Four Microsoft switch-offs to plan for before April

9 November 2026 · Carl Heaton · Infrastructure Security

If your business runs on Microsoft, and most small businesses do, four things you rely on are being switched off between now and April. None of them is a crisis today. Each one becomes an outage, a failed Cyber Essentials question, or a box of files nobody can open if nobody notices in time.

The four are an old server that stops getting security fixes, the text-message codes many staff use to sign in, a behind-the-scenes connection to your mailboxes that older apps still use, and an app many offices still use for leaflets and newsletters. They have different owners in most firms, which is exactly why they get missed.

Windows Server 2016: last security update on 12 January

Windows Server 2016 reaches the end of its support on 12 January 2027. The January security update is the last one. This applies to every edition, including Essentials, the version sold to small businesses.

This is not like the Windows Server 2022 date we covered in August, where security fixes carry on for years. After 12 January, every new security hole found in Server 2016 stays open on your machine for good.

That matters beyond the risk itself. Cyber Essentials requires software to be supported, and anything that no longer gets security updates has to be removed or isolated. A Server 2016 machine still running your files or accounts package in February is a failed question on your next renewal.

There is a paid way to buy time. Microsoft sells Extended Security Updates for Server 2016, which provide critical and important security fixes for up to three years, through 2030. They are set up through Microsoft's Azure Arc service and billed from 13 January. That is a bridge for a server you genuinely cannot move yet, not a plan.

Text-message sign-in codes: gone from 1 February

If staff confirm their Microsoft 365 sign-in with a code sent by text message or read out in a phone call, that stops on 1 February 2027. Microsoft is retiring the text and voice codes it sends itself for every user except Global Administrators and external users, who follow on 1 July. Codes from an authenticator app keep working.

Nobody is quietly locked out. From 1 February, anyone whose only second step is a text or a call will be stopped at sign-in and made to set up a passkey before they can carry on, with no way to skip it. A passkey is a sign-in tied to the person's phone or computer and unlocked with a fingerprint, face, or PIN. It cannot be typed into a fake login page. Microsoft has been prompting these users to register one since 1 September.

The risk is a Monday morning of people who cannot get in: someone with an old phone, a shared mobile on a desk, or anyone who has dismissed the prompt since September. Moving everyone across before February, at a time you choose, avoids that. Your administrator can list who still relies on text or voice codes with a script Microsoft provides. A business that genuinely needs text codes can keep them by paying a telephone provider through Microsoft's Security Store.

This one is good news. Text codes can be phished, and stolen outright by anyone who persuades a mobile network to move your number to their SIM. Passkeys fix both.

Exchange Web Services: already blocked, gone in April

Exchange Web Services is an older way for apps to read and write your Microsoft 365 mailboxes and calendars from outside Outlook. Microsoft has been retiring it since 2023, and pushed harder after a 2024 attack on Microsoft itself involved it.

Since 1 October it has been switched off by default in Microsoft 365 for organisations that had not chosen to keep it. Anything still using it has started failing, often with error messages about the connection being unavailable or repeated requests to type a password. BleepingComputer lists Outlook add-ins, older versions of Outlook for Windows, and Apple Mail and Calendar on the Mac among the affected apps.

Your administrator can switch it back on for now. That stops working on 1 April 2027, when Microsoft turns it off for good. The real fix is to update each affected app to a version that no longer uses it, which usually means a conversation with the app's supplier.

If staff have been complaining since early October that an add-in, a Mac mail app, or a tool that files emails has stopped working, this is the likely reason. Re-enabling it buys five months. Use them.

Publisher: leaving Microsoft 365 now

Publisher left Microsoft 365 subscriptions on 1 October, and support for the bought-outright versions ended on 13 October. According to The Register, the updates that remove it from computers start arriving in mid-November, and in early December for organisations on Microsoft's slower monthly update schedule.

The risk here is mostly lost work. Word and PowerPoint cannot open Publisher files, so years of price lists, menus, and newsletters can become unreadable overnight. Microsoft's advice is to save each file as a PDF while Publisher still opens it. LibreOffice Draw, which is free, can also import Publisher files if you need to keep editing them.

A bought-outright copy will keep running, but it now gets no security fixes. That puts it in the same Cyber Essentials bucket as the old server.

What to do this month

For whoever looks after your IT:

List every server and its version. Anything on Windows Server 2016 needs a move date before 12 January, or a deliberate decision to buy Extended Security Updates while you move.
Run Microsoft's script to list who still signs in with text or voice codes, and move them to passkeys or an authenticator app before 1 February. Start with anyone on a shared or old phone.
Check which apps still use Exchange Web Services. If you re-enabled it to stop complaints, write down what broke, and ask each supplier for the version that works without it.
Ask staff who uses Publisher, then convert the files that matter to PDF or move them to another tool before the removal update arrives.

For the director, four questions for your IT provider:

Do we have any Windows Server 2016 machines, and what is the plan and date for each?
Who in the business still signs in with a text-message code, and will they all be moved before 1 February?
Has anything stopped working since 1 October because of the email change, and is it fixed properly or just switched back on?
Will any of this cause a problem with our Cyber Essentials renewal?

A good provider will answer all four from a list they already keep. If the answer is "we'll have a look", that list is the first thing to ask for.

How Steelwise can help

Finding what you run, which deadlines apply to it, and the sensible order to deal with them is the kind of infrastructure review we do in a few days, not months. Get in touch.