Updated March 25, 2026: We have updated the content. Thank you for your patience. [Introduction] We are resurfacing MC670435, published September 2023 to remind admins of the Microsoft Teams Premium self-service trial capability. This message serves as a reminder as we begin a broader rollout of the feature announced in 2023. As we expand rollout and introduce additional entry points for this feature, we want to ensure continued awareness and readiness. [When this will happen:] Ongoing rollout. [How this will affect your organization:] When rolled out, users within your organization will be able to directly initiate a Teams Premium trial. These self-service trial licenses will be a part of your Microsoft organizational tenant, and you will be able to manage these licenses like other Microsoft subscriptions. You will be able to cancel these trial licenses at any time. If you choose to dis
Microsoft has identified an issue affecting signing in to apps using a Microsoft account. After installing the March 2026 Windows security update, some users might be unable to sign in to Microsoft apps and services. During sign‑in, users might see a “no internet” error even when the device has a working internet connection. This issue affects only Microsoft account sign‑in scenarios; organizations using Microsoft Entra ID for app authentication are not affected. An out-of-band (OOB) update was released today, March 21, 2026, to address this issue. This cumulative update includes all protections and improvements from the March 2026 Windows security update released March 10, 2026. This OOB update is available for Windows 11, versions 25H2 and 24H2 devices that receive standard Windows updates. It can be installed through Windows Update or the Microsoft Update Catalog. For more information
In 2018, we announced that we were no longer making feature updates to Exchange Web Services (EWS) in Exchange Online, and we advised developers to move to Microsoft Graph. In September 2023, we announced that on October 1, 2026, we will start blocking EWS requests to Exchange Online. We are now less than 12 months from October 1, 2026. We have made progress on closing most parity gaps with more changes in development to be released in the coming quarters. Please refer to Deprecation of Exchange Web Services in Exchange Online for up-to-date guidance and roadmap information. You are receiving this notification because there are EWS applications in your tenant. If you haven't already, start the process of working with your application development organization and your application vendors to either sunset or migrate active EWS applications on your tenant to the Graph API, Power Platform, o
Updated March 20, 2026: Added additional guidance for devices using Azure Files SMB with Active Directory–based authentication and Azure Virtual Desktop. Windows updates released April 2026 and later introduce the second deployment phase of protections for a Kerberos information disclosure vulnerability (CVE‑2026‑20833). In this phase, domain controllers change default Kerberos ticket behavior for accounts that do not have an explicit Kerberos encryption configuration, shifting to AES‑SHA1-only by default. Environments with remaining RC4 dependencies may experience authentication issues unless those dependencies are remediated or explicitly configured. When this will happen:April 2026 - Enforcement Phase with manual rollback: Default Kerberos behavior changes so domain controllers use AES‑SHA1-only encryption for accounts without explicit encryption type settings, and Enforcement mode is
[Introduction] Teams Phone user multi-line provides greater flexibility for organizations whose users manage multiple business numbers. This capability allows administrators to assign up to 10 telephone numbers to a single Teams Phone user, all within one Teams account. Users can make and receive calls from multiple numbers across Teams desktop, Teams mobile, and Teams devices without switching accounts or hardware. This enhancement supports a familiar and localized calling experience for users who work across regions, roles, or business lines. This capability supports scenarios such as: Establishing local presence across multiple regions Supporting users with multiple roles or responsibilities Allowing executives, assistants, or support teams to manage multiple business lines within one Teams account This message applies to Teams for Windows desktop, Teams for Mac desktop, and Teams for
Microsoft has identified an issue affecting hotpatch-enabled Enterprise editions of Windows where Bluetooth devices may not appear on the Bluetooth & devices page in Windows Settings or in Quick Settings, even though the devices are connected and functioning as expected. In addition, users might be unable to add Bluetooth devices because available devices do not appear in the connection list. This issue was identified in Microsoft’s internal environment and is expected to affect a limited set of Enterprise devices running Windows hotpatch updates. An out-of-band (OOB) hotpatch update (KB5084897) was released today, March 16, 2026, to address this issue. This cumulative update includes all protections and improvements from the March 2026 Windows hotpatch updates released on March 10 and March 13, 2026. This OOB hotpatch update is offered only to hotpatch‑enabled Windows 11, versions 25H2
Microsoft has identified a security issue in the Windows Routing and Remote Access Service (RRAS) management tool that could allow remote code execution when connecting to a malicious server. This issue only applies to a limited set of scenarios involving Enterprise client devices running hotpatch updates and being used for remote server management. An out-of-band (OOB) hotpatch update (KB5084597) was released today, March 13, 2026, to address this issue. This cumulative update includes all protections and improvements from the March 2026 Windows security update released March 10, 2026. No action is required if:Your devices receive standard Windows updates. If you are not using the RRAS management tool on Windows devices running versions 25H2 or 24H2. This OOB hotpatch update is available for Windows 11, versions 25H2 and 24H2 devices enrolled in hotpatch updates and managed by Windows A
As announced in January 2026, the unattend.xml file used in hands‑free deployment poses a vulnerability when transmitted over an unauthenticated RPC channel. Beginning with the April 2026 security update, IT admins should prepare for the second phase of hardening for CVE-2026-0386. These changes will make hands‑free deployment disabled by default to enforce secure behavior. After this update, hands‑free deployment will no longer work unless explicitly overridden with registry settings. When will this happen:Starting with the April 2026 security update, Windows Deployment Services (WDS) will enforce secure‑by‑default behavior by automatically disabling hands‑free deployment. How this will affect your organization:After installing the April 2026 security update, hands‑free deployment will be blocked to prevent unauthenticated access to unattend.xml, enforcing the hardening requirements for
If you are an IT admin with questions about managing and updating Windows, we want to help. Every third Thursday of the month, we host a live chat-based event on the Tech Community called Windows Office Hours. Members of the Windows, Microsoft Intune, Windows Autopilot, Windows Autopatch, and Windows 365 engineering teams will be standing by to answer your questions. We also have experts from FastTrack, the Customer Acceleration Team, and Microsoft public sector teams. Want to attend the March 19 session of Office Hours? Add it to your calendar and select Attend on the event page to let us know you’re coming. There is no video or live meeting component. Simply visit the event page, log in to the Tech Community, and leave your questions in the Comments section. You can also bookmark https://aka.ms/Windows/OfficeHours for upcoming dates (and the ability to add this event to your calendar).
You can now use familiar Remote Server Administration Tools (RSAT) on Arm-based Windows 11 devices. With the February 2026 non-security preview update, five of the most widely used RSAT components are available for everyday system administrator tasks. Add users to Active Directory, edit GPOs, configure NDS and DHCP servers, and more. When will this happen: Starting with the February 2026 non-security preview update How this will affect your organization: For the past several years, if you’ve used Windows on Arm, you had to rely on alternative management methods (such as Windows Admin Center) or switch to an x64 device for certain tasks. Similarly, testing newer Arm-powered laptops for your enterprise highlighted the pressing need for RSAT support on Arm64 devices. With RSAT support, Windows 11 on Arm becomes a more viable platform for enterprise IT management. What you need to do to prep
The March 2026 security update is now available for all supported versions of Windows. We recommend that you install these updates promptly. For more information about the contents of this update, see the release notes, which are easily accessible from the Windows 11 update history page. To learn more about the different types of monthly quality updates, see Windows monthly updates explained. Highlights for the Windows 11, version 25H2 update: This security update includes improvements that were a part of update KB5077181 (released February 10, 2026). This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. This update adds high‑confidence device targeting, expanding coverage for automatic Secure Boot certificate delivery. This update improves File Explorer search reliability when searching across multiple drives or "This PC". T
Starting with the May 2026 Windows security update, Windows Autopatch is enabling hotpatch security updates by default because they are the quickest way to get secure. This change in default behavior will impact all eligible Microsoft Intune devices. Additional IT controls are coming in April. When will this happen: Devices will start receiving hotpatch updates by default with the May 2026 Windows security update. The tenant setting to opt out of hotpatch updates is scheduled to go live on April 1, 2026. How this will affect your organization: Devices that meet hotpatch prerequisites will get secure faster because full Windows security updates are applied without waiting for a restart. Devices are secured as soon as the update is installed. You don’t need to wait for devices to restart, saving on average three to five days. Devices will restart during baseline months, which are January,