Three Microsoft Changes That Will Affect Your Inbox, Laptops, and Logins This Fall

Exchange Web Services: The Old Way to Access Your Mailbox

Exchange Web Services, or EWS for short, is how older software accesses your Exchange Online mailbox. Examples include a CRM integration, a backup tool, or a scanner that sends data to your mailbox. Since October 1, Microsoft has been phasing out EWS on a tenant-by-tenant basis for organizations that haven’t configured it themselves. It will be permanently shut down in April 2027.

If you have Exchange on your own server, nothing will change. This applies to Microsoft 365.

What to do this month: Have your administrator review the EWS usage report in Microsoft 365. Ask each vendor on that list whether they use Microsoft Graph and when they plan to switch. If a connection unexpectedly stops working this month, first check whether it was using EWS.

Windows 10: The Laptop Nobody Counts

Starting October 14, 2025, Windows 10 will no longer receive free security updates. Organizations can pay for Extended Security Updates on a per-device, per-year basis, or switch to Windows 11.

Your administrator knows which laptops are in the office. The gap lies in the work-from-home laptop that never comes into the office, the PC at the front desk, and the device next to the printer that only scans.

Here’s what you’ll do this month: count them. For each device, note the Windows version, the user, and whether it still receives updates. Using that list, you’ll decide whether to continue paying for it or replace it—and that’s a budget decision.

The SMS code and the passkey

Microsoft will stop sending SMS and call codes for sign-in itself. For most users, this will take effect on February 1, 2027. Global Administrators and external users will follow on July 1, 2027. Internal guests will follow the February date.

If your second step is only a text message or phone call, you must first register a passkey when logging in. Do not dismiss that notification. Since September 1, passkeys have been enabled by default for users who use text messages or voice calls.

You can still use text messages by linking your own mobile carrier through the Microsoft Security Store. For most organizations, the passkey is the quicker option, and it’s free.

What to do this month: Make a list of colleagues who only use text messaging. They’ll run into problems on February 1. After the Microsoft login, their other passwords will still be valid; the next blog post will cover that.

The grant that is still in effect

No change from Microsoft, but the date is in the same months: My Cyber-Resilient Business runs through November 30, 2026, at 5:00 p.m. Funding is allocated on a first-come, first-served basis.

The order is set. First, complete the NCSC’s CyberVeilig Check and download your action list. Then, purchase a solution from that list and keep your invoice and proof of payment. Only then should you submit your application to RVO. Anything you purchased or paid for before September 7 does not count.

One thing you can do in ten minutes

Find out who will be locked out on February 1. The Tenant Check requires an administrator account and does not include PIM-eligible administrators. However, in two minutes, it shows which users have only SMS or phone as their second step, in addition to your MFA coverage and your administrator accounts. It does not store any data from your tenant.

How ALTA-ICT helps

For our customers, we compile these dates into a single overview, with an assigned owner and an action for each date. We retrieve the EWS report and the list of SMS users ourselves. We perform the Windows 10 count using Device Manager. If you’d like to switch providers, please read the blog post about switching first. To learn more about what’s in your tenant, read the blog post about the inner workings of Microsoft 365. We operate in accordance with ISO 27001:2023, ISO 9001:2015, and NEN 7510:2024.

Frequently Asked Questions

How do I know what software EWS uses?

Microsoft 365 includes an EWS usage report. Your administrator can use it to see which applications are still accessing your mailbox via EWS. That’s your list of vendors.

Should I replace my Windows 10 laptops right away?

No. You can pay for Extended Security Updates on a per-device basis. But do the math first, so you’ll know how much it will cost to continue paying for them in addition to the replacement cost.

What is a passkey?

A key that your device stores and that you unlock with your fingerprint, face, or PIN. The key is specific to a single website, so a fake site can’t access it.

Does the February deadline also apply to administrators?

No. Global Administrators and external users will follow the July 1, 2027, deadline. Internal guests, however, will follow the February deadline.

If I could do only one thing, what should I do first?

The EWS report. That date has already passed, and you don’t notice a seized clutch until something stops working.

Conclusion

Three Microsoft changes and one grant deadline, all falling within the same months as your budget. Old email links are being shut down, keeping Windows 10 up to date costs money, and the SMS code has an expiration date. None of these are major projects, as long as someone takes care of them this month.

Would you like to go over the dates in a single meeting, with a designated person responsible for each date? Schedule a meeting with ALTA-ICT in October.