Tomorrow is Patch Tuesday, and this one is more than a batch of fixes. Several products get their last update on the same day, three things already changed on 1 October, and a Secure Boot certificate expires six days later. Here is the month as a list, with what to check for each.

Already happened: 1 October

Exchange Web Services is off by default

Exchange Online now blocks Exchange Web Services (EWS) unless the tenant has asked for it to stay on. Microsoft’s message to admins was: “Beginning October 1, 2026, EWS will be blocked unless the tenant configures an AppID AllowList”, and without one “Microsoft will set EWSEnabled=False and EWS apps will stop working.” [1]

EWS is the old way for other programs to read mailboxes and calendars. What still uses it tends to be the things nobody has touched for years: backup tools, signature managers, CRM plugins, room booking screens.

One well-known program is on that list. heise reports that Apple Mail and Apple Calendar on the Mac use EWS for Exchange Online, that the current macOS does not yet support the replacement, and that they “may experience a complete failure” [2]. Apple has said that support will come in a later update to macOS 27, without giving a date [2]. iPhones and iPads are not affected, because they use a different protocol [2].

What to do:

  • If something stopped working for Mac users or in an integration on or after 1 October, this is the likely reason.
  • You can turn EWS back on for specific apps with an allow list, but only until 1 April 2027: “After April 1, 2027, EWS access will be permanently removed with no re-enablement.” [1]
  • The replacement is Microsoft Graph [1]. Ask each vendor when their product moves to it.
  • Exchange Server on your own hardware is not affected [1].

Publisher is gone from Microsoft 365

“Microsoft 365 subscribers will not be able to access Publisher after October 1, 2026.” [3] If someone in the organisation still has .pub files, they need a PC with a perpetual version of Publisher to open them and save them as PDF. I have written more about that in the post on Office 2021.

Teams and Copilot have new addresses

Covered in its own post: Teams and Copilot are moving to cloud.microsoft. If you have not checked your firewall and proxy rules yet, do that before the patches.

Tuesday 13 October

The last update for three products

  • Windows 11 24H2, Home and Pro [4]. Enterprise and Education continue on 24H2 until October 2027. More in the Windows post.
  • Office 2021 and Office LTSC 2021, with “no extension and no extended security updates” [5].
  • Publisher in the perpetual versions [3].

Windows 10 is not on the list. The extended security updates for home users were extended to 12 October 2027 [6].

What to check before Tuesday: an inventory. Which PCs are on Windows 11 24H2 with Home or Pro, and which have Office 2021? Those are the machines that are unpatched from November if nothing is done.

The patches themselves

Microsoft does not publish the list in advance, so nobody knows yet how many vulnerabilities are fixed tomorrow or whether any are already being exploited.

What we do know is how last month went. September was the largest Patch Tuesday Microsoft has shipped, and one of the Office updates in it broke copy and paste in Excel. I wrote about that, and about why it is worth letting a few PCs get the updates first, in September 2026 Patch Tuesday broke Excel. The same advice holds tomorrow: a pilot group first, the rest a few days later.

Monday 19 October: a Secure Boot certificate expires

The certificate that Windows’ boot loader has been signed with since 2011, “Microsoft Windows Production PCA 2011”, expires on 19 October 2026. Its replacement is “Windows UEFI CA 2023” [7]. Two related certificates expired in June [7].

A PC that has not received the new certificates still starts and still gets ordinary Windows updates. What it loses is described by Microsoft: such devices “will no longer be able to receive new security protections for the early boot process” [7].

Most PCs that have been updated regularly have the new certificates already. The ones to check are those that have been switched off for a long time, virtual machines, and anything with unusual firmware.

The checklist

  1. Exchange Online: anything broken since 1 October? Check EWS, and plan for 1 April 2027.
  2. Publisher files: convert them while a working Publisher exists.
  3. *.cloud.microsoft: allowed in firewall and proxy.
  4. Inventory: Windows 11 24H2 Home/Pro and Office 2021.
  5. Patch Tuesday: pilot group first.
  6. Secure Boot: PCs that have been off for months.

Sources

  1. MC1227454: Exchange Web Services (EWS) retirement update (Microsoft 365 message center, via mc.merill.net), pulled 2026-10-04, rechecked 2026-10-11
  2. Exchange Web Services shutting down: Apple Mail is not yet ready (heise online), pulled 2026-10-04, rechecked 2026-10-11
  3. Microsoft Publisher will no longer be supported after October 2026 (Microsoft Support), pulled 2026-10-04
  4. Windows 11 Home and Pro lifecycle (Microsoft Learn), pulled 2026-10-04
  5. End of support for Office 2021 (Microsoft Support), pulled 2026-10-04
  6. Windows 10 Consumer Extended Security Updates (ESU) program (Microsoft), pulled 2026-10-04
  7. Windows Secure Boot certificate expiration and CA updates (Microsoft Support), pulled 2026-10-04, rechecked 2026-10-11