Three Microsoft 365 Things Switch Off Before New Year. Which Ones Touch Your Company?

Three separate Microsoft retirements share one calendar window: from now until December 31. None of them comes with a pop-up for your staff, and none of them is big enough to make the news outside admin circles. That is the problem. When a shared mailbox in the warehouse stops syncing, or a certain employee's phone stops receiving email on January 2, nobody connects it to a notice Microsoft posted in May.

This article sorts the three changes by one question: does it touch a company like yours? For most owners the honest answer is "one of them, maybe". Your Microsoft 365 support partner can settle that in an afternoon. If you do not have one, the checks below take about ten minutes each.

Quick answers

Do all three changes hit every company? No. The companion apps only matter if they are installed on Windows 11 PCs. The encryption change only matters if something connects with the old POP or IMAP mail protocols. The certificate change only matters if phones use a certificate to sign in to email.

What is the earliest date? December 16, 2026 for the companion apps. The mail encryption change is already rolling out gradually, so an old device could fail before the end-of-year date.

Will Microsoft warn my staff? Not in a way they will notice. The notices go to tenant administrators in the Microsoft 365 message center, so whoever holds the admin role has to read them.

Is any of this an emergency? No. Each one is a small fix if found early and an annoying outage if found after the deadline.

The three changes side by side

The table shows what stops, when, and who has to look. Dates come from Microsoft's own announcements as reported below; where Microsoft gives only "by end of 2026", we say so.

Are the companion apps worth worrying about?

Probably not, but they are the one with a hard date. The companion apps are small Calendar, People and Files windows that sit on the Windows 11 taskbar. According to BleepingComputer's report on Microsoft's announcement, they stop working and lose support on December 16, 2026, and Microsoft advises administrators to remove them from devices before then.

They launch at startup by default, which is why some people have them without ever choosing them. After the date they will sit there, broken. The cost is not money, it is a support call: "a window pops up when I log in and shows an error". Removing them through Intune takes one policy. On PCs that nobody manages, each person can uninstall them from Settings.

What replaces them is the normal Outlook calendar, Outlook contacts and OneDrive. If someone loved the taskbar calendar, tell them now rather than on December 17.

Does anything in your office still use POP or IMAP?

POP and IMAP are two old ways for a program to fetch email. Modern Outlook does not use them for Microsoft 365. Older things do: a scanner that mails PDFs to a folder mailbox, a small accounting tool that reads invoices from an inbox, a mail archive connector, an old Thunderbird profile on a back-office PC.

Microsoft's message center entry MC1293480 states that POP3 and IMAP4 connections to Exchange Online must use TLS 1.2 or later. The rollout runs gradually from August 1 to December 31, 2026, so a device that speaks only the older versions can fail at any point in that window, not on the last day. Microsoft notes that modern email clients are not expected to be affected.

A related and separate retirement concerns devices that send mail with a stored password. If a copier or an application does that, read our earlier post on the SMTP basic authentication retirement as well, because the fixes often get done in the same visit.

The practical test is a list. Ask three people: who owns the scanners, who owns the accounting and CRM tools, and who set up the shared mailboxes. Anything that reads or sends mail on its own goes on the list, with the vendor's name and model.

Do your phones sign in with a certificate?

Most small companies do not, and can skip this section. Certificate sign-in for phone email is typically used where a company wants a phone to prove itself without a password, often in regulated sectors or where a mobile device management product hands out certificates. Microsoft announced that connecting a certificate directly to Exchange Online through Exchange ActiveSync will be retired by the end of 2026. The replacement is that the phone shows its certificate to Microsoft Entra ID, which then issues the access token for mail, as Petri's summary of the announcement explains.

Petri notes that the published sources do not always give an exact day, so treat "December 31" as the latest safe assumption and plan to be done in early December. If your phones are enrolled in Intune with Microsoft-managed profiles, the change is usually small. If a third-party management product delivers the certificates, ask that vendor today whether its profile supports the Entra route. Their answer is the slow step.

The signal that you are affected: phones that get email without ever asking for a password and that are not set up with the standard Outlook app. If nobody can name such a setup, you are almost certainly fine. A look at the sign-in logs in Entra confirms it, and a Microsoft 365 security assessment includes that check.

A ten-minute triage, split by who does it

The owner or manager: asks the office manager for a list of scanners and business tools that send or fetch email, and asks the person with admin rights whether anyone reads the message center. If nobody does, name someone. This is the single most useful fix, because it also covers the next retirement.

The office manager: checks Windows 11 PCs for the three taskbar apps, and notes the make and model of every scanner and copier.

The administrator or provider: removes the companion apps with a device policy, checks the Exchange Online logs for POP and IMAP sign-ins, and checks Entra sign-in logs for certificate-based mobile sign-ins. Both log checks take minutes, and an empty result is a clean answer. A provider running managed cloud operations for you does this as routine monitoring, not as a project.

Write the result on one page: item, owner, status, date checked. That page is also what an auditor or an insurer asks for when they want to see that you track vendor changes.

What if you find something you cannot fix by the deadline?

Then you have a choice between replacing the device and keeping it alive in a way that does not involve Microsoft 365 mail. A scanner that only supports old encryption can often be set to send to a small relay instead, or replaced; a business-priced replacement scanner usually costs less than a day of the staff time lost to the outage. A custom program from a vendor that has disappeared is harder: put a date on its replacement and write down the risk.

What not to do is switch security settings off tenant-wide to bring an old device back. That trades a one-device problem for a company-wide one. Companies that keep a clear governance routine for exceptions, with an owner and an end date for each, avoid that trap.

What does it cost to find out after the deadline?

In the tenants we look after, the pattern is the same each time: nothing fails dramatically, a single thing stops, and it takes a day or two to trace because nobody remembers that the scanner was set up four years ago by a technician who has since left. The cost is staff time and a delayed invoice run, not a breach. It is the kind of loss that never appears in a budget line, which is exactly why a ten-minute check beats it.

The second cost is attention. If your administrator spends the first week of January chasing three unrelated mail problems, the security work that was planned for that week slips. Clearing these items in November and early December keeps the holidays quiet and the new year starting on plan. Put the review date in the calendar now, and make December 9 the internal deadline so the week before Microsoft's own date is a buffer.