Field notes from the migrations.

Deadline: Claim window: Sept 30

M365 outage, August 2026: what the SLA actually pays

Microsoft's August 31 incident ran into September under one ID and hit ten Microsoft 365 services — Defender XDR among them, so the tool you would use to tell an outage from an attack was inside the failure. Separately, Microsoft's Volume Licensing SLA pays a service credit when measured uptime falls short. It is worth one month's fee for the affected service, you must choose one Service Level when an incident trips two, and a suite license does not unlock a claim per service. The conservative filing deadline is September 30, 2026.

Read the post →

Deadline: Six platforms, one Tuesday

.NET 8 LTS ends November 10, 2026, and PowerShell with it

Six Microsoft platforms end support on November 10, 2026: .NET 8 LTS, .NET 9, PowerShell 7.4 LTS, PowerShell 7.5, and Windows 11 23H2 on Enterprise and IoT Enterprise. PowerShell dies with .NET because it inherits the runtime's lifecycle — the successors share an end date too. And Windows 11 carries three dates a year apart, separated only by edition.

Read the post →

Deadline: M365: Oct 1, files included

Microsoft Publisher retires October 1, 2026

Most end-of-support dates are a risk decision — the software keeps running and you carry the risk. This one is not. Microsoft 365 subscribers lose Publisher after October 1, 2026 and, in Microsoft's own words, can no longer open or edit their existing .pub files. The perpetual version has a different date and keeps working. And Microsoft's bulk-conversion script needs a licensed Publisher install to run, so it has to be finished before the app goes away.

Read the post →

Deadline: Six 10.0s, nothing to patch

Entra ID RCE: six CVSS 10.0 CVEs you cannot patch

Microsoft published six CVSS 10.0 cloud-service CVEs on August 20, 2026 — an Entra ID remote code execution flaw among them — and every record reads customerActionRequired: false. There is no KB number, no maintenance window, and nothing your scanner could ever have found. What a mid-market tenant actually controls here is identity configuration, not patch cadence.

Read the post →

Deadline: Three costs, one budget cycle

What a 2026 infrastructure refresh actually costs

A VMware exit is not one cost. Broadcom's licensing changes, hosts that are mostly memory in the middle of a shortage IDC expects to run through 2027, and a 5% Microsoft CSP uplift landing October 1 all hit the same budget. The asymmetry is the argument: hyperscalers signed long-term agreements capping their memory increases. A firm buying three hosts did not.

Read the post →

Deadline: Not law — policy direction

Washington's first data privacy report and the mid-market

Washington's Attorney General published the state's first Data Privacy Report on August 14: 209 breaches in 2025, more than eight million residents, over four in five exposing Social Security numbers. Four days later, independent research put 73% of ransomware victims in the $10M–$1B revenue band. Nothing here is law. Both are worth reading anyway.

Read the post →

Deadline: The plant floor sets the plan

Manufacturing VMware exit: the plant floor sets the plan

A manufacturing VMware exit is not gated by the hypervisor. It is gated by a cutover window measured against production schedules, machine-attached workstations pinned to OS versions by warranty, and segments that genuinely cannot reach the internet. Which systems move first, which move last, and why the historian usually decides.

Read the post →

Deadline: The field is the hard half

Microsoft 365 migration with a field-mobile workforce

The office half of a Microsoft 365 migration is the easy half. Re-authentication is the migration event nobody schedules — and the users who cannot complete it are the ones you cannot reach by walking to a desk. Shared site devices, crews that change between phases, and connectivity that is genuinely intermittent.

Read the post →

Deadline: Census before wave plan

Litigation hold blocks the mailbox migration you planned

A mailbox on hold does not migrate cleanly, and most plans discover this mid-cutover. The hold census belongs before the wave plan, not during it. Retention policy, retention label and hold are three different things routinely conflated — and the decision to release one belongs to the firm's counsel, never to IT.

Read the post →

Deadline: The calendar, not the tech

The close cycle sets your migration calendar

In a finance organization the close cycle sets the migration calendar. Month-end, quarter-end, year-end and audit fieldwork eliminate most of the year, and what is left is narrower than any project plan assumes. Plus the part nobody designs up front: administrative access during the period is an audit artifact, not a convenience.

Read the post →

Deadline: End of Aug 2026 to opt out

EWS retirement: the August deadline most tenants miss

Configure an Allow List and set EWSEnabled=True by the end of August 2026 and your tenant is excluded from the October 1 flip that turns EWSEnabled from Null to False and blocks EWS for every app you run. The real trap is not the date — it is that Microsoft shipped two controls with almost the same name, and the obvious reading points at the wrong one.

Read the post →

Deadline: EOS Jan 12, 2027

Windows Server 2016 End of Support: ESU or Modernize?

Windows Server 2016 leaves extended support January 12, 2027 — and the same date takes Hyper-V Server 2016, IIS 10, WSUS, Defender, Storage Server 2016 and .NET 4.6.2, while the day before takes the whole System Center 2016 family. Backup and monitoring expire before the servers they cover, which inverts the usual sequencing. ESU is quotable as of August 13.

Read the post →

Deadline: Seven items, one day

Everything Microsoft retires on October 13, 2026

Seven Microsoft lifecycle items end on October 13, 2026 — and every table says October 14, because the cells carry a timestamp on the morning after the last supported day. A triage list: what actually stops, what only changes phase, and two places Microsoft's own summary page contradicts itself.

Read the post →

Deadline: 26.x out of servicing Oct 13

Business Central on-prem: the servicing clock nobody reads

Business Central on-premises versions carry about eighteen months of servicing each — but waves land twice a year, so a version drops out roughly every six months. 25.x lapsed in April 2026, 26.x lapses October 13. Two lapses in one calendar year, neither with an end-of-life headline attached.

Read the post →

Deadline: The split, in writing

Co-managed IT: what it actually covers

Co-managed IT is sold as a philosophy and bought as a division of labour. What your team keeps, what a partner takes, who holds which escalation, whose tenant the tooling lives in, and how project work differs from steady state. Includes the failure mode nobody sells against — your own senior people ending up as the escalation tier for someone else's junior bench — and the cases where co-managed is the wrong answer.

Read the post →

Deadline: Sync stops Sep 30, 2026

Entra Connect sync stops Sept 30: the version trap

Microsoft will stop all synchronization services in Entra Connect Sync on September 30, 2026 for any server below version 2.5.79.0 — password hash sync, joiner and leaver provisioning, all of it. The trap: 2.5.79.0 is itself scheduled to reach end of support on October 23, so the minimum upgrade buys about three weeks. And the fix lands on a Tier-0 server.

Read the post →

Deadline: Retires Sep 30 · recovery point already gone

Azure Migrate classic appliance retires September 2026

Azure Migrate's classic replication appliance retires 30 September 2026 — but the final recovery point for existing replications was 31 May 2026, a date already behind us. Anyone still replicating through it is in a degraded state now, not in six weeks. What to move to, and what memory pricing is doing to the host refresh that usually rides along with a VMware exit.

Read the post →

Deadline: Renamed from Azure Stack HCI

Azure Local as a VMware exit: what it is, what it costs

Azure Local is the product Microsoft used to call Azure Stack HCI — the old docs URL redirects to the new one. What it actually is, how per-physical-core pricing compares to Broadcom’s 16-core-per-socket minimum, whether it needs a live Azure connection, and the cases where plain Hyper-V is the more honest answer.

Read the post →

Deadline: Per host, not per core

XCP-ng as a VMware exit: free hypervisor, priced platform

XCP-ng is a Type-1 Xen hypervisor that Vates describes as having no limits and no license. The money is in Xen Orchestra and the Vates VMS bundle around it — priced per host, per year, with no CPU or RAM limits, which inverts the density penalty Broadcom’s core minimum creates.

Read the post →

Deadline: GP retires Dec 31, 2029

Dynamics GP retires end of 2029: what actually migrates

Microsoft retires Dynamics GP at the end of 2029 — on the Modern Lifecycle Policy, so there is no extended-support phase behind it. Microsoft points GP at Business Central and ships a migration tool. What that tool does to your chart of accounts, the four things it does not bring, and the place Microsoft’s own documentation contradicts itself.

Read the post →

Deadline: KEV added Aug 18 · due Aug 21

CISA KEV, August 2026: patch, then assume compromise

CISA added four CVEs to the Known Exploited Vulnerabilities catalog on August 18 — vCenter, SharePoint and Windows IKE among them. The three-day clock is routine and it binds federal civilian agencies, not you. What does transfer is the federal standard’s sequencing: patch, then run forensic triage to find out whether you were already compromised.

Read the post →

Deadline: Project Online retires Sep 30, 2026

Project Server end of support: three paths

Project Server 2016 and 2019 ended support July 14, 2026 — and the destination most teams name first, Project Online, retires September 30, 2026. It has a shorter remaining life than the thing you are leaving. Three real paths, the desktop's own October 13 date, and why the on-premises option is a SharePoint Enterprise decision wearing a different name.

Read the post →

Deadline: EOS Jul 14, 2026 · ESUs to Jul 2029

SQL Server 2016 end of support: ESU or upgrade?

SQL Server 2016 left extended support on July 14, 2026. The free-ESU-on-Azure-VM route that worked for 2012 and 2014 explicitly does not apply to 2016, and ESUs are delivered through Azure Arc. What they cover, what they cost, and the four real paths.

Read the post →

Deadline: CVE-2026-18577 · KEV Aug 3, 2026

Your provider's RMM is Tier 0: 8 questions to ask

An incomplete patch put an RMM platform on CISA's KEV catalog on August 3 — a bypass of a bug that was already fixed, reached through the tool's own remote-control feature. Why remote management tooling belongs in Tier 0, why 'patched' is a state you can lose, and eight questions your IT provider should be able to answer from memory.

Read the post →

Deadline: Suspended Jul 13, 2026 · RFI closed Aug 14

CMMC Phase 2 suspended: what defense contractors should do

The Department of War suspended CMMC Phase 2 on July 13, 2026 — the Nov 10 C3PAO mandate is off and Phases 3–4 are paused. But DFARS 252.204-7012 and NIST 800-171 self-attestation still bind, and with third-party assessment gone, an inflated SPRS score is a bigger False Claims Act risk. What changed, what didn't, and what to do now.

Read the post →

Deadline: Renewal-audit ready

Cyber-insurance readiness for the mid-market (2026)

Cyber-insurance renewal quietly became a security-controls audit — underwriters now verify MFA, EDR, and backups instead of trusting the checkbox. Where the 'MFA everywhere' gap reprices renewals and denies claims, backed by Coalition's 2026 claims data (BEC/FTF 58%, 70% dual extortion), and how to close it as a scoped 90-day readiness project.

Read the post →

Deadline: Agentic ID: 90-day cutover

Intune's June 2026 releases: STIG audits, shadow-AI control, agentic remediation

Three June 2026 Intune shipments for regulated mid-market IT: a Windows 11 STIG SCAP audit baseline (GCC High + Advanced Analytics), native shadow-AI detect-and-block for local AI agents like OpenClaw, and a Vulnerability Remediation Agent now on its own Entra agentic identity. What's base Intune, what's an add-on, and what's still preview.

Read the post →

Deadline: Oct 12, 2027 (consumer only)

Windows 10 ESU extended to 2027 — but not for your fleet

Microsoft quietly extended the free consumer Windows 10 ESU to Oct 12, 2027 — but it excludes every domain-joined, Entra-joined, and Intune-managed device you own. The two ESU programs, the registered-vs-joined trap, and the commercial cost ($61 → $122 → $244/device).

Read the post →

Deadline: Took effect Jul 1, 2026

Microsoft 365 prices rose July 1, 2026 — what to do now

Microsoft's new commercial pricing took effect July 1, 2026 — E3 $36→$39, E5 $57→$60, Business Basic $6→$7, Frontline up 25–33%. The pre-increase lock-in has closed, but the renewal-boundary mechanic still sets what you pay, and it is the playbook for the next increase.

Read the post →

Deadline: Jul–Nov 2026 stack

IT layoffs vs. 2026 deadlines: who runs the work?

H1-2026 tech cuts collided with a stacked Microsoft EOL calendar. When a team shrinks, the SharePoint, Exchange, and CMMC deadlines don't move — how a senior bench fills the gap without touching headcount.

Read the post →

Deadline: Aug 2026 SU kills OWA Light

Exchange Server SE: what modern servicing commits you to

You're on Exchange Server SE — now what? Single-version modern servicing, mandatory CU currency, the cloud dependency for on-prem servers, Server Core, and the coming product-key requirement. The August 2026 security update permanently disables OWA Light — and the KB never says so.

Read the post →

Deadline: SE CU2, date unannounced

Exchange SE CU2: the coexistence deadline after EOL

Exchange 2016/2019 are out of support; the paid ESU bridge ends Oct 2026. SE CU2 will block coexistence with legacy Exchange — closing the last clean migration window. The senior operator's runbook.

Read the post →

Deadline: Governance: 90-day playbook

Copilot governance one year on: the 12,000-permission reckoning

One year after the oversharing warning, mid-market Copilot tenants are leaking HR, finance, and legal docs. The 90-day playbook using Purview DSPM, SharePoint Advanced Management, and Restricted SharePoint Search.

Read the post →

Deadline: RC4 phase knob removed Jul 2026

Kerberos RC4 April 2026 enforcement: mid-market triage runbook

Microsoft's April 14 patch flipped DCs to AES-SHA1-only and broke RC4 service-account logins. The 3-hour triage runbook, and what the July 2026 updates actually remove.

Read the post →

Deadline: Period 2 is an enrollment gate

Exchange ESU Period 1 expired — your real deadline

The paid Exchange ESU bridge is nearly spent: Period 1 expired April 14, 2026 and Period 2 ends October 2026 (final). Only Period 2 enrollees receive the May–October 2026 updates — management-only hybrid servers included. The real deadline, four exit paths, and hour ranges for 50–1,500 seats.

Read the post →

AD functional level on Windows Server 2019/2022: not stuck at 2016

Microsoft skipped Server 2019 and 2022 functional levels. Server 2016 IS the maximum for any 2019/2022 forest. What Server 2025 (behavior version 10) actually adds.

Read the post →

Deadline: Identity-substrate

AD Tier-0 in 90 days: the mid-market edition

Microsoft's enterprise Tier-0 guidance is overkill for 100–500-user shops. The four controls and 12-week plan that close 80% of the gap at under 25% of the cost.

Read the post →

Deadline: M&A integration

M&A tenant merge in 60 days: the reference playbook

A worked reference scenario for folding a subsidiary tenant into a parent: two M365 tenants, one identity model, 60 days from legal close. Power Platform sprawl, externally shared apps, Teams chat fidelity, OneDrive personal data.

Read the post →

Deadline: Phase 2 suspended Jul 2026

CMMC L2 pre-assessment: what $15K buys you

A fixed-fee $15K pre-assessment for a 100–300-user GovCon shop — SSP draft, POA&M draft, GCC High eligibility, NIST 800-171 gap register, third-party app compatibility, two weeks.

Read the post →

Deadline: Renewal-driven

VMware to Azure vs Hyper-V: 500-VM decision guide

Six dimensions that decide whether a 500-VM mid-market VMware exit lands in Azure IaaS or Hyper-V on-prem. Two anonymized walk-throughs and a decision matrix.

Read the post →

Deadline: EOL passed + 2 exploited CVEs

SharePoint 2016 & 2019 EOL July 14, 2026: three paths

SharePoint 2016 and 2019 hit end of support July 14, 2026 — no ESU at any price — and two actively-exploited flaws have landed since, including CVE-2026-50522 at CVSS 9.8. Project Server and SQL Server 2016 died the same day. SPO migration, Subscription Edition, or selective hybrid, with cutover math for 50/200/500 users.

Read the post →

Deadline: Pre-rollout

Is Microsoft Copilot HIPAA compliant? Read the BAA

Microsoft's BAA covers the platform, not your tenant configuration. The four pre-deployment fixes that keep Copilot on the right side of HIPAA.

Read the post →

Deadline: Renewal-driven

After Broadcom: 250-VM Hyper-V migration in 90 days

Anonymized field notes — $310K Broadcom renewal turned into a $35K Hyper-V migration with a four-month payback.

Read the post →

Deadline: Jan 12, 2027 (Server 2016)

Windows Server 2019 EOS: real upgrade options for 2026

Windows Server 2019 is out of mainstream support and Server 2016 ends January 12, 2027. The real upgrade paths — in-place to Server 2025, rehost, or Azure — and the AD functional-level facts most teams get wrong.

Read the post →

Deadline: SE CU2, date unannounced

Exchange Server 2019 EOL: your real migration deadline

Exchange 2016/2019 lost support Oct 14, 2025; the paid ESU bridge ends Oct 2026. The four migration paths and the deadline that actually bites: SE CU2.

Read the post →

Deadline: Renewal-driven

VMware after Broadcom: your real exit options

vSphere → Hyper-V vs Nutanix vs Scale Computing vs Azure Local vs Proxmox. When each lands.

Read the post →

Deadline: Pre-rollout

Copilot readiness: the 12,000-permission problem

Why oversharing becomes a data-loss event when Copilot turns on, and how to fix it before you flip the switch.

Read the post →

Deadline: Phase 2 suspended Jul 2026

GCC High before CMMC Phase 2

The Nov 10, 2026 C3PAO mandate was suspended in July 2026 — what still binds, realistic GCC High timelines, common mistakes.

Read the post →

Tenant-to-tenant M365 migration: a playbook

The M&A and divestiture story, what tools fit when, and how to budget realistically.

Read the post →