IT & AI brief, 2 November 2026: Windows Server 2022 hotpatch restarts and Entra passkey changes

Windows Server 2022 machines enrolled in hotpatch will need a restart for both the November and December 2026 security updates. Microsoft also refreshed its Entra passkey notices and announced per-meeting Conditional Access for Teams, while two deadlines land this week.

Windows Server 2022 hotpatch: restarts needed in November and December

What changed: In MC1527979, Microsoft says the November and December 2026 security updates for Windows Server 2022 ship as standard updates instead of hotpatches, because some fixes touch components that cannot be patched without a restart. January 2027 is planned as a baseline month, and the next hotpatch is expected in February 2027.

Who is affected: Hotpatch-enabled Windows Server 2022 devices. They stay enrolled in hotpatch. Windows Server 2025 and Windows 11 hotpatch devices are not affected, and non-hotpatch servers already restart.

What to do: Schedule maintenance windows for restarts when you deploy the November and December updates. No configuration change is needed to stay enrolled. See our guide on update rings and hotpatch.

Entra passkeys on Windows: new dates for sovereign clouds

What changed: MC1282568 was updated on 30 October. Users can create device-bound passkeys in the Windows Hello container and sign in to Entra resources with face, fingerprint or PIN. Admins no longer have to allow the Windows Hello AAGUIDs explicitly, so profiles that allow device-bound, non-attested passkeys let users register them by default. Attestation is not supported yet. Rollout for GCC High and DoD now starts in early February 2027, and air-gapped clouds follow in May 2027.

Who is affected: Tenants with passkeys enabled in the Authentication Methods policy, including users on personal or shared PCs where Conditional Access permits it.

What to do: Most tenants need no action. If you do not want Windows passkeys, add the Windows Hello AAGUIDs to the block list in the relevant passkey profile, and review profiles that allow non-attested device-bound passkeys. Guide: /blog/passkeys-entra-id-deployment-guide.

Entra passkey profiles: migration defaults and revised timelines

What changed: MC1221452, also updated on 30 October, covers passkey profiles and synced passkeys. Tenants that do not opt in are moved automatically into a Default passkey profile, with the passkey type derived from the current attestation setting: device-bound only if attestation is enforced, otherwise device-bound and synced. Dates for GCC High, DoD, USNat and USSec moved into 2027.

Who is affected: Tenants that already have passkeys (FIDO2) enabled. The notice also describes a registration campaign change, but a related post says that part was later not moved forward, so check it before planning.

What to do: If you want different settings, opt in to passkey profiles before your automatic window and set the passkey type on the Default profile. Update help desk material to match.

Teams: Conditional Access for individual meetings

What changed: MC1532256 announces granular Conditional Access for Teams meetings. Organizers can require checks such as MFA, device compliance or location for a specific meeting, and participants must satisfy the policy before joining. Public preview begins in late November 2026 and general availability in early January 2027.

Who is affected: Admins who manage Entra Conditional Access and Teams meeting policies, plus organizers and participants on desktop, web and mobile.

What to do: Create the authentication contexts and their Conditional Access policies in Entra, publish them to Teams, then enable meeting authentication requirements in Teams meeting policies. Background: /blog/conditional-access-require-compliant-device.

Deadlines this week: Ivanti today, MemberOf tomorrow

What changed: Nothing new, but two dates arrive. The CISA KEV catalog gives CVE-2026-111357 in Ivanti Connect Secure a due date of 2 November, and a second Ivanti flaw, CVE-2026-118527, is due 13 November. Entra's MemberOf rule operator reminder, MC1529463, lists 3 November.

Who is affected: Anyone running Ivanti Connect Secure, and tenants with dynamic groups that still use MemberOf.

What to do: Patch Ivanti appliances and review logs for unexpected admin activity. Replace MemberOf rules before the deadline, as covered in our 29 October brief.

Also worth knowing

• Gemini in Google Slides can now restyle or condense a whole deck from one prompt.
• Gemini app users can create, preview and edit documents, slides, sheets and code inside a chat.
• Google Sheets adds a compact layout for multi-level pivot tables.