MC1268714 – M365 Change Digest

One-line summary

Starting April 2026, admins can enable Secure Boot certificate status indicators in Windows Security app; 2011 Secure Boot certs expire June 2026, so update to 2023 certs to stay protected.

Similar updates

Details

Body (from Message Center)

Starting April 2026, the Windows Security app can show users the status of their Secure Boot certificate updates. This experience is disabled by default on enterprise-managed Windows 10 and Windows 11 client devices and Windows Server. If you want to enable this experience for devices in your organization, see the complete guidance at IT admin guide: Secure Boot certificate update status in the Windows Security app.

When will this happen:

In April 2026, this enhancement brings green, yellow, and red-color badges to Device security > Secure Boot.
In May 2026, notifications will appear outside the app (such as system alerts).
In late June 2026, the 2011 Secure Boot certificates begin expiring. Devices need updated 2023 certificates by this date to remain protected and productive.

How this will affect your organization:

This feature is available in Windows 11, Windows 10, Windows Server 2025, Windows Server 2022, and Windows Server 2019. It’s disabled by default on enterprise IT-managed devices. If enabled, visual indicators and warnings can help users know their Secure Boot certificate update status. If action is required, notifications will guide users to take appropriate steps. This isn’t a replacement but a complement to the IT monitoring and deployment guidance in Secure Boot playbook for certificates expiring in 2026.

What you need to do to prepare:

If you don’t wish to enable this feature for users at your organization, no action is required.

On the contrary, please use the registry key guidance in IT admin guide: Secure Boot certificate update status in the Windows Security app. See additional information for more helpful resources.

Additional information:

See complete information at IT admin guide: Secure Boot certificate update status in the Windows Security app.
If you enable this feature, share this user-focused KB article with them: Secure Boot certificate update status in the Windows Security app.
For comprehensive review of Secure Boot certificate updates, visit https://aka.ms/GetSecureBoot.
For devices that don’t have these certificates applied, use the specific monitoring and deployment methods described in the Secure Boot playbook.
For Windows Server, see Windows Server Secure Boot playbook for certificates expiring in 2026.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": "2026-06-30T00:00:00Z",
    "ai_actions": [
      "Plan to update Secure Boot certificates by June 2026",
      "Decide whether to enable certificate status feature",
      "Review admin guidance for deployment"
    ],
    "ai_master_tags": [
      "User",
      "Admin",
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Starting April 2026, admins can enable Secure Boot certificate status indicators in Windows Security app; 2011 Secure Boot certs expire June 2026, so update to 2023 certs to stay protected.",
    "ai_topics": [
      "Windows",
      "Windows 10",
      "Windows 11",
      "Windows Server"
    ],
    "category": "stayInformed",
    "details_map": {},
    "id": "MC1268714",
    "importance": 2,
    "is_major_change": false,
    "last_modified": "2026-04-02T17:05:09Z",
    "ms_products": [
      "Windows"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Windows"
    ],
    "severity": "normal",
    "tags": [
      "Admin impact"
    ],
    "title": "Enable Secure Boot certificate update status in the Windows Security app"
  }
}