Updated March 20, 2026: Added additional guidance for devices using Azure Files SMB with Active Directory–based authentication and Azure Virtual Desktop. Windows updates released April 2026 and later introduce the second deployment phase of protections for a Kerberos information disclosure vulnerability (CVE‑2026‑20833). In this phase, domain controllers change default Kerberos ticket behavior for accounts that do not have an explicit Kerberos encryption configuration, shifting to AES‑SHA1-only by default. Environments with remaining RC4 dependencies may experience authentication issues unless those dependencies are remediated or explicitly configured. When this will happen:April 2026 - Enforcement Phase with manual rollback: Default Kerberos behavior changes so domain controllers use AES‑SHA1-only encryption for accounts without explicit encryption type settings, and Enforcement mode is
[Introduction] Teams Phone user multi-line provides greater flexibility for organizations whose users manage multiple business numbers. This capability allows administrators to assign up to 10 telephone numbers to a single Teams Phone user, all within one Teams account. Users can make and receive calls from multiple numbers across Teams desktop, Teams mobile, and Teams devices without switching accounts or hardware. This enhancement supports a familiar and localized calling experience for users who work across regions, roles, or business lines. This capability supports scenarios such as: Establishing local presence across multiple regions Supporting users with multiple roles or responsibilities Allowing executives, assistants, or support teams to manage multiple business lines within one Teams account This message applies to Teams for Windows desktop, Teams for Mac desktop, and Teams for
Microsoft has identified an issue affecting hotpatch-enabled Enterprise editions of Windows where Bluetooth devices may not appear on the Bluetooth & devices page in Windows Settings or in Quick Settings, even though the devices are connected and functioning as expected. In addition, users might be unable to add Bluetooth devices because available devices do not appear in the connection list. This issue was identified in Microsoft’s internal environment and is expected to affect a limited set of Enterprise devices running Windows hotpatch updates. An out-of-band (OOB) hotpatch update (KB5084897) was released today, March 16, 2026, to address this issue. This cumulative update includes all protections and improvements from the March 2026 Windows hotpatch updates released on March 10 and March 13, 2026. This OOB hotpatch update is offered only to hotpatch‑enabled Windows 11, versions 25H2
Microsoft has identified a security issue in the Windows Routing and Remote Access Service (RRAS) management tool that could allow remote code execution when connecting to a malicious server. This issue only applies to a limited set of scenarios involving Enterprise client devices running hotpatch updates and being used for remote server management. An out-of-band (OOB) hotpatch update (KB5084597) was released today, March 13, 2026, to address this issue. This cumulative update includes all protections and improvements from the March 2026 Windows security update released March 10, 2026. No action is required if:Your devices receive standard Windows updates. If you are not using the RRAS management tool on Windows devices running versions 25H2 or 24H2. This OOB hotpatch update is available for Windows 11, versions 25H2 and 24H2 devices enrolled in hotpatch updates and managed by Windows A
As announced in January 2026, the unattend.xml file used in hands‑free deployment poses a vulnerability when transmitted over an unauthenticated RPC channel. Beginning with the April 2026 security update, IT admins should prepare for the second phase of hardening for CVE-2026-0386. These changes will make hands‑free deployment disabled by default to enforce secure behavior. After this update, hands‑free deployment will no longer work unless explicitly overridden with registry settings. When will this happen:Starting with the April 2026 security update, Windows Deployment Services (WDS) will enforce secure‑by‑default behavior by automatically disabling hands‑free deployment. How this will affect your organization:After installing the April 2026 security update, hands‑free deployment will be blocked to prevent unauthenticated access to unattend.xml, enforcing the hardening requirements for
If you are an IT admin with questions about managing and updating Windows, we want to help. Every third Thursday of the month, we host a live chat-based event on the Tech Community called Windows Office Hours. Members of the Windows, Microsoft Intune, Windows Autopilot, Windows Autopatch, and Windows 365 engineering teams will be standing by to answer your questions. We also have experts from FastTrack, the Customer Acceleration Team, and Microsoft public sector teams. Want to attend the March 19 session of Office Hours? Add it to your calendar and select Attend on the event page to let us know you’re coming. There is no video or live meeting component. Simply visit the event page, log in to the Tech Community, and leave your questions in the Comments section. You can also bookmark https://aka.ms/Windows/OfficeHours for upcoming dates (and the ability to add this event to your calendar).
You can now use familiar Remote Server Administration Tools (RSAT) on Arm-based Windows 11 devices. With the February 2026 non-security preview update, five of the most widely used RSAT components are available for everyday system administrator tasks. Add users to Active Directory, edit GPOs, configure NDS and DHCP servers, and more. When will this happen: Starting with the February 2026 non-security preview update How this will affect your organization: For the past several years, if you’ve used Windows on Arm, you had to rely on alternative management methods (such as Windows Admin Center) or switch to an x64 device for certain tasks. Similarly, testing newer Arm-powered laptops for your enterprise highlighted the pressing need for RSAT support on Arm64 devices. With RSAT support, Windows 11 on Arm becomes a more viable platform for enterprise IT management. What you need to do to prep
The March 2026 security update is now available for all supported versions of Windows. We recommend that you install these updates promptly. For more information about the contents of this update, see the release notes, which are easily accessible from the Windows 11 update history page. To learn more about the different types of monthly quality updates, see Windows monthly updates explained. Highlights for the Windows 11, version 25H2 update: This security update includes improvements that were a part of update KB5077181 (released February 10, 2026). This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. This update adds high‑confidence device targeting, expanding coverage for automatic Secure Boot certificate delivery. This update improves File Explorer search reliability when searching across multiple drives or "This PC". T
Starting with the May 2026 Windows security update, Windows Autopatch is enabling hotpatch security updates by default because they are the quickest way to get secure. This change in default behavior will impact all eligible Microsoft Intune devices. Additional IT controls are coming in April. When will this happen: Devices will start receiving hotpatch updates by default with the May 2026 Windows security update. The tenant setting to opt out of hotpatch updates is scheduled to go live on April 1, 2026. How this will affect your organization: Devices that meet hotpatch prerequisites will get secure faster because full Windows security updates are applied without waiting for a restart. Devices are secured as soon as the update is installed. You don’t need to wait for devices to restart, saving on average three to five days. Devices will restart during baseline months, which are January,
Do you need to update Secure Boot certificates across your organization before they start expiring in June 2026? Two events next week can help you with best practices and answers to your questions in real time. When will this happen:On March 9 at 7:30 AM PT (2:30 PM UTC) is Secure Boot certificate updates explained. This will be a fast-paced walkthrough of essential guidance - including how to test firmware, monitor device readiness, deploy updated certificates, and diagnose issues. Then, on March 12 at 8:00 AM PT (3:00 PM UTC), you can ask any questions you might have at the Secure Boot AMA. Members of the engineering team will be on camera and in the comments working to help with answers. What you need to do to prepare:Both events will take place on the Tech Community. Registration is not required, but you will need to sign in to the Tech Community with a Microsoft account in order to
Catch up on important changes across Windows update management, Windows 365, security, and productivity with Windows news you can use for February 2026. Key announcements include general availability of the first sign‑in restore experience in Windows Backup for Organizations, new Start menu customization policies, expanded Windows 365 capabilities and regional availability, and guidance around Windows 11, version 26H1. On the security front, you’ll find a helpful list of new tools and resources to help you manage upcoming Secure Boot certificate expirations plus details on strengthened protections such as DPAPI key rotation and native Sysmon functionality in Windows. When will this happen:Some improvements summarized in this monthly recap are already available, while others are rolling out gradually. What you need to do to prepare:Read February's recap, which includes links to resources
Introduction We are introducing license-based management updates for Microsoft Teams Rooms on Android (MTRA) and other Android-based Teams devices that are synced to the Teams Rooms Pro Management Portal through Device Management (DM) services. This update aligns management portal capabilities with existing Teams Rooms license entitlements (Basic, Standard, and Pro). By enforcing license boundaries in the portal, this change provides clearer expectations for inventory visibility versus advanced monitoring and management features, while maintaining the current in-room meeting experience. These changes apply only to Android devices currently synced from DM services. Internet of Things (IoT)–based Android management convergence is still in progress and is not yet Generally Available. When this will happen General Availability (Worldwide, GCC, GCC High, DoD): Rollout will begin in early Marc