Microsoft 365

October 2026 for Microsoft admins: what changed on the 1st, and what ends on Patch Tuesday

Tomorrow is Patch Tuesday, and this one is more than a batch of fixes. Several products get their last update on the same day, three things already changed on 1 October, and a Secure Boot certificate expires six days later. Here is the month as a list, with what to check for each.

Already happened: 1 October

Exchange Web Services is off by default

Exchange Online now blocks Exchange Web Services (EWS) unless the tenant has asked for it to stay on. Microsoft’s message to admins was: “Beginning October 1, 2026, EWS will be blocked unless the tenant configures an AppID AllowList”, and without one “Microsoft will set EWSEnabled=False and EWS apps will stop working.” [1]

Office 2021 support ends on 13 October: what are your options?

On Tuesday 13 October 2026, Office 2021 gets its last update. That goes for the version you bought in a shop and for Office LTSC 2021, the version organisations buy through volume licensing [1] [2]. Microsoft leaves no opening: “there will be no extension and no extended security updates” [1].

What end of support means

Word and Excel will start on 14 October exactly as they did the day before. “All of your Office 2021 apps may continue to function. However, you could expose yourself to serious and potentially harmful security risks.” [1]

Teams and Copilot are moving to cloud.microsoft: check your allow-lists before October

Two of the most used Microsoft 365 web addresses are changing this autumn. Copilot is moving to copilot.cloud.microsoft and Teams on the web to teams.cloud.microsoft. If something in your network blocks *.cloud.microsoft, October is when your users find out.

What’s changing

Copilot: m365.cloud.microsoft becomes copilot.cloud.microsoft

In message center post MC1462915 Microsoft says it started redirecting users from m365.cloud.microsoft to copilot.cloud.microsoft in early September, in organisations where the new address is reachable. Everyone else gets redirected in early October [1]. If the address is blocked, the redirect happens anyway, and “affected users may be unable to use Copilot in the web app, desktop app, and Microsoft Edge experience” [1].