IT Leadership
Microsoft's autumn deadlines: what ends on 13 October, 19 October and 10 November
6 min read
Office LTSC 2021 and Windows 11 24H2 Home and Pro lose support on 13 October, a Secure Boot certificate expires on 19 October, and .NET 8 and PowerShell 7.4 follow on 10 November. What each date means and what to decide now.
In brief
Microsoft has three hard deadlines in the next seven weeks, and each takes a different part of the estate out of support. On 13 October Office LTSC 2021 and Office 2021 reach end of support, Windows 11 Home and Pro version 24H2 stop receiving updates, and the third year of paid updates for Windows Server 2012 ends. On 19 October the Secure Boot certificate that has signed Windows' boot components since 2011 expires. On 10 November .NET 8, PowerShell 7.4 and the Enterprise and Education editions of Windows 11 23H2 follow.
None of these dates will stop a machine from working the next morning. What they stop is security updates. Microsoft's own notices add a twist: on-premises Office cannot run Microsoft 365 Copilot, so the Office decision is also an AI decision.
The dates
| Date | What ends | What it means |
|---|---|---|
| 30 Sep | Several Azure services retire, including Azure Virtual Desktop (Classic) and Azure API for FHIR (Gen 1). Microsoft 365 E5, E7 and Copilot promotions end for cloud resellers. | Check for workloads still on the retiring services. Expect reseller quotes to change. |
| 1 Oct | Azure Anomaly Detector, Metrics Advisor and Personalizer retire. | AI features built on these services stop. |
| 13 Oct | End of support for Office LTSC 2021 (Windows and Mac), Project 2021, Visio LTSC 2021 and Skype for Business LTSC 2021. Office 2021 retires. Windows 11 Home and Pro 24H2 reach end of servicing. Year 3 of Windows Server 2012 and 2012 R2 Extended Security Updates ends. Windows Server 2022 moves to extended support. | No more security updates for the Office versions, for 24H2 Home and Pro, or for Server 2012 under the paid programme. Server 2022 keeps its security fixes but loses mainstream support. |
| 19 Oct | The Secure Boot "Windows Production PCA 2011" certificate expires. Its replacement is the Windows UEFI CA 2023. | Devices without the new certificates keep booting but stop getting early-boot security fixes. |
| 2 Nov | Pay-as-you-go billing is on by default for new Microsoft 365 Copilot Business licences bought through resellers. | Usage charges start unless someone sets the limit. |
| 10 Nov | End of servicing for Windows 11 Enterprise, Education and IoT Enterprise 23H2, .NET 8, PowerShell 7.4 and Azure IoT Edge 1.5. The in-process model for .NET apps on Azure Functions ends. | Applications and scripts on these runtimes stop receiving security fixes. |
What each date means
13 October: Office is now an AI decision. Office LTSC 2021 is the perpetual, non-subscription version many regulated and disconnected organisations chose deliberately. Microsoft's partner notice recommends Microsoft 365 E3 as the main path, with Office LTSC 2024 where cloud is not possible. It also says plainly that "Microsoft 365 Copilot is supported only on cloud-backed apps" and that "on-premises versions of Office aren't eligible". Choosing LTSC 2024 buys another perpetual cycle and rules out Copilot in those apps. Choosing Microsoft 365 opens the Copilot path and brings its new usage-based billing with it.
The same date matters to smaller organisations for a different reason. Windows 11 Home and Pro PCs still on version 24H2 stop receiving security updates. Those editions are common in small offices, shops and among staff using their own devices. For Windows Server 2012 and 2012 R2, the third year of paid Extended Security Updates ends, and Microsoft's extended-update programmes normally stop at three years. Any server still running either version after 13 October should be treated as unpatchable.
19 October: the quiet one. Secure Boot uses Microsoft certificates to check that the software loading before Windows has not been tampered with. Two of the 2011 certificates expired in June. The last, the Windows Production PCA 2011, expires on 19 October. Microsoft says devices without the 2023 replacements "will continue to start and operate normally". But they "will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager". Nothing breaks on the day, which is why this is easy to miss. Secondary guidance says Windows Server and Generation 2 virtual machines do not receive the new certificates automatically through Windows Update, so an administrator has to deploy them. Confirm that against Microsoft's guidance for your platforms.
10 November: the developers' deadline. .NET 8 and PowerShell 7.4 were long-term-support releases, which is why so many internal applications, automation scripts and build agents standardised on them. After 10 November they stop receiving security fixes. So does the in-process hosting model for .NET functions on Azure Functions, which requires moving those functions to the isolated worker model. Enterprise and Education PCs still on Windows 11 23H2 also reach the end of servicing that day.
Decisions to make now
- Decide the Office path before 13 October. For each group still on Office LTSC 2021, choose between Microsoft 365, which is cloud-backed and Copilot-eligible, and Office LTSC 2024, which is perpetual and not Copilot-eligible. The choice sets that group's AI options for years, so make it with the AI roadmap in view, not only the licence cost.
- Find every Windows 11 PC on 24H2 Home or Pro, and every 23H2 Enterprise or Education PC. Move the first group before 13 October and the second before 10 November. Small sites and unmanaged devices are where these hide.
- Check Secure Boot certificates on servers and virtual machines this week. Do not assume Windows Update has handled them. Record which devices have the 2023 certificates and plan deployment for the rest.
- Give runtime owners a date. List the applications, scripts and pipelines on .NET 8, PowerShell 7.4 or in-process Azure Functions, and book October change windows to move them to supported releases.
- Isolate what cannot move. A Windows Server 2012 machine or an Office 2021 installation that must stay beyond its date needs network isolation and a documented exception, not a quiet extension.
Sources and scope
Dates and product lists are from Microsoft's lifecycle page for 2026. The Copilot eligibility statement, the recommended upgrade paths and the reseller dates are from Microsoft's Partner Center announcements for September 2026. The Secure Boot quotations are from Microsoft Support. The point about servers and virtual machines comes from secondary guidance, 4sysops, and should be checked against Microsoft's current documentation.
The prioritisation and recommendations are ByteNib editorial analysis. ByteNib's companion piece covers Copilot's move to usage billing.
Continue exploring: IT Leadership analysis, the related implementation tutorial, and the structured learning path.