An IT roadmap for a small business is largely a list of dates set by other organisations. For 2027, Microsoft, Openreach and HMRC have already fixed many of the key deadlines. The job now is to put those dates alongside your own renewals, contracts and budget. Here is the calendar at the start of November 2026, in date order, with the decision each date needs.
The calendar for your IT roadmap
| Date | What happens | Who it affects |
| End of December 2026 | Basic authentication for SMTP AUTH is switched off by default in existing Microsoft 365 tenants; the final removal date is announced in the second half of 2027 | Anyone with a scanner, alarm panel, website form or application that sends email through Microsoft 365 with a username and password |
| 12 January 2027 | Windows Server 2016 leaves extended support; patches continue only on paid Extended Security Updates. SQL Server 2017 follows on 12 October 2027 | Any firm still running a 2016 server, on premises or hosted, or a 2017 database under its accounts or practice system |
| 31 January 2027 | Openreach withdraws analogue and ISDN phone lines as the PSTN closes | Any business still on an analogue line or an ISDN circuit, including an on-premises phone system and lines behind alarms, lifts and card terminals |
| 1 February 2027 | Microsoft 365 users whose only second factor is a text message or phone call are made to register a passkey | Staff whose only second factor is SMS or voice |
| 15 March 2027 | Public TLS certificates issued from this date last 100 days at most, down from 200 | Anyone who renews a website, VPN or firewall certificate by hand |
| 6 April 2027 | Making Tax Digital for Income Tax extends to sole traders and landlords with turnover over £30,000 | Owner-managers and directors with property or self-employed income |
| 1 July 2027 | The passkey requirement reaches global administrators and external users | Global administrators and external B2B users; other admin roles and guests created in your own tenant are in the February group |
| October 2027 | Year two of Windows 10 Extended Security Updates ends; year three costs double again | Any firm that paid to keep Windows 10 machines patched |
December 2026: the email that stops sending
Microsoft’s January 2026 update to its deprecation timeline, message centre post MC786329, says it will disable basic authentication for SMTP AUTH by default for existing tenants at the end of December 2026. Administrators can still enable it if needed. Microsoft says it will announce the final removal date in the second half of 2027.
The practical effect is simple. A printer, door entry system or accounts package that sends email using a mailbox password may stop working in late December or early January. The first sign could be a failed scan-to-email, with no obvious explanation.The fix depends on the device. Use modern authentication where supported. Where it is not, use a connector or relay, or replace the device.November is the time to find these systems. The SMTP AUTH clients report in the Exchange admin centre shows every sending address and how it authenticated. Re-enabling the setting in January buys time and nothing else.
January 2027: the server and the phone line
Windows Server 2016 support ends on 12 January 2027, on Microsoft’s published product lifecycle page. After that, the server receives no security updates unless the business pays for Extended Security Updates. Microsoft offers these for Windows Server 2016 through Azure Arc or volume licensing for up to three years, subject to eligibility. An unsupported server within the scope of a Cyber Essentials assessment will also cause a failure.
A server migration usually takes longer than anything else on this list. The people who know what runs on the old server are often busiest in December, so this should be the first call to make if it is still outstanding. SQL Server 2017, which often runs on the same server beneath accounts or practice management software, reaches end of support on 12 October 2027. In many cases, the application vendor’s upgrade path is the part that takes the most time.
The phone lines businesses forget about
Nineteen days later, on 31 January 2027, Openreach will withdraw the analogue and ISDN line products that run on the public telephone network. Its commitments to Ofcom put ISDN2 and ISDN30 on the same deadline. That means businesses using on-premises phone systems over ISDN30 also need to migrate, not just those relying on fax lines. At the end of October 2026, Openreach said around one million lines were still active, including 300,000 at business premises. Price rises on legacy lines throughout 2026, with further increases from February 2027, are intended to encourage businesses to move away from them.
Openreach has said it will not disconnect every remaining line on the day. Instead, it may move some lines onto Emergency Voice Access, a temporary service for essential calls.The service has limited capacity, does not guarantee availability and comes with a higher rental cost. Openreach will then cease the line at a later date. Broadband that shares the line has to move too, although the emergency service may keep it running where technically possible, with those migrations to follow.
The lines people forget are the ones not plugged into a phone: the alarm panel, the lift, the card machine, the fax the accountant still uses. Those need the alarm or lift company involved, so they belong in November’s diary.
February and July 2027: passkeys, in two waves
From 1 February 2027, Microsoft 365 users can no longer use SMS or voice codes as a second factor. Anyone who still relies on one of those methods will see a passkey registration prompt at sign-in and will need to complete it before continuing. Global administrators and external users get the same on 1 July 2027. The prompts have been appearing since September 2026, snoozable until the deadline, and firms that need to keep SMS have been able to configure a provider since 30 October 2026.
The work is a count and a conversation: count the users whose only method is a text message, check their devices can create a passkey, and tell them before the prompt does. Done in November it is an email and a lunchtime session; done on 1 February it is a morning of helpdesk calls.
March 2027: certificates start expiring twice as often
From 15 March 2027, the maximum lifetime of a public TLS certificate drops from 200 days to 100 days. This is the middle step in the CA/Browser Forum schedule, which will reduce certificate validity to 47 days by 2029. Certificates issued before the deadline will remain valid for their existing term. However, businesses that currently renew website, VPN or firewall certificates manually once a year will soon need to do so four times a year.The practical fix is to automate certificate renewal and have it in place before March.
April 2027: the deadline that lands on the owner
Making Tax Digital for Income Tax became mandatory in April 2026 for sole traders and landlords with turnover above £50,000. HMRC’s October 2026 notice confirms that the threshold drops to £30,000 from 6 April 2027. It will then fall to £20,000 in 2028.The rules apply to the individual. That means a company director with rental income or a side business can still be affected once that income passes the threshold, even if the company’s own accounts are already digital. The IT requirements are fairly simple: compatible software, a working login and quarterly updates from the first quarter of the 2027/28 tax year. Those updates also need to be completed on a supported machine, which is not guaranteed given the Windows 10 deadline below.
October 2027: the Windows 10 bill doubles again
Windows 10 left support in October 2025. Businesses already enrolled in Extended Security Updates have moved into year two. Microsoft’s terms state that the price doubles each year for a maximum of three years. Year two runs until 12 October 2027. Year three, if taken, will be the final year. Microsoft also extended the free or one-off consumer version for personal PCs in June 2026. That support also ends on 12 October 2027. This matters for business owners who still run tax or accounting software on a home machine.Every extra month on Windows 10 becomes a more expensive way of delaying a laptop refresh the business will eventually need anyway. Deciding whether to replace those machines before year three starts should be a first-quarter priority.
Putting the fixed dates against your own
Around those eight fixed dates sit the deadlines only your business knows about. These might include your Microsoft 365 renewal, which for many plans will reflect Microsoft’s July 2026 price increase at the next renewal. Add your Cyber Essentials anniversary, broadband contract and insurance renewal, including any security questionnaire. Two more items also belong on the same page, even though they do not yet have fixed dates. The Cyber Security and Resilience Bill is still moving through Parliament. It is expected to regulate medium and large managed service providers and could push more supply-chain responsibilities onto their clients. IASME also updates the Cyber Essentials question set each April. Put everything on one page in date order and the shape of the year becomes much clearer. For many businesses, January quickly starts to look crowded.
The Unite Group’s managed IT services include a quarterly IT meeting. In the final quarter of 2026, that meeting should focus on this list: which of the eight points apply to the business, which are already covered and which need action or an order placed before Christmas. The server, the phone lines and whatever sends your scans by email are the three.