Microsoft 365 Message Center

When this will happen

We'll be gradually rolling out these updates of Microsoft 365 Apps to users on those update channels starting October 13th, 2026 (PST).

How this will affect your organization

If your Microsoft 365 Apps clients are configured to automatically update from the Office Content Delivery Network (CDN), then no action is required.

If you manage updates directly you can now download these latest updates and begin deployment.

What you need to do to prepare

To get more details about these updates view the following release notes:

• Current Channel
• Monthly Enterprise Channel
• Semi-Annual Enterprise Channel

Rollout schedule

• General Availability (Worldwide, GCC): Beginning in early October 2026 and expected to complete in mid-December 2026 (previously late November)

Impact on your organization

Who is affected

• Organizations using Microsoft Entra ID
• Users who authenticate with Windows Hello for Business
• Users who authenticate with macOS Platform SSO
• Organizations using Conditional Access Authentication Strength policies

Platforms and services

• Microsoft Entra ID
• Windows Hello for Business
• macOS Platform SSO
• Conditional Access
• Authentication Strength policies

What will happen

After rollout:

• Users signing in with WHfB or macOS PSSO can complete supported MFA challenges without requiring a separate passkey.
• WHfB and macOS PSSO will satisfy supported MFA requirements for step-up authentication scenarios.
• WHfB and macOS PSSO can be used during 2FA to satisfy supported Authentication Strength policy requirements.
• WHfB and macOS PSSO can be used during 2FA to satisfy supported sign-in frequency challenge requirements.
• Users whose only MFA method is WHfB or macOS PSSO will be considered MFA-capable.
• Users who sign in with only a password will no longer be automatically prompted to register an additional MFA method if WHfB or macOS PSSO is their only registered MFA credential.
• Users with WHfB or macOS PSSO credentials, will be able to see them listed in My Security Info as auto-registered passkeys.

Action required and recommendations

No configuration changes are required.

We recommend reviewing user onboarding and MFA registration processes before rollout. Because WHfB and macOS PSSO credentials are device-bound, users may not be able to complete MFA challenges from devices where those credentials are not available.

Recommended actions:

• Update onboarding guidance to ensure users register at least one portable MFA method.
• Consider requiring users to register a synced passkey or Microsoft Authenticator passkey in addition to WHfB or macOS PSSO.
• Review custom Authentication Strength policies to confirm WHfB and macOS PSSO are allowed where appropriate.
• Update user documentation because users with only WHfB or macOS PSSO registered will no longer be automatically guided to register an additional MFA method.

Learn more (To be updated closer to GA rollout.)

• Plan a Windows Hello for Business deployment | Security | Windows | Microsoft Learn
• Prepare users to provision and use Windows Hello for Business | Security | Windows | Microsoft Learn

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• Public Preview: The macOS client will be made available for download on or around May 29, 2026.
• General Availability (Worldwide): We will begin rolling out late January 2027 and expect to complete by mid-November 2027.

Impact on your organization

Who is affected

• Users on macOS who work with labeled and protected files
• Admins managing Microsoft Purview Information Protection

Platforms/Services

• macOS
• Microsoft Purview Information Protection

What will happen

• The macOS client will be made available to download via the Microsoft Purview Information Protection page.
• Users will be able to apply, change, and remove sensitivity labels on supported files, including Office documents, PDFs, images, text files, and other file types.
• Users will be able to apply labels and protection to single files, or multiple files
• Labels and protection will remain applied when files are shared or moved.
• Users will be able to open and view protected files (including .pfile-based formats) that are not supported by their originating applications.
• The macOS client will provide parity with the Windows File Labeler and File Viewer, with the following exceptions:
  • Advanced label-based protection will not be supported in this release.
  • Need to work with files, selecting a folder will not show the option.
• The client will not be pre-installed and will need to be downloaded separately.
• Existing sensitivity labeling policies will continue to apply; no changes will be required.

Action Required/Recommendations

No immediate action is required.

Admins may consider the following:

• Review your current sensitivity labeling policies to ensure they meet cross-platform needs.
• Inform macOS users about the availability of labeling and protected file viewing capabilities.
• Download the macOS client from the Microsoft Purview Information Protection page when it becomes available.

Learn more

• Learn about Advanced label-based protection for all files on devices | Microsoft Purview | Microsoft Support
• Learn about sensitivity labels | Microsoft Purview | Microsoft Learn
• Label and protect files in File Explorer in Windows | Microsoft Support
• View protected files with Microsoft Purview Information Protection viewer | Microsoft Support

Compliance considerations

QuestionAnswerDoes the change alter how existing customer data is processed, stored, or accessed?Yes. Files can now be labeled and accessed on macOS, extending existing sensitivity labeling and protection workflows to another platform.Does the change modify Information Protection labels or encryption capabilities?Yes. Labeling capabilities are extended to macOS; however, advanced label-based protection is not supported in this release.Does the change include an admin control and can it be controlled via Entra ID groups?Yes. Existing Purview labeling policies and controls continue to govern behavior across platforms.

Rollout schedule

• Public Preview (Worldwide): Rollout has completed.
• General Availability (Worldwide): Rollout begins in late October 2026 and is expected to complete by mid-November 2026.

Impact on your organization

Who is affected

• Organizations who have Planner agent enabled as part of the Microsoft 365 Copilot app.
• Within those organizations, users with an active Microsoft 365 Copilot license who use Planner Agent.
  • Note: Users who view or edit reports do not require a Microsoft 365 Copilot license; a Copilot license is required only to generate reports.

Platforms and services

• Microsoft Planner
• Microsoft 365 Copilot

What will happen

• Planner Agent will be able to generate AI-powered status reports from Planner plan data within Microsoft 365 Copilot app.
• Reports will be generated only from Planner content that users already have permission to access. Existing Planner sharing permissions, Copilot policies, and agent controls continue to apply.
• Reports will synthesize plan information, including tasks, owners, due dates, status, buckets, and recent activity, into sections such as executive summary, progress, risks and blockers, achievements, milestones, and next steps.
• Users can customize reports by reporting period, sections, tone, length, audience, and additional instructions before reviewing and refining the generated content.
• Reports can be exported to a Copilot Page and shared by link or exported to Word and PDF.
• This feature adds new functionality and does not replace existing Planner capabilities.

Copilot-generated status report

Action required and recommendations

No action is required. We recommend that you:

• Confirm that intended users have an active Microsoft 365 Copilot license.
• Review Planner Agent and Copilot agent availability and settings in the Microsoft 365 admin center. If needed, the agent can be blocked tenant-wide.
• Inform support teams and users about the new status report generating capability, which can be accessed via the Planner Agent in Copilot or the Reports tab in Planner.
  • Note that generating a report requires a plan that is shared with a Microsoft 365 Group and contains sufficient task data.
• Update internal documentation, training, and change management materials as appropriate.

Compliance considerations

To assist our customers with identifying compliance concerns, review the questions below and provide details for impact if appropriate:

• Does the change store new customer data?

  • Answer

    Yes. A status report generated from your plan appears in the Microsoft 365 Copilot conversation. If a user chooses to export it, the report is also saved as a copilot page or a word document.

• Does the change alter how existing customer data is processed, stored, or accessed (e.g., documents, emails, chats, etc.)?

  • Answer

    Yes. When an authorized user requests a report, Planner Agent uses information from a plan they can access to create a status report. If the user attaches a file as a template, that file will also be used for the request. This change does not edit the source plan or its tasks.

• Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data?

  • Answer

    Yes. It adds the ability to generate and refine a status report through Planner Agent chat using accessible plan information. It does not grant the agent access to plans the requesting user cannot access.

Rollout schedule

• Targeted Release (Worldwide): Rollout will begin in early November 2026 and end in early December 2026.
• General Availability (Worldwide, GCC, GCC High, DoD): Rollout will begin in early December 2026 and is expected to complete by early December 2026.

Impact on your organization

Who is affected

• Teams event organizers and producers using events configured with Manage what attendees see.

Platforms and services

• Microsoft Teams
• OneDrive
• Teams events

What will happen

• Organizers and producers will be able to select and share videos stored in OneDrive directly within Teams events configured with Manage what attendees see and will have access to built-in controls to start and pause video playback during events.
• Videos can be presented on stage without screen sharing a local media player or embedding videos into a PowerPoint presentation.
• Attendees will experience smoother and higher-quality video playback.

Action required and recommendations

No action is required. We recommend that you:

• Inform Teams event organizers and producers that they can share videos directly from OneDrive in Teams events configured with Manage what attendees see.
• Ensure that organizers and producers store videos in OneDrive with the appropriate permissions before using them in events.
• Review and update internal event production guidance that recommends screen sharing locally played videos or embedding videos in PowerPoint.

Learn more

We will update this post with new documentation.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• Worldwide: Beginning in early November 2026 and expected to complete by late November 2026

Impact on your organization

Who is affected

• Organizations using Microsoft Entra
• Default users who don't have a built-in or custom Microsoft Entra role

Platforms and services

• Microsoft Entra

What will happen

• Default users will be able to create agent blueprints unless an administrator turns off Users can create agent blueprints. If you set the toggle to No, default users will not be able to create new agents. Supported administrators and users assigned the Agent ID Developer role can continue to create them.
• If you change this toggle now, your tenant won't change right away. Your setting takes effect when the rollout begins in early November.

Action required and recommendations

If default users should be allowed to create agents in your organization, no action is required. Choosing to allow users to create agent blueprints will not begin until the functionality is available in your tenant.

To restrict creation:

1. Sign in to the Microsoft Entra admin center using this link.
2. Go to Entra ID > Users > User settings.
3. Under Default user role permissions, find Users can create agent blueprints.
4. Set the toggle to No, then save the change.

For more information and instructions on setting the toggle for your organization, see Manage who can create agent blueprints here.

This change affects new agent blueprint creation by default users. It does not:

• Change or remove existing agent blueprints.
• Change who can create agent identities from existing blueprints.
• Block an app or an agent from creating identities
• Affect creation requirements within platforms such as Microsoft Foundry or Security Copilot, such as requiring licenses and Azure subscriptions.

The new setting is independent of Users can register applications. Review both settings separately.

Learn more

• Delegate application management administrator permissions - Microsoft Entra ID | Microsoft Learn

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

General Availability (Worldwide): Beginning in early November 2026 and expected to complete by late November 2026

• The initial visual updates will roll out to classic Outlook Current Channel. Users may receive individual improvements at different times as the rollout progresses.
• We will provide additional advance notice before larger changes that might affect navigation or workflows, including timing and any preparation required.

Impact on your organization

Who is affected

• Users of classic Outlook for Windows Current Channel

Platforms and services

• The initial visual updates apply to classic Outlook for Windows Current Channel.
• We are also improving Outlook on the web, new Outlook for Windows, and Outlook for macOS to reduce unnecessary differences and make familiar capabilities easier to recognize across devices.

What will happen

• Users will begin seeing visual refinements to familiar mail and calendar surfaces, including updates to icons, spacing, and alignment.
• These initial updates are intended to improve clarity and consistency without changing how users perform their tasks.
• This change does not replace the classic Outlook experience.
• No admin configuration changes are required for these initial visual updates.

Action required and recommendations

No admin action is required.

We recommend that you:

• Inform your help desk that the appearance of some Outlook controls may change as updates roll out.
• Inform users as appropriate.
• Continue to direct users to Outlook’s existing feedback options to share feedback.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Beginning in early November 2026 and expected to complete by late November 2026

Impact on your organization

Who is affected

• Organizations using Microsoft Entra
• No action is required if your organization doesn't have an agent that depends on the automatic AgentIdentity.CreateAsManager grant.

Platforms and services

• Microsoft Entra

What will happen

Today, an agent blueprint principal is granted AgentIdentity.CreateAsManager automatically. This implicit grant allows the principal to create agent identities without a tenant-admin granting an app-role assignment.

After enforcement, an administrator must grant the Microsoft Graph application permission AgentIdentity.CreateAsManager to agents that needs this authority.

This change:

• Makes app-only agent identity creation authority visible, auditable, and revocable.
• Makes AgentIdentity.CreateAsManager revocable if consented
• Affects existing and future agents.
• Doesn't remove existing agent identities or agent blueprints.
• Doesn't remove the ability for agent identity blueprints to create agent identities, when AgentIdentity.CreateAsManager is explicitly granted by an administrator
• Doesn't affect an agent that uses a directory role to authorize creation of agent identities.

Action required and recommendations

No action is required if your organization doesn't have an agent that depends on the automatic AgentIdentity.CreateAsManager grant.

Identify agents that create agent identities without a signed-in user.

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID>Audit Logs.
3. Set the Category to "ApplicationManagement"
4. Set the Activity filter to "Add Service Principal"

Find events where the Initiated By (actor) Type is Application and the Target is an agent identity.

For each affected agent:

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID>Agent blueprints>Search for your agent blueprint>Granted permissions
3. Review if the Agent has any other granted permissions that may allow for creation of agent identities. If there are no other permissions allowing for creation, this agent relies on AgentIdentity.CreateAsManager.
4. Starting October 16, you may grant the explicit AgentIdentity.CreateAsManager Microsoft Graph application permission through tenant-wide admin consent or manual app-role creation. Granting it earlier will cause an error. A successful grant appears in the Granted Permissions table with “An administrator” in the Granted By column.
5. Test app-only agent identity creation before enforcement begins.
6. Update operational guidance for a failed request after enforcement.

If an app-only request relies only on the automatic grant after enforcement reaches your tenant, the request will fail with a 403 authorization error.

Learn more

• For more about how to grant your agents access to resources, visit Grant agents access to Microsoft 365 resources | Microsoft Learn.
• For the Microsoft Graph permission reference on AgentIdentity.CreateAsManager, visit Microsoft Graph permissions reference - Microsoft Graph | Microsoft Learn.

Compliance considerations

No specific compliance impacts have been identified for this configuration update.

Rollout schedule

• General Availability (Worldwide): Beginning in late November 2026 and expected to complete by late November 2026

Impact on your organization

Who is affected

• Organizations using supported agents built by Microsoft or on Microsoft platforms

Platforms and services

• Microsoft 365 admin center
• Agent 365 observability

What will happen

• An Agent 365 license will no longer be required to view usage and activity metrics for supported agents built by Microsoft or on Microsoft platforms.
• The change applies to both existing and new supported agents.
• In Registry, the affected usage and activity columns are Active users, Total sessions, Exception rate, and Run Time.
• In Agent overview, affected cards and charts include Active users, Active users over time, and Trending agents by active users. These views may already be visible in organizations without an Agent 365 license. Reported values and trends may change temporarily as activity data accumulates during rollout.
• In Agent details > Activity, affected metrics include the Active users, Sessions, Exceptions, and Agent run-time cards, and the Active users over time and Sessions over time charts.
• As the change reaches your organization, some metrics may initially appear lower or show incomplete trends while activity data is collected. This temporary change does not necessarily indicate reduced agent usage.
• Allow up to 30 days after data collection begins for a full 30-day reporting view for each enabled agent or platform. Completing the rollout does not mean every agent will immediately have a full 30-day history.
• Data availability continues to depend on the agent or platform sending activity data and on applicable observability settings.
• Existing licensing and access requirements for third-party agent observability are unchanged.
• Other licensed Agent 365 capabilities, including risk-related features, continue to require the applicable license.

Action required and recommendations

When comparing usage before and after rollout, account for the time required to collect a full reporting window rather than interpreting a lower displayed value alone as a decline in usage.

Review the affected Microsoft 365 admin center views as the change reaches your organization.

Learn more

• Data handling, data residency, and compliance in Agent 365 observability | Microsoft Learn

Compliance considerations

No compliance considerations were identified. Review as appropriate for your organization.

Rollout schedule

• Public Preview: Beginning in late September 2026 (previously early September) and expected to complete by mid-October 2026 (previously mid-September)
• General Availability (Worldwide): Beginning in early November 2026 (previously mid-October)

Impact on your organization

Who is affected

• Users in your organization who have the Copilot new tab page enabled in Microsoft Edge.
• Users who do not have the Copilot new tab page enabled will continue to see the existing new tab page experience.
• To access this experience, users must have a Microsoft 365 Copilot license.

Platforms and services

• Microsoft Edge
• Microsoft 365 Copilot

What will happen

The Copilot new tab page is off by default.

When enabled, users will see:

• An updated search box for navigating to websites, searching the web, or sending a query to Microsoft 365 Copilot.
• Enhanced Copilot chat and compose capabilities.
• Suggested actions and work content to help users begin and complete tasks.
• Work cards that may surface organizational content such as files and calendar events.
• A refreshed design, app launcher, pinned quick links, and updated theme settings.
• Starting in September 2026, Discover feed and feed toggle functionality will be limited. We plan to continue improving and expanding these capabilities as the Copilot new tab page evolves
• A Discover feed with curated news and content where supported.

Admins can enable the Copilot new tab page through the Microsoft Edge management service using the CopilotNewTabPageEnabled policy and assign the configuration to all users or selected Microsoft Entra groups.

Depending on organizational policy settings, users may be able to disable the experience after it has been enabled.

Users who are not enabled will continue to see the existing Microsoft Edge new tab page.

Action required and recommendations

The Copilot new tab page is off by default. No admin action required before rollout as this change applies only to organizations that enabled the Copilot new tab page via CopilotNewTabPageEnabled. If your organization has enabled this policy, users will automatically see the upgraded Copilot new tab page. If the policy is not configured or is disabled, there is no change to your users' new tab page experience.

If your organization plans to enable the experience, we recommend that you:

• Review your current Microsoft Edge and Copilot new tab page configuration.
• Determine which users or Microsoft Entra groups should receive the experience.
• Verify that affected users have a Microsoft 365 Copilot license.
• Evaluate the effect of surfacing organizational files and calendar events through work cards.
• Review applicable AI governance and compliance requirements before enabling the experience.
• Notify affected users about the updated new tab page.
• Update relevant user guidance, training, and support documentation.

Learn more

• Configure the Copilot new tab page | Microsoft Edge | Microsoft Learn

Compliance considerations

QuestionAnswerDoes this change introduce or significantly modify AI, ML, or agent capabilities that interact with or provide access to customer data?Yes. The upgraded Copilot new tab page integrates Microsoft 365 Copilot chat and can surface organizational content, including files and calendar events, through work cards and suggested prompts.Does this change provide end users with a new way to interact with generative AI?Yes. Users can send queries directly to Microsoft 365 Copilot from the new tab page search box and access integrated Copilot chat functionality within the Microsoft Edge new tab experience.Does this change include an admin control?Yes. Administrators can enable the Copilot new tab page through the Microsoft Edge management service and assign the configuration to all users or selected Microsoft Entra groups.Can users enable or disable the feature themselves?Yes. Depending on organizational settings, users may be able to turn off the Copilot new tab page experience and switch between Work cards and Chat chips.Can the feature be controlled through Microsoft Entra ID group membership?Yes. Administrators can assign the Copilot new tab page configuration to one or more Microsoft Entra groups.

Rollout schedule

• Public Preview: We will communicate via Message center when we are ready to proceed.
• General Availability (Worldwide): We will communicate via Message center when we are ready to proceed.

Impact on your organization

Who is affected

• Admins managing Endpoint Data Loss Prevention policies in Microsoft Purview

Platforms/Services

• Microsoft Purview compliance portal
• Endpoint DLP
• Security Copilot

What will happen

• Admins will see new AI-powered insights for policy sync status and device health:
• Real-time visibility into DLP policy deployment across endpoints will be available:
• Impacted devices and sync failures will be identified automatically:
• Root cause explanations and recommended remediation actions will be provided:
• The experience will be available within DLP policy and device views in Microsoft Purview.
• The feature requires Security Copilot capabilities to be available in the tenant.

Action Required/Recommendations

No immediate action is required.

To prepare for this feature:

• Ensure that Security Copilot is enabled in your organization.
• Confirm that Security Compute Units are provisioned to support AI experiences.
• Verify that admins have appropriate permissions to access DLP policies and device views in Microsoft Purview.
• Review the DLP portal to familiarize your team with where the feature will appear.
• Communicate this update to your security and compliance administrators.

Compliance considerations

QuestionAnswerDoes the change introduce or significantly modify AI or machine learning capabilities that interact with or provide access to customer data?Yes. The change introduces AI-powered skills that analyze DLP policy sync status and device health, identify impacted devices, and provide root cause insights along with recommended remediation actions.Does the change alter how admins can monitor, report on, or demonstrate compliance activities?Yes. The change adds new AI-driven insights and visibility into DLP policy deployment and device readiness within Microsoft Purview, enhancing how admins monitor and assess compliance activities.

Rollout schedule

Rollout for Copilot Cowork will begin on September 8, 2026, and is expected to complete by September 14, 2026.

The corresponding experience in Microsoft Copilot Studio is expected to become available within the next weeks.

Impact on your organization

• The app-building experience in Copilot Cowork is available in preview through the Frontier Program to users who have a Microsoft 365 Copilot license and access to Cowork.
• When the app-building experience in Copilot Studio becomes available, it will be enabled by default for eligible makers. During preview, administrators can turn the experience on or off in the Microsoft 365 admin center and scope access to specific security groups.
• Eligible users will be able to create and refine apps through conversation, preview and test them, and publish and share them with people or groups permitted by organizational policies.
• Apps use Microsoft Entra authentication and follow your organization's existing connector, environment, data, security, compliance, and sharing policies. Published apps are visible in Apps > All apps in the Microsoft 365 admin center.
• Based on the organization’s governance policies, makers who create apps through these experiences are automatically routed to an isolated personal developer environment instead of the shared environment.
• The personal developer environment is protected from the start by secure defaults that administrators can adjust to meet organizational requirements. Applicable policies are enforced when each app is created, helping keep apps within the organization’s governance boundaries.
• For organizations that have not enabled environment routing, routing will be automatically applied to apps created through these experiences. This change does not affect other resources created in Power Platform or Copilot Studio.

Action required / Recommendations

• Complete Frontier Program onboarding for your organization and enable eligible app creators in the Microsoft 365 admin center under Apps > Overview.
• Review the default configuration and adjust the policies to match your requirements in Microsoft 365 admin center > Apps > Settings.
• Inform your maker community when each experience becomes available and share your organization’s requirements for building and sharing apps.
• Review the Copilot Credits requirements for building and running apps and configure usage-based billing as needed.

Learn more

• Get started with the Microsoft Copilot Frontier Program
• Build apps in Copilot Cowork documentation link
• Manage apps in the Microsoft 365 admin center
• Manage Copilot Cowork for your organization
• Copilot Credits Guide
• Understand usage-based billing and cost management for Copilot Credits

When this will happen

Preview: We will begin rolling out mid-January 2027 (previously late November 2026) and expect to complete by late February 2027 (previously end of December 2026)

General Availability (Worldwide): We will begin rolling out late February 2027 (previously early January) and expect to complete by late March 2027 (previously early February)

How this will affect your organization

This feature will help delete obsolete data, which will improve the quality and relevance of Microsoft 365 Copilot responses.

This feature will be available by default.

After the rollout, admins can use the retention control When items were last accessed when configuring labels and policies.

Retention settings page in Purview with the new “last accessed” option for retention policies:

What you need to do to prepare

This rollout will happen automatically by the specified date with no admin action required before the rollout. Review your current configuration to determine the impact for your organization. You may want to notify your users about this change and update any relevant documentation.

Before rollout, we will update this post with new documentation.

Rollout schedule

General Availability

• Worldwide: Beginning late October 2026 (previously mid-October) and expected to complete by mid-November 2026 (previously early November)
• GCC and GCC High: Beginning mid-November 2026 (previously early November) and expected to complete by early December 2026 (previously late November)
• DoD: Beginning mid-November 2026 (previously early November) and expected to complete by early December 2026 (previously late November)

Impact on your organization

Who is affected

• All users with Copilot license and enterprise license users (with or without Copilot license) will see the new DAB.

Platforms and services

• Classic Outlook for Windows
• Microsoft 365 Copilot

What will happen

• The entry point for Copilot in classic Outlook will be updated and located next to the Outlook ribbon:
• Users will continue to have access to the Copilot side pane.
• This new entry point will surface contextual, AI-powered recommendations based on the task at hand.
• The feature will be available by default for eligible users with the required Microsoft 365 Copilot license.
• No existing Copilot licensing requirements or admin settings are changing as part of this update.

Action required and recommendations

No action is required.

We recommend that you:

• Inform users that the Copilot entry point in classic Outlook is moving to a new location.
• Update any internal documentation or training materials that reference the current location of the Copilot button.
• Communicate the change to help desk and support teams so they can assist users when the new experience becomes available.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Beginning in late September 2026 and expected to complete by late October 2026

Impact on your organization

Who is affected

• Microsoft Purview administrators and compliance administrators who review audit logs for access investigations and troubleshooting

Platforms and services

• Microsoft Purview portal
• Microsoft Purview Audit

What will happen

• New audit records will be generated when access checks are performed in the Microsoft Purview portal.
• Two new audit operations will be available:
  • CheckUsersInRoles
  • CheckUserInRolesWithScopes
• Administrators will be able to review these audit records as part of SecurityComplianceRBAC audit activities.
• The enhancement is enabled by default and requires no configuration.
• Audit records will only be generated for access checks that occur after the feature is deployed.
• No historical or retroactive audit records will be created for prior access checks.
• There is no impact for organizations.
• Supported permission-assignment and role-group change audit records will include the ClientPortal field within PreExecutionMessage, helping administrators distinguish changes initiated from Microsoft Purview and Microsoft Defender.
  • Supported activities for portal attribution
    • Permission assignments: Granting, updating, or removing permission assignments.
    • Role groups: Creating, updating, or deleting role groups.
• Expected ClientPortal values:
  • Microsoft Purview portal: "ClientPortal": "Microsoft Purview"
  • Microsoft Defender portal: "ClientPortal": "Microsoft Defender"
  • Missing or unrecognized X-ClientPage value: "ClientPortal": "Unknown"

RBAC audit-CheckUserInRolesWithScopes:

RBAC audit-checkusersinroles:

Action required and recommendations

No action is required. We recommend that administrators:

• Review internal monitoring and audit procedures to determine whether the new audit activities should be included in access investigations.
• Inform compliance and security teams about the availability of the new audit operations.
• Update any internal documentation or reporting processes that reference Microsoft Purview RBAC audit data.

Learn more

• Permissions in the Microsoft Purview portal | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change modify, interrupt, or disable audit logging capabilities?Yes. The change enhances audit logging capabilities by adding two new audit operations.Does the change alter how admins can monitor, report on, or demonstrate compliance activities?Yes. Administrators gain additional audit visibility into RBAC access evaluation outcomes, improving monitoring and troubleshooting capabilities.

Rollout schedule

• General Availability (Worldwide): Beginning in early October 2026 and expected to complete by early October 2026

Impact on your organization

Who is affected

• Administrators who manage Microsoft Teams Panels
• Organizations using Teams Rooms Pro licenses
• Organizations using Teams Shared Spaces licenses
• Users who view meeting information on Teams panel devices

Platforms and services

• Microsoft Teams Panels
• Teams Rooms Pro Management portal

What will happen

• A new setting, Show organizer name, will be available for Teams panel devices.
• Administrators can choose whether organizer names are displayed in Calendar View.
• The setting can be configured from the Teams Rooms Pro Management portal or directly on a Teams panel device.
• By default, organizer names will continue to be displayed in Calendar View.

Action required and recommendations

No action is required if you want organizer names to continue appearing in Calendar View on Teams panel devices.

If you want to hide organizer names:

• Review your room privacy and display requirements.
• Update the Show organizer name setting in the Teams Rooms Pro Management portal or on individual Teams panel devices.

Learn more

• Release notes for devices in Microsoft Teams - Microsoft Teams | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change include an admin control, and can it be controlled through Entra ID group membership?Yes. Administrators can enable or disable the display of organizer names on Teams Panels. The available information does not indicate support for management through Entra ID group membership.

Rollout schedule

• Targeted Release (Worldwide): Rollout begins in late September 2026 and is expected to complete by early October 2026.
• General Availability (Worldwide, GCC, GCC High, and DoD): Rollout begins in early October 2026 and is expected to complete by mid-October 2026.

Impact on your organization

Who is affected

• Users who access or manage resources in Microsoft Teams chats and channels.

Platforms and services

• Microsoft Teams
• Microsoft Teams mobile

What will happen

• Users will have a centralized location to find, access, and manage important resources.
• Users will be able to pin frequently used resources directly below the chat or channel header, pin multiple messages alongside other resources, and organize them into folders.
• On mobile devices, users will be able to access shared resources and folders by tapping the chat or channel header.
• The In this chat and In this channel panes will be removed; existing resources within these panes will be accessed and managed through the updated experience.

Screenshot - Comparison before and after

Action required and recommendations

No administrative action is required. We recommend that you:

• Inform users about the updated resource pinning and management experience.
• Update any internal training or support documentation that references the In this chat and In this channel panes.

Learn more

We will update this post with new documentation.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide and GCC): Beginning end of October 2026 (previously mid-October) and expected to complete by end of November 2026 (previously late October)

Impact on your organization

Who is affected

• Microsoft Entra administrators who manage password change settings
• Users who have a registered allowed password change after secure sign-in method (passkey, FIDO2 security key, or Windows Hello for Business) and also maintain a password
• Organizations that choose to enable the feature

Platforms/Services

• Microsoft Entra
• My Sign-Ins (mysignins.microsoft.com)

What will happen

• Because this feature is off by default, there is no change to your users' experience unless you turn it on.
• After the feature is enabled, eligible users will see a new Change password option in My Sign-Ins.
• Users can authenticate set a new password without knowing their existing password.
• Users are not required to enroll in or use SSPR to complete this action.
• Administrators can choose to enable or disable the capability through Microsoft Entra management interfaces available at release.
• Authentication continues to require a strong password change method, such as a passkey, FIDO2 security key, or Windows Hello for Business.
• The setting is tenant-wide: you can turn it on for your entire tenant or leave it off for everyone. There is no per-user or per-group scoping.

Action Required/Recommendations

No action is required.

If your organization plans to support allowed password changes after secure sign-in:

• Review your password management and allowed password changes after secure sign-in strategy.
• Evaluate whether enabling this capability aligns with your organization's security and support requirements.
• Communicate the new self-service capability to helpdesk and support teams.
• Update internal user guidance and documentation as needed.
• If your organization chooses to offer allowed password changes after secure sign-in, enable the feature through the Microsoft Entra admin experience or supported APIs when it becomes available in October 2026.

Learn more

• Microsoft Learn documentation will be available when the feature releases in October.

Compliance considerations

QuestionAnswerDoes the change include an admin control?Yes. The feature is disabled by default and requires explicit administrator enablement.Does the change modify how users can access or correct their personal data?Yes. Users gain a new self-service method to update their password using an existing allowed password change after secure sign-in.

Rollout schedule

General Availability (Worldwide): We will begin rolling out in mid-October 2026 and expect to complete by late October 2026.

Impact on your organization

When an administrator sets up Brand Center in the Microsoft 365 admin center:

• Public CDN will be unselected by default.
• Brand Center setup can be completed without Public CDN.
• Public CDN will only be enabled after an administrator explicitly selects the option and confirms the change.
• Font-related capabilities will remain unavailable until Public CDN is enabled.
• If Public CDN is already enabled for the tenant, this update will not disable or change it.

This change separates Brand Center setup from Public CDN activation. It does not remove the Public CDN requirement for organizational fonts.

Why we are making this change

Some organizations want to begin using Brand Center for branding governance without introducing an external or public content-delivery dependency.

Making Public CDN optional provides a more incremental adoption path: organizations can establish Brand Center first and enable font capabilities only when they are ready.

Action Required/Recommendations

No action is required. If your organization plans to use organizational fonts, an administrator must explicitly enable Public CDN during setup or later from the applicable settings experience.

• Set up the SharePoint Brand Center
• Use organizational fonts in SharePoint
• Learn more about Microsoft 365 Public CDN

Compliance considerations

QuestionAnswerDoes the change include an admin control and can it be controlled through Entra ID group membership?Yes. The feature includes or affects admin controls, policies, permissions, roles, authentication, or management settings as described in this message. Review the linked documentation or admin center controls for group-based configuration support.

Rollout schedule

MilestoneEventApps in Copilot Cowork available through the Frontier programSeptember 8, 2026Public preview rollout of Apps in Microsoft Copilot Studio beginsEarly October 2026In-product migration becomes available. Creation of new apps in App Builder agent and vibe.powerapps.com is no longer supported.Mid-October 2026App Builder agent and vibe.powerapps.com are retired.November 30, 2026

Impact on your organization

Who is affected

• Makers who have built apps using the App Builder agent in Microsoft 365 Copilot
• Makers who have built apps using vibe.powerapps.com
• Administrators responsible for supporting these makers and applications

Platforms and services

• Microsoft 365 Copilot
• Power Apps
• Microsoft Copilot Studio
• Copilot Cowork

What will happen

• Starting in mid-October 2026, makers will no longer be able to create new apps using the App Builder agent.
• Starting in mid-October 2026, makers will no longer be able to create new apps using vibe.powerapps.com.
• Existing App Builder and Vibe apps can be opened to begin the migration process once in-product migration becomes available.
• On November 30, 2026, the App Builder agent and vibe.powerapps.com will be retired.
• Apps that are not successfully migrated before November 30, 2026, will no longer be accessible through these retired experiences.
• Makers should build new apps in Copilot Cowork or Microsoft Copilot Studio.

Action required and recommendations

Action is required if your organization has apps created using the App Builder agent or vibe.powerapps.com.

• Identify makers and teams currently using the App Builder agent or vibe.powerapps.com.
• Communicate this retirement timeline to affected makers.
• Direct makers to use Copilot Cowork or Microsoft Copilot Studio for new app development.
• Review migration documentation and begin manual migration of existing apps once in-product migration becomes available.
• Use the in-product migration experience when it becomes available sometime around mid-October 2026.
• Complete migration of any apps your organization wants to retain before November 30, 2026.

Learn more

• Build apps with Microsoft Copilot (Frontier) | Microsoft Support
• Overview of the new Power Apps vibe experience - Power Apps | Microsoft Learn

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

Rollout schedule

Targeted Release (Worldwide): We will begin rolling out in mid-October 2026 and expect to complete by early November 2026.

General Availability (Worldwide): We will begin rolling out in early December 2026 and expect to complete by late December 2026.

Impact on your organization

Who is affected: Users of new Outlook for Windows and Outlook on the web who use inbox rules and want to automatically reply to incoming messages using saved templates.

Platforms/Services:

• New Outlook for Windows and Outlook on the web
• Outlook inbox rules

What will happen

• Users can create an inbox rule with conditions for incoming messages.
• Users can select a saved template as the automatic reply.
• When an incoming message meets the rule conditions, Outlook automatically sends the configured template response.
• This provides users with a way to automate repetitive, consistent responses.
• The capability will roll out automatically during the scheduled rollout window.

Action Required/Recommendations

No admin action is required before rollout.

• Inform your help desk about this new inbox-rule capability.
• Update internal Outlook guidance if your organization documents inbox rules or automated responses.
• Consider whether your organization has policies or guidance governing automated email responses.
• Review Microsoft Outlook documentation as it is updated for this capability.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

Microsoft Graph AuditLogQuery API general availability (Worldwide): Beginning in early October 2026

Search-UnifiedAuditLog retirement:

• Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
• On October 15, 2027, Search-UnifiedAuditLog will be retired and will no longer provide access to the audit log.
• Organizations using Search-UnifiedAuditLog should migrate to the Microsoft Graph AuditLogQuery API before October 15, 2027.

Impact on your organization

Who is affected

• Organizations that use Search-UnifiedAuditLog for audit data retrieval, reporting, investigations, compliance workflows, or automation are affected.
• Organizations that do not use Search-UnifiedAuditLog are not required to take action for this retirement.

Platforms and services

• Microsoft Purview Audit
• Microsoft Graph AuditLogQuery API
• Exchange PowerShell Search-UnifiedAuditLog cmdlet

What will happen

• Admins with the required permissions will be able to programmatically access audit logs through the Microsoft Graph AuditLogQuery API.
• Existing PowerShell scripts, applications, and automation workflows that call Search-UnifiedAuditLog will need to be updated to use the AuditLogQuery API.
• Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
• On October 15, 2027, Search-UnifiedAuditLog will no longer provide access to the audit log.
• There is no tenant setting to prevent the retirement.
• Organizations that do not complete migration before October 15, 2027, may experience disruptions to audit retrieval processes that depend on Search-UnifiedAuditLog.
• Future investments and enhancements for audit search will focus on the AuditLogQuery API rather than Search-UnifiedAuditLog.
• The AuditLogQuery API supports exporting up to 1 million audit records per query.
• The AuditLogQuery API uses tenant-level throttling limits. Each tenant has a baseline of 200 search submissions per rolling 24-hour period and can have up to 50 searches queued or running at one time. Larger tenants may receive higher allocations based on eligible license counts.
• When a limit is reached, the API returns an HTTP 429 Too Many Requests response with retry guidance.

Action required and recommendations

• If your organization uses Search-UnifiedAuditLog, begin migration planning and complete the migration before October 15, 2027.
• Identify scripts, applications, automation workflows, and operational processes that currently use Search-UnifiedAuditLog.
• Evaluate the Microsoft Graph AuditLogQuery API and validate that it meets your audit retrieval requirements.
• Register your application with Microsoft Graph and add the required Microsoft Graph permissions.
• Update and test existing integrations to use the AuditLogQuery API.
• Complete migration before October 15, 2027, to avoid service disruption.

No action is required if your organization does not use Search-UnifiedAuditLog.

Learn more

• auditLogQuery resource type - Microsoft Graph v1.0 | Microsoft Learn
• Examples - List auditLogQueries - Microsoft Graph | Microsoft Learn
• Get started with auditing solutions | Microsoft Learn
• Learn about auditing solutions in Microsoft Purview | Microsoft Learn
• Microsoft Graph service-specific throttling limits - Microsoft Graph | Microsoft Learn
• Permissions - List auditLogQueries - Microsoft Graph | Microsoft Learn
• Search-UnifiedAuditLog (ExchangePowerShell) | Microsoft Learn
• Security audit log query service limits - Microsoft Graph service-specific throttling limits - Microsoft Graph | Microsoft Learn
• Use the Microsoft Graph API - Microsoft Graph | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change modify, interrupt, or disable Audit logging capabilities?Search-UnifiedAuditLog will no longer provide access to the Audit log effective October 15, 2027.Does the change alter how admins can monitor, report on, or demonstrate compliance activities?Programmatic retrieval of Microsoft Purview Audit activity logs is moving from Search-UnifiedAuditLog to the Microsoft Graph AuditLogQuery API for organizations using the retiring cmdlet.Does the change include an admin control?Access to the AuditLogQuery API requires applicable Microsoft Graph permissions. The retirement itself cannot be prevented through a tenant setting. The source does not state that the change can be controlled through Entra ID group membership.

Rollout schedule

• Targeted Release: Beginning early November 2026 (previously early October) and expected to complete mid-November 2026 (previously mid-October)
• General Availability (Worldwide): Beginning early December 2026 (previously mid-October) and expected to complete early January 2027 (previously late October 2026)

Teams admin center controls for this feature will be available approximately four weeks before memory file generation begins. The dates above reflect when admin controls become available.

Impact on your organization

Who is affected

• Microsoft Teams administrators
• Users with Microsoft 365 Copilot or Facilitator capabilities enabled

Platforms/Services

• Microsoft Teams
• Microsoft 365 Copilot
• SharePoint Embedded

What will happen

• AI meeting memory files (.meeting files) will be generated for meetings where Intelligent Recap is turned on. The feature is enabled by default in your organization.
• Memory files are stored in a tenant-owned SharePoint Embedded container, not in user storage. You can control the default expiration time for these files within your organization.
• Users cannot directly view or access memory files.
• When the feature is released, Facilitator will use the memory to answer questions about meetings and responses include citations linking to meeting recaps or invites. In the future, Copilot will also use the memory to answer questions about meetings.
• Memory files cannot be modified, renamed, or moved.
• All content in memory files is AI-generated. No raw transcript snippets are stored.
• Memory generation requires all of the following:
  • Meeting memory is enabled for your organization.
  • Intelligent Recap is enabled for the meeting.
• Memory files are not created for:
  • Meetings with sensitivity labels that include encryption
  • End-to-end encrypted meetings
  • Meetings with restricted copying or forwarding
• Access and data protection:
  • Only users with access to the meeting can receive responses grounded in its memory and AI tools do not surface insights to users who do not have meeting access.
  • Memory knowledge is only shared with users who are in the same tenant as the meeting organizer.

Action Required / Recommendations

No immediate action is required. However, administrators should review configuration settings and consider organizational policy alignment.

Admins can enable or disable this feature in the Teams admin center.

Recommended actions:

• Review the AI archive setting in Teams admin center before rollout. Setting path: Meeting Policies > Meeting Memory".
• Evaluate the default expiration period, which is set to five years (1,825 days), and adjust retention settings as needed to align with compliance policies.
• Communicate this capability to helpdesk teams and compliance stakeholders.
• Monitor availability of the memory setting in Teams admin center and review or update settings when they become available. Memory file generation will begin 4 weeks after the setting is released to your organization.

Learn more: AI Archives for Microsoft Teams Meetings | Microsoft Teams | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change store new customer data, and if so, where, and is the data cached or permanently stored?Yes. The change introduces AI-generated meeting memory files that are stored in a tenant-owned SharePoint Embedded container and retained according to a configurable retention period.Does the change alter how existing customer data is processed, stored, or accessed?Yes. Meeting transcripts and metadata are processed into structured AI memory files that enable downstream AI systems such as Copilot and Facilitator to reason over meeting content.Does the change introduce or significantly modify AI or machine learning capabilities that interact with or provide access to customer data?Yes. Copilot and Facilitator use AI meeting memory files to generate context-aware responses grounded in prior meeting content.Does the change provide users any new way of interacting with generative AI?Yes. Users can interact with Copilot and Facilitator, which leverage meeting memory data to answer questions and provide insights about meetings.Does the change modify retention policies, holds, or deletion workflows?Yes. AI meeting memory files are governed by a default retention period of five years and are automatically deleted upon expiration.Does the change include an admin control, and can it be controlled through Entra ID group membership?Yes. Administrators can enable or disable AI meeting memory generation and configure retention settings in the Teams Admin Center.

Rollout schedule

General Availability (GCC, GCC High, DoD): Beginning in early December 2026 (previously early October) and expected to complete by early January 2027 (previously early November 2026)

Impact on your organization

Who is affected

• Admins managing Microsoft Purview Data Lifecycle Management
• Organizations using retention policies in SharePoint Online and OneDrive

Platforms and services

• Microsoft Purview (Data Lifecycle Management)
• SharePoint Online
• OneDrive
• Microsoft 365 Archive
• Microsoft Copilot

What will happen

• A new Archive option will be available within retention policy settings in Data Lifecycle Management.
• Admins can configure retention policies to move inactive files to Microsoft 365 Archive storage.
• Archived files remain available for compliance scenarios, including eDiscovery.
• Archived content will be excluded from Copilot indexing, helping improve answer relevance.
• This feature is not enabled by default and requires admin configuration.
• Existing retention policies and compliance configurations remain unchanged unless updated by admins.

Action required and recommendations

No immediate action is required. To prepare for and take advantage of this feature, we recommend that you:

• Review your current retention policies in Microsoft Purview Data Lifecycle Management.
• Evaluate opportunities to reduce storage costs by archiving inactive content.
• Update retention policies to include the new Archive option where appropriate.
• Inform compliance and records management stakeholders about this new capability.
• Review internal documentation and processes related to data lifecycle and storage optimization.

Learn more: Configure Microsoft 365 retention settings to automatically retain or delete content | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change store new customer data, and if so where, is it cached or permanently stored?Files moved by retention policies are relocated to Microsoft 365 Archive storage, a distinct storage tier, and are stored there until restored or otherwise actioned.Does the change alter how existing customer data is processed, stored, or accessed?Archived files move out of active storage into Microsoft 365 Archive, changing how those files are stored and accessed going forward.Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data?Archived content is excluded from Copilot indexing, which changes what data Copilot can access and surface in responses.Does the change modify, interrupt, or disable Purview capabilities such as retention policies, holds, or eDiscovery?Retention policies gain a new archive action, and archived files remain subject to eDiscovery, extending existing retention and discovery workflows.

Rollout schedule

Public Preview: We will begin rolling out early September 2026 (previously mid-August) and expect to complete by early October 2026 (previously early September).

General Availability (Worldwide): Rollout will begin in early November 2026 (previously early October) and is expected to complete by early December 2026 (previously early November).

Impact on your organization

Who is affected

• Admins managing Microsoft Purview Data Lifecycle Management
• Organizations using retention policies in SharePoint Online and OneDrive

Platforms/ServicesPlatforms/Services

• Microsoft Purview (Data Lifecycle Management)
• SharePoint Online
• Microsoft 365 Archive
• Microsoft Copilot

What will happen

• A new Archive option will be available within retention policy settings in Data Lifecycle Management.
• Admins can configure retention policies to move inactive files to Microsoft 365 Archive storage.
• Archived files remain available for compliance scenarios, including eDiscovery.
• Archived content will be excluded from Copilot indexing, helping improve answer relevance.
• This feature is not enabled by default and requires admin configuration.
• Existing retention policies and compliance configurations remain unchanged unless updated by admins.

Action Required / Recommendations

No immediate action is required.

To prepare and take advantage of this feature:

• Review your current retention policies in Microsoft Purview Data Lifecycle Management.
• Evaluate opportunities to reduce storage costs by archiving inactive content.
• Update retention policies to include the new Archive option where appropriate.
• Inform compliance and records management stakeholders about this new capability.
• Review internal documentation and processes related to data lifecycle and storage optimization.

Compliance considerations

QuestionAnswerDoes the change store new customer data?Yes. Archived files are stored in Microsoft 365 Archive (low-cost storage tier).Does the change alter how existing customer data is processed, stored, or accessed?Yes. Files meeting retention criteria can be moved from active storage to archive storage while remaining discoverable.Does the change introduce or modify AI/ML capabilities interacting with data?Yes. Archived content is excluded from Copilot indexing, influencing how Copilot processes and retrieves organizational data.Does the change modify Purview retention policies or workflows?Yes. Adds a new Archive action within retention policy configuration in Data Lifecycle Management.Does the change affect eDiscovery or Content Search?Yes. Archived content remains discoverable for compliance workflows such as eDiscovery.Does the change include an admin control?Yes. Admins configure and enable the feature through retention policy settings in Purview.

Rollout schedule

• Public Preview (Worldwide): We will begin rolling out in early July 2026 and expect to complete by mid-July 2026.
• General Availability: We will begin rolling out in mid-September 2026 and expect to complete by mid-October 2026.

Impact on your organization

Who is affected

• Admins managing Microsoft 365 Backup policies
• Organizations currently using or planning to use Microsoft 365 Backup

Platforms/Services:

• Microsoft 365 Backup
• SharePoint Online
• OneDrive
• Exchange Online

What will happen

• A new option to back up all artifacts within a selected workload will be available.
• Admins can enable Full Workload Backup per workload (SharePoint, OneDrive, Exchange).
• All eligible artifacts not covered by existing custom backup policies will be automatically protected.
• Newly created artifacts will be included in backup coverage automatically on subsequent runs.
• Existing custom backup policies will continue to take precedence and remain unchanged.
• Admins can upload a CSV file to exclude specific artifacts.
• The feature is available by default but requires admin configuration to enable.

Action Required/Recommendations

No immediate action is required before rollout.

After rollout, we recommend that you:

• Review your current Microsoft 365 Backup policies and coverage.
• Evaluate whether Full Workload Backup aligns with your data protection strategy.
• Inform backup administrators about this new capability.
• Update internal documentation if you manage backup procedures.

To enable the feature:

1. Go to the Microsoft 365 Backup dashboard in the Microsoft 365 admin center.
2. Select the workload you want to protect and choose the option to back up all artifacts.
3. (Optional) Upload a CSV file on the Exclude sites step to exclude specific sites from the scope of the policy.
4. Review the coverage summary and confirm to create the Full Workload Backup policy.

Learn more

• Create, view, and edit backup policies in Microsoft 365 Backup | Microsoft Learn (will be updated before rollout begins)
• Overview of Microsoft 365 Backup | Microsoft Learn (will be updated before rollout begins)

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

When this will happen

We have decided not to move forward with this change at this time.

How this affects your organization

• • Who is affected:All Microsoft Teams users who create or collaborate on Whiteboards using the Teams Channel tab app
  • What will happen:Whiteboards created from a Teams Channel tab will be stored in the channel’s SharePoint site.
  • All channel members will have consistent access based on channel permissions.
  • Existing Microsoft 365 compliance and security policies continue to apply.
  • Whiteboards will be discoverable from the Whiteboard board picker.
  • The change is enabled by default.

What you can do to prepare

No action is required from administrators.

Recommended optional steps:

• Review internal documentation or helpdesk guidance that references Whiteboard storage locations.
• Inform support teams that Whiteboards created in Teams Channels are now SharePoint-based for troubleshooting and access requests.

Compliance considerations

Compliance areaImpact and explanationStorage of customer dataWhiteboard files created from Teams Channel tabs are now stored in the channel’s SharePoint site instead of the creator’s OneDrive. The data is permanently stored in SharePoint.Processing, storage, or access to existing customer dataThe storage location changes from personal OneDrive to SharePoint, which alters how access is inherited and managed for channel members.Purview compliance capabilitiesWhiteboards now inherit SharePoint-based Purview controls, including DLP, sensitivity labels, retention policies, eDiscovery, audit logging, and Conditional Access.Admin compliance monitoring and reportingCentralized storage in SharePoint simplifies compliance monitoring, reporting, and eDiscovery for Teams Channel whiteboards.

When this will happen

• Targeted Release (Worldwide): We will begin rolling out in late December 2026 (previously late September) and expect to complete by end of January 2027 (previously end of September 2026).
• General Availability (Worldwide): We will announce via Message center when we are ready to proceed.

How this affects your organization

Who is affected

• Users who create or participate in Microsoft Teams meetings and use Microsoft Planner
• Organizations with Teams, Planner, and Loop enabled

What will happen

• Users will be able to link a Teams meeting to an existing Planner plan.
• Tasks created during meetings can be added to the selected existing plan.
• If no plan is selected, meetings will continue to create a new Planner plan.
• This feature will be available by default.
• Facilitator (the meeting task automation capability) can create tasks in the selected plan.
• Users can manually create tasks if Facilitator is disabled.
• No changes to existing plans or previously created plans.

Learn more: Facilitator in Microsoft Teams meetings | Microsoft Support

What you can do to prepare

• No action is required.
• You may want to:
  • Ensure that Teams, Planner, and Loop are enabled in your tenant.
  • Review whether Facilitator should be enabled for automated task creation scenarios.
  • Update internal documentation or task management guidance if applicable.
  • Inform helpdesk staff and users about this new option for organizing meeting tasks.

Compliance considerations

QuestionExplanationDoes the change alter how existing customer data is processed, stored, or accessed (e.g. documents, emails, chats, etc.), if so how and to what extent?Tasks created in Teams meetings can now be stored in an existing Planner plan instead of a new auto-generated plan, changing how task data is organized across plans.Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data, if so summarize changes?Facilitator can create and associate tasks with user selected Planner plans when enabled.Does the change include an admin control and, can it be controlled through Entra ID group membership?Availability depends on enabling Teams, Planner, Loop, and optionally Facilitator in the tenant.Does the change allow a user to enable and disable the feature themselves?Users can choose whether to link a meeting to an existing plan or continue using the default behavior.

When this will happen

• App and agent AVAILABILITY unification (section A): Rollout began in late September 2025. The Phase 3 timeline will be announced separately, at least 60 days before that phase begins.
• App and agent INSTALLATION unification (section B): Rollout begins at the end of September 2026.

A: Unify app availability across admin centers

1. Phase 1 – Default Tenant Unification of App/Agent Availability

We will begin rolling out this feature at the end of September 2025. This initial phase targets tenants that have never modified their organization-wide defaults, app availability, or block/unblock in either the Microsoft 365 admin center or the Teams admin center. At the end of this phase, agent and app manageability will be unified across both Microsoft 365 admin center and Teams admin center ensuring agent and Microsoft 365 apps availability policies are in alignment for all future administrative changes. This message is associated with Microsoft 365 Roadmap ID 393931.

2.Phase 2 – Modified Tenants Unification of App/Agent Availability

This phase targets tenants that have previously modified their organization-wide defaults, app availability, or block/unblock settings in either admin center. These tenants will be transitioned to a unified management experience across both Microsoft 365 and Teams admin centers.

• For tenants with no agent or app availability differences across both admin centers, guidance will be provided to help maintain unified availability policy for all future changes.

For tenants with agent or app availability differences across both admin centers, a wizard in the Teams admin center will help identify affected agents and apps and guide through resolving discrepancies.

• As part of this phase we will also enable administrators to manage Microsoft 365 certified SaaS applications within their tenant through org-wide settings for third-party apps. This has been rolled out completely for all tenants.
• This message is associated with Microsoft 365 Roadmap ID 485712 & 503105.

This phase has been fully rolled out to all tenants. Tenants can choose to align through the wizard experience available in Teams admin center.

Note: In this phase, no changes will be applied to org-wide settings or app-level settings without administrator action.

3. Phase 3 – Automatic Unification (Future)

Tenants that have not taken action to unify availability through the wizard experience released in Phase 1 and Phase 2 will have their availability automatically unified across MAC and TAC as part of this phase. We will inform customers of the timeline and additional details at least 60 days in advance before this phase begins.

B: Unified app and agent installation management

This capability unifies installation management across the Teams admin center and Microsoft 365 admin center. Administrators can manage supported app and agent installations from either portal, with changes synchronized across both admin centers.

Who receives this capability?

Tenants whose app and agent availability has been unified through any of the phases described in section A are eligible. Once rollout begins, this capability will be automatically enabled for tenants whose availability is already unified as part of Section A. Tenants that unify their availability later will receive this capability automatically once unified.

Note: This capability is separate from availability unification described in section A . It does not automatically unify app or agent availability.

When will it roll out?

Rollout will begin at the end of September 2026 for eligible tenants. This date applies only to installation management (section B).

Is administrator action required?

No additional action is required to enable installation unification for eligible tenants. Existing installation assignments for supported apps and agents will be synchronized across both admin centers.

Important: App installation is no longer managed through Teams app setup policies. Installations previously made through those policies are not unified as part of this change.

Rollout schedule

• General Availability (Worldwide): This update is available now.

Impact on your organization

Who is affected

• Outlook for Android and iOS users

Platforms and services

• Microsoft Outlook for Android
• Microsoft Outlook for iOS

What will happen

• Users can view and send their meeting availability directly within the Microsoft Outlook for Android and iOS mobile apps, making it easier to schedule meetings with others.
• iOS users can also access this feature by using the on-screen keyboard or VoiceOver.

Action required and recommendations

No action is required.

Learn more

• How do I send my availability to someone via email? | Microsoft Support

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

General Availability (Worldwide): We will begin rolling out in late October 2026 and expect to complete by late November 2026.

Impact on your organization

Who is affected

• Users who create and consume Audio Overviews.
• Organizations that use Audio Overview with Microsoft 365 content stored or saved in OneDrive.

Platforms/Services:

• Microsoft 365 Copilot
• Audio Overview
• OneDrive
• Microsoft Purview sensitivity labels

What will happen

• Users can navigate longer Audio Overviews through topic-based episodes.
• Users can create Audio Overviews grounded in additional content types, including OneNote pages, Loop pages, .txt files, emails, Teams meetings, and Teams chats.
• Audio Overviews saved to OneDrive from labeled source content will inherit the most restrictive sensitivity label from the sources.
• This release does not introduce sensitivity labeling for Audio Overviews while they remain within the notebook.

Action Required/Recommendations

No admin action is required to prepare for this update. These Audio Overview improvements will roll out automatically to eligible users.

For sensitivity labels, when an Audio Overview is saved to OneDrive from labeled source content, the saved file will automatically inherit the most restrictive sensitivity label from its sources. No additional configuration is required as part of this feature rollout.

Compliance considerations

Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data?Yes. Audio Overview uses AI capabilities to generate audio grounded in Microsoft 365 content, including additional supported content types.Does the change provide end users any new way of interacting with generative AI?Yes. Users can create and navigate Audio Overviews from more supported Microsoft 365 content sources.Does the change modify, interrupt, or disable Purview capabilities such as Information Protection labels?Yes. Audio Overviews saved to OneDrive from labeled source content inherit the most restrictive sensitivity label from the sources.

Rollout schedule

• Service change (Worldwide, GCC, GCC High, DoD): Beginning in early April 2027 and expected to complete in late April 2027

Impact on your organization

Who is affected

• Administrators responsible for Microsoft Graph, SharePoint Online, OneDrive, application integrations, and tenant security
• Owners of third-party applications, line-of-business applications, custom applications, and automation solutions that use affected Microsoft Graph file APIs
• Organizations using applications that follow redirects or rely on URLs containing embedded authentication information

Platforms and services

• Microsoft Graph
• SharePoint Online
• OneDrive
• Microsoft Entra ID
• Third-party and custom applications that consume Microsoft Graph file APIs

What will happen

Applications using affected Microsoft Graph APIs may currently receive:

• SharePoint Online download, upload, monitor, preview, version, or similar URLs that contain temporary authentication information.
• Media service URLs that contain temporary authentication information.
• HTTP 302 redirects to URLs containing embedded authentication information.

After the change:

• Applications configured to use supported Microsoft Graph URL alternatives will receive Microsoft Graph URLs and continue authenticating with Microsoft Graph access tokens.
• APIs that currently return HTTP 302 redirects to temporary authentication URLs will instead return content directly.
• SharePoint Online URLs returned by affected APIs will no longer contain embedded temporary authentication information.
• Applications accessing SharePoint Online URLs directly will need a valid Microsoft Entra ID access token for the SharePoint Online resource.
• Requests made directly to SharePoint APIs rather than through Microsoft Graph are not affected by the tenant control setting.
• Applications that store, inspect, or redeem URLs containing embedded authentication tokens may stop functioning if not updated before April 1, 2027.
• The change is not enabled by default through tenant controls. Administrators must choose which application IDs participate in testing and validation.

Affected API families include:

• File download and content APIs
• createUploadSession APIs
• Copy APIs and long-running action monitors
• Preview APIs
• Thumbnail APIs
• Version APIs
• Format conversion APIs

Action required and recommendations

Administrators should begin validation before April 1, 2027.

Recommended actions:

• Identify applications that obtain file, version, thumbnail, preview, upload-session, or copy-operation URLs through Microsoft Graph.
• Review whether applications inspect, store, or redeem URLs containing embedded authentication information.
• Verify that applications can process direct content responses instead of relying on HTTP 302 redirects.
• Confirm applications can obtain and send the appropriate Microsoft Entra ID access token when calling Microsoft Graph or SharePoint Online endpoints.
• Enable the new tenant setting for a limited set of application IDs and validate application behavior.
• Monitor application errors, authentication failures, and sign-in activity during testing.
• Expand the configuration to additional applications after successful validation.
• Contact application vendors and internal application owners to confirm support plans and timelines for affected applications.
• Communicate this upcoming change to development and application support teams.

No action is required if:

• Your organization does not use the affected APIs.
• Applications already use direct Microsoft Graph content endpoints and standard Microsoft Entra ID authentication.

Learn more

• Clear-SPOTenantPreAuthSettings (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn
• Get-SPOTenantPreAuthSettings (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn
• Get started with the SharePoint Online Management Shell | Microsoft Learn
• OAuth 2.0 and OpenID Connect protocols - Microsoft identity platform | Microsoft Learn
• Pre-authenticated (tempauth) URLs are retiring: move to Microsoft Entra ID tokens before April 1, 2027 - Microsoft 365 Developer Blog

Compliance considerations

QuestionAnswerDoes the change include an admin control, and can it be controlled through Entra ID group membership?Yes. New SharePoint Online tenant controls are being introduced to allow administrators to opt specific application IDs into the updated authentication behavior before the retirement date. Customers should review documentation to determine available scoping and configuration options. Regarding controlled by EntraID Group membership, I do not think that applies. These are SharePoint Online PowerShell cmdlets.

Rollout schedule

• General Availability (Worldwide): Rollout begins in late October 2026 and is expected to complete by early November 2026.

Impact on your organization

Who is affected

• Users with a Planner Premium P1, P3, or P5 license
• Users with a Microsoft 365 license

Platforms and services

• Microsoft Planner

What will happen

• Users with a Planner Premium P1, P3, or P5 license will be able to create, edit, and manage Custom Fields and their values.
• Users with a Microsoft 365 license can view Custom Fields and values as read-only and export them but cannot create or edit them.
• Users can add up to 10 custom fields with 255 characters each to tasks in a plan for information beyond Planner's built-in fields. Available types are Text, Number, Date, Yes/No, and Choice, and field names can be up to 255 characters.
• Choice fields are single-select and can contain 2 to 25 colored options.
• Field values can be viewed and updated across Board, Grid, and Task details and used for sorting, filtering, grouping, and bulk editing.
• This feature is optional. Existing plans are not affected unless users add Custom Fields.
• Existing compliance capabilities cover custom field data, including Unified Audit Log, eDiscovery, Microsoft Information Protection through inherited plan-level labels, and Data Lifecycle Management.

Action required and recommendations

No tenant-level configuration or admin setup is required to enable Custom Fields. We recommend that you:

• Ensure users who need to create or edit Custom Fields have a Planner Premium P1, P3, or P5 license. Microsoft 365 users will have read-only access.
• Inform users about the supported field types, the limit of 10 fields per plan, and that Choice fields are single-select with 2 to 25 options.
• Advise users that deleting a custom field or choice option is permanent and cannot be undone, and that deleting a choice option clears affected values.
• Remind users to follow your organization's data-handling policies. Custom field data is included in audit, eDiscovery, Microsoft Information Protection, and data lifecycle processes.

Learn more

We will update this post with new documentation.

Compliance considerations

Does the change store new customer data?

• Yes. Custom field names and values that users create on tasks (up to 10 fields per plan) are stored as part of plan/task data.

Does the change alter how existing customer data is processed, stored, or accessed (e.g., documents, emails, chats, etc.)?

• No. Existing task and plan data is unchanged. Custom fields are additive metadata on tasks.

Does the change modify, interrupt, or disable any of the following Microsoft Purview capabilities?

• Data Loss Prevention (DLP) policies or enforcement
  • No.
• Information Protection labels or sensitive information types
  • No.
• Conditional Access policies
  • No.
• Audit logging capabilities
  • No. Custom field edits are logged in Task History and flow to the Unified Audit Log.
• eDiscovery or Content Search
  • No.
• Encryption methods or key management
  • No. Data uses existing service encryption.
• Retention policies, holds, or deletion workflows
  • No. Custom field data follows the existing task/plan lifecycle (deleted when the task/plan is deleted).

Does the change alter how admins can monitor, report on, or demonstrate compliance activities (e.g., Purview or admin reporting)?

• No. Existing Purview and admin reporting continue to work; custom field activity appears in audit logs like other task edits.

Does the change modify how users can access, export, delete, or correct their personal data within Microsoft 365 services (GDPR Data Subject Rights)?

• No. Users can view, edit, and export custom field values (Export to Excel), and the data is deleted along with the task or plan it belongs to.

Rollout schedule

• General Availability (Worldwide): Retirement begins in mid-October 2026 and is expected to complete by late October 2026.

Impact on your organization

Who is affected

• Users with a Copilot license.

Platforms and services

• New Outlook for Windows
• Outlook for Android
• Outlook for iOS
• Outlook for Mac
• Outlook on the web

What will happen

• Themes by Copilot will be removed from Settings. Users who are currently using a Theme by Copilot will retain their current theme until they change it.
• Themes by Copilot configured to automatically refresh will remain applied but will stop refreshing. Users will retain the current theme imagery until they change their theme.
• Users can change from their existing Theme by Copilot to a non-Copilot theme but cannot return to a Theme by Copilot after doing so.

Action required and recommendations

No action is required.

Rollout schedule

• Targeted release: Beginning in early September 2026 and expected to complete by late October 2026 (previously early September)
• General Availability (Worldwide, GCC, GCC High, DoD): Beginning in early September 2026 and expected to complete by late November 2026 (previously late October)

Impact on your organization

Who is affected

• Users who present PowerPoint content using PowerPoint Live in Microsoft Teams.

Platforms and services

• Microsoft Teams
• PowerPoint Live

What will happen

Presenters will be able to select from the following display modes when using PowerPoint Live:

• Light mode
• Dark mode
• Classic mode
• High contrast mode

Users can choose the mode that best aligns with their preferences and accessibility needs.

This change enhances the presenting experience and does not alter presentation content or attendee viewing experiences.

Action required and recommendations

No admin action is required.

Consider informing users who regularly present in Teams meetings about the new display mode options.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

Public Preview (Worldwide): We will begin rolling out in early October 2026 and expect to complete by early October 2026.

General Availability (Worldwide): We will begin rolling out late October 2026 (previously early October) and expect to complete by mid-November 2026 (previously early October).

Impact on your organization

Who is affected

- Security operations teams that use Advanced Hunting in Microsoft Defender.

- Admins and analysts who investigate email submissions and submission results.

Platforms/Services:

- Microsoft Defender for Office 365

- Microsoft Defender XDR

- Advanced Hunting

What will happen

- Two new Advanced Hunting tables will be available: SubmissionEvents and SubmissionResults.

- SubmissionEvents provides information about email submission events.

- SubmissionResults provides information about the results associated with those submissions.

- Security teams can query submission information directly and correlate it with other Microsoft Defender XDR data.

- The tables can be used with Advanced Hunting custom detections, allowing organizations to create detections based on submission activity that is important to their SOC workflows.

Action Required/Recommendations

No immediate action is required. Additional documentation for the new tables will be provided as part of the release.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• Public Preview: We have decided not to move forward with this change at this time.
• Worldwide, GCC, GCC High, DoD: We have decided not to move forward with this change at this time.

Impact on your organization

Who is affected

• Organizations using Microsoft Entra Administrative Units and Microsoft Purview Data Loss Prevention for Microsoft Copilot and Copilot Chat
• Administrators responsible for managing Microsoft Purview DLP policies for Microsoft Copilot and Copilot Chat
• Organizations that do not use Administrative Units do not need to change their existing Copilot DLP policies

Platforms and services

• Microsoft Purview Data Loss Prevention
• Microsoft Copilot
• Microsoft Copilot Chat
• Microsoft Entra ID Administrative Units

What will happen

• Administrators scoped to an Administrative Unit will be able to create, view, edit, and delete supported Copilot DLP policies within their assigned Administrative Unit.
• Administrative Unit scoped administrators will not be able to modify tenant-wide policies.
• Administrative Unit scoped administrators will not be able to manage policies assigned to other Administrative Units.
• Existing Microsoft Purview role-based access control permissions continue to apply.
• Tenant-wide Copilot DLP policies will continue to function as they do today.
• End users will not experience a new workflow.
• Copilot interactions will continue to be evaluated against applicable tenant-wide and Administrative Unit scoped DLP policies.
• Administrative Unit boundaries are determined by the user initiating the Copilot interaction, not by the owner or storage location of referenced content.

Action required and recommendations

No action is required.

If your organization plans to use Administrative Units for Copilot DLP policy management, we recommend the following:

• Review your Microsoft Entra Administrative Unit structure and membership assignments.
• Review Microsoft Purview role group assignments and ensure administrators are assigned only to the Administrative Units they manage.
• Review existing tenant-wide Copilot DLP policies before creating Administrative Unit scoped policies.
• When creating a new DLP policy, select the appropriate Administrative Unit and configure the Microsoft Copilot policy location for eligible users or groups within that Administrative Unit.

Licensing requirements for Microsoft Purview DLP and Microsoft Copilot continue to apply.

Learn more

• Administrative units in Microsoft Purview | Microsoft Learn
• Microsoft Purview DLP for Microsoft 365 Copilot and Copilot Chat | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change modify DLP policies or enforcement?Yes. Administrative Unit scoped administrators gain delegated management capabilities for supported Copilot DLP policies within their assigned Administrative Units. DLP enforcement functionality remains unchanged.

Rollout schedule

• Copilot chat list entry point removal (Worldwide, GCC): Cancelled

Impact on your organization

Who is affected

• Organizations whose users access Microsoft 365 Copilot in Microsoft Teams
• Users of Microsoft Teams desktop and web applications who currently access Copilot from the Teams chat list.
• Mobile users are not affected.

Platforms and services

• Microsoft Teams desktop
• Microsoft Teams web

What will happen

• The Copilot entry point in the Teams chat list will be removed.
• Prior to the mid-October removal, users who access Copilot from the chat list will see a coachmark directing them to the Copilot app.
• The Copilot app in the Teams app bar will remain available and unchanged.
• If the Copilot app has been unpinned from the Teams app bar, users will be directed to the app overflow menu where they can locate the Copilot app.
• Existing Copilot conversations, notifications, supported deep links, and session continuity will continue to work.
• No user conversations, prompts, chat history, or Copilot data will be removed.
• Mobile experiences are unchanged.
• This change is enabled by Microsoft and does not require tenant configuration.

Before:

After:

Action required and recommendations

No action is required.

We recommend that administrators:

• Inform users that Copilot in Teams will be accessed through the Copilot app in the Teams app bar going forward.
• Update internal training materials, screenshots, adoption content, and support documentation that reference the Copilot chat list entry point.
• Notify help desk and support teams before rollout.
• Review Teams app setup policies and consider pinning the Copilot app for users if it is not already pinned.
• Monitor user feedback after rollout and direct users to the Copilot app if they are looking for the retired chat list entry point.

Learn more

• Pin Microsoft Copilot Chat in the Microsoft 365 apps | Microsoft Learn

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide, GCC, GCC High): Rollout began in late September 2026 and is expected to complete by late October 2026.

Impact on your organization

Who is affected

• Users who create events in Microsoft Outlook

Platforms and services

• Microsoft Outlook

What will happen

• A new Duplicate event option will appear in Microsoft Outlook event details.
• Users can quickly create a new event based on an existing event without re-entering the same details.

Action required and recommendations

No action is required.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Rollout begins in early October 2026 and is expected to complete by mid-October 2026.

Impact on your organization

Who is affected

• All Microsoft PowerPoint for Windows users

Platforms and services

• Microsoft PowerPoint for Windows

What will happen

• The slide contextual menu and slide thumbnail contextual menu will be updated to be more complete and reorganized in a more predictable order for greater consistency.
• The Photo Album… command will be removed from the contextual menus due to low usage but will remain available on the Insert tab in the ribbon. All other commands will remain available, although some commands may appear in a different position within the contextual menus.
• This update is enabled by default for all users and ships via standard staged rollout without introducing new SKUs, licensing, tenant, geography, or admin controls, or changes to files, data, security, or compliance.

Action required and recommendations

No action is required. We recommend that you:

• Inform help desk and support staff that some slide commands may appear in different locations within the contextual menu.
• Update internal PowerPoint guidance that refers to the previous slide contextual menu experience.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Rollout begins in early October 2026 and is expected to complete by mid-October 2026.

Impact on your organization

Who is affected

• All Microsoft PowerPoint for Mac users

Platforms and services

• Microsoft PowerPoint for Mac

What will happen

• The slide contextual menu and slide thumbnail contextual menu will be updated to be more complete and reorganized in a more predictable order for greater consistency.
• The Zoom… command will be removed from the contextual menus due to low usage.
• The Cut and Copy commands will be removed to reduce duplication but remain available on the slide thumbnail contextual menu and the ribbon. Users can also use the ⌘X and ⌘C key combinations to perform these actions.
• The Layout and Reset Slide commands will be available in the slide contextual menu and slide thumbnail contextual menu.
• All other commands will remain available, although some commands may appear in a different position within the contextual menus.
• This update is enabled by default for all users and ships via standard staged rollout without introducing new SKUs, licensing, tenant, geography, or admin controls, or changes to files, data, security, or compliance.

Action required and recommendations

No action is required. We recommend that you:

• Inform help desk and support staff that some slide commands may appear in different locations within the contextual menu.
• Update internal PowerPoint guidance that refers to the previous slide contextual menu experience.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Beginning in early October 2026 and expected to complete by late January 2027

Impact on your organization

Who is affected

• Organizations using Zendesk OAuth connections in Microsoft API Hub
• Developers who manage Zendesk connections and affected flows

Platforms and services

• Microsoft API Hub
• Zendesk integrations and connected workflows

What will happen

• New Zendesk connections will receive access tokens with a 48-hour lifetime, refresh tokens with a 90-day lifetime, and automatic token refresh support.
• Existing Zendesk connections created before this change cannot be automatically migrated to the new token model.
• Existing connections must be reauthorized to receive expiring tokens and automatic refresh support.
• Active new or reauthorized connections should refresh automatically.
• Connections that remain unused for 90 days may lose refresh capability and require reauthorization when they are used again.
• Flows that rely on existing Zendesk connections may fail until those connections are reauthorized.

Action required and recommendations

Action is required for existing Zendesk connections created before this change.

• Identify existing Zendesk connections that require reauthorization.
• Reauthorize those connections to receive expiring tokens and automatic refresh support.
• Inform developers who manage Zendesk connections and affected workflows about this change.
• Review affected flows that depend on existing Zendesk connections.

Learn more

• Zendesk - Connectors | Microsoft Learn

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

General Availability (Worldwide): Rollout begins on October 8, 2026.

Impact on your organization

Who is affected

• Users with access to Microsoft 365 Copilot in PowerPoint on desktop.
• Organizations that use Copilot in PowerPoint to draft, refine, or review presentation content.

Platforms/Services:

• Microsoft 365 Copilot
• Microsoft PowerPoint on desktop

What will happen

• Users will see the built-in Clarify my thinking skill in Copilot for PowerPoint.
• The skill helps users answer questions designed to sharpen ideas and improve presentation clarity.
• The feature is enabled as part of the existing Microsoft 365 Copilot in PowerPoint experience.
• Existing Microsoft 365 Copilot admin controls and licensing requirements continue to apply.

Action Required/Recommendations

No admin action is required before rollout.

You may want to inform users that the Clarify my thinking skill is becoming available in Copilot for PowerPoint and update any internal Copilot guidance or training materials as appropriate.

Compliance considerations

• Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? Yes. The Clarify my thinking skill uses Microsoft 365 Copilot in PowerPoint to analyze presentation content and generate feedback.
• Does the change provide end users any new way of interacting with generative AI? Yes. The skill gives users a new prompt-based way to request presentation feedback from Copilot in PowerPoint.

Rollout schedule

General Availability (Worldwide): Rollout begins on October 8, 2026.

Impact on your organization

Who is affected

• Users with access to Microsoft 365 Copilot in PowerPoint on web.
• Organizations that use Copilot in PowerPoint to draft, refine, or review presentation content.

Platforms/Services:

• Microsoft 365 Copilot
• Microsoft PowerPoint on web

What will happen

• Users will see the built-in Clarify my thinking skill in Copilot for PowerPoint.
• The skill helps users answer questions designed to sharpen ideas and improve presentation clarity.
• The feature is enabled as part of the existing Microsoft 365 Copilot in PowerPoint experience.
• Existing Microsoft 365 Copilot admin controls and licensing requirements continue to apply.

Action Required/Recommendations

No admin action is required before rollout.

You may want to inform users that the Clarify my thinking skill is becoming available in Copilot for PowerPoint and update any internal Copilot guidance or training materials as appropriate.

Compliance considerations

• Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? Yes. The Clarify my thinking skill uses Microsoft 365 Copilot in PowerPoint to analyze presentation content and generate feedback.
• Does the change provide end users any new way of interacting with generative AI? Yes. The skill gives users a new prompt-based way to request presentation feedback from Copilot in PowerPoint.

Rollout schedule

General Availability (Worldwide): Rollout begins on October 8, 2026.

Impact on your organization

Who is affected

• Users with access to Microsoft 365 Copilot in PowerPoint on Mac.
• Organizations that use Copilot in PowerPoint to draft, refine, or review presentation content.

Platforms/Services:

• Microsoft 365 Copilot
• Microsoft PowerPoint on Mac

What will happen

• Users will see the built-in Clarify my thinking skill in Copilot for PowerPoint.
• The skill helps users answer questions designed to sharpen ideas and improve presentation clarity.
• The feature is enabled as part of the existing Microsoft 365 Copilot in PowerPoint experience.
• Existing Microsoft 365 Copilot admin controls and licensing requirements continue to apply.

Action Required/Recommendations

No admin action is required before rollout.

You may want to inform users that the Clarify my thinking skill is becoming available in Copilot for PowerPoint and update any internal Copilot guidance or training materials as appropriate.

Compliance considerations

• Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? Yes. The Clarify my thinking skill uses Microsoft 365 Copilot in PowerPoint to analyze presentation content and generate feedback.
• Does the change provide end users any new way of interacting with generative AI? Yes. The skill gives users a new prompt-based way to request presentation feedback from Copilot in PowerPoint.

Rollout schedule

• General Availability (Worldwide): Rollout began in late September 2026 and is expected to complete by late October 2026.

Impact on your organization

Who is affected

• Users of Microsoft PowerPoint for Windows who paste slides using the Keep Source Formatting option.

Platforms and services

• Microsoft PowerPoint for Windows

What will happen

• When users paste slides with Keep Source Formatting, PowerPoint will import only the slide masters and layouts required by the pasted slides.
• Presentation file sizes may be reduced because unnecessary slide masters and layouts will no longer be imported by default.
• By minimizing unnecessary design content, smaller presentations may open faster and perform better during collaboration and co-authoring scenarios.
• Users who prefer the previous behavior can continue using it through a setting that allows them to bring over all slide masters and layouts from the source presentation.

Action required and recommendations

No action is required.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Rollout began in late September 2026 and is expected to complete by late October 2026.

Impact on your organization

Who is affected

• Users of Microsoft PowerPoint for Mac who paste slides using the Keep Source Formatting option.

Platforms and services

• Microsoft PowerPoint for Mac

What will happen

• When users paste slides with Keep Source Formatting, PowerPoint will import only the slide masters and layouts required by the pasted slides.
• Presentation file sizes may be reduced because unnecessary slide masters and layouts will no longer be imported by default.
• By minimizing unnecessary design content, smaller presentations may open faster and perform better during collaboration and co-authoring scenarios.
• Users who prefer the previous behavior can continue using it through a setting that allows them to bring over all slide masters and layouts from the source presentation.

Action required and recommendations

No action is required.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• In early September, 2026, Microsoft will redirect users from m365.cloud.microsoft to copilot.cloud.microsoft in organizations where access to copilot.cloud.microsoft is available.
• In early November, 2026 Microsoft will redirect the remaining users who had not been redirected in early September. If your organization cannot complete the required configuration before the redirect, contact your Microsoft account representative to discuss available options.

Impact on your organization

When the Copilot web app transitions from m365.cloud.microsoft to copilot.cloud.microsoft, users will be automatically redirected. If device, network, proxy, firewall, security gateway, or similar controls block URLs within *.cloud.microsoft, affected users may be unable to use Copilot in the web app, desktop app, and Microsoft Edge experience. Review these controls and allow the required domain before the redirect begins.

The redirect remains within the *.cloud.microsoft domain and retains its security, compliance, and enterprise allow-listing properties. Organizations that follow the recommendednetwork configurations for Microsoft 365 Copilot do not need additional network changes.

Action required / Recommendations

• You can validate connectivity to the *.cloud.microsoft domain by using the Microsoft 365 Connectivity Test tool. Use the connectivity tool to validate connectivity to *.cloud.microsoft and confirm that your network and security controls allow access before the redirect applies to your organization. If you find out your organization blocks connection to *.cloud.microsoft, contact your Microsoft account representative before September 10, 2026 to discuss available options.
• Confirm that copilot.cloud.microsoft is not blocked in your environment. Review legacy filtering rules, URL category restrictions, proxy policies, firewall rules, tenant restrictions, Conditional Access policies, and app control policies, and update them if needed.
• Add *.cloud.microsoft to your organization’s allow lists. If you have questions about tenant-specific network configurations and allow list requirements, you can contact your Microsoft support team for guidance based on your specific environment. Note: Microsoft does not support allowing partial or only selected Microsoft 365 application URLs within the *.cloud.microsoft domain. Allow the entire *.cloud.microsoft domain to maintain service reliability and avoid disruptions.
• Confirm that your environment aligns with the recommended network requirements for Microsoft 365 Copilot.
• Coordinate with teams that manage network security, proxy services, firewalls, secure web gateways, SSE/SASE platforms, or third-party filtering solutions to ensure traffic to *.cloud.microsoft is permitted.
• If preventing personal Microsoft account sign-ins is the reason your organization blocks copilot.cloud.microsoft, consider using TenantRestrictions as the targeted control. This control allows your organization to restrict authentication with personal Microsoft accounts on managed networks or devices, while still permitting access to the Copilot service URL.

Rollout schedule

General Availability (GCC, Worldwide): Beginning in late October 2026, with a phased rollout as outlined below:

• Internal guest users: Beginning in late October 2026 (previously early October) and is expected to complete by late November 2026 (previously late October)
• External users (excluding Microsoft Authenticator app passkeys): Rollout timing will be communicated in a future Message center post update.

Impact on your organization

Who is affected

• Microsoft Entra administrators managing Authentication methods policies
• Organizations that use Microsoft Entra B2B collaboration
• Internal guest users and external users who are in scope for passkey authentication
• Internal guest users and external users who are enabled for SMS or voice in the Authentication methods policy or legacy MFA policies

Platforms and services

• Microsoft Entra ID
• My Security Info
• Authentication methods policy
• Conditional Access

What will happen

• The feature will be enabled by default.
• B2B users who are already in scope for passkeys in your Authentication methods policy will automatically be able to register and sign in with resource tenant passkeys.
• Eligible B2B users may receive prompts to register a passkey during sign-in through proof-up experiences or passkey registration campaigns, if those experiences are configured in your tenant.
• Users can also register a passkey from the resource tenant's My Security Info page.
• If your organization has excluded B2B users from passkeys in the Authentication methods policy, and those users are not separately subject to automatic passkey enablement through the SMS and voice retirement changes, they will not be prompted and will not be able to register or sign in with a resource tenant passkey.
• Under the SMS and voice retirement changes described in MC1426371 and MC1434201, B2B users who are enabled for SMS or voice in the Authentication methods policy or legacy MFA policies will be automatically enabled for all passkey types. Excluding these users from the passkey policy alone will not prevent this automatic enablement if they remain enabled for SMS or voice.
• This change gives guest and external users a phishing-resistant sign-in option and helps organizations extend strong authentication requirements to their B2B population.

Action required and recommendations

No action is required.

We recommend that administrators review current passkey and MFA configurations before rollout:

• Review your Authentication methods policy. Confirm which users are in scope for passkeys, including guest and external users. B2B users who are in scope will be enabled automatically. Exclude them from the policy if that is not the intended behavior.
• Review Message Center posts MC1426371 and MC1434201 for details about the SMS and voice retirement changes.
• Review SMS and voice assignments in both the Authentication methods policy and legacy MFA policies. If you do not want specific B2B users to be automatically enabled for all passkey types, move those users off SMS and voice in all applicable policies. Excluding them only from the passkey policy is not sufficient while they remain enabled for SMS or voice.
• Review your passkey registration campaign. Confirm that the campaign's user scope includes the intended users.
• Review your Conditional Access policies. Confirm that MFA and authentication strength requirements will apply as intended for B2B users when resource tenant passkeys become available.
• Confirm user scoping across authentication-related policies. Make sure the groups and user types targeted by each policy align with your organization's requirements for guest and external users.

Consider notifying your help desk and identity support teams that eligible B2B users may begin receiving passkey registration prompts after rollout.

Compliance considerations

QuestionAnswerDoes the change store new customer data?Passkey credential registration data may be stored as part of Microsoft Entra authentication management.Does the change alter how existing customer data is processed, stored, or accessed?The change introduces an additional authentication method for B2B users accessing resource tenant resources.

Rollout schedule

This feature will roll out in phases:

Phase 1: Support for synced passkeys, Microsoft Entra passkeys on Windows, and FIDO2 security keys.

General Availability (Worldwide, GCC): We will begin rolling out in late October 2026 (previously early October) and expect to complete by late November 2026 (previously mid-November).

Phase 2: Support for Windows Hello for Business, macOS Platform SSO, Authenticator App passkey, and Authenticator App passwordless sign-in.

General Availability (Worldwide, GCC): We will begin rolling out in early January 2026 and expect to complete by late February 2027.

Impact on your organization

Who is affected

• Users who have not yet registered a multifactor authentication method
• Identity and security administrators responsible for authentication onboarding and registration policies

Platforms and services

• Microsoft Entra ID
• Passkeys (FIDO2)
• Windows Hello for Business
• macOS Platform SSO
• Microsoft Authenticator passwordless sign-in

What will happen

• Password-only users will be able to register passkeys or passwordless sign-in as their first MFA method.
• Users will no longer need to register a method such as SMS or voice before registering a passkey (FIDO2), Windows Hello for Business, macOS Platform SSO, or Authenticator passwordless sign-in.
• Organizations may see reduced registration friction and increased adoption of phishing-resistant authentication methods.

Action required and recommendations

No action is required for this change.

We recommend that administrators:

• Review Conditional Access policies related to security information registration.
• Consider requiring MFA to register security information if additional verification is required by your organization.
• Review onboarding and registration guidance so users know to set up a passkey as their preferred first method.

Learn more

• (To be updated closer to rollout) Register a synced passkey (FIDO2) | Authentication | Microsoft Entra ID | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change include an admin control?Yes. Administrators can control which authentication methods users are allowed to register through existing Microsoft Entra authentication method policies and Conditional Access policies.Does the change affect access or authentication controls?Yes. The update changes how users register multifactor authentication methods by allowing eligible users to register supported passkeys or passwordless authentication methods as their first MFA method.Can administrators govern the feature through existing Microsoft Entra controls?Yes. Administrators retain control over the feature through Microsoft Entra authentication method policies and Conditional Access configurations.

Rollout schedule

• General Availability (Worldwide, GCC, GCC High, DoD): Mid-November 2026 (previously late September)

Impact on your organization

Who is affected

• Organizations using Microsoft Purview sensitivity labels.
• Users of Outlook for iOS and Android.

Platforms/Services

• Outlook for iOS
• Outlook for Android
• Microsoft Purview Information Protection

What will happen

• When a user attaches one or more files that have sensitivity labels applied, Outlook may automatically apply or recommend an email sensitivity label.
• The applied or recommended label is determined by your organization's Microsoft Purview sensitivity labeling policies.
• This behavior helps align email classification with the classification of attached content.
• Users may experience fewer manual labeling steps when composing messages that contain labeled content.
• Organizations can benefit from more consistent application of information protection policies across mobile Outlook clients.

Action Required / Recommendations

No admin action is required.

Organizations currently using Microsoft Purview sensitivity labels should:

• Review existing label publishing policies.
• Review sensitivity label inheritance and protection configurations.
• Validate that attachment-based label inheritance aligns with compliance, regulatory, and information protection requirements.
• Update internal user guidance if your organization provides sensitivity labeling training or documentation.

Compliance considerations

IssueExplanationMicrosoft Purview sensitivity labelsThis update extends sensitivity label behavior to Outlook for iOS and Android by enabling email labeling based on labeled attachments. Organizations should verify that existing labeling and protection policies produce the desired outcomes for email communications.

For organizations already using Microsoft Purview sensitivity labels, this change helps improve consistency in classification and protection while reducing the risk of emails being sent with a lower sensitivity level than their attachments.

Rollout schedule

Frontier and Microsoft 365 Insider Beta channel

• Skill now available in PowerPoint for Windows, Mac and web.
• Ribbon Button in PowerPoint for Windows and Mac: By late September 2026
• Skill and Ribbon Button in PowerPoint for the web: By early October 2026

Current channel (Preview)

• Skill and Ribbon Button in PowerPoint for Windows and Mac: By early October 2026

Worldwide

• Skill and ribbon button in PowerPoint for Windows, Mac and web: rollout will start in mid-October 2026 and is expected to complete by end of October 2026.
• Attendee interaction now available in PowerPoint Live in Microsoft Teams.

Impact on your organization

Who is affected

• PowerPoint for Windows, Mac and web users who have access to this capability.

Platforms:

• PowerPoint for Windows, Mac and web.
• Interactive slides are interactive in PowerPoint for iPad and will appear as non-interactive images in PowerPoint for iPhone and Android.

After the feature becomes available, eligible users will be able to use the Create interactive slide skill to produce or update full-slide visual experiences for scenarios such as:

• Explaining complex concepts.
• Presenting timelines.
• Comparing options or information.
• Illustrating systems and relationships.
• Communicating data visually.

Organizations participating in the Microsoft Copilot Frontier program can evaluate the preview experience before general availability. Frontier capabilities are pre-release experiences and may change before reaching general availability.

Action required / recommendations

No action is required before rollout. There are no admin settings for this capability.

A Copilot license is required.

We recommend that administrators:

• Review this information with presentation support, adoption, training, and help desk teams.
• Consider identifying Frontier participants who can evaluate the capability and provide feedback before general availability.
• Update internal PowerPoint guidance or training materials if your organization maintains standardized presentation-creation processes.
• Review the Microsoft Copilot Frontier program documentation: Get started with the Microsoft Copilot Frontier Program.

Rollout schedule

• General Availability (Worldwide): Beginning in November 2026

Impact on your organization

Who is affected

• Organizations using Microsoft Teams Rooms on Android devices.
• Users who participate in meetings on Teams Rooms on Android devices.

Platforms/Services

• Microsoft Teams
• Microsoft Teams Rooms on Android
• Teams admin center (for device app updates)

What will happen

• Users will periodically see a call quality feedback survey after meetings end on Teams Rooms on Android devices.
• Users can provide feedback on call quality, video quality, audio quality, and screen-sharing experiences.
• Feedback will be used by Microsoft to improve Teams products and services.
• The experience aligns with existing call quality surveys already available in Teams Rooms on Windows and other Teams clients.
• The feature becomes available after eligible Teams Rooms on Android devices are updated to the required app version.
• The feature is enabled by default once available.

Action required/Recommendations

No admin action is required before rollout.

Recommended actions:

• Review how this change may affect meeting room experiences in your organization.
• Update Teams Rooms on Android devices to the latest supported application version through the Teams admin center.
• Inform users that they may be prompted to provide call quality feedback after meetings.
• Update internal training materials and support documentation as appropriate.

Learn more

• Manage user feedback in Microsoft Teams - Microsoft Teams | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change store new customer data?Yes. Users can submit call quality feedback through post-meeting surveys. The post does not specify storage location, retention, or storage duration.

Rollout schedule

General Availability (Worldwide, GCC): Rollout begins in early November 2026 and is expected to complete in early November 2026.

Impact on your organization

Who is affected

• Organizations using Microsoft Edge on Windows.
• Users with Edge profiles that have not yet automatically migrated to OneAuth.
• Organizations that explicitly disabled OneAuth WAM using --disable-features=msOneAuthWAM.

Platforms/Services:

• Microsoft Edge on Windows
• Browser sign-in, identity, token fetch, Single Sign-On, and account synchronization experiences

What will happen

• Starting with Microsoft Edge version 157, all remaining profiles will transition directly to OneAuth authentication.
• The fallback legacy WAM path will default off under all circumstances.
• Most users will transition transparently.
• In rare cases, users may need to sign in to Microsoft Edge again.

Action Required/Recommendations

We recommend that admins identify unmigrated profiles and test the transition before Microsoft Edge version 157 reaches their environment.

• Navigate to edge://signin-internals in Microsoft Edge.
• Under Edge Auth Library Information > Library, confirm whether the profile shows OneAuth or WAM.
• If OneAuth is displayed, the profile is already using the modern path and no action is required.
• If WAM is displayed, the profile is still using the legacy path.

On pilot test devices running Microsoft Edge version 155 or later, admins can test the transition before version 157 by launching Edge with this force flag:

msedge.exe --enable-features=msForceOneAuthWAM

Verify that edge://signin-internals reflects OneAuth, and confirm that browser sign-in, Single Sign-On, and account synchronization work as expected.

Inform support teams that a small number of users might see a sign-in action on the profile menu after updating to Edge version 157. If users experience sign-in issues, collect OneAuth logs with:

msedge.exe --enable-features=msForceOneAuthWAM --enable-logging -v=1 --oneauth-log-level=5

Default log location: %LOCALAPPDATA%\Microsoft\Edge\User Data\chrome_debug.log

Compliance considerations

Does the change include an admin control, and can it be controlled through Entra ID group membership?Admins can validate and manage the transition through Microsoft Edge configuration and feature flags. Review your Microsoft Edge deployment and policy management practices for group-based rollout controls.

Rollout schedule

General Availability (Worldwide): We will begin rolling out on late November 2026 and expect to complete by late December 2026.

Public Preview (Worldwide): We will begin rolling out on late October 2026 and expect to complete by late November 2026.

Targeted Release (Worldwide): We will begin rolling out on late September 2026 and expect to complete by late October 2026.

Impact on your organization

This feature expands vulnerability management coverage in Microsoft Security Exposure Management (MSEM) to include CVE exposure for a curated set of Node.js, Python, and Java packages on supported Windows devices onboarded to Microsoft Defender for Endpoint. These package findings will appear within existing experiences for software components, vulnerabilities, affected devices, and security recommendations, helping security teams identify developer-package exposure alongside the software and vulnerability information they already use.

For organizations that consume vulnerability data outside the portal, the expanded coverage may also affect assessment exports and downstream integrations. The preview introduces ProductCategory to help distinguish Applications, Components, and BIOS/firmware records, while JSON integrations can explicitly include the expanded component population. Complete-file exports for enabled tenants receive the full package population, so organizations should evaluate potential changes to file volume, ingestion, and downstream processing.

The initial preview has defined coverage boundaries. It is limited to Windows, and areas such as package-native identity, dependency relationships, ownership, SBOM, VEX, reachability, and affectedness are not included. Advanced Hunting remains available, but ProductCategory support in the relevant tables may not be enabled during the initial preview phase.

Action Required/Recommendations

Before enablement, admins should identify the people, integrations, and workflows that may be affected by the expanded package population. This includes JSON and complete-file assessment exports, Delta integrations, Advanced Hunting queries and custom detections where applicable, as well as API-based extraction, dashboards, BI, SIEM, ITSM, and data-lake ingestion. Organizations should also capture a baseline of relevant workflows, including current file sizes, ingestion and processing times, so they can compare behavior before and after activation.

Admins should review each integration before opting in and validate that existing applications, components, queries, and downstream processes continue to behave as expected after enablement. For Delta integrations, a new baseline should be established when the included population changes. For complete-file exports, organizations that need to preserve their previous component population can use the Microsoft-provided Legacy Components Support List during ingestion.

Finally, organizations participating in the preview need an approved environment and enablement window, along with named practitioner, integration, and rollback contacts. Microsoft enables the bounded package population for the approved environment, after which the organization should run its assigned scenarios and report unexpected endpoint, data, query, or processing behavior.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

General Availability (Worldwide): We will begin rolling out on early November 2026 and expect to complete by mid December 2026.

Impact on your organization

These insights can help organizations better understand how bookable desks are being used and inform workplace and space planning decisions.

Action Required/Recommendations

To enable utilization analytics, a desk must have one or more associated peripheral devices and be licensed with a Microsoft Teams Shared Space or Microsoft Teams Shared Space - Single Space license.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Beginning in early October 2026 and expected to complete by early November 2026

Impact on your organization

Who is affected

• Organizations using Microsoft Teams with Microsoft Defender for Office 365
• Organizations using Microsoft Teams
• Organizations licensed for Microsoft Defender for Office 365
• Security operations teams that use Microsoft Defender XDR Advanced Hunting
• Organizations that have Zero-hour Auto Purge (ZAP) for Teams enabled can receive additional protection for eligible internal messages

Platforms and services

• Microsoft Teams
• Microsoft Defender for Office 365
• Microsoft Defender XDR Advanced Hunting

What will happen

• Teams messages containing QR codes will be analyzed after message delivery.
• URLs extracted from QR codes will be evaluated for malicious content.
• When a malicious URL is identified in an external conversation, users will see a warning on the affected Teams message.
• When a malicious URL is identified in an internal conversation, users will see a warning on the affected Teams message.
• Organizations with Microsoft Defender for Office 365 Plan 1 or Plan 2 and Teams ZAP enabled may have eligible malicious internal messages blocked through existing post-delivery protection mechanisms.
• Security teams will gain visibility into QR code URL detections through Advanced Hunting.
• URLs extracted from QR codes will appear with QRCode in the UrlLocation column of the MessageUrlInfo table.
• The feature is enabled as part of existing Teams URL protection capabilities. No separate end-user configuration is required.

Screenshot 1 - QR-code-blocking:

Screenshot 2 - QR-warning-protection:

Screenshot 3 - QR-Code Advanced Hunting:

Action required and recommendations

No action is required.

We recommend that administrators:

• Review existing Microsoft Defender for Office 365 Teams protection settings and Teams ZAP configuration to understand how blocking behavior applies in your organization.
• Inform security operations teams that QR code URL detections will become available in Advanced Hunting.
• Review your incident investigation and threat hunting processes to incorporate QR code detections where applicable.

Learn more

• Configure ZAP for Teams protection in Defender for Office 365 - Microsoft Defender for Office 365 | Microsoft Learn
• Zero-hour auto purge (ZAP) in Microsoft Teams - Zero-hour auto purge (ZAP) in Microsoft Defender for Office 365 - Microsoft Defender for Office 365 | Microsoft Learn

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

Rollout schedule

General Availability (Worldwide): Rollout begins in early October 2026 and is expected to complete in early October 2026.

Impact on your organization

Who is affected

• Users who use Copilot in PowerPoint and create or reuse skills for PowerPoint workflows.

Platforms/Services:

• Microsoft PowerPoint
• Microsoft 365 Copilot

What will happen

• Users will be able to record actions in PowerPoint to create a repeatable skill for use with Copilot in PowerPoint.
• Recorded skills can help users repeat common PowerPoint workflows more efficiently.
• The capability is part of the existing skills experience with Copilot in PowerPoint.
• The feature will become available automatically as it rolls out.

Action Required/Recommendations

No admin action is required.

You may want to:

• Inform helpdesk and training teams about the new Record a Skill capability in Copilot for PowerPoint.
• Share guidance with users who frequently repeat the same PowerPoint tasks and may benefit from creating reusable skills.
• Review the support article when it becomes available: https://aka.ms/ppt-record-a-skill.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• Now: Review current release preferences and enroll users in Frontier, Standard release, or Deferred release if needed.
• November 2026: Targeted release enrollment changes are disabled.
• November 2026: Unified release preferences experience becomes available. Update your release preferences (Frontier, Standard release, Deferred release) in the unified release preferences experience.
• January 2027: Targeted release retires. Targeted release assignments are no longer used for Microsoft 365 feature delivery.

Impact on your organization

Who is affected

• Organizations with users or tenants enrolled in Microsoft 365 Targeted release.
• Administrators who manage Microsoft 365 release preferences.

Platforms/Services:

• Microsoft 365 admin center
• Microsoft Teams
• Outlook (New)
• Outlook on the web
• Office for the Web
• Microsoft OneDrive
• SharePoint Online
• Some components of Exchange Online

What will happen

• In November 2026, administrators can no longer add, remove, or modify Targeted release assignments.
• In November 2026, administrators can configure Frontier, Standard release, and Deferred release preferences from a single unified release preferences experience in the Microsoft 365 admin center.
• Users currently assigned to Targeted release will continue receiving eligible Microsoft 365 features through existing Targeted release assignments until Targeted release is retired.
• Targeted Release retires in January 2027, and Targeted release will no longer used for Microsoft 365 feature delivery.
• After retirement, feature rollout timing follows your configured Frontier, Standard release, or Deferred release preference.

Action Required/Recommendations

Before November 2026, administrators should complete the following actions:

• Identify and update users currently assigned to Targeted release before enrollment changes are disabled. In the Microsoft 365 admin center, go to Settings > Org settings > Organization profile > Release preferences.
• Evaluate and select the appropriate Standard release or Deferred release preference for your organization under Copilot > Settings > View all > Copilot Release preferences: General availability.
• Evaluate Frontier and, where appropriate, enroll eligible users who require early access to preview experiences under Copilot > Settings > View all > Copilot Frontier.
• Review the Learn documentation on Targeted release retirement for detailed transition guidance.
• Notify change management teams, support teams, security and compliance teams, pilot groups, and key IT stakeholders about the upcoming retirement and required transition actions.

In November 2026, release preferences for Frontier, Standard release, and Deferred release can be managed through the unified release preferences experience in the Microsoft 365 admin center. Also, the current experience for managing Standard release and Deferred release preferences will be retired when the unified release preferences experience becomes available. Additional details about related admin experience changes will be shared in a future Message center post.

Additional Resources

• Configure new Standard and Deferred release options for Microsoft 365
• Plan for the Retirement of Targeted Release in Microsoft 365

Compliance considerations

• Does the change include an admin control, and can it be controlled through Entra ID group membership? Administrators will manage release preferences through the Microsoft 365 admin center and should evaluate user/group assignment needs for Frontier, Standard release, and Deferred release.
• Does the change alter how admins can monitor, report on, or demonstrate compliance activities? Organizations should update internal release-management and readiness processes because Targeted release assignments will no longer be used after retirement.

Rollout schedule

• General Availability (Worldwide, GCC, GCC High, DoD): Rolling out early October 2026 (previously mid-September) through end of November 2026 (previously late October)

Impact on your organization

Who is affected: All users who share or manage files and folders in Microsoft 365.

Platforms and services: SharePoint, OneDrive, and Microsoft 365 file-sharing experiences.

What will happen

• Every file and folder will have a single primary sharing link, called the hero link, displayed in the sharing dialog.
• The hero link settings determine who can access the item beyond people who are explicitly granted access.
• Adding people directly to a file or folder remains unchanged and continues to be the simplest way to share content.

Screenshot - Add people screen when sharing

• By default, the hero link is set to Only people added to the file, meaning the link itself does not grant access to anyone.

Screenshot - Share file view with hero link

• Users can broaden access to people in the organization with the link or, where permitted by organizational policy, to anyone with the link.
• Users can choose whether recipients can view, edit, or view without downloading, depending on available permissions.
• Changing the audience for the hero link updates the existing link rather than creating a new one.
• If recipients cannot open a previously shared file, the sender can expand access on the same hero link without redistributing a new URL.
• Existing sharing links will continue to function and will appear under Other links in the sharing dialog.
• Effective access remains the most permissive combination of direct permissions, inherited permissions, group-based permissions, and link-based permissions.
• Users will see a tutorial experience upon opening the new share dialog for the first time.

Action required/Recommendations

No action is required before rollout.

Organizations should consider the following preparation activities:

• Review internal sharing guidance and end-user documentation to reflect the new single-link sharing model.
• Communicate the updated sharing experience to users who regularly collaborate across teams and organizations.
• Evaluate site-level default sharing settings where different sharing behaviors are required.

Learn more

• Walkthrough Video: https://www.youtube.com/watch?v=3RpE0KrQmcA&t=4s
• Announcement Blog: https://techcommunity.microsoft.com/blog/onedriveblog/simple-smart-and-secure-the-next-step-in-sharing-files-in-microsoft-365/4411655

Admin controls

• Administrators can configure the default audience for the hero link at the SharePoint site collection or OneDrive level by using the DefaultMainLinkScope parameter in SharePoint PowerShell.
• Supported values are:
  • OnlyPeopleAdded (default)
  • Organization
• There is currently no tenant-wide equivalent setting for the hero link audience.
• DefaultMainLinkScope controls only the default audience and does not prevent users from broadening access when allowed by policy.
• Hero links start with view permissions by default.
• Existing default sharing link settings and link expiration policies continue to apply to legacy links and do not govern hero links.

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

Rollout schedule

General Availability (Worldwide): We have decided not to move forward with this change at this time.

Impact to your organization

Who is affected

1. Global Administrators and People Administrators responsible for profile card management.
2. Organizations with users whose profile data includes one or more of the affected properties.

Platforms/Services

1. Microsoft 365 Profile Cards
2. Microsoft Entra ID
3. Microsoft 365 Organizational Data
4. Microsoft Entra People Graph Connectors
5. Microsoft Graph profile card management APIs
6. Microsoft 365 admin center

What will happen

1. The 11 listed properties will automatically appear on profile cards when the corresponding attributes contain data.
2. The change is enabled by default.
3. Attributes sourced from Microsoft Entra ID, Microsoft 365 Organizational Data, and Microsoft Entra People Graph Connectors follow the same visibility behavior.
4. No changes are made to underlying attribute values or source systems.
5. No changes are required from end users.
6. Tenants that have never configured profile card settings will automatically receive the new default visibility behavior.
7. Only properties with populated values will appear on profile cards.

Action Required/Recommendations

If your organization does not want specific properties displayed on profile cards, action is recommended before October 31, 2026.

Review current profile card configuration

Use Microsoft Graph to review existing profile card property settings:

HTTP

For each property, you can use the property mappings below:

Important: Each property requires a separate Microsoft Graph API call. Bulk enable or bulk disable operations are not currently supported. You can find more on using Microsoft Graph APIs for showing and hiding profile card attributes here. Recommended Administrator Actions

1. Verify your current profile card configuration using Microsoft Graph and review which of the affected properties contain data in your tenant.
2. Use Microsoft Graph Profile Card APIs to hide any properties that should remain unavailable to users before rollout begins on October 31, 2026.
3. Communicate the upcoming change to help desk and support teams.

After rollout, administrators can continue managing profile card visibility through Microsoft 365 admin center > People settings > Profile cards. Changes made can take up to 24 hours to be reflected on profile cards across Microsoft 365 experiences.

Rollout schedule

• Frontier Preview: Available starting in mid-June 2026.
• General Availability: GA release will now be tracked separately in an upcoming MC post.

Impact on your organization

Who is affected

• Organizations enrolled in the Microsoft 365 Copilot Frontier program
• Users with Microsoft 365 Copilot licenses, particularly legal professionals (for example, in-house counsel, contract managers, legal ops)

Organizations not enrolled in the Frontier program are not impacted.

Platforms/Services

• Microsoft Word (Copilot) – desktop
• Microsoft 365 Copilot (Frontier)

What will happen

• Copilot for Legal will be available in Copilot Chat in Word via the “+” (plus) menu.
• Users can:
  • Review contracts to identify risks and non-standard clauses
  • Generate redlines using Word tracked changes
  • Compare clauses against internal legal playbooks
  • Analyze document sections for compliance with internal standards
  • Receive responses grounded in document content with citations
• The feature is enabled by default for tenants enrolled in Frontier.
• No separate installation is required.
• The feature is available immediately after users update to a supported version of Word.
• Availability depends on:
  • Frontier program enrollment
  • Microsoft 365 Copilot licensing
• There is no dedicated admin or user toggle to disable this feature
• Access is controlled through Frontier enrollment and Copilot license assignment.

Action Required / Recommendations

No action is required if you do not plan to use this feature.

If you plan to use this feature:

• Enroll your tenant in the Frontier Public Preview program.
• Ensure Microsoft 365 Copilot licenses are assigned to eligible users.
• Review internal legal workflows that may benefit from:
  • Contract analysis
  • Playbook-based reviews
  • AI-assisted redlining
• Communicate this capability to legal teams.
• Update internal documentation or helpdesk guidance if applicable.

Compliance considerations

QuestionAnswerDoes the change alter how existing customer data is processed, stored, or accessed (such as documents, emails, chats, etc.)? If so, how and to what extent?Yes. Copilot for Legal processes existing document content in Word to analyze contracts, compare clauses to internal playbooks, and generate suggested edits.Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? If so, summarize the changes.Yes. The change introduces Copilot for Legal within Microsoft 365 Copilot that uses AI to interact with and analyze customer document data.Does the change provide end users any new way of interacting with generative AI? If so, how?Yes. The change provides a new interaction surface through Copilot for Legal in Copilot Chat in Word, enabling users to generate and review contract insights using AI.

For more information visit Get Started with Copilot for Legal in Word and Transparency Documentation

When this will happen

• General Availability (Worldwide): Effective July 2, 2026, the rollout is 100% complete across all regions in the Public cloud.
• General Availability (GCC High): We expect to start the rollout by mid-August 2026 and complete by late-August 2026 (previously late-July).
• General Availability (GCC and DoD): We expect to complete the rollout by mid-October 2026 (previously late-August).
• Device management deprecation in TAC: The deprecation of Teams device management capabilities in TAC will begin in October 2026 and will roll out in phases based on device type and feature readiness.
  • For public cloud, we will begin the phased deprecation of SIP device management this week. The rollout will occur in stages and is expected to be fully completed by next week.
  • The current planned sequence is: SIP devices → Teams Phones → Teams Rooms on Android & Teams Panels
  • For government clouds, the deprecation rollout will follow the readiness of the respective environments. GCCH will follow the public cloud rollout, while GCC and DoD customers will have a migration period after the required convergence features become available.

How this affects your organization

Who is affected

Admins who manage Teams Rooms on Android, Teams phones, Teams panels, and SIP Phones.

What will happen

• By end of June 2026, Android device management capabilities, including inventory, updates, health monitoring, and settings will transition from TAC to PMP for the device types, Teams Rooms on Android, Teams phones, Teams panels and SIP Phones.
• The following capabilities will be available and enhanced in PMP:
  • Device inventories for Android-based Teams Rooms, phones, and panels, including metadata and app information
  • Remote device actions (restart, log collection, sign-in/out, provisioning, and more)
  • Update management
  • Device settings management
  • Device health monitoring
  • SIP device management
• PMP will become the primary portal for all Teams device management. By November 2026, overlapping TAC capabilities (updates, settings, restart, sign-in/out, log collection, provisioning) will be deprecated in TAC.
• The article below serves as the main information source for this transition. It has been updated with the latest timelines, milestones, migration guidance, and readiness steps. We will keep updating it as the rollout progresses.
  • Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal - Microsoft Teams | Microsoft Learn

What you need to do to prepare

• Monitor the below article for any feature specific updates and timelines. This article also provides migration guidance and pre-requisites for successful transition to PMP.
  • Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal - Microsoft Teams | Microsoft Learn
• Learn more about Pro Management portal features with these Teams Rooms Pro Management short YouTube videos.
• Update internal helpdesk and IT documentation to reference PMP as the new management portal.

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

Rollout schedule

General Availability (Worldwide): We will begin rolling out on mid-November 2026 and expect to complete by early December 2026.

Targeted Release (Worldwide): We will begin rolling out on mid-October 2026 and expect to complete by late October 2026.

General Availability (GCC, GCC High, DoD): We will begin rolling out on mid-November 2026 and expect to complete by mid-December 2026.

Impact on your organization

Who is affected

• Users of new Outlook for Windows and Outlook on the web.
• Help desk and training teams that support Outlook messaging experiences.

Platforms/Services:

• Exchange Online.
• New Outlook for Windows and Outlook on the web.

What will happen

• Users can configure Outlook to check spelling automatically before sending email.
• This can help reduce spelling mistakes in sent messages without requiring users to manually start spell check for each message.
• The capability will roll out automatically during the scheduled rollout window.
• This feature requires Connected Experiences to be enabled. Users who have Connected Experiences disabled will not be able to use automatic spell checking before sending email.

Action Required/Recommendations

• Confirm that your organization’s privacy policies allow the use of connected experiences in Office.
• Inform users that they can enable spell check before sending if they want Outlook to review spelling automatically.
• Update internal Outlook training or help desk guidance if it describes message composition settings.

Compliance considerations

This feature requires Connected Experiences in Office. Review as appropriate for your organization.

Rollout schedule

• Worldwide: Beginning in early November 2026 and expected to complete by mid-November 2026

The rollout will occur progressively. Until the update reaches your tenant, Microsoft Purview may continue to display the current setup experience or indicate that Intune multi-admin approval is not supported.

Impact on your organization

Who is affected

• Organizations using Microsoft Purview collection or DLP policies to monitor and protect supported activities with unmanaged cloud apps in Microsoft Edge for Business
• Organizations using Microsoft Intune multi-admin approval
• Organizations that require coordination between Purview and Intune administrators

Platforms/services

• Microsoft Purview
• Microsoft Intune
• Microsoft Edge for Business

What will happen

• Microsoft Purview inline protection for unmanaged apps will support tenants that use Intune multi-admin approval.
• Required Intune configuration changes will continue through your existing multi-admin approval process.
• Microsoft Purview will not bypass Intune approval requirements.
• The Microsoft Purview portal will provide clearer setup status information, more detailed error information, and guidance about actions required to complete activation.
• When Intune administrator assistance is required, a Purview administrator can send a task to the appropriate Intune administrator.
• Sending a task does not grant permissions, bypass approval requirements, or automatically complete requested Intune changes.
• Protection may remain pending or inactive until required Intune approvals or administrator actions are completed.
• You do not need to migrate or recreate existing collection or DLP policies.
• This update does not expand supported applications, browsers, activities, licenses, devices, or cloud environments.
• Existing DLP enforcement behavior remains unchanged.

Action required and recommendations

No action is required before rollout.

After the update reaches your tenant, if Microsoft Purview indicates that administrator action is required:

• Review the status and error details in the Microsoft Purview portal to identify the required next step.
• In Microsoft Purview, send a task to the appropriate Intune administrator and have that administrator complete the requested action.
• Return to Microsoft Purview, review the request status, and complete any remaining steps.
• Check again after approximately one hour to confirm the supporting configuration and activation status are complete and that the error no longer appears.

If your organization does not use Intune multi-admin approval and your policies are already active, no action is required.

For questions or support, contact your Microsoft account representative or Microsoft Support.

Learn more

• Centrally manage Admin Tasks - Microsoft Intune | Microsoft Learn
• Learn about Data Loss Prevention for Cloud Apps in Edge for Business | Microsoft Learn
• Use Multi Admin Approval in Intune - Microsoft Intune | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change alter how administrators can monitor, report on, or demonstrate compliance activities, for example, through Microsoft Purview or administrator reporting?Yes. Administrators will receive clearer setup status information, more detailed error information, remediation guidance, and task-based coordination between Microsoft Purview and Microsoft Intune administrators.

Rollout schedule

• General Availability (Worldwide, GCC, GCC High, DoD): This change has already been implemented.

Impact on your organization

Who is affected

• Users of new Outlook for Windows and Outlook on the web.

Platforms and services

• Exchange Online.
• New Outlook for Windows
• Outlook on the web

What will happen

• Outlook will no longer generate preview cards for web links that have been inserted or pasted into email messages. Links will continue to function as standard clickable hyperlinks.

Action required and recommendations

No action is required. We recommend that you inform users that link preview cards will no longer be automatically generated when composing email messages.

Rollout schedule

• General Availability (Worldwide and GCC): Rollout begins in early November 2026 and is expected to complete by late November 2026.

Impact on your organization

Who is affected

• Organizations using Microsoft Viva Insights report publishing capabilities.
• Analysts, chief officers, managers, delegates, Insights Admins, and Global Admins.
• Users who receive published Viva Insights reports.

Platforms and services

• Microsoft Viva Insights
• Power BI reports available through the Viva Insights Reports tab

What will happen

• All analysts and leaders will be able to publish Power BI reports that are available to them in the Reports tab.
• Users can publish either default or customized reports available to them.
• Publishers can define the audience, report title, description, and publication end date.
• Recipients will receive an email notification when a report is published to them, and can access published reports from the Viva Insights Reports tab.
• Published reports can be shared using either:
  • Unfiltered publish, where recipients view the report using the full data scope available for that report.
  • Manager-hierarchy publish, where recipients view the report based on the applicable manager hierarchy.
• If a published report is configured to refresh weekly or monthly, the underlying query will continue to refresh until the publication end date.
• Analysts and leaders will be able to manage published reports through the Manage publishes option.
• Recipients can view and interact with published reports but cannot download reports, access row-level data, modify or manage publications, extend access, or republish reports.
• If a publisher loses the qualifying role used to publish the report, recipients will retain access until the publication expires.
• The existing Analyst report publish feature access control will be renamed to Report publish. This control will govern report publishing for analysts and leader personas, remains managed by Global Admins and Insights Admins, and is on by default.
• Insights Admins will have visibility into published reports through the Admin Publish Reports experience, including the ability to view and remove publications and publish reports on behalf of users.

Setting up report properties prior to publishing

View and manage published reports

Action required and recommendations

No action is required. We recommend that you review your organization's report publishing governance and processes prior to rollout.

Learn more

• Publish reports | Microsoft Learn

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Rollout begins in mid-October 2026 and is expected to complete by mid-October 2026.

Impact on your organization

Who is affected

• Administrators who manage Microsoft 365 Backup

Platforms and services

• Microsoft 365 Backup
• SharePoint Online
• OneDrive
• Exchange Online

What will happen

• Activity logs will be available for Microsoft 365 Backup actions across supported workloads, including SharePoint Online, OneDrive, and Exchange Online.
• Activity log entries will include metadata such as service, activity type, status, impact, policy or restore task details, timestamps, and the administrator who performed the action.
• Administrators will be able to:
  • Filter logs by service, activity type, activity status, impact, and date range.
  • Search activity logs using free text.
  • Export filtered or searched logs to CSV for offline review, reporting, and compliance workflows.
• Role-based access controls will apply. Administrators will only be able to view logs for workloads they are authorized to manage.
• To access this feature:

1. Go to the Microsoft 365 admin center.

2. Open Microsoft 365 Backup.

3. Select Recent activities to open the Activity logs page.

4. Use the date selector, search, or filters to review activity. Select Export to download the current result.

Activity logs in the Microsoft 365 admin center

Action required and recommendations

No action is required. We recommend that you inform your backup administrators that activity monitoring for Microsoft 365 Backup will be available directly within the product.

Learn more

We will update this post with new documentation.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Available now

Impact on your organization

Who is affected

• Brand Managers
• Brand Kit owners with access to Brand Kit

Platforms and services

• Brand Kit

What will happen

• Brand Managers and Brand Kit owners can create a new Brand Kit by duplicating an existing one.
• The duplicated Brand Kit can be used as a starting point and customized as needed.
• This capability reduces manual effort when creating multiple Brand Kits with similar branding requirements.
• The feature is available to Brand Managers and Brand Kit owners with access to Brand Kit.

Action required and recommendations

No action is required.

You may want to:

• Inform Brand Managers and Brand Kit owners about this new capability.
• Review any internal documentation or processes related to Brand Kit creation and management.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Available now

Impact on your organization

Who is affected

• Brand Kit owners using Microsoft Create Brand Kits
• Users who have been granted access to shared Brand Kits

Platforms and services

• Microsoft Create
• Brand Kits

What will happen

• Brand Kit owners can modify sharing permissions after sharing a Brand Kit.
• Owners can change a user's access level between view and edit.
• Owners can remove access for users who no longer require it.
• Improved sharing controls are available when Brand Kit owners manage access to shared Brand Kits.

Action required and recommendations

No action is required.

You may want to:

• Inform Brand Kit owners that sharing permissions can be modified after a Brand Kit is shared.
• Review internal guidance for Brand Kit ownership and access management, if applicable.

Compliance considerations

This change provides Brand Kit owners with additional controls for managing access to shared Brand Kits. Owners can change a user's access level between view and edit or remove access after a Brand Kit has been shared. Review as appropriate for your organization.

Rollout schedule

• Public Preview (Worldwide): The public preview of this feature is available now to all commercial tenants.
• General Availability (Worldwide): Rollout begins in early November 2026 and is expected to complete by early December 2026.

Impact on your organization

Who is affected

• Microsoft 365 commercial tenant administrators who manage OneDrive storage.
• Organizations with OneDrive users approaching or exceeding their licensed storage quotas.

Platforms and services

• OneDrive
• Microsoft 365 admin and storage management experiences

What will happen

• Administrators will be able to control which accounts are enabled to use a pay-as-you-go model to provide additional OneDrive storage beyond their licensed storage quotas.
• Accounts enabled for storage consumption above their licensed storage quotas will be billed automatically based on usage.

Action required and recommendations

No action is required if you do not wish to use pay-as-you-go storage for your organization. We recommend that you:

• Identify OneDrive accounts approaching or exceeding their licensed storage quotas.
• Evaluate whether pay-as-you-go storage is appropriate for your organization.

Learn more

• Buy More OneDrive and SharePoint Storage Capacity | Microsoft Learn

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

When this will happen

We'll be gradually rolling out this update of Microsoft 365 Apps to users on that update channel starting October 6th, 2026 (PST).

How this will affect your organization

If your Microsoft 365 Apps clients are configured to automatically update from the Office Content Delivery Network (CDN), then no action is required.

If you manage updates directly you can now download this latest update and begin deployment.

What you need to do to prepare

To get more details about this update view the following release notes:

• Current Channel

Rollout schedule

Public Preview (Worldwide): We will begin rolling out on late October 2026 (previously late September) and expect to complete by late October 2026 (previously late September).

General Availability (Worldwide): We will begin rolling out late November 2026 (previously late October) and expect to complete by late November 2026.

Impact on your organization

Who is affected

• Administrators using Microsoft Agent 365 and Connected platforms
• Organizations synchronizing agents from Amazon Bedrock Classic, Amazon Bedrock AgentCore, Google Vertex AI, or Anthropic Claude Managed Agents (preview)

Platforms/Services

• Microsoft Agent 365
• Connected platforms
• Amazon Bedrock Classic
• Amazon Bedrock AgentCore
• Google Vertex AI
• Anthropic Claude Managed Agents (preview)

What will happen

• Agent 365 can collect observability data from supported third-party agent platforms.
• Collected activity appears on each synchronized agent's Activity tab.
• Runs, sessions, tool calls, and exceptions are mapped to the Agent 365 observability model.
• Existing connections continue syncing agents as they do today.
• Collection remains disabled for existing connections until an administrator enables it.
• A new Collect agent observability data setting is available when creating or editing a supported connection.
• The setting is enabled by default for new connections.
• Agent 365 reads activity using existing connection credentials and does not execute agents.
• Third-party providers may charge for tracing, storage, logging, or query services.
• The Users metric is unavailable for synchronized third-party agents because Microsoft Entra identities are not provided by supported platforms.

Action Required/Recommendations

• No action is required for existing connections.
• Enable Collect agent observability data on existing connections if observability is desired.
• Validate source platform permissions and telemetry configuration.
• Clear the Collect agent observability data option during setup if collection is not desired for a new connection.

Platform Requirements

• Amazon Bedrock Classic: Enable trace capture to Amazon S3 and grant read access to the activity bucket.
• Amazon Bedrock AgentCore: Enable CloudWatch Transaction Search and grant access to query CloudWatch log groups.
• Google Vertex AI: Assign required BigQuery, Monitoring, and Cloud Trace roles; enable APIs; enable telemetry collection and Trace Analytics BigQuery export.
• Anthropic Claude Managed Agents (preview): No additional setup required.

Compliance considerations

Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data?Yes. The feature uses AI/ML or agent capabilities with Microsoft 365 content, prompts, or service data as described in this message.Does the change introduce or significantly modify any capability that enables users to automate workflows through AI or bot agents?Yes. The feature introduces or updates agent-related AI capabilities as described in this message.Does the change include an admin control and, can it be controlled through Entra ID group membership?Yes. The feature includes or affects admin controls, policies, permissions, roles, authentication, or management settings as described in this message. Review the linked documentation or admin center controls for group-based configuration support.

Rollout schedule

• Targeted Release: Beginning in late October 2026 and expected to complete by late November 2026
• General Availability (Worldwide, GCC, GCC High, DoD): Beginning in late October 2026 and expected to complete by late November 2026

Impact on your organization

Who is affected

• Organizations using Microsoft Teams external access (federation)
• This change applies only to organizations where the setting has not been explicitly configured. Any customers who have left the configuration in the default state will be impacted.
• Users participating in external 1:1 chats, external group chats, and meeting chats

Platforms and services

• Microsoft Teams
• External (federated) 1:1 chats
• External (federated) group chats
• Meeting chats
• Teams desktop app
• Teams web app

What will happen

• The ability for users to attach and share files in external chats will be enabled for all Microsoft 365 tenants, unless your organization has previously explicitly disabled this setting in Teams. Any customers who have left the configuration in the default state will be impacted.
• Users can already paste file links into external chants. This ability is unchanged. With this change, users will also have the ability to attach and share files using the paperclip option or drag and drop in external (federated) chats.
• Files shared through these experiences continue to be stored and shared through OneDrive or SharePoint. Files uploaded from a user’s device are stored in the sender’s OneDrive, while existing cloud files remain in their current location.
• When automatic permission assignment is enabled, Teams assigns permissions to participants in the external chat for files uploaded using paperclip or drag-and-drop, subject to existing OneDrive and SharePoint policies.
• Senders can review, modify, or remove sharing permissions before sending a file.
• Senders can continue to modify or revoke access after a file has been shared.
• Automatic permission assignment applies only to files shared through the paperclip or drag-and-drop experience.
• The files will be shared as hyperlinks after send.
• Existing OneDrive and SharePoint sharing controls continue to govern access.
• Existing sensitivity labels, domain restrictions, and security protections continue to apply.

Action required and recommendations

No action is required to preserve external-sharing restrictions already configured in OneDrive and SharePoint; this update does not change those restrictions. To review or change these controls, see Manage sharing settings for SharePoint and OneDrive in Microsoft 365.

To disable file attachments in external chats

To opt out of this change, apply the following Teams PowerShell setting if you have not already explicitly configured this setting:

Set-CsTeamsFilesPolicy -Identity Global -FileSharingInChatsWithExternalUsers Disabled

Verify the setting:

Get-CsTeamsFilesPolicy | Select Identity, FileSharingInChatsWithExternalUsers

Recommended actions:

• Review your SharePoint, OneDrive, and Microsoft Entra external sharing configuration because these settings continue to govern what external recipients can access.
• Inform helpdesk and support teams about the updated attachment experience and the distinction between Teams attachment controls and OneDrive/SharePoint access controls.
• Update user training and internal documentation as needed.
• Communicate to users that:
  • They can attach files directly in chats with people outside the organization.
  • When automatic permission assignment is enabled, Teams assigns chat participants access to files shared via paperclip icon, subject to existing OneDrive and SharePoint policies. Senders can review, modify, or remove access before sending.
  • Pasted file links retain their existing permissions.
  • Files uploaded to external chats are stored in the sender's OneDrive and display.

Optional configuration to allow attachments without automatic permission assignment:

To disable automatic permission assignment while continuing to allow file attachments in external chats:

Set-CsTeamsMessagingPolicy -Identity Global -AutoShareFilesInExternalChats Disabled

If automatic permission assignment is disabled, users may need to manually grant access to shared files before external recipients can open them.

Allow several hours for policy changes to propagate before users see the updated experience.

Learn more

• Share files and Loop in external chats - Microsoft Teams | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change alter how existing customer data is processed, stored, or accessed?Yes. Uploaded files shared through Attach or drag-and-drop can automatically receive permissions for participants in external chats. Existing OneDrive and SharePoint controls continue to govern access. Uploaded files are stored in the sender’s OneDrive.Does the change provide a new way of communicating between users, tenants, or subscriptions?Yes. The direct file-attachment experience in external (federated) chats becomes available by default; the existing ability to paste file links remains unchanged.Does the change include an admin control, and can it be controlled through Entra ID group membership?Yes. Admins can separately control Teams file attachments and automatic permission assignment through Teams PowerShell policies. OneDrive and SharePoint sharing settings continue to govern external file access.

Rollout schedule

General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out mid-November 2026 (previously late September) and expect to complete by mid-November 2026 (previously late September).

Impact on your organization

This feature helps organizations extend Microsoft Purview Data Loss Prevention protections to calendar events created in Outlook for Mac. Users receive policy guidance before sending meeting invitations that contain sensitive information, helping reduce accidental data exposure and improve compliance. Organizations benefit from more consistent protection across email and calendar workflows while supporting regulatory and corporate data protection requirements.

Action required, Recommendations

No administrator action is required to prepare for this feature. Existing Microsoft Purview Data Loss Prevention policies will automatically apply to supported calendar events in Outlook for Mac. Organizations with DLP policies already configured can benefit from expanded protection of calendar content without additional policy creation or client configuration. Administrators may choose to review existing DLP policies to ensure they align with their organization's compliance requirements.

Rollout schedule

General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out mid-November 2026 (previously late September) and expect to complete by mid-November 2026 (previously late September).

Impact on your organization

This feature helps organizations extend Microsoft Purview Data Loss Prevention protections to calendar events created from Outlook for iOS and Android. Users receive policy guidance before sending meeting invitations that contain sensitive information, helping reduce accidental data exposure and improve compliance. Organizations benefit from more consistent protection across email and calendar workflows while supporting regulatory and corporate data protection requirements.

Action required / Recommendations

No administrator action is required to prepare for this feature. Existing Microsoft Purview Data Loss Prevention policies will automatically apply to supported calendar events in Outlook for iOS and Android. Organizations with DLP policies already configured can benefit from expanded protection of calendar content without additional policy creation or client configuration. Administrators may choose to review existing DLP policies to ensure they align with their organization's compliance requirements.

Rollout schedule

General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out mid-November 2026 (previously late September) and expect to complete by mid-November 2026 (previously late September).

Impact on your organization

This feature helps organizations reduce the risk of sensitive information being sent before Microsoft Purview DLP policies can be evaluated. Administrators can require users to wait for policy inspection and configure the maximum wait time based on organizational requirements. This improves policy enforcement and compliance while allowing organizations to balance security, performance, and user productivity.

Action required / Recommendations

Administrators can review their existing Microsoft Purview Data Loss Prevention policies and determine whether wait-on-send enforcement is appropriate for their organization. To take advantage of this feature, administrators may enable and configure the desired wait period within supported DLP policies. No changes are required for organizations that do not plan to use wait-on-send enforcement.

Rollout schedule

General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out in mid-November 2026 (previously late September) and expect to complete by mid-November 2026 (previously late September).

Impact on your organization

This feature helps organizations reduce the risk of sensitive information being sent before Microsoft Purview DLP policies can be evaluated. Administrators can require users to wait for policy inspection and configure the maximum wait time based on organizational requirements. This improves policy enforcement and compliance while allowing organizations to balance security, performance, and user productivity.

Action required / Recommendations

Administrators can review their existing Microsoft Purview Data Loss Prevention policies and determine whether wait-on-send enforcement is appropriate for their organization. To take advantage of this feature, administrators may enable and configure the desired wait period within supported DLP policies. No changes are required for organizations that do not plan to use wait-on-send enforcement.

Rollout schedule

• General Availability (Worldwide, GCC, GCC High, DoD): Rollout will begin in mid-November 2026 (previously late September) and is expected to complete in mid-November 2026 (previously late September).

Impact on your organization

Who is affected

• Users who compose email messages in Outlook for Mac.
• Organizations that use Microsoft Purview sensitivity labels.

Platforms and services

• Outlook for Mac
• Microsoft Purview Information Protection

What will happen

• When users attach files that already have Microsoft Purview sensitivity labels, Outlook for Mac can automatically apply or recommend an appropriate sensitivity label for the email message.
• Email classification can better align with the sensitivity of attached content.
• Depending on your organization's label policies, users may see sensitivity label recommendations or automatic label application while composing messages.
• This capability helps reduce manual labeling effort and promotes a more consistent information protection experience across Outlook clients.

Action Required / Recommendations

No admin action is required.

We recommend that organizations using Microsoft Purview sensitivity labels:

• Review existing sensitivity label publishing and protection policies.
• Validate that attachment-based label inheritance behavior aligns with organizational compliance and information protection requirements.
• Inform compliance, security, and support teams of the upcoming change so they can address user questions.

Compliance considerations

IssueExplanationMicrosoft Purview labeling behaviorThis change affects how Microsoft Purview sensitivity labels may be applied or recommended for email messages based on the sensitivity labels of attached files.Information protection and compliance workflowsOrganizations should verify that automatic or recommended label inheritance aligns with their existing classification and protection requirements.

Rollout schedule

• General Availability (Worldwide, GCC, GCCH, DoD): Rollout will begin early September 2026.

Impact on your organization

Who is affected

• Users licensed for and able to access Copilot in Word.

Platforms and services

• Microsoft Word
• Microsoft 365 Copilot in Word

What will happen

• The existing Top of Doc summarization experience will move to other Copilot surfaces in Word.
• In supported scenarios, users may see a proactive “Summarize this document” suggestion within the Copilot experience.
• Selecting the suggestion will generate a summary of the current document in Copilot.
• Users can open Copilot in Word and request a summary using natural language prompts, such as “Summarize this document.”
• The underlying document summarization capability will remain available; only the access experience is changing.

Action Required/Recommendations

No admin action is required.

We recommend that you:

• Inform users that document summarization is moving from the Top of Doc experience to other Copilot surfaces in Word.
• Update internal training materials, adoption content, and help desk documentation that reference Top of Doc summarization.
• Encourage users to access summaries through Copilot in Word by using the “Summarize this document” suggestion or a natural language prompt.

Suggested user communication

Document summaries in Word will continue to be available through Copilot, but the existing Top of Doc summary experience is being retired. To generate a summary, open Copilot in Word and ask Copilot to summarize the current document.

Compliance considerations

• End users have a new way to interact with generative AI: The summarization capability remains AI-powered and will be accessed through Copilot interactions and prompts.
• User workflow change: Users will access the same summarization capability through different Copilot entry points, which may require user awareness and updated training materials.

No other compliance considerations identified based on the information provided. Review as appropriate for your organization.

Rollout schedule

• Public Preview: Beginning mid-August 2026 and expected to complete by late September 2026
• General Availability (Worldwide): Beginning late October 2026 (previously late September) and expected to complete by mid-November 2026 (previously late September)

Impact on your organization

Who is affected

• Organizations with 50 or more Copilot licenses
• Users assigned the CxO or CxO-delegate role in the Copilot dashboard
• Organizations using Microsoft Viva Pulse and the Copilot dashboard

Platforms and services

• Microsoft Viva Pulse
• Copilot dashboard
• Microsoft Viva Insights

What will happen

• The feature will be enabled by default for eligible organizations.
• Survey results appear in your existing Pulse and dashboard surfaces.
• Authorized users with the CxO or CxO-delegate role can send Viva Pulse surveys to predefined Copilot user cohorts from the Copilot dashboard.
• Available survey audiences include:
  • All Copilot Licensed Users
  • All Copilot Active Users
• Survey audiences will be generated using Copilot dashboard data and respect supported dashboard filters.
• Individual employee identities are not exposed through audience selection.
• Viva Insights exclusion lists continue to be honored for survey distribution.

Action required and recommendations

No action is required to enable this feature.

We recommend that administrators:

• Review who has been assigned the CxO or CxO-delegate role in the Copilot dashboard.
• Inform change leaders that targeted audience surveys are available.
• Verify that Viva Insights exclusion lists are current and accurately reflect users who should be excluded from surveys.

Administrators can disable this feature in the Microsoft 365 admin center by navigating to Setup > Microsoft Viva > Feature access management > Viva Pulse and turning off Targeted Audience Surveys.

Compliance considerations

QuestionAnswerDoes this change include an admin control?Yes. Administrators can disable the feature through Feature access management in Microsoft Viva Pulse.Does this change affect how users communicate or provide feedback within Microsoft 365?Yes. This feature provides a new method for authorized users to collect employee feedback by sending Viva Pulse surveys to predefined Copilot user audiences from Copilot dashboard.Does this change process customer or organizational data in a new way?Yes. Survey audiences are generated using Copilot dashboard data and existing audience filters to identify eligible recipients for Viva Pulse surveys.Can users be assigned access to this feature through role-based permissions?Yes. Only users assigned the CxO or CxO-delegate role in Copilot dashboard can create surveys for the predefined Copilot audiences.

Rollout schedule

• Worldwide: We have decided not to move forward with this change at this time.

Impact on your organization

Who is affected

• Administrators who create, edit, or review Microsoft Purview DLP policies that target managed apps (Enterprise applications and devices -> Managed cloud apps) in Microsoft Edge for Business

Platforms and services

• Microsoft Purview Data Loss Prevention
• Microsoft Edge for Business
• Managed app protections

What will happen

• The developer tools (debug tools) protection will appear as a visible activity within applicable managed app DLP rules.
• The protection remains enabled by default and continues to block access to developer tools in Edge for Business.
• Admins cannot modify this protection.
• New managed app DLP rules will display the activity when created.
• Existing managed app DLP rules will display the activity after the next edit and save operation.
• DLP enforcement behavior is unchanged.
• Existing policies continue to function exactly as they do today.
• Users will experience no changes.

Action required and recommendations

No action is required.

Recommended actions:

• Inform DLP administrators that the developer tools protection will now be visible within managed app DLP rules.
• Update any internal documentation that describes managed app DLP rule configuration, if applicable.
• Review the Microsoft documentation for managed app interactions.

Learn more

• Policies for managed app interactions - Learn about Data Loss Prevention for Cloud Apps in Edge for Business | Microsoft Purview | Microsoft Learn
• Help prevent users from sharing sensitive information with cloud apps in Microsoft Edge for Business | Microsoft Purview | Microsoft Learn

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• Targeted Release: Beginning in early November 2026 (previously early October) and expected to complete by early November 2026 (previously early October)
• General Availability (Worldwide, GCC, GCC High, DoD): Beginning in early November 2026 and expected to complete by end of November 2026 (previously mid-November)

Impact on your organization

Who is affected

• Teams Phone users with multi-line calling enabled and multiple phone numbers assigned
• Users without multi-line calling enabled are not affected

Platforms and services

• Microsoft Teams desktop for Windows
• Microsoft Teams desktop for Mac
• Microsoft Teams on the web
• Teams Phone

What will happen

• A dedicated tab will be created in the Calls app for each assigned phone line.
• Call history will be displayed under the phone line associated with the activity.
• Voicemails will appear under the phone line where they were received.
• Call recordings will appear under the phone line associated with the call.
• Users will be able to view and manage activity separately for each phone line.
• The feature will be enabled automatically for eligible users with multi-line calling configured.
• No changes will occur for users who do not use multi-line calling.

Action required and recommendations

No action is required.

We recommend that you:

• Notify your help desk and support teams about the updated Calls app experience.
• Inform affected users who manage multiple phone lines.
• Update internal documentation, training materials, and support content that references call history, voicemail, or recordings in the Teams Calls app.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• Targeted Release: Beginning in mid-October 2026 (previously early October) and expected to complete in mid-October 2026 (previously early October)
• General Availability (Worldwide): Beginning in late October 2026 (previously mid-October) and expected to complete by late October 2026 (previously mid-October)

Impact on your organization

Who is affected

• Organizations that allow communication with external users in Microsoft Teams.
• Users who receive Teams messages from external senders.
• Teams administrators and support teams that manage external collaboration policies.

Platforms and services

• Microsoft Teams
• Teams desktop
• Teams web
• Teams mobile

What will happen

• Images containing QR codes sent by external users will be blurred by default in Teams messages.
• Users can reveal the image if they trust the sender and want to view or scan the QR code.
• The blurred image does not indicate that Microsoft Teams has determined the QR code to be malicious.
• The protection is applied automatically to QR code images received from external senders.
• No administrator configuration or policy changes are required.
• The feature will be enabled by default as part of the rollout.

Action required and recommendations

No admin action is required before rollout.

We recommend that administrators:

• Inform users that QR code images from external senders may appear blurred by default.
• Remind users to verify the sender before revealing or scanning QR codes.
• Review existing user education materials related to phishing awareness, QR code safety, and external collaboration.
• Update internal help desk documentation to reflect the new user experience.

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

Rollout schedule

• Targeted Release (Worldwide): Rollout will begin in mid-October 2026 (previously early October) and is expected to complete by mid-October 2026 (previously early October).
• General Availability (Worldwide): Rollout will begin in mid-October 2026 (previously early October) and is expected to complete by late October 2026.

Impact on your organization

Who is affected

• Users of Microsoft Teams for Web who join meetings in supported browsers.

Platforms:

• Teams for Web.

What will happen

• Users will receive the new Picture-in-Picture (PiP) Call Monitor experience during Teams meetings.
• When users navigate away from the active meeting tab, Teams can display meeting controls in a separate PiP window.
• The PiP Call Monitor helps users remain connected to meetings while working elsewhere in their browser.
• The experience is available only in browsers that support the required browser capabilities.
• No changes are required to existing meeting or calling workflows.

Action Required / Recommendations

No admin action is required before rollout.

• Ensure helpdesk and support staff are aware of the upcoming user experience change.
• Review internal training and support materials as needed.
• Confirm that users are running supported browser versions for Teams for Web.
• Review Teams for Web prerequisites and supported browsers in Microsoft Learn.

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Rollout begins in mid-October 2026 and is expected to complete by the end of October 2026.

Impact on your organization

Who is affected

• Users with access to Copilot in Microsoft Excel.

Platforms and services

• Microsoft Excel for Windows
• Microsoft Excel Online
• Microsoft 365 Copilot

What will happen

• Users will be able to generate an interactive Copilot-created report from workbook data.
• Reports will combine key visualizations, metrics, and insights in a single view.
• Report content will automatically update when the underlying workbook data changes.
• Users will be able to modify and refine reports by interacting with Copilot using natural language.

Action required and recommendations

No action is required to prepare for this change. We recommend that you notify users about this new capability and update any internal training or adoption materials related to Copilot in Microsoft Excel.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• Targeted Release (Worldwide): Rollout will begin in early December 2026 and is expected to complete by mid-December 2026.
• General Availability (Worldwide): Rollout will begin in mid-December 2026 and is expected to complete by late December 2026.
• General Availability (GCC): Rollout will begin in mid-December 2026 and is expected to complete by late December 2026.
• General Availability (GCC High): Rollout will begin in mid-December 2026 and is expected to complete by late December 2026.
• General Availability (DoD): Rollout will begin in mid-December 2026 and is expected to complete by late December 2026.

This is a gradual rollout, and not all eligible users will receive the feature at the same time.

Impact on your organization

• Who is affected: Users with a Microsoft 365 Copilot license who access PDF files in OneDrive and SharePoint on the web.
• Platforms/Services: OneDrive, SharePoint, Microsoft 365 Copilot, PDF viewer on the web.

What will happen

• The Smart TOC entry point will appear when an eligible user opens a PDF that does not already contain table-of-contents information.
• The feature is available only in the OneDrive and SharePoint PDF viewer on the web during the initial release.
• Mobile and desktop applications are not included at this time.
• Copilot analyzes document structure and generates nested, clickable entries mapped to pages or page ranges.
• Users with edit permissions can save the generated table of contents into the PDF.
• The saved table of contents can be displayed by compatible PDF editors.
• Users with view-only permissions can generate and use Smart TOC for navigation but cannot save the generated table of contents.
• Smart TOC is available only to users with a Microsoft 365 Copilot license.
• AI-generated content may be inaccurate, particularly for scanned or OCR-based PDF files.

Action Required/Recommendations

No immediate admin action is required.

Before rollout, you may want to:

• Review Microsoft 365 Copilot license assignments for users who should have access to this capability.
• Inform eligible users, helpdesk personnel, and support teams about the new PDF navigation experience.
• Update internal documentation to clarify that saving a generated table of contents requires edit permissions on the PDF.
• Encourage users to validate AI-generated table-of-contents entries when accuracy is important.

Compliance considerations

• Does the change alter how existing customer data is processed, stored, or accessed? Yes. Copilot processes PDF content that the licensed user is already authorized to access in order to generate a table of contents for navigation. Existing file permissions are respected, and saving changes requires edit permissions.
• Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? Yes. Copilot analyzes PDF document structure and generates an AI-created hierarchical table of contents. The experience is user-initiated and does not run automatically.
• Does the change provide end users any new way of interacting with generative AI? Yes. Eligible users can request Copilot to generate a table of contents for PDF files that do not already contain one.
• Does the change allow a user to enable and disable the feature themselves? Yes. The feature is user-initiated and only runs when a licensed user chooses to generate a Smart TOC.

The experience will clearly indicate that the table of contents was AI generated and may contain inaccuracies.

Rollout schedule

General Availability (Worldwide): Beginning end of October 2026 (previously early October) and expected to complete by end of November 2026 (previously end of October)

Impact on your organization

Who is affected

• All users of the OneDrive sync client on Windows desktop

Platforms and services

• OneDrive for Business (Windows desktop sync client)

What will happen

Max path errors are one of the most commonly reported issues by OneDrive sync users. Currently, when a file or folder path exceeds the 520-character sync limit, the error message only states how many characters the path exceeds the limit and asks users to shorten it. In addition, File Explorer limitations may prevent users from renaming paths over 260 characters, and the sync client may stop syncing until the issue is resolved.

As part of this improved error experience, when users encounter max path errors, the sync client will continue running and users will be guided through a custom rename and move experience.

With this update:

• The sync client will continue running when users encounter max path errors
• Users will be guided through a custom rename and move experience to resolve issues directly

The rename experience will:

• Show the number of over-limit characters
• Highlight which items in the path can be renamed
• Allow renames even when the path exceeds 260 characters

Screenshot - Custom rename dialog

The move experience will:

• Show over-limit character counts in a guided interface
• Display warning dialogs for over-limit shared items in OneDrive
• Display warning dialogs for over-limit items in shortcuts

Screenshot - Example warning dialog for overlimit items in shortcuts

These enhancements are designed to reduce troubleshooting time and improve the overall sync experience.

Action required and recommendations

No admin action is required. This update will be automatically available through the OneDrive sync client.

You may want to:

• Inform your helpdesk and support teams about the improved error messages, as this update should reduce max-path-related support tickets.
• Update internal documentation for resolving OneDrive sync issues if applicable.

Learn more

• Fix paths that are too long to sync in OneDrive | Microsoft Support
• Restrictions and limitations in OneDrive and SharePoint | Microsoft Support

Compliance considerations

No compliance considerations identified. This update does not change how customer data is stored, processed, or accessed.

Rollout schedule

• Public Preview (GCC High and DoD): New Outlook will begin Public Preview July 30, 2026.
• General Availability (GCC High, DoD): We will begin rolling out on September 30, 2026 and expect to complete by late December 2026.
• General Availability (DoD): We will begin rolling out on September 30, 2026 and expect to complete by late December 2026.

Impact on your organization

Who is affected

• GCC High and DoD tenants
• Exchange and Outlook admins

Platforms/Services:

• New Outlook for Windows

What will happen

• Existing users who continue to use classic Outlook for Windows are not affected.
• New Outlook for Windows becomes available for GCC High and DoD sovereign environments but remains OFF by default.
• New Outlook continues to be an opt-in experience. Users can choose to switch to the new experience and can revert back to classic Outlook at any time.
• This update does not change organization settings and will not automatically switch users from classic Outlook for Windows.
• Microsoft will provide at least 12 months’ notice before initiating any Microsoft-driven migration steps in managed environments. Learn more about how we are approaching our migration timeline: New Outlook for Windows: A Guide to Product Availability.
• General Availability status enables organizations to begin evaluating and planning adoption timelines for the new Outlook experience.
• A future announcement will provide General Availability details for additional sovereign cloud environments.

Action Required / Recommendations

Administrative action is required to enable new Outlook for Windows in supported sovereign environments. The experience remains off by default.

To enable new Outlook for Windows when it becomes available, set the appropriate registry key:

Enable availability when ready:

GCC High:

DoD:

Recommended actions:

• Control availability: Organizations retain control over new Outlook’s availability. Policies can be used to hide the toggle in classic Outlook for Windows, block new mailboxes from being added, or remove new Outlook from certain Windows builds. Refer to: Control the installation and use of new Outlook.
• Learn about policy management: Policies for new Outlook are managed through mailbox policies on the primary account, consistent with Outlook on the web. IT admins may choose to preconfigure an organization account as the primary account. Learn more: Policy Management – Deploy Office and Map Classic Outlook Policies to New Outlook.
• Prepare to manage updates: New Outlook introduces features through service-based flighting rather than build updates. Track new functionality using the Microsoft 365 Roadmap.
• Public Preview: Public Preview begins in July 2026 and provides an early look at new Outlook in U.S. Government environments. Set one of the registry keys listed above to access the Preview.
• Transition from COM to web add-ins: COM add-ins are not supported in new Outlook. Organizations should begin transitioning to web add-ins. Learn more: Migrate from COM to web add-ins.
• Plan for user migration: Microsoft will provide at least 12 months’ advance notice before Microsoft-driven migrations. Organizations are encouraged to plan and manage their own adoption timelines using the following resources:
  • Adoption and migration resources: New Microsoft Outlook for Windows
  • User training: Getting started with the new Outlook for Windows; Discover New Outlook for Windows – Training
  • Admin documentation: Overview of the new Outlook for Windows

We understand that some organizations may have specific requirements that prevent them from transitioning from classic Outlook at this time. New Outlook team welcomes feedback through the following channels:

• The Help tab in new Outlook for Windows (feedback must be enabled by tenant admin)
• Dialog boxes shown when a user reverts to classic Outlook
• Your Microsoft account team (for larger organizations)

For detailed guidance:

• Please refer to: How to enable new Outlook for Windows Public Preview in DoD and GCC High

Learn more

• Feature comparison of the classic and new Outlook: New and classic Outlook for Windows feature comparison
• Resources to help with change management and enterprise adoption: New Microsoft Outlook for Windows

Compliance considerations

Area Explanation Alteration of existing customer data processing New Outlook uses a service-based architecture aligned with Outlook on the web, which may change how policies are evaluated and applied compared to classic Outlook. Admin controls available Availability is controlled by registry keys and admin policies; the experience remains opt-in and OFF by default. User self-enable/disable Users can opt in to new Outlook when enabled by admin and revert back to classic Outlook at any time.

Rollout schedule

• General Availability (Worldwide): Beginning in mid-November 2026 and expected to be complete by late November 2026

Impact on your organization

Who is affected

• Organizations using Microsoft Teams Rooms on Android devices
• Meeting organizers who use breakout rooms in Microsoft Teams meetings

Platforms and services

• Microsoft Teams
• Microsoft Teams Rooms on Android

What will happen

• Meeting organizers will be able to assign Microsoft Teams Rooms on Android devices to breakout rooms.
• Teams Rooms on Android devices can be moved into and out of breakout rooms during a meeting.
• The feature will be available by default when rollout is complete.

Action required and recommendations

No action is required.

We recommend that you:

• Inform meeting organizers and room administrators about this new capability.
• Update any internal documentation or training materials that reference breakout room functionality for Teams Rooms devices.

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

Rollout schedule

• General Availability (Worldwide): Rollout begins in early November 2026.
• Expected completion: late November 2026.

Impact on your organization

Who is affected

• Users who create and manage private tasks in Planner and Planner-powered experiences.

Platforms/Services:

• Microsoft Planner
• Planner on the web
• Planner-powered experiences
• Microsoft To Do

What will happen

• New private tasks will be stored in a private Planner plan.
• Users will continue to see existing private tasks in Planner My Tasks.
• Private tasks remain private to the task owner.
• Private tasks cannot be shared or assigned to others.
• Additional Planner task capabilities, such as labels, will become available.
• New private tasks created in Planner will no longer appear in Microsoft To Do.
• Existing compliance and security protections continue to apply.
• The feature is enabled automatically.
• No administrator action is required for deployment.

Action Required/Recommendations

No action is required.

You may want to:

• Inform support and help desk teams of the change.
• Review any internal documentation that references Planner private tasks appearing in Microsoft To Do.
• Review the Microsoft Planner service description and admin documentation.
• Communicate the updated experience to affected users.

Compliance considerations

Does the change store new customer data, if so, where, and is the data cached or permanently stored?Yes. New private tasks will be stored in a user's private Planner plan instead of the Microsoft To Do task store.Does the change alter how existing customer data is processed, stored, or accessed?Yes. Private task storage changes from Microsoft To Do to Planner for new private tasks. Existing private tasks remain visible in Planner My Tasks.Does the change modify retention policies, holds, or deletion workflows?Yes. Organizations should validate any retention, discovery, reporting, or governance processes that depend on Microsoft To Do storage.Does the change alter how admins can monitor, report on, or demonstrate compliance activities?Yes. Admins may need to account for the storage change from To Do to Planner in reporting or governance processes.Does the change provide end users any new way of interacting with generative AI?No. This is a Planner task storage and experience update, not a generative AI capability.

Rollout schedule

• General Availability (Worldwide): Rollout will occur from early through late November 2026.

Impact on your organization

Who is affected

• All users who access Microsoft Planner and use the My Tasks experience.

Platforms/Services:

• Microsoft Planner
• Planner on the web
• Planner task management experiences

What will happen

• Users will see an updated My Tasks interface in Planner.
• Navigation within My Tasks will be simplified and easier to understand.
• Task organization and prioritization experiences will be updated.
• Users will be able to create tasks through streamlined workflows without leaving their current context.
• Existing tasks and task data will remain available.
• No migration or user data movement is required.
• The feature will be enabled automatically as part of the service rollout.
• No changes to existing admin policies or configurations are required.

Action Required/Recommendations

No action is required.

You may want to:

• Inform helpdesk and support teams of the upcoming user interface changes.
• Communicate the updated Planner experience to end users who regularly use My Tasks.
• Review any internal training materials or screenshots that reference the current experience and update them as needed.
• Monitor user feedback during rollout and adoption.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

General Availability (Worldwide): We will begin rolling out on late September 2026 and expect to complete by late September 2026.

Impact on your organization

Who is affected

• Users with access to Copilot in Word on Android.
• Organizations that enable Microsoft 365 Copilot experiences on Android devices.

Platforms/Services:

• Microsoft Word for Android.
• Microsoft 365 Copilot.

What will happen

• Copilot Agent Mode will become available in Word on Android.
• Users can work with Copilot in a more task-oriented experience to help draft, reason over, and refine Word content on mobile devices.
• The feature will roll out automatically during the scheduled rollout window.

Action Required/Recommendations

• No admin action is required.
• Inform users and support teams that Copilot Agent Mode is coming to Word on Android.
• Update mobile productivity, Word, or Microsoft 365 Copilot guidance if it describes Copilot experiences available on Android devices.
• Review your organization’s existing Microsoft 365 Copilot and mobile app policies to ensure they align with intended user access.

Compliance considerations

Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data?Yes. Copilot Agent Mode can help users draft, reason over, and refine Word content on Android devices.Does the change provide end users any new way of interacting with generative AI?Yes. Users can interact with Copilot Agent Mode in Word on Android.Does the change introduce or significantly modify any capability that enables users to automate workflows through AI or bot agents?Yes. This update brings an agentic Copilot mode to Word on Android for task-oriented assistance.

Rollout schedule

• General Availability (Worldwide, GCC, GCC High, DoD): Rollout begins in early November 2026 and is expected to complete by mid-November 2026.

Impact on your organization

Who is affected

• Exchange Online administrators who manage OWA mailbox policies
• Users who send or receive .msix or .msixbundle attachments in Outlook on the web or new Outlook for Windows

Platforms and services

• Outlook for the web
• New Outlook for Windows
• Exchange Online

What will happen

• The .msix and .msixbundle file types will be added to the BlockedFileTypes list in all OWA Mailbox policies in your organization, including the default policy and any custom policies created in your tenant.
• Users who send or receive .msix or .msixbundle attachments in Outlook on the web or new Outlook for Windows will no longer be able to open or download them.

Action required and recommendations

No action is required if your organization does not rely on the .msix or .msixbundle file types. If your organization relies on these file types, we recommend that you add them to the AllowedFileTypes property of your users' OwaMailboxPolicy objects prior to rollout.

Learn more

• Blocked attachments in Outlook | Microsoft Support
• Set-OwaMailboxPolicy -AllowedFileTypes | Microsoft Learn
• Set-OwaMailboxPolicy -BlockedFileTypes | Microsoft Learn

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.

Rollout schedule

• Retirement date (Worldwide): November 3, 2026
• Action required by: November 3, 2026

Impact on your organization

Who is affected

• Organizations using the MemberOf rule operator in:
• Dynamic membership groups
• Dynamic administrative units (AUs)
• Entitlement management auto-assignment policies

Platforms and services

• Microsoft Entra ID
• Microsoft Entra Groups
• Microsoft Entra Administrative Units
• Microsoft Entra Entitlement Management
• Group-based licensing
• Conditional Access configurations that rely on dynamic group membership

What will happen

Beginning November 3, 2026:

• Dynamic groups using MemberOf will stop processing membership changes.
• Dynamic administrative units using MemberOf will stop updating membership and administrative scope.
• Entitlement management auto-assignment policies using MemberOf will stop processing assignment updates.
• Existing membership and assignment data will remain in their last known state.
• New users may not receive required access or licenses.
• Former users may retain access or licenses that should have been removed.
• Conditional Access policies may rely on outdated group membership.
• Teams, SharePoint, and other applications that depend on dynamic group membership may receive outdated membership information.
• Group-based licensing assignments may no longer reflect current user eligibility.

Action required and recommendations

Complete the following actions before November 3, 2026.

Dynamic membership groups:

• Export dynamic membership groups from the Microsoft Entra admin center and identify rules containing MemberOf.
• Replace MemberOf with supported rule operators where possible.
• Convert groups to assigned membership if a supported dynamic rule alternative is not available.
• Validate membership results after making changes.
• Remove groups that are no longer required.

Dynamic administrative units:

• Use Microsoft Graph PowerShell to identify dynamic administrative units that use MemberOf rules.
• Replace MemberOf-based rules with supported rule operators where possible.
• Convert administrative units to assigned membership if necessary.
• Validate both membership and administrative scope after making changes.
• Remove administrative units that are no longer required.

Entitlement Management auto-assignment policies:

• Use Microsoft Graph PowerShell to identify auto-assignment policies that use MemberOf.
• Replace MemberOf-based policies with supported operators where possible.
• Plan an alternate assignment approach if no equivalent rule is available.
• Validate access package assignments after making changes.

Learn more

• Configure an automatic assignment policy for an access package in entitlement management | Microsoft Entra ID Governance | Microsoft Entra | Microsoft Learn
• Configure dynamic membership groups with the memberOf attribute in the Entra admin center | Users | Microsoft Entra ID | Microsoft Entra | Microsoft Learn
• Create simpler, more efficient rules for dynamic membership groups in Microsoft Entra ID | Users | Microsoft Entra ID | Microsoft Entra | Microsoft Learn
• Manage users or devices for an administrative unit with rules for dynamic membership groups | Role-based access control | Microsoft Entra ID | Microsoft Entra | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change alter how existing customer data is processed, stored, or accessed (for example, documents, emails, chats, identities, or group memberships)?Yes. After November 3, 2026, configurations that use the MemberOf rule operator will stop updating membership and assignment information. Existing membership and assignment data will remain in its last known state, which may result in outdated access, licensing assignments, Conditional Access targeting, administrative scope, and entitlement assignments.Does the change modify, interrupt, or disable Conditional Access policies?Yes. Conditional Access policies that rely on dynamic groups using the MemberOf rule operator may no longer receive updated group membership information after retirement. Organizations should review and update affected configurations before November 3, 2026.

Rollout schedule

• General Availability (Worldwide, GCC): Beginning in mid-August 2026 and is expected to complete by late October 2026 (previously mid-August)
• General Availability (GCC High and DoD): Beginning in early September 2026 and expected to complete in late October 2026 (previously late September)

Impact on your organization

Who is affected

• Organizations using Microsoft Teams Rooms on Android devices.

Platforms and services

• Microsoft Teams
• Teams Rooms on Android

What will happen

Today, Teams Rooms on Android devices may display participants using a mix of aspect ratios and provide a different gallery experience than Teams Rooms on Windows.

After this rollout:

• Gallery view will prioritize video participants on the meeting stage by default:
• Participant tiles will be displayed using more consistent aspect ratios, including 16:9, 4:3, and 1:1 layouts.
• Audio participants will be deprioritized when video participant prioritization is enabled, helping display more video participants on screen.
• Meeting participants will be able to:
  • Hide the room self-preview video for a meeting.
  • Display audio and video participants equally instead of prioritizing video participants.
• Gallery updates will be more stable, with reduced tile movement when active speakers are promoted to the meeting stage.
• Admin controls will be available through device settings and the Pro Management portal.

Action required and recommendations

No action is required before the rollout.

Administrators can configure the default Gallery view behavior through local device settings and the Teams Rooms Pro Management portal.

Communicate these visual changes to Teams Rooms users if your organization provides end-user training or adoption materials.

Learn more

• Microsoft Teams Rooms (Android) | Microsoft Support

Compliance considerations

No compliance considerations identified.

Rollout schedule

• Targeted Release (Worldwide): We began rolling out in early August 2026 (previously late March) and expect to complete by mid-August 2026 (previously early July).
• General Availability (Worldwide): We will begin rolling out in mid-August 2026 (previously early July) and expect to complete by early November 2026 (previously late August).
• General Availability (GCC): We will begin rolling out in mid-August 2026 (previously mid-July) and expect to complete by early November 2026 (previously early September).
• General Availability (GCC High): We will begin rolling out in late August 2026 (previously late July) and expect to complete by early November 2026 (previously mid-September).
• General Availability (DoD): We will begin rolling out in early September 2026 (previously early August) and expect to complete by early November 2026 (previously late September).

Impact on your organization

Who is affected: All Microsoft Teams users on iOS and Android devices

Platforms/Services: Microsoft Teams (iOS and Android)

What will happen

• Users can open the emoji suggestion menu by typing : followed by at least two characters (e.g., :sm)
• Users can insert emojis by typing a full name between colons (e.g., :smile: → 🙂)
• Common emoticons such as :), :D, and :P automatically convert into emojis
• Lowercase emoticons (e.g., :d, :p) are also supported
• Emoji search supports fuzzy matching and mid-string search
• Custom emojis are supported
• Parenthesis () shortcuts continue to work and will be retired later in alignment with desktop
• The feature is enabled by default with no admin controls

Action Required / Recommendations

No action is required.

To prepare your organization:

• Notify your help desk about the updated emoji shortcut experience.
• Update internal training or adoption materials to include emoji shortcuts triggered with :.
• Consider sharing a brief user communication highlighting the new mobile parity experience.

Learn more

• Send an emoji or GIF in Microsoft Teams Free | Microsoft Support
• Send an emoji, GIF, or sticker in Microsoft Teams | Microsoft Support

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

When this will happen

• Public Preview: Rollout will begin in late March 2026 and complete by early April 2026.
• General Availability (Worldwide): We have decided not to move forward with this change at this time.

How this affects your organization

Who is affected

• Admins who manage Microsoft Purview and use the Data Security Posture Agent within Microsoft 365 tenants

What will happen

• A new credential scanning capability will be added to the Data Security Posture Agent under the Explore Agent tab (figures 1-5):

1.

2.

3.

4.

5.

• The feature uses LLM-powered credential detection to:
• • Scan selected data locations for exposed credentials.
  • Detect Entra ID credentials, private keys, API tokens, and other credential types.
• Each finding includes:
  • A risk score
  • AI-generated insights
  • A confidence score
  • A credential category
• A task board experience will be available to track progress, review findings, and take action.

What you can do to prepare

• Set up the Data Security Posture Agent in Microsoft Purview > Explore Agent using the required admin roles.
• Communicate this change to your security and compliance teams.

Learn more

• Get started with Microsoft Purview Posture Agent in Data Security Investigations | Microsoft Learn
• Security Copilot Agents in Microsoft Purview overview | Microsoft Purview | Microsoft Learn

Compliance considerations

QuestionAnswerDoes the change alter how existing customer data is processed, stored, or accessed? The agent discovers exposed credentials and data security risks across scoped locations Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? Introduces LLM-powered discovery and risk assessment. Does the change provide users any new way of interacting with generative AI? Admins receive GenAI-generated summaries and LLM-assisted tasks. Does the change include an admin control and can it be controlled through Entra ID group membership? Setup requires admin roles in Microsoft Purview.