Welcome to our news!
Every month, Microsoft ships changes that directly affect how CSP partners operate. Some are minor. Others reshape workflows overnight.
January 2026 brought four updates worth your attention. Retirement of legacy attestation tools to a fundamental shift in how subscriptions end. Here's what happened, what it means, and what you should do about it.
Ready to start?
Microsoft Updates - [01/2026]
1. MCA Legacy Attestation is gone
What's happening:
Microsoft retired the legacy Microsoft Customer Agreement (MCA) attestation API, the UX-based attestation experience in Partner Center, and the bulk attestation tool. All three are now offline.
- Date of announcement: January 5, 2026
- Effective date: January 5, 2026
- Who is affected: CSP direct-bill partners and indirect providers (distributors).
Action required:
All new customer orders are now blocked unless one of two conditions is met:
- the customer directly accepts the MCA in the Microsoft 365 admin center, or
- the partner attests on their behalf using the new enhanced MCA attestation API.
If you were still relying on the old API, the Partner Center UX, or the bulk tool, those paths no longer work. You need to integrate the enhanced API or shift to direct customer acceptance.
Quick note: This is one of those changes that sounds administrative until it blocks your next deal. If your onboarding flow still depends on legacy attestation, every new customer order is on hold until you fix it. Prioritize this. Review Microsoft's documentation on the enhanced MCA attestation API and make sure your technical team has completed the integration.
2. Extended Service Terms (EST) are now in motion
What's happening:
Microsoft is rolling out Extended Service Terms — a new end-of-term option for NCE license-based subscriptions. Subscriptions with auto-renew set to false are being automatically converted to EST. Starting January 19, 2026, API requests to disable auto-renew are also being converted to EST.
Date of announcement: January 14, 2026
Effective date: January 19, 2026 (conversion backfill and API behavior change). Full enforcement begins May 4, 2026. At that point, the free grace period for non-renewed subscriptions is discontinued entirely.
Who is affected: All CSP partners — direct-bill, indirect providers, and indirect resellers managing NCE license-based subscriptions.
Action required: Review all subscriptions currently set to auto-renew off. Understand that these are being converted to EST, which carries a 3% premium above the monthly rate. After May 4, 2026, there's no free grace period — customers either renew, cancel at end of term, or enter a paid EST.
Quick note:
This changes the default behavior of what happens when a subscription expires. Before, auto-renew off meant the customer kept access during a grace period at no extra cost. Now, that grace period goes away and EST kicks in, which means charges your customers might not expect. Have renewal conversations early.
Make sure your billing workflows account for the 3% EST premium, and don't let subscriptions drift into EST unintentionally. The EST documentation on Microsoft Learn covers the full timeline and eligibility criteria.
3. MFA enforcement for Partner Center APIs starts April 2026
What's happening:
Microsoft is enforcing multifactor authentication (MFA) across all Partner Center APIs. All APIs are already MFA-enabled and ready for testing. After the enforcement date, any API call made without a valid MFA token will be blocked.
- Date of announcement: January 21, 2026
- Effective date: April 1, 2026
- Who is affected: All CSP partners: direct-bill, indirect providers, and any partner using Partner Center APIs for provisioning, billing, or subscription management.
Action required:
Confirm that all app+user API calls are sending a valid MFA token. Update your systems ahead of the enforcement date to avoid service disruptions.
Quick note:
If you're already using MFA for Partner Center portal access (mandatory since September 2025), you're halfway there. But API access is a different integration path, and a lot of partners have automated workflows that don't include MFA tokens yet.
April 1 is the hard deadline. After that, blocked API calls mean blocked operations: no provisioning, no billing updates, no subscription changes. Test now. Review Microsoft's MFA requirements and supported options to make sure your systems are compliant.
4. Updated MPA (CSP) Program Guide is available
What's happening:
The Guide to the Online Services and Software Channel Authorization (MPA Program Guide) has been updated. This version adds provisions for ISV Clinical Embed offers and updates outdated links.
- Date of announcement: January 12, 2026
- Effective date: February 12, 2026 (for existing partners)
- Who is affected: CSP direct-bill partners and indirect providers (distributors).
Action required:
None. The updated guide takes effect automatically for existing partners on February 12, 2026. No action, signature, or acknowledgment is required.
Quick note:
This one's low-effort but worth a quick read, especially if you work with ISVs in the healthcare space. The new provisions for ISV Clinical Embed offers could open doors if clinical software is part of your portfolio. Download the updated MPA Program Guide when it's convenient and share it with your compliance team.
The bottom line
January 2026 is a month in which Microsoft tightened operational requirements across the board. Legacy attestation is gone, MFA enforcement has a hard deadline, and the way subscriptions expire is fundamentally changing.
The common thread: less room for manual workarounds, more emphasis on automated, API-driven compliance. If you're managing subscriptions, onboarding customers, or running any integration with Partner Center, now is the time to audit your workflows and make sure nothing breaks when these changes fully take effect.
All information in this post is based on official Microsoft Partner Center announcements for January 2026. For the full list of announcements, visit Microsoft Partner Center Announcements.
