Microsoft aims to transition to post-quantum cryptography (PQC) by 2029, Mark Russinovich, chief technology officer of Microsoft Azure, wrote in a June 30, 2026, post on the company’s security blog. In August 2025, the company had said that its roadmap “aims to complete transition of its services and products by 2033.”
Post-quantum cryptography is a family of public-key algorithms designed to resist attack by quantum computers. Microsoft has moved its goal for its own products and services from 2033 to 2029, the year it had set for “early adoption of quantum-safe capabilities” in the 2025 roadmap.
BleepingComputer reported on June 30 that Microsoft planned to transition “critical products and services” by 2029. Asked by the site what falls under that phrase, Russinovich said it refers to “the entire portfolio of Microsoft’s products and services.”
In the version of the post that Microsoft last modified on July 1, Russinovich wrote that “the goal is to transition products and services to PQC by 2029.” He also wrote that Microsoft is accelerating the timeline of its Quantum Safe Program.
Microsoft’s reasons
“Advances in quantum research and development have shifted the risk horizon,” Russinovich wrote. Microsoft believes cryptographically relevant quantum computers “could arrive sooner than previously expected,” he added. Such a computer would be large and reliable enough to break the RSA and elliptic-curve public-key cryptography in wide use today.
Russinovich also cited U.S. and French “guidance to adopt quantum-safe cryptography as early as 2030 in certain high-risk systems.” He described the transition as “a multi-year engineering effort” and wrote that “delaying that work increases both cost and risk.”
“This is a proactive, risk-informed decision to help customers stay ahead of potential future threats,” Russinovich told BleepingComputer when the site asked what prompted the change. He said the decision was based on risk management, not on a specific research result, the site reported.
Government actions Microsoft cited
In its first footnote, Microsoft cited Executive Order 14412, signed by President Trump on June 22. In Section 4(b), Trump directed the Office of Management and Budget (OMB) to issue guidance requiring agencies to move all high-value assets and high-impact systems to PQC. He set December 31, 2030, as the deadline for key establishment and December 31, 2031, for digital signatures.
The order expressly excludes national security systems from its first requirement, a review of agencies’ inventories of those systems. OMB issued the guidance on June 24 as memorandum M-26-15 and wrote that it “does not apply to national security systems,” which follow separate NSA and CNSS rules.
Key establishment is the step in which two systems agree on a shared secret key. With a digital signature, a recipient can check who produced a message or a software update.
In its second footnote, Microsoft cited a Reuters report that ANSSI, France’s cybersecurity agency, would stop certifying security products that lack quantum-resistant encryption. Samih Souissi, ANSSI’s chief of staff, said at the France Quantum conference that the agency would halt such certifications from 2027, Reuters reported. In its written guidance, ANSSI ties 2027 to products entering qualification, a separate process from certification, as Quantum Observer reported.
Work Microsoft is bringing forward
Russinovich grouped the engineering work into three areas. For data in transit, Microsoft aims to have critical endpoints negotiate TLS 1.3 by default. TLS is the protocol used to encrypt web traffic and many other network connections.
Russinovich described TLS 1.3 as “a baseline that enables hybrid and post-quantum key exchange as standards mature.” A hybrid key exchange combines a classical algorithm with a post-quantum one. An attacker would have to break both to recover the key.
For stored data, Microsoft is building what it calls crypto-agility, “the ability to change cryptography without redesigning systems,” according to the post.
In the third area, Microsoft is modernizing the trust chains behind identity, signing, and certificates. In a trust chain, each certificate or signed software update can be traced back to a root key that a computer already trusts. “The most complex work is securing the chains of trust that underpin software, devices, and services at scale,” Russinovich wrote.
Microsoft is also adding PQC requirements to its Secure Future Initiative (SFI), which the company called “a multi-year commitment” in March 2024 to advance the way it designs, builds, tests, and operates its technology. Russinovich wrote that Microsoft would manage quantum-safe readiness with “clear ownership, measurable milestones, and transparent progress,” in the same engineering framework it uses for other critical security outcomes.
Steps for customers
Microsoft recommended that customers align on strategy, design new systems for change, begin with an inventory of their cryptography, and modernize protocols, starting with TLS 1.3. In a cryptographic inventory, an organization records where it uses encryption, signatures, and certificates, along with the algorithms and keys involved. Russinovich wrote that, for most organizations, the hardest part is understanding and updating where cryptography already exists across apps, services, networks, identities, certificates, and hardware.
Update, November 13, 2026: In a July 10 progress report on its Secure Future Initiative, Microsoft described the goal as “transitioning to post-quantum cryptography (PQC) in critical products and services by 2029.” It also wrote that “PQC is now an SFI-measured engineering requirement.”
