Microsoft Security retirements and deprecations
Upcoming retirements, deprecations and end-of-support dates across Microsoft Sentinel, Defender, Entra, Intune and Purview, with effective dates and the official source for each.
Upcoming
| Effective | What's changing | Product | Type | Source |
|---|---|---|---|---|
| Jan 6, 2027 | File policies retiring January 6, 2027 File policies retiring January 6, 2027. | Defender for Cloud Apps | Retirement | Microsoft Learn |
| Feb 27, 2027 | Control plane SDK releases Control plane management SDKs that use older API versions will stop working when those API versions retire on February 27, 2027. Action may be required | Azure security | Retirement | Microsoft Learn |
| March 2027 | Updated date: Microsoft Sentinel in the Azure portal to be retired March 2027 Updated date: Microsoft Sentinel in the Azure portal to be retired March 2027. Action may be required | Sentinel | Retirement | Microsoft Learn |
Announced, no date stated
| Effective | What's changing | Product | Type | Source |
|---|---|---|---|---|
| —not stated | Additional information [Update to support statement for Windows 10 in Intune] Stay secure with Windows 11, Copilot+ PCs, and Windows 365 before support ends for Windows 10 Windows 10 reaching end of support Enable Extended Security Updates … | Intune | Retirement | Microsoft Learn |
| —not stated | Azure Key Vault Secrets Provider Extension for Azure Arc enabled Kubernetes clusters Retirement: Azure Key Vault Secrets Provider Extension for Azure Arc enabled Kubernetes clusters. Action may be required | Azure security | Retirement | Azure Updates |
| —not stated | Breaking change: Unused actions no longer included in AWS and GCP overprovisioned identity assessments Any workflows or processes that rely on the Unused actions list within Defender for Cloud CIEM will no longer be available for AWS and GCP recommendations. Action may be required | Defender for Cloud | Retirement | Microsoft Learn |
| —not stated | Classic Defender for SQL APIs retirement Classic Defender for SQL APIs retirement. | Defender for Cloud | Retirement | Microsoft Learn |
| —not stated | Container-level misconfiguration recommendations for Kubernetes (Preview) Cluster-level recommendations will be deprecated at GA. | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | Containerized data connector agent for the Microsoft Sentinel solution for SAP applications Retirement: Containerized data connector agent for the Microsoft Sentinel solution for SAP applications. | Sentinel | Retirement | Azure Updates |
| —not stated | Deprecation completed: Legacy grouped recommendations removed from Azure portal Deprecation completed: Legacy grouped recommendations removed from Azure portal. | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | Deprecation of preview of container and container images vulnerability recommendations Deprecation of preview of container and container images vulnerability recommendations. | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | General Availability - Microsoft Entra Connect Health now enforces TLS 1.2 Why this matters TLS 1.1 is deprecated due to security vulnerabilities. | Entra | Deprecation | Microsoft Learn |
| —not stated | General availability of individual recommendations for Defender for Cloud in Azure portal and deprecation of legacy grouped recommendations General availability of individual recommendations for Defender for Cloud in Azure portal and deprecation of legacy grouped recommendations. | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | Intune Data Warehouse (beta) connector retirement in Power BI Intune Data Warehouse (beta) connector retirement in Power BI. | Intune | Retirement | Microsoft Learn |
| —not stated | Intune ending support for legacy Apple MDM software update policies [Device security] With the release of iOS 26, iPadOS 26, and macOS 26, Apple has deprecated legacy mobile device management (MDM) software update commands and payloads. | Intune | Deprecation | Microsoft Learn |
| —not stated | Intune security baseline for Windows 11, version 25H2 The Windows 11, version 25H2 security baseline includes new settings, updated default values, retired settings, and revised security guidance. | Intune | Retirement | Microsoft Learn |
| —not stated | Legacy Apple MDM software update workloads removed from Intune [Device configuration] Microsoft Intune is removing legacy Apple MDM software update workloads after Apple retired the underlying commands and payloads in OS 27. | Intune | Retirement | Microsoft Learn |
| —not stated | MDTI Standalone Portal Retirement and Transition to Defender XDR MDTI Standalone Portal Retirement and Transition to Defender XDR. | Defender XDR | Retirement | Microsoft Defender XDR Blog |
| —not stated | New Microsoft Edge settings in the Windows settings catalog This policy is temporary and will be removed in a future release. | Intune | Retirement | Microsoft Learn |
| —not stated | New container security capabilities are now generally available The following cluster-level recommendations are now deprecated: HostPath volume mount restrictions, allowed ports enforcement, host networking/ports restrictions, CAP_SYS_ADMIN capability restrictions, and AppArmor … | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | New individual recommendations format in Azure portal (Preview) The grouped recommendations will still show side by side with the new format for now, but they will be deprecated in several months. | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | New settings in the Windows settings catalog Licensing > Enable ESU Subscription Check : This policy is deprecated and only works on Windows 10. | Intune | Deprecation | Microsoft Learn |
| —not stated | Non-FIPS compliant signing keys (P-256K) retirement Non-FIPS compliant signing keys (P-256K) retirement. | Entra | Retirement | Microsoft Learn |
| —not stated | OT security in Microsoft Defender for IoT Retirement: OT security in Microsoft Defender for IoT. | Defender for IoT | Retirement | Azure Updates |
| —not stated | Plan enablement API now blocks onboarding to five deprecated Defender plans Plan enablement API now blocks onboarding to five deprecated Defender plans. | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | Plan for change - Update SCIM provisioning applications to use modern authentication A small number of applications that cannot support a modern method may be retired from the Microsoft Entra app gallery. Action may be required | Entra | Retirement | Microsoft Learn |
| —not stated | Preparing for end of support for CNAME auto-discovery in Windows MDM-only enrollment Preparing for end of support for CNAME auto-discovery in Windows MDM-only enrollment. | Intune | Retirement | Intune Customer Success |
| —not stated | Preview API version deprecation Preview API version deprecation. Action may be required | Azure security | Deprecation | Microsoft Learn |
| —not stated | Replace deprecated yaml.safeLoad with yaml.load Replace deprecated yaml.safeLoad with yaml.load. safeLoad was deprecated in js-yaml v4 and removed in favor of load. | Sentinel | Deprecation | Azure-Sentinel content (merged pull requests) |
| —not stated | Setup Assistant legacy deprecation for Apple enrollment profiles Setup Assistant legacy deprecation for Apple enrollment profiles. | Intune | Deprecation | Microsoft Learn |
| —not stated | Upcoming deprecation of the Machines should have a vulnerability assessment solution recommendation Upcoming deprecation of the Machines should have a vulnerability assessment solution recommendation. | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | Updated CIEM recommendation logic The Permissions Creep Index (PCI) metric is deprecated and no longer appears in recommendations. | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | Updated security baseline for Microsoft Edge v139 The Edge v139 security baseline includes new settings, updated default values, and retired settings. | Intune | Retirement | Microsoft Learn |
| —not stated | Use DDM to manage Apple Intelligence settings on devices running 26.4 and later [Custom top bar elements on Managed Home Screen] With the release of 26.4, Apple deprecated several intelligence-related settings in the MDM restrictions payload. | Intune | Deprecation | Microsoft Learn |
Already in effect
| Effective | What's changing | Product | Type | Source |
|---|---|---|---|---|
| November 2026passed | Plan for change - Switch from basic auth to workload identity based auth for SAP SuccessFactors provisioning integrations This change helps customers transition to a more secure authentication model in preparation for SAP’s plan to deprecate basic authentication for SuccessFactors APIs by November 2026 . Action may be required | Entra | Deprecation | Microsoft Learn |
| November 2026passed | Public Preview - Workload identity-based authentication for SAP SuccessFactors provisioning integrations This change helps customers transition to a more secure authentication model in preparation for SAP’s plan to deprecate basic authentication for SuccessFactors APIs by November 2026 . Action may be required | Entra | Deprecation | Microsoft Learn |
| Jun 15, 2026passed | Call to action: update older Microsoft Sentinel content as code (Sentinel repositories) API versions before June 15, 2026 Starting June 15, 2026 , older API versions used by Microsoft Sentinel repositories will no longer be supported. Action may be required | Sentinel | Retirement | Microsoft Learn |
| May 1, 2026passed | Plan for change – Agent Registry consolidation into Microsoft Agent 365 What’s changing The Agent registry and Agent collections blades in the Entra admin center will be retired on May 1, 2026. Action may be required | Entra | Retirement | Microsoft Learn |
| Oct 14, 2025passed | Update to support statement for Windows 10 in Intune Windows 10 has reached end of support on October 14, 2025 . | Intune | Retirement | Microsoft Learn |
Nothing matches.
An entry appears only when Microsoft's text explicitly says something is deprecated, retired, removed or reaching end of support. The effective date is shown only when a date appears in that same sentence; we never estimate one. The quoted sentence is Microsoft's wording, and every row links to the source.