Why your Microsoft knowledge ages faster than your licences
Stefan Dingemanse
15 September 2026 | 7 min read

Why your Microsoft knowledge ages faster than your licences

You renew your Microsoft 365 licences every year, often without giving it much thought. The knowledge of your IT team does not renew itself. Yet the environment that knowledge is about changes faster than many organisations keep up with. What was the right configuration two years ago may today be outdated, less secure or no longer available at all.

Current Microsoft knowledge is therefore not a luxury, but a security issue.

As of 15 September 2026. This article is not legal advice.

Microsoft 365 never stands still

Microsoft 365, Intune and Entra ID are cloud services. Microsoft continuously adds features, adjusts default settings, renames components and retires old ones. That is why the Microsoft 365 admin center has the Message center, with announcements in categories such as Plan for change: changes that require action from you as an administrator. Microsoft also publishes the AI at Work Roadmap, formerly the Microsoft 365 Roadmap, with features that are in development, rolling out or already available.

A few examples from recent years show how significant these changes can be:

  • Azure AD is now Microsoft Entra ID. Portals, documentation and feature names now use the new name.
  • You manage authentication methods in one place. Since 30 September 2025, you can no longer manage methods in the legacy MFA and SSPR settings. This is now done through the Authentication methods policy in Entra ID.
  • SMS and voice are disappearing as a Microsoft MFA method. Since 1 September 2026, passkeys have been the default sign-in experience. From 1 February 2027, Microsoft itself no longer provides SMS and voice calls for MFA. For Global Administrators and external users, this happens on 1 July 2027.
  • Old PowerShell modules have been phased out. The Azure AD, Azure AD Preview and MSOnline modules are deprecated. Microsoft Graph PowerShell is the successor, and existing scripts do not automatically work with the new module.
  • Security baselines in Intune receive new versions. Existing profiles are not updated automatically. The settings in them become read-only until you move the profile to the new version.

Microsoft announces and documents these kinds of changes in advance. But someone in your organisation still has to notice them, understand them and translate them to your own environment.

Outdated knowledge is a security risk

Knowledge ages without a notification. An administrator who learned Conditional Access thoroughly a few years ago often still works with the same picture of how it works.

In practice we see two consequences:

  • Misconfiguration. Settings are looked for in a place that no longer exists, or configured in a way Microsoft now advises differently. Scripts run on modules that are no longer supported. New security options go unused, because nobody knows they exist.
  • A false sense of security. “We have MFA” sounds reassuring. But if users sign in with SMS, they are using a method that Microsoft itself considers weaker than passkeys. And “we use the security baseline” says little if the profile is a version from years ago.

The difficult part is that neither consequence is visible from the outside. The environment works, users can sign in and nobody complains. Only during an incident, an audit or a migration does it become clear that the configuration no longer matches how Microsoft now intends the product to be used.

Microsoft certifications expire for a reason

Microsoft applies the same principle to its own certifications. Role-based certifications at associate and expert level and specialty certifications, such as Azure Virtual Desktop Specialty (exam AZ-140), are valid for one year. Microsoft itself gives the reason: it helps professionals keep their skills up to date with technology that keeps changing.

Renewal works like this:

  • From six months before the expiry date, you can take a free online renewal assessment on Microsoft Learn.
  • The assessment is shorter than the original exam, focuses on recent changes and is open book.
  • If you pass, the certification is extended by one year, counted from the expiry date.
  • If the certification does expire, you have to pass the exam again.

Fundamentals certifications, such as AZ-900 Azure Fundamentals, do not expire. That is convenient, but it also means that a Fundamentals certificate from a few years back says little about today’s knowledge.

For an IT team, this annual renewal is a simple and free moment to consider what has changed. Plan it as a fixed part of the year.

The Cyber Security Act asks the same of the board

The Dutch Cyber Security Act (Cyberbeveiligingswet, Cbw) has applied since 15 August 2026. Article 24 of the Cyber Security Act places responsibility for cyber security with the board. Board members must keep the knowledge this requires demonstrably up to date. You can read more about this in our article on the Cyber Security Act.

So the legislator also assumes that cyber security knowledge ages, and that a single training course is not enough. In addition, article 21 lists cyber hygiene and cyber security training as a topic the measures must cover at a minimum.

A board that keeps its own knowledge current will also ask the IT team different questions. Does our configuration still match what Microsoft advises today? Who follows the changes? When was our knowledge last tested? An IT team that is up to date itself can answer those questions.

How to keep your team’s knowledge current

Current knowledge does not happen by itself. It helps to turn it into a fixed rhythm:

  1. Structured training. Decide per administrator which topics need attention in the coming year, for example identity, endpoint management or Azure Virtual Desktop. A training course with official courseware gives a complete picture, instead of fragments of knowledge from blogs and forums.
  2. Certification and renewal. Use certifications as a checkpoint and put the renewal date of each certification in the planning. This also gives you demonstrable insight into the knowledge level of your team.
  3. Knowledge transfer after projects. An environment is only truly delivered when your own team understands what was built and why. Record the choices that were made and walk through the configuration together before the external party leaves.
  4. Following the Message center and roadmap. Assign an owner per service who reads the messages and assesses what they mean for your environment. You can sync Message center posts with Microsoft Planner, so actions do not get left behind.
  5. Hands-on in a test tenant. Try new features and changed defaults first in a test tenant or with a small group of users. This way your team learns how things now work without risk to the production environment.

How we help

Knowledge transfer is part of every engagement: we walk through the configuration with your team, so they can manage the environment themselves afterwards. We also deliver tailored workshops on topics such as Conditional Access, Intune and Windows 365, always based on your own environment.

For those who want to get certified, we deliver official Microsoft training with Microsoft courseware:

Founder Stefan Dingemanse has been a Microsoft MVP for seven years, in both Security (Intune) and Windows and Devices (Windows 365), and is a Microsoft Certified Trainer. He works as an Identity & Endpoint Security Architect in the Microsoft ecosystem. As a result, the material connects to what your team encounters in day-to-day administration.

You can read more about the options on the Training and knowledge transfer page. Tell us what your team needs and we will make a proposal.

Request a training

Sources

Stefan Dingemanse

Stefan Dingemanse

Founder of Brainpulse IT and Identity & Endpoint Security Architect in the Microsoft ecosystem. Microsoft MVP and Microsoft …