Microsoft moved the Entra Connect deadline: by April 7, 2027, every Connect Sync server must be on 2.6.84.0 or later with application-based authentication, or sync stops. What to do

Free for higher ed IT · no email required

Will Your Identity Scripts Break?

The Microsoft Deadline Check for Higher Ed. 16 questions, about 5 minutes. Get your next break date and a plan.

79 days Next on the calendar: End of December 2026: SMTP AUTH Basic Auth off by default
Start the check

The Microsoft Deadline Calendar

Microsoft published every one of these dates in advance. The gap is ownership, not the vendor.

  1. Already passed2025
    MSOnline (May 2025) and AzureAD (from mid-October 2025) PowerShell modules retired; cmdlets stopped working. Legacy Azure AD Graph API retired.
    Who it hits: Any script using Connect-MsolService, Get-MsolUser, Connect-AzureAD, Get-AzureADUser, or calling graph.windows.net
    Source: Microsoft Learn: Azure AD PowerShell migration FAQ (MSOnline retired May 30, 2025)
  2. ChangedSept 30, 2026
    Microsoft moved the Entra Connect Sync deadline from Sept 30, 2026 to April 7, 2027, and raised the minimum from 2.5.79.0 to 2.6.84.0 (Sept 29 on its security hardening page, Oct 1 on the hardening page). Sync did not stop on Sept 30.
    Who it hits: Every campus syncing on-prem AD to Entra with Connect Sync below 2.6.84.0
    Source: Microsoft Learn: Hardening updates for Microsoft Entra Connect Sync (changed Sept 30 and Oct 1, 2026)
  3. Live nowSept 30, 2026
    Microsoft's recommended date for Entra Connect Health agents 4.5.2466.0 or higher. Below that, a subset of alerts is impacted, including the alert that reports password hash sync has stopped
    Who it hits: Same population
    Source: Microsoft Learn: Entra Connect security updates
  4. Live nowFrom Oct 6, 2026
    Microsoft switches off the last Azure AD Graph access for old Azure CLI and Azure PowerShell releases over about two months; they may stop working at any point
    Who it hits: Automation pinned to an old Azure CLI or Az PowerShell version
    Source: Microsoft Azure Tools blog: Azure AD Graph API retirement, action required for older Azure CLI and Azure PowerShell (Oct 5, 2026)
  5. NextOct 23, 2026
    Entra Connect 2.5.79.0 retires (it met the old deadline, but it is below Microsoft's new 2.6.84.0 minimum)
    Who it hits: Campuses that upgraded to 2.5.79.0 for the old Sept 30 deadline
    Source: Microsoft Learn: Entra Connect version release history
  6. RollingOngoing
    Every Entra Connect 2.x version retires 12 months after a newer version ships (policy since March 15, 2023)
    Who it hits: Everyone on Connect Sync
    Source: Microsoft Learn: Entra Connect version release history
  7. NextEnd of Dec 2026
    SMTP AUTH Basic Authentication disabled by default for existing Exchange Online tenants (admins can re-enable for now)
    Who it hits: Scripts that email new-account notices via smtp.office365.com with a stored username and password
    Source: Microsoft Exchange Team blog: Updated SMTP AUTH Basic Authentication deprecation timeline (Jan 27, 2026)
  8. NextApr 7, 2027
    Entra Connect Sync must be on 2.6.84.0 or later with application-based authentication, or all synchronization fails until you upgrade. Upgrading alone doesn't switch an existing server; run the wizard.
    Who it hits: Every campus on Connect Sync, including those that stopped at 2.5.x
    Source: Microsoft Learn: Hardening updates for Microsoft Entra Connect Sync
  9. AnnouncedH2 2027
    Microsoft announces the final removal date for SMTP AUTH Basic Auth
    Who it hits: Same
    Source: Microsoft Exchange Team blog: Updated SMTP AUTH Basic Authentication deprecation timeline (Jan 27, 2026)
  10. StructuralStarted April 2026, no end date
    Microsoft's Entra Connect Sync to Entra Cloud Sync transition ("plan for change"). No retirement date for Connect Sync yet. Cloud Sync lacks some Connect features (e.g., advanced sync rules, groups over 50,000 members, device writeback).
    Who it hits: Campuses with custom sync rules
    Source: Microsoft Learn: What's new in Microsoft Entra (April 2026)

Errors and deadlines: fix them now

Questions

Is this check really free and anonymous?
Yes. Your answers are scored in your browser and are never sent. QuickLaunch receives your email only if you ask for the report or join the waitlist.
Is QuickLaunch replacing Microsoft Entra?
No. We complete it. Most of our customers run Entra. We handle what campus scripts were doing: SIS-driven account creation, OU placement, groups and deprovisioning, governed and monitored.
Microsoft announced these dates years ago. Why are campuses still getting caught?
Deprecation notices go to people. Scripts don't read email. If the person who wrote a script has left, the notice reaches nobody.
Do we have to replace every script?
No. Migrate the load-bearing flows (provisioning, deprovisioning, directory sync). Keep small, well-understood scripts, with an owner, a vault and logging.
What should we do first?
Check your Entra Connect version today. Then search your scripts for Msol, AzureAD, graph.windows.net and smtp.office365.com.
Request a Demo