</li>
<li><strong>Transaction history inline</strong>: Associates can view recent purchases, including items bought, channel, and location, without leaving the current context.</li>
<li><strong>Buy-again workflow</strong>: Frequently purchased items are surfaced with a direct add-to-sale action, enabling associates to quickly rebuild a customer's basket.</li>
<li><strong>Customer timeline</strong>: Chronological view of customer interactions, notes, and activities gives associates context for the current conversation.</li>
<li><strong>Product recommendations</strong>: Curated or engine-driven recommendations are shown inline to support upsell and cross-sell during the interaction.</li>
</ul>
<p><strong>Streamlined customer creation and editing</strong></p>
<ul>
<li><strong>Single-save workflow</strong>: Associates can create a new customer record with both customer information and primary address captured in one form, saved in a single action. This reduces the number of clicks and screen transitions required compared to the legacy multistep flow.</li>
<li><strong>Inline address validation</strong>: Mandatory address fields are validated at the point of entry before the record is saved to help ensure compliance with fiscal requirements for markets where a complete primary address is legally required on customer records. This validation is opt-in and configured at the channel level.</li>
<li><strong>Unified edit experience</strong>: Editing an existing customer's details and address follows the same consolidated pattern to keep associates in a single context rather than navigating between separate management screens.</li>
</ul>
<p><strong>Custom attributes tab</strong></p>
<p>Retailers who capture custom attribute data on customer records can now find that information directly within the CDP panel via a dedicated <strong>Custom information</strong> tab. The tab is displayed conditionally and appears only when custom attributes have been configured for the customer record to keep the panel clean and uncluttered for retailers who do not use custom attributes. This allows retailers to extend the clienteling experience with their own data, such as membership tiers, fit preferences, loyalty program details, or any other retailer-defined fields, without requiring associates to leave the panel or open a separate management screen.</p>
<p><strong>How associates access the feature</strong></p>
<p>The CDP panel is accessible from two entry points in Store Commerce:</p>
<ol>
<li><strong>Customer search</strong>: When an associate searches for and selects a customer, the modernized CDP panel opens directly.</li>
<li><strong>Active transaction</strong>: Associates can open the CDP panel from within an in-progress transaction to view customer context without interrupting the sale.</li>
</ol>
<p><strong>Enabling the feature</strong></p>
<p>This feature is enabled via <strong>Feature management</strong> in Dynamics 365 Commerce headquarters. Once the feature flag is turned on, the modernized CDP panel is automatically available in Store Commerce for all users without additional configuration at the register or device level.</p>
<p><strong>Applies to</strong>: Point of sale (Store Commerce)</p>
<p>Business Value:</p>
<p>Store associates spend valuable selling time navigating a cluttered, legacy customer detail page that wasn't designed for mobile or fast-paced retail floors. Critical information, such as purchase history, loyalty points, preferences, and product recommendations, is buried across multiple tabs and screens, slowing assisted selling and reducing the quality of in-store customer interactions.</p>
<p>The modernized Customer Data Platform (CDP) panel in Store Commerce delivers a lightweight, mobile-optimized clienteling experience designed for the way associates actually work. Key customer signals, such as spending summaries, recent transactions, buy-again suggestions, and a full customer timeline, are now surfaced inline without requiring associates to navigate away from the transaction. This means faster, more personalized customer conversations, higher basket value through timely product recommendations, and reduced training burden for new associates who can now act on customer context at a glance.</p>
<p>Creating and editing customer records has also historically required associates to navigate multiple screens and save operations, increasing the risk of incomplete records and slowing down queue-sensitive moments on the shop floor. For retailers operating in regions with fiscal requirements, where a validated primary address is mandatory for customer records, the legacy workflow offered no inline guardrails, leading to compliance gaps and post-transaction corrections.</p>
<p>The modernized CDP panel addresses this by consolidating customer creation and editing into a streamlined, single-save workflow. Associates can capture customer information and primary address in one form and save the complete record in a single action that reduces clicks and eliminates the back-and-forth between separate screens. Mandatory address field validation is enforced inline at the point of entry, ensuring compliance with fiscal requirements before the record is committed and removing the need for manual follow-up or administrative correction.</p>
<p>For retailers investing in omnichannel clienteling, this feature provides a modern, compliant foundation to deliver consistent, data-informed customer engagement at the point of sale.</p>
<p>Enabled for:</p>
<p>Enabled by admins/makers/marketers for end users</p>
In developmentDynamics 365 Customer Service
⏰ Act before October CY2026 · overdue
<p>The intraday performance report provides supervisors with an interval-level view of performance against the forecast. In Copilot Service workspace, go to <strong>Workforce management</strong> to access the report.</p>
<ul>
<li>Compare forecast and actual contact volume and average handle time. Variances appear as values and percentages, making outliers easier to identify.</li>
<li>Compare forecast, required, and scheduled staffing levels to identify understaffed and overstaffed intervals.</li>
<li>Review service level, occupancy, and schedule adherence alongside volume and staffing data in a single report.</li>
<li>View data in 15-, 30-, or 60-minute intervals to match how your organization manages intraday performance.</li>
<li>Filter the report by planning group and shift plan to focus on the areas you manage.</li>
</ul>
<p><strong>Access and prerequisites</strong></p>
<p>To use Workforce Management capabilities, an administrator must install the Workforce Management for Customer Service package from the Power Platform admin center.</p>
<p>Business Value:</p>
<p>Contact center forecasts and schedules are built days or weeks in advance, but demand rarely arrives exactly as planned. When volume spikes, handle times run long, or agents are absent, supervisors often don't see the gap until service levels have already slipped and the interval is gone.</p>
<p>The intraday performance report closes that gap by showing plan versus actual as the day unfolds. Supervisors can see which intervals are under- or over-staffed and act while there's still time by moving agents between queues, adjusting break and training schedules, or opening overtime only where it's genuinely needed. That protects service level and abandonment targets on the days that matter most, and it curbs the two costs that quietly compound in every contact center: paying for idle capacity in over-forecasted intervals and paying premium rates to recover from under-forecasted ones.</p>
<p>Enabled for:</p>
<p>Enabled by admins/makers/marketers for end users</p>
In developmentMicrosoft Entra
⏰ Act before October CY2026 · overdue
<p>B2B users, including internal guest users and external users, will be able to register and sign in with passkeys issued by a resource tenant to meet that tenant's multifactor authentication (MFA) requirements. Today, passkeys are supported for member users in their home tenant. With this update, B2B users can register a resource tenant passkey from the resource tenant's My Security Info page, or in-line during a proof-up prompt or passkey registration campaign, and then use it to satisfy the resource tenant's MFA requirements. This change is on by default. B2B users already in scope for passkeys in your Authentication methods policy will be enabled automatically. No action is required to turn it on. If you want to review or adjust who's affected, update your Authentication methods policy, passkey registration campaign, Conditional Access policies, and user scoping before rollout.</p>
LaunchedDynamics 365 Business Central
⏰ Act before October CY2026 · overdue
<p>"Add default method bodies to AL interfaces so existing implementors continue working, then use RequiredPending and analyzer rules to introduce required methods safely.</p>
<p>Business value: Extension publishers can add behavior to an interface without immediately requiring every implementing extension to change. Default methods provide a compatible implementation, while the new transition attribute and AppSourceCop rules support a managed path toward making a method mandatory in a future version. This reduces disruptive interface upgrades and gives dependent developers time to adopt new contracts."</p>
LaunchedDynamics 365 Business Central
⏰ Act before October CY2026 · overdue
<h2>Business Value</h2>
<p>Direct transfers move inventory between locations without using an in-transit location. You can use this simpler transfer method when the source location requires outbound warehouse handling, while preserving the picking and shipment controls configured for that location.</p>
<h2>Details</h2>
<p>Previously, one setting on the <strong>Inventory Setup</strong> page controlled how Business Central posted all direct transfers. You can now choose a posting method for each transfer route, so different routes can post separate transfer shipment and receipt documents together or create one posted direct transfer document.</p>
<p>Set <strong>Default Direct Transfer Posting</strong> on the <strong>Inventory Setup</strong> page to define the company-wide default. On the <strong>Transfer Routes</strong> page, set <strong>Direct Transfer Posting</strong> for routes that need a different method. The transfer order uses the route setting when one is specified and otherwise uses the Inventory Setup default. You can change <strong>Direct Transfer Posting</strong> on an open <strong>Transfer Order</strong> when needed.</p>
<p>The posting methods work as follows:</p>
<ul>
<li><strong>Shipment and Receipt</strong> posts a transfer shipment and transfer receipt together. <strong>Qty. to Ship</strong> must equal <strong>Qty. to Receive</strong>. When you post from a warehouse shipment, partial posting is supported.</li>
<li><strong>Direct Transfer</strong> posts one <strong>Posted Direct Transfer</strong> document. Business Central posts the full transfer-line quantity without creating separate transfer shipment and receipt documents.</li>
</ul>
<p>Direct transfers support the following outbound warehouse scenarios:</p>
<table>
<thead>
<tr>
<th>Transfer-from location setup</th>
<th>How you complete the transfer</th>
</tr>
</thead>
<tbody>
<tr>
<td>No warehouse requirements</td>
<td>Post from the <strong>Transfer Order</strong>.</td>
</tr>
<tr>
<td><strong>Require Pick</strong> without <strong>Require Shipment</strong></td>
<td>Create and post an <strong>Inventory Pick</strong>.</td>
</tr>
<tr>
<td><strong>Require Shipment</strong> without <strong>Require Pick</strong></td>
<td>Create and post a <strong>Warehouse Shipment</strong>.</td>
</tr>
<tr>
<td><strong>Require Pick</strong> and <strong>Require Shipment</strong></td>
<td>Register the <strong>Warehouse Pick</strong>, and then post the <strong>Warehouse Shipment</strong>.</td>
</tr>
<tr>
<td><strong>Bin Mandatory</strong></td>
<td>Enter valid source and destination bins, and post from the document required by the other warehouse settings.</td>
</tr>
<tr>
<td><strong>Directed Put-away and Pick</strong> at the source</td>
<td>Register the warehouse pick and post the warehouse shipment by using the advanced warehouse process.</td>
</tr>
</tbody>
</table>
<p>With <strong>Shipment and Receipt</strong>, the destination can't require warehouse receipt or put-away. A destination that uses bins requires a valid <strong>Transfer-To Bin Code</strong>.</p>
LaunchedMicrosoft Copilot (Microsoft 365)
⏰ Act before October CY2026 · overdue
<p>Federated Copilot connectors (MCP type) currently let Microsoft 365 Copilot read data from third-party services in real time. With this update, the connector tools that create, update, and delete content in those services are unblocked in Copilot Chat, so users can complete work without leaving Copilot. Copilot acts with the user's own account and permissions at the third-party service, and every create, update, or delete action requires the user's explicit confirmation before it runs. Admins can view each connector's read and write/delete tools in the Microsoft 365 admin center and disable connectors that don't meet their organization's policies.</p>
ImportantExploitedOn-premWindows ServerWindows 10 VersionWindows 10 Version 21H2 for 32-bit Systems
⏰ Remediate by Oct 16, 2026 · passed 27d ago
Security Feature Bypass · Important · CVSS 8.8 · Exploited in the wild. Affects: Windows Server, Windows 10 Version, Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems.
ModerateExploitedCloud + on-premMicrosoft Office LTSCMicrosoft 365 Apps
⏰ Remediate by Nov 24, 2026 · in 12d
Spoofing · Moderate · CVSS 6.5 · Exploited in the wild. Affects: Microsoft Office LTSC, Microsoft 365 Apps.
In developmentMicrosoft Edge
⏰ Act before December CY2026 · ~1 mo away
Microsoft Edge is updating its vertical tab implementation and architecture. Edge is reimplementing capabilities across pane, layout, controls, tab behavior, visual treatments, & embedder customizations. No admin action is required.
betaMicrosoft GraphDevice and app management
⏰ Update before removal Dec 31, 2026 · in 49d
Added the domainJoinCredential property to the cloudPcOnPremisesConnection resource. Added the cloudPcDomainJoinCredential resource. Added the cloudPcPlainTextDomainJoinCredential resource. Added the cloudPcKeyVaultDomainJoinCredential resource. Added the cloudPcDomainJoinKeyVaultIntentConfiguration resource. Added the cloudPcDomainJoinKeyVaultPasswordConfiguration resource. Added the cloudPcDomainJoinUserIdentity resource. Added the cloudPcDomainJoinPlainTextUserIdentity resource. Added the domainJoinCredential parameter to the updateAdDomainPassword method. Deprecated the adDomainPassword property of the cloudPcOnPremisesConnection resource. This property will be removed on December 31, 2026. Going forward use the domainJoinCredential property instead. Deprecated the adDomainUsername property of the cloudPcOnPremisesConnection resource. This property will be removed on December 31, 2026. Going forward use the domainJoinCredential/domainUserPrincipalName property instead. Deprecated the adDomainPassword parameter of the updateAdDomainPassword method. This parameter will be removed on December 31, 2026. Going forward use the domainJoinCredential parameter instead. Added the keyVaultSecretCheckAccessDenied member to the cloudPcOnPremisesConnectionHealthCheckErrorType enumeration. Added the keyVaultSecretCheckVaultNotReachable member to the cloudPcOnPremisesConnectionHealthCheckErrorType enumeration. Added the keyVaultSecretCheckNotFound member to the cloudPcOnPremisesConnectionHealthCheckErrorType enumeration. Added the keyVaultSecretCheckDisabled member to the cloudPcOnPremisesConnectionHealthCheckErrorType enumeration. Added the keyVaultSecretCheckExpired member to the cloudPcOnPremisesConnectionHealthCheckErrorType enumeration. Added the keyVaultSecretCheckEmptyValue member to the cloudPcOnPremisesConnectionHealthCheckErrorType enumeration. Added the keyVaultSecretCheckTransientServiceError member to the cloudPcOnPremisesConnectionHealthCheckErrorType enumeration. Added the keyVaultSecretCheckUnknownError member to the cloudPcOnPremisesConnectionHealthCheckErrorType enumeration.