(Updated 3-31-2026: The March 2026 Windows non-security preview update has been replaced with out-of-band update KB5086672 for Windows 11, versions 25H2 and 24H2. The Windows 11 links in this message have been updated to reflect this change.) The March 2026 non-security preview update is now available for Windows 11, versions 26H1, 25H2, and 24H2. Information about the contents of this update is available from the release notes, which are accessible from the Windows 11 update history page. To learn more about the different types of monthly quality updates, see Windows monthly updates explained. Looking to explore upcoming features and improvements in Windows 11? Check out the Windows roadmap. It includes what’s coming to the Windows Insider Program, what’s gradually rolling out, and what’s generally available. Highlights for the Windows 11, version 25H2 update: Narrator now provides rich
Updated March 27, 2026: We have updated the timeline. Thank you for your patience. [Introduction] We are updating the entry points for Copilot in Word to provide a clearer, more consistent, and more intuitive experience. These changes unify how users access Copilot and introduce Word Agent in the chat pane as the primary Copilot interface. This update improves discoverability, simplifies the user workflow, and creates consistency with other Microsoft 365 apps. [When this will happen] General Availability (Worldwide): We will begin rolling out in early April 2026 (previously late March) and expect to complete by June 2026 (previously late April). General Availability (GCC, GCCH and DoD): We will begin rolling out in October 2026 (previously late March) and expect to complete by late October 2026 (previously late April). [How this affects your organization] Who is affected All users of Mic
Secure Boot certificates begin expiring in June 2026, and IT admins should take action now to help ensure devices remain secure. Timely deployment of updated certificates is essential to preserving device startup integrity and avoiding servicing (i.e., updates) disruptions. New guidance has recently been published to support a range of deployment scenarios. Whether your organization manages certificates through Microsoft Intune, Group Policy, or manual processes, the resources below provide detailed steps, recommended practices, and troubleshooting guidance to help you plan your updates:Updates and announcements – This page consolidates ongoing updates, milestones, and rollout status changes for the deployment of new Secure Boot certificates across Windows devices. Use it to stay current on important servicing communications as the deployment progresses. Sample Secure Boot E2E Automatio
Updated March 25, 2026: We have updated the content. Thank you for your patience. [Introduction] We are resurfacing MC670435, published September 2023 to remind admins of the Microsoft Teams Premium self-service trial capability. This message serves as a reminder as we begin a broader rollout of the feature announced in 2023. As we expand rollout and introduce additional entry points for this feature, we want to ensure continued awareness and readiness. [When this will happen:] Ongoing rollout. [How this will affect your organization:] When rolled out, users within your organization will be able to directly initiate a Teams Premium trial. These self-service trial licenses will be a part of your Microsoft organizational tenant, and you will be able to manage these licenses like other Microsoft subscriptions. You will be able to cancel these trial licenses at any time. If you choose to dis
Microsoft has identified an issue affecting signing in to apps using a Microsoft account. After installing the March 2026 Windows security update, some users might be unable to sign in to Microsoft apps and services. During sign‑in, users might see a “no internet” error even when the device has a working internet connection. This issue affects only Microsoft account sign‑in scenarios; organizations using Microsoft Entra ID for app authentication are not affected. An out-of-band (OOB) update was released today, March 21, 2026, to address this issue. This cumulative update includes all protections and improvements from the March 2026 Windows security update released March 10, 2026. This OOB update is available for Windows 11, versions 25H2 and 24H2 devices that receive standard Windows updates. It can be installed through Windows Update or the Microsoft Update Catalog. For more information
In 2018, we announced that we were no longer making feature updates to Exchange Web Services (EWS) in Exchange Online, and we advised developers to move to Microsoft Graph. In September 2023, we announced that on October 1, 2026, we will start blocking EWS requests to Exchange Online. We are now less than 12 months from October 1, 2026. We have made progress on closing most parity gaps with more changes in development to be released in the coming quarters. Please refer to Deprecation of Exchange Web Services in Exchange Online for up-to-date guidance and roadmap information. You are receiving this notification because there are EWS applications in your tenant. If you haven't already, start the process of working with your application development organization and your application vendors to either sunset or migrate active EWS applications on your tenant to the Graph API, Power Platform, o
Updated March 20, 2026: Added additional guidance for devices using Azure Files SMB with Active Directory–based authentication and Azure Virtual Desktop. Windows updates released April 2026 and later introduce the second deployment phase of protections for a Kerberos information disclosure vulnerability (CVE‑2026‑20833). In this phase, domain controllers change default Kerberos ticket behavior for accounts that do not have an explicit Kerberos encryption configuration, shifting to AES‑SHA1-only by default. Environments with remaining RC4 dependencies may experience authentication issues unless those dependencies are remediated or explicitly configured. When this will happen:April 2026 - Enforcement Phase with manual rollback: Default Kerberos behavior changes so domain controllers use AES‑SHA1-only encryption for accounts without explicit encryption type settings, and Enforcement mode is
[Introduction] Teams Phone user multi-line provides greater flexibility for organizations whose users manage multiple business numbers. This capability allows administrators to assign up to 10 telephone numbers to a single Teams Phone user, all within one Teams account. Users can make and receive calls from multiple numbers across Teams desktop, Teams mobile, and Teams devices without switching accounts or hardware. This enhancement supports a familiar and localized calling experience for users who work across regions, roles, or business lines. This capability supports scenarios such as: Establishing local presence across multiple regions Supporting users with multiple roles or responsibilities Allowing executives, assistants, or support teams to manage multiple business lines within one Teams account This message applies to Teams for Windows desktop, Teams for Mac desktop, and Teams for
Microsoft has identified an issue affecting hotpatch-enabled Enterprise editions of Windows where Bluetooth devices may not appear on the Bluetooth & devices page in Windows Settings or in Quick Settings, even though the devices are connected and functioning as expected. In addition, users might be unable to add Bluetooth devices because available devices do not appear in the connection list. This issue was identified in Microsoft’s internal environment and is expected to affect a limited set of Enterprise devices running Windows hotpatch updates. An out-of-band (OOB) hotpatch update (KB5084897) was released today, March 16, 2026, to address this issue. This cumulative update includes all protections and improvements from the March 2026 Windows hotpatch updates released on March 10 and March 13, 2026. This OOB hotpatch update is offered only to hotpatch‑enabled Windows 11, versions 25H2
Microsoft has identified a security issue in the Windows Routing and Remote Access Service (RRAS) management tool that could allow remote code execution when connecting to a malicious server. This issue only applies to a limited set of scenarios involving Enterprise client devices running hotpatch updates and being used for remote server management. An out-of-band (OOB) hotpatch update (KB5084597) was released today, March 13, 2026, to address this issue. This cumulative update includes all protections and improvements from the March 2026 Windows security update released March 10, 2026. No action is required if:Your devices receive standard Windows updates. If you are not using the RRAS management tool on Windows devices running versions 25H2 or 24H2. This OOB hotpatch update is available for Windows 11, versions 25H2 and 24H2 devices enrolled in hotpatch updates and managed by Windows A
As announced in January 2026, the unattend.xml file used in hands‑free deployment poses a vulnerability when transmitted over an unauthenticated RPC channel. Beginning with the April 2026 security update, IT admins should prepare for the second phase of hardening for CVE-2026-0386. These changes will make hands‑free deployment disabled by default to enforce secure behavior. After this update, hands‑free deployment will no longer work unless explicitly overridden with registry settings. When will this happen:Starting with the April 2026 security update, Windows Deployment Services (WDS) will enforce secure‑by‑default behavior by automatically disabling hands‑free deployment. How this will affect your organization:After installing the April 2026 security update, hands‑free deployment will be blocked to prevent unauthenticated access to unattend.xml, enforcing the hardening requirements for
If you are an IT admin with questions about managing and updating Windows, we want to help. Every third Thursday of the month, we host a live chat-based event on the Tech Community called Windows Office Hours. Members of the Windows, Microsoft Intune, Windows Autopilot, Windows Autopatch, and Windows 365 engineering teams will be standing by to answer your questions. We also have experts from FastTrack, the Customer Acceleration Team, and Microsoft public sector teams. Want to attend the March 19 session of Office Hours? Add it to your calendar and select Attend on the event page to let us know you’re coming. There is no video or live meeting component. Simply visit the event page, log in to the Tech Community, and leave your questions in the Comments section. You can also bookmark https://aka.ms/Windows/OfficeHours for upcoming dates (and the ability to add this event to your calendar).