For Windows devices in Egypt, a workaround is available for an issue affecting Daylight Saving Time (DST). Between April 24 and April 30, 2026, calendar events and meeting times in Egypt will appear off by one hour only for Windows Server 2016. This is due to a calendar edge case: a five-week April in 2026. Clocks will be correctly set to Egypt DST time zone on May 1, 2026, without any further intervention. If needed, a temporary workaround is available for the affected week. When will this happen:The workaround is available today. April 24-30, 2026: Affected devices might see calendar events off by an hour. May 1, 2026: Clocks will be correctly set to Egypt DST time zone without any further intervention, whether you use the workaround or not. How this will affect your organization:If your organization has devices affected by this issue and you don’t apply the workaround, the impact is a
Microsoft 365 apps · Microsoft Copilot (Microsoft 365) · Microsoft 365 Copilot Chat
[Introduction] We’re updating how users access Copilot in Excel to provide a clearer, more consistent, and more intuitive experience across Microsoft 365 apps. These changes consolidate multiple Copilot entry points into a single, predictable location and establish Excel Edit Mode in the right-side chat pane as the primary Copilot interface. This update improves discoverability, simplifies user workflows, and aligns the Excel Copilot experience with other Microsoft 365 applications. [When this will happen:] General Availability (Worldwide): Rollout begins in late April 2026 and is expected to complete by early June 2026. General Availability (GCC, GCC High, and DoD): Rollout begins in early October 2026 and is expected to complete by late October 2026. [How this affects your organization:] Who is affected: All users of Microsoft 365 apps for Excel on Windows, macOS, and the web with Copi
Introduction Beginning January 30, 2026, Microsoft Entra ID Governance will require all tenants to have a linked Azure subscription to continue using Identity Governance features for guest users. This change ensures accurate billing for governance actions performed by guests and supports continued access to advanced governance capabilities. When this will happen: General availability and enforcement begin on January 30, 2026. How this will affect your organization: Who is affected: Organizations using Microsoft Entra ID Governance features for guest users (userType = Guest). Admins managing lifecycle workflows or Entra ID Governance features in entitlement management for external or guest identities. Access reviews will be included by March 31, 2026. What will happen: If your tenant does not have a linked Azure subscription, creation or updates of policies scoped to guest users using pre
IMPORTANT: This notice only affects environments where Scan Cab is used to check for update compliance. The April 2026 Scan Cab was made available at 4:30 PM PT today, April 14, 2026. The Scan Cab can help determine whether a Windows device needs to install necessary security updates released by Microsoft without first connecting to the Windows Update service. How this affects your organization:The Wsusscn2.cab file is a cabinet file that is signed by Microsoft and contains information about Microsoft security-related updates. Devices that aren't connected to the Internet can be scanned to see whether these security-related updates are present or required. The Wsusscn2.cab file doesn't contain the security updates themselves so you must obtain and install any needed security-related updates through other means. What you need to do to prepare:You can download and deploy the April 2026 Sca
Starting with the April 2026 Windows security update, Remote Desktop adds new safeguards to help reduce phishing attacks that misuse Remote Desktop (.rdp) files. These attacks attempt to trick devices into connecting to attacker‑controlled systems and sharing local resources without clear visibility. To address this, a new security dialog appears before any connection is made, showing the remote computer address, publisher information (when available), and any requested access to local resources. All requested settings are disabled by default and must be explicitly enabled. A one‑time security warning also appears the first time an RDP file is opened. When will this happen:This change takes effect with the April 2026 Windows security update. How this will affect your organization:Devices that open Remote Desktop (.rdp) files will see a new security dialog before a connection is establish
Note: This notice only affects environments where Scan Cab is used to check for Microsoft update compliance. The Scan Cab for the April 2026 Microsoft security updates is currently delayed and has not yet been released. We will communicate an update on Scan Cab availability as more information becomes available. Thank you for your patience. How this affects your organization: IT administrators who rely on Scan Cab to check for update compliance can track our communications. Progress on the availability of this month's Scan Cab will be communicated when new information is available. Additional information: Learn more about the Scan Cab process: Announcing a smaller WSUS Scan Cab Use Windows Update Agent (WUA) to scan computers for security updates without connecting to Windows Update: Using WUA to Scan for Updates Offline - Win32 apps Documentation on the Catalog Site used to import updat
Windows updates released April 2026 and later begin the second deployment phase of protections for a Kerberos information disclosure vulnerability (CVE‑2026‑20833). In this phase, domain controllers change default Kerberos ticket behavior for accounts that do not have an explicit Kerberos encryption configuration, shifting to AES‑SHA1-only by default. Environments with remaining RC4 dependencies may experience authentication issues unless those dependencies are remediated or explicitly configured. When this will happen:April 2026 - Enforcement Phase with manual rollback: With installation of the April 2026 Windows security update, default Kerberos behavior changes so domain controllers use AES‑SHA1-only encryption for accounts without explicit encryption type settings, and Enforcement mode is enabled by default on Windows domain controllers. Audit mode remains available as a manual rollb
The April 2026 security update is now available for all supported versions of Windows. We recommend that you install these updates promptly. For more information about the contents of this update, see the release notes, which are easily accessible from the Windows 11 update history page. To learn more about the different types of monthly quality updates, see Windows monthly updates explained. Highlights for the Windows 11, version 25H2 update: This security update includes fixes and quality improvements from KB5079391 (released March 26, 2026 - no longer offered) and KB5086672 (released March 31, 2026). This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. This update expands high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Devices receive th
Next month, Windows Autopatch will become more broadly available in Government Community Cloud (GCC). Previously, Windows Autopatch was not automatically available for Microsoft 365 G3 and G5 SKUs in GCC. It required the $0 Windows Enterprise (OLS) activation SKU. Now, the OLS SKU is no longer needed. Windows Autopatch is included automatically with:Microsoft 365 G3 GCC Microsoft 365 GCC G5 Microsoft 365 GCC G5 without WDATP/CAS Unified When will this happen:Expected date of launch: May 13, 2026 How this will affect your organization:If you don't use the $0 Windows Enterprise (OLS) activation SKU, you’ll see new Windows Autopatch features in Microsoft Intune next month. These features include update policies for feature, quality, and driver updates, plus enhanced reporting. What you need to do to prepare:No action is needed. New capabilities will be available automatically in Microsoft I
As previously communicated, support for Office LTSC 2021 will end on October 13, 2026. After that date, no further updates, security fixes, or technical support will be available for this version of Office. While the applications may continue to function, using unsupported software could lead to potential security risks, compliance risks, system incompatibilities, and other issues. Support for Visio LTSC 2021 and Microsoft Project LTSC 2021 and several other products will also end on October 13, 2026. Organizations using these products should upgrade as soon as possible to maintain security, compliance, and performance. [How this will affect your organization:] After end of support, Office LTSC 2021 suites and standalones will no longer receive security updates or other fixes, and no technical assistance will be available for devices still running them. Continuing to use unsupported soft
As announced in January 2026, the unattend.xml file used in hands‑free deployment poses a vulnerability when transmitted over an unauthenticated RPC channel. Beginning with the April 2026 security update, the second phase of hardening for CVE-2026-0386 is now in effect. These changes make hands‑free deployment disabled by default to enforce secure behavior. After this update, hands‑free deployment no longer works unless explicitly overridden with registry settings. When will this happen:Starting with the April 2026 security update, Windows Deployment Services (WDS) enforces secure‑by‑default behavior by automatically disabling hands‑free deployment. How this will affect your organization:After installing the April 2026 security update, hands‑free deployment is blocked to prevent unauthenticated access to unattend.xml, enforcing the hardening requirements for CVE-2026-0386. Any workflows
Administrative actions are undergoing hardening changes that might require operational change to support your organization’s security posture. With the August 2025 Windows non-security update, devices were hardened against unauthorized attempts to bypass loopback detection. However, if you’ve cloned machines without Sysprep, you might see Kerberos and NTLM authentication failures. This is by design. The recommended solution is to rebuild affected devices using supported imaging methods. A temporary workaround is also available. When will this happen:September 2025 and later: Windows security updates include hardening changes that strengthen the trust boundary between identity, authentication, and User Account Control (UAC). April 2026 and later: Windows security updates include a temporary workaround for machines cloned without Sysprep. This registry-based compatibility option isn’t reco