365Fanatic / M365 Roadmap / Product updates
Intune · Entra · Teams · Defender · Purview · Copilot

Product updates

New and upcoming features for Intune, Entra, Teams, Defender (XDR, Endpoint, Office 365), Purview and Microsoft 365 Copilot in one place, straight from Microsoft's documentation. Updated every 4 hours.

Updated: 15 okt 2026, 11:25 CEST · 1006 features · 22 in development · 10 new in the last 14 days

RSS Click to subscribe

Set filters first, then copy the link. Do not open it in Chrome.

Or open directly: Feedly Inoreader

In development · Intune 22

Announced

Agentic identity for the Policy Configuration Agent (public preview)

The Intune Policy Configuration Agent will update to use a Microsoft Entra agentic identity instead of a human user identity. This enables the agent to run policy configuration actions securely and independently. For existing agents, admins will be able to transition to…

Announced

Associate devices to your organization with Windows Autopilot device preparation

A new capability for Windows Autopilot device preparation will be available soon: device association. Device association binds a Windows device to your organization and enables advanced functionality such as streamlined out-of-box experience (OOBE) pages, device naming before enrollment, and device-based targeting. It…

Windows
Announced

Automatically launch Microsoft Defender for Endpoint during Android Enterprise device setup

You'll be able to configure Microsoft Defender for Endpoint to open automatically during out-of-box setup for supported corporate-owned Android Enterprise devices. After you configure the Defender for Endpoint connector, turn on Grant MTD role permissions, and assign the Defender app as required,…

Android
Announced

Bulk eSIM activation and wipe options for corporate-owned Android Enterprise devices

You'll be able to use Microsoft Intune bulk device actions to activate eSIMs on up to 100 supported corporate-owned Android Enterprise devices running Android 15 or later by using a carrier activation server URL. When you bulk wipe supported devices, Intune will…

Android
Announced

Certificate connector health monitoring in the Microsoft Intune admin center

The Certificate Connector for Microsoft Intune will surface new health and status signals in the admin center, so you can spot certificate-issuance problems early. You'll get clear indicators for common failure conditions — such as the connector being unable to reach the…

Announced

Client-driven compliance evaluation for Windows devices

Microsoft Intune will introduce client-driven compliance evaluation for Windows devices to reduce delays in compliance reporting. Supported devices will detect important state changes locally and proactively request a compliance re-evaluation when it matters, instead of waiting for the next scheduled check-in. As…

Windows
Announced

Configure Quality Update approvals and policies for Quick Machine Recovery (QMR)

Windows Autopatch currently offers limited control over the deployment of quality updates. Today, the expedite mechanism focuses on deploying the latest security update and doesn't let admins select specific quality update releases or apply different deployment schedules, which can limit compliance, validation,…

Windows
Announced

Declarative VPP app download in Company Portal

The iOS/iPadOS Company Portal will support Declarative Volume-Purchased Program (VPP) app downloads from the Apps tab. Declarative VPP apps provide an improved end-user experience by reducing app installation latency, allowing for automatic overnight app updates, and providing the end user with a…

iOS/iPadOS
Announced

Device query for multiple devices for app inventory on Windows

Advanced Analytics will extend device query for multiple devices to cover app inventory data on Windows. Building on the existing multi-device query for hardware inventory, you'll be able to use Kusto Query Language (KQL) to investigate installed applications across your entire Windows…

Windows
Announced

Disable MAC address randomization on macOS Wi-Fi profiles

On macOS devices, the Disable MAC address randomization setting will be available for Wi-Fi profiles. Use this setting to disable MAC address randomization on managed macOS devices. When connecting to a network, devices can present a randomized MAC address instead of the…

macOS
Announced

Enforce Routes capability in iOS/iPadOS and macOS VPN profiles

Microsoft Intune will support Apple's Enforce Routes feature in iOS/iPadOS and macOS VPN profiles. This feature helps prevent situations where VPN traffic accidentally or maliciously goes outside the VPN tunnel, like what happens with de-cloaking risks. It ensures VPN routing aligns with…

macOSiOS/iPadOS
Announced

Mark Windows devices noncompliant when prohibited AI agents are discovered

Automatically mark Windows devices as noncompliant when prohibited local AI agents, such as OpenClaw, are discovered on the device. As an admin, you'll be able to configure a list of prohibited agents in a Windows compliance policy. When a prohibited agent is…

Announced

New Apple settings in the Settings Catalog for iOS/iPadOS and macOS

Microsoft Intune will add new Apple settings for supported iOS/iPadOS and macOS devices. You'll be able to configure the new options by using Settings Catalog profiles in the Microsoft Intune admin center. These settings will expand the device management controls available through…

macOSiOS/iPadOS
Announced

New Linux antivirus settings for Microsoft Defender for Endpoint

We're adding a new Microsoft Defender Updates template for Linux endpoint security antivirus policies. This template will include four new settings for managing Microsoft Defender for Endpoint agent auto-update behavior on Linux devices attached via MDE attach. You will be able to…

Linux
Announced

Remote Help support in GCCH

You'll be able to use Remote Help in US Government Community Cloud High (GCCH) environments. This expansion extends the same secure, cloud-based remote assistance capabilities currently available in GCC to GCCH tenants. IT support staff will be able to establish Remote Help…

WindowsmacOSAndroid
Announced

Require Managed Home Screen authentication for protected app activities

For Android Enterprise dedicated devices using Managed Home Screen (MHS) with Microsoft Entra shared device mode, Intune will allow admins to requiring users to complete MHS authentication state before allowing protected activities in MAM-integrated apps. When MHS requires sign-in or session PIN…

Android
Announced

Scope tags support for Endpoint Privilege Management reports

We're fixing how scope tags work with Endpoint Privilege Management (EPM) reports. With this change, EPM reports will respect the report viewer's assigned scope and display the details for only the users and devices that the report user is scoped to view.

Announced

Scoped permissions for role-based access control moving to general availability

The Scoped permissions setting for role-based access control (RBAC) will move from public preview to general availability. Scoped permissions prevents Intune from merging permissions across multiple role assignments that share the same permission category but use different scope tags. When enabled, each…

Announced

Stage app and policy rollout with deployment plans

Deployments and Deployments plans will give you a new way to roll out apps and configuration policies in Intune. Instead of assigning to all targeted groups at once, you'll be able to stage a rollout across multiple rings, control the timing of…

Windows
Announced

Support for Intune Device control policy for devices managed by Microsoft Defender for Endpoint

You'll be able to use the endpoint security policy for Device control (Attack surface reduction policy) from Microsoft Intune with the devices you manage through the Microsoft Defender for Endpoint security settings management capability. Device control policies are part of endpoint security…

Announced

Updated minimum supported version for iOS and iPadOS

Microsoft Intune will update its minimum supported operating-system version after Apple releases iOS and iPadOS 27. Intune device management, the Company Portal, and app protection policies will require iOS/iPadOS 18 or later for standard supported scenarios. You'll be able to use Intune…

iOS/iPadOS
Announced

Updated minimum supported version for macOS

Microsoft Intune will update its minimum supported macOS version after Apple releases macOS 27. Intune, the Company Portal, and the Intune management agent will support macOS 15 and later. Devices running macOS 14 or earlier that are already enrolled will remain enrolled,…

macOS

October 2026 8

New October 2026

Admin Center - detailed report on Everyone except external user permissions

The new report provides SharePoint Advanced Management admins complete item-level details of permissions granted to special SharePoint groups: Everyone and Everyone except external users. Roadmap ID: 561038 Details: What changed: The SharePoint Admin Center now includes a detailed report that shows item-level…

Web
New October 2026

Copilot Analytics - Cowork adoption and impact

Deeper insights into Cowork adoption and impact, accessible from Copilot dashboard and Consumption dashboard in the Microsoft 365 services tab. Includes export capability. All metrics can be queried by analysts with the new Consumption query (credit usage data) and through the Person…

Web
New October 2026

Create custom skills in Copilot in PowerPoint for tailored workflows for your specific presentation needs

Details: What changed: Copilot now supports user defined custom skills, allowing users to extend its capabilities with personalized commands and workflows in PowerPoint. Previously, Copilot operated only with built-in skills and predefined functions in PowerPoint. This update enables customization within Microsoft 365…

Windows
New October 2026

Edit query string and user identity mapping rules for Copilot connectors

Admins can now edit query string and user identity mapping rules directly in connector settings without opening a support ticket. Details: What changed: Query string parameters and user identity mapping rules are now editable after a connection is created. Admins can update…

WindowsWeb
New October 2026

Reference files saved in SharePoint libraries and OneDrive folders when creating a presentation with Copilot in PowerPoint

You can now reference files saved in SharePoint libraries and OneDrive folders when creating a presentation with Copilot in PowerPoint. Roadmap ID: 555897 Details: What changed: Copilot in PowerPoint can now recognize references to files stored in SharePoint and OneDrive when you…

macOS
New October 2026

Regenerate response for alternative answers

The Regenerate action lets you quickly get an alternative response to your latest prompt using options like Try Again or Switch Model, helping you explore different answers and improve output quality. Details: What changed: Previously, users had to re-enter prompts to get…

Web
New October 2026

Seamless Search and Chat Integration

Microsoft 365 Chat brings the power of conversational AI directly into Microsoft 365 Copilot Search, enabling users to move effortlessly from finding information to acting on it. Search results become the foundation for contextual chat, allowing you to ask follow-up questions, synthesize…

WindowsWeb
New October 2026

Expanding user reporting in Teams to include meetings

Users can report scheduled or Meet now Microsoft Teams meetings or individual meeting participants as a security concern during or after the meeting. Users can also report a meeting participant that was incorrectly identified as suspicious as not a security concern. Depending…

September 2026 38

September 2026

"Sort by" filter for Outlook Mail in Copilot search

Users can now sort Outlook Mail results by date in ascending or descending order within Copilot Search. Details: What changed: Copilot Search now includes a "Sort by" filter for Outlook Mail results, allowing sorting by date in both ascending and descending order.…

WindowsWeb
September 2026

Add references to your Copilot Notebooks from the Quick Access section in Search on the Microsoft Copilot app

Users can quickly add references to a Copilot Notebook through the Quick Access section in Search on the Microsoft Copilot app. Roadmap ID: 510099 Details: What changed: Users can now add references directly to their Copilot Notebooks from the Quick Access section…

Web
September 2026

Additional Outlook triage actions in Copilot

Microsoft 365 Copilot now supports more natural language triage actions in Outlook, including deleting, moving, copying, categorizing messages, and managing inbox rules and folders with confirmation prompts for bulk or mailbox changes. Details: What changed: Building on existing triage commands like pin…

WindowsmacOSiOS/iPadOSAndroidWeb
September 2026

CarPlay support for the Microsoft Copilot app

The Microsoft Copilot app is now supported on Apple CarPlay for hands-free use. Details: What changed: The Microsoft Copilot app now integrates with Apple CarPlay, allowing users to activate Copilot using voice commands while driving. Previously, Copilot was not accessible through CarPlay,…

iOS/iPadOS
September 2026

Configure organizational policy link for blocked Microsoft 365 Copilot app

If your organization blocks the Copilot Chat in the Microsoft 365 Copilot app, you can provide a link to company policy or internal guidance for users who are blocked from accessing Copilot Chat in the Microsoft 365 Copilot app. Details: What changed:…

WindowsmacOSWeb
September 2026

Copilot Analytics - Power user insights in Copilot dashboard

Understand who is building a habit using Copilot with the new power user insights in Copilot dashboard Roadmap ID: 560705 Details: What changed: The Copilot dashboard in Microsoft Viva Analytics introduces new power user insights. Previously, habit-building data was limited. Now, administrators…

Web
September 2026

Copilot Enhanced Topic Assignment

We're upgrading our topic assignment pipeline to be powered by Copilot, delivering significantly improved accuracy in categorizing survey comments into relevant topics. Roadmap ID: 553224 Details: What changed: The topic assignment pipeline in Viva Glint now uses Copilot to categorize survey comments…

Web
September 2026

Copilot chat pane available in Microsoft Forms

The Copilot chat pane is now built into Microsoft Forms, helping users improve forms and quizzes, draft and send invitations, and analyze responses. Available to Microsoft 365 Copilot licensed business users through the Copilot icon in Forms. Roadmap ID: 553136 Details: What…

Web
September 2026

Copilot usage snapshot PBI at day level with fresh data

A day level Copilot adoption Power BI report reflecting the most recent copilot activity & freshest insights. Roadmap ID: 561325 Details: What changed: The Copilot usage snapshot report in Microsoft Viva now updates at the day level instead of aggregated periods. This…

Web
September 2026

Create user-defined custom skills in Copilot in PowerPoint

Create user-defined custom skills in Copilot to tailor assistance to your specific presentation needs. Details: What changed: Copilot now supports user-defined custom skills in PowerPoint, allowing users to extend its capabilities with personalized commands and workflows. Previously, Copilot operated only with built-in…

Web
September 2026

Delegate complex work with Copilot Cowork

Copilot Cowork helps you delegate complex work by describing the outcome you need. Cowork gathers context from your emails, meetings, chats, files, and business data, works across tools and systems, and returns completed results. Details: What changed: Copilot Cowork introduces a new…

WindowsmacOSiOS/iPadOSAndroidWeb
September 2026

Federated Copilot Connectors

Microsoft is announcing the General Availability (GA) of federated Copilot connectors for Microsoft 365 Copilot. Federated Copilot connectors enable users to securely connect Copilot to popular third-party sources and retrieve data in real time using the Model Context Protocol (MCP). These connectors…

Web
September 2026

Find meetings based on topics and keywords

Copilot will be able to find meetings based on topics or keywords from relevant data like meeting body, chat, and transcription. The search for meetings based on transcript text is based on meetings in last two months. Roadmap ID: 559110 Details: What…

WindowsmacOSiOS/iPadOSAndroid
September 2026

GitHub Copilot AI cost dashboard in Insights

A centralized dashboard in Insights shows GitHub Copilot AI consumption, cost, and adoption metrics across your organization. Roadmap ID: 566470 Details: What changed: The new dashboard consolidates GitHub Copilot AI usage and cost data in one location within Workplace Analytics Insights. Previously,…

Web
September 2026

Integrated extensibility experience capability for declarative agents for Microsoft 365 Copilot available in Copilot Chat in classic Outlook for Windows

We added integrated extensibility experience support for declarative agents in Copilot Chat in Outlook. This release note covers availability in classic Outlook for Windows. Roadmap ID: 481559 Details: What changed: Users are now able to customize their Copilot experience in classic Outlook…

Windows
September 2026

Navigate to your workbook changes directly from the Copilot chat pane response

In Copilot in Excel, the response contains links to highlight where changes are made in your workbook. Navigate directly to new sheets, tables, ranges, and objects like charts and shapes. Details: What changed: In the Copilot chat response, there now is a…

WindowsmacOSWeb
September 2026

New Copilot Notebooks design in the Microsoft 365 Copilot App

The new Copilot Notebooks design in the Microsoft 365 Copilot app now lets users organize related chats, output creations, and references into a persistent AI workspace. Copilot uses the Notebook's accumulated context to ground responses, so work continues across sessions instead of…

Web
September 2026

New dedicated License Requests page in Microsoft 365 Admin Center

We are introducing a new dedicated License Requests page in the Microsoft 365 Admin Center to help admins more easily discover, review, and manage Microsoft 365 Copilot license requests submitted by users. Roadmap ID: 561206 Details: What changed: The Microsoft 365 Admin…

Web
September 2026

New profile cards for buildings, rooms and desks

Buildings, rooms and desks that are added to the Places directory will have new profile cards, accessible from Copilot Chat and across other Microsoft 365 entry points. Roadmap ID: 553219 Details: What changed: Buildings, rooms, and desks added to the Places directory…

Windows
September 2026

People Skills - removal and deletion admin control

A new admin control in the People Skills settings lets administrators permanently remove their organization's People Skills data from the tenant. With this new control, organizations can delete their entire skills library along with all users confirmed, inferred, and imported skills data—giving…

Web
September 2026

Planner Agent chat

Introducing built-in Planner Agent chat with natural language Q&A, smart task discovery, and in-plan task management. Roadmap ID: 560532 Details: What changed: Planner integrates Planner Agent chat directly into the app, enabling users to ask questions and manage tasks using natural language.…

WindowsWeb
September 2026

Pre-setup guides, editability, actionable errors & alerting support available for Connector admins

Roadmap ID: 502529 Details: What changed: Connector admins now have access to pre-setup guides that outline configuration steps before deployment. They can edit settings post-setup and receive actionable error messages with alerting support. These improvements enhance troubleshooting and proactive management of Connectors.…

Web
September 2026

See Copilot usage in show changes pane

Users can now view Copilot usage details directly within the Show Changes pane in Excel. Details: What changed: Previously, Copilot activity was not visible in the Show Changes pane. Now, the pane includes on-card attribution showing when Copilot made edits or suggestions.…

WindowsmacOSWeb
September 2026

See email attachments as pills in Copilot search results

When users search for an email in Microsoft 365 Copilot search, that email's attachments now appear as pills directly on the result, so users can spot and open attachments without opening the email. Details: What changed: Email results in Microsoft 365 Copilot…

WindowsWeb
September 2026

Unlocking Deeper Copilot Insights with Enhanced Power BI Filtering

Enable Global and Insights admins to turn on additional attributes as filters in Power BI reports, including reserved attributes and your organization’s custom attributes. Users who have access to Power BI reports can then use these newly enabled filters to tailor reports…

Web
September 2026

Vision in Microsoft 365 Copilot can analyze content shared on desktop screen and through mobile camera

Vision in Microsoft 365 Copilot helps you make faster, more informed decisions by understanding context from what you share on screen or camera. Copilot can analyze visual inputs from shared desktop screens and provide detailed insights about the content. You can also…

WindowsiOS/iPadOSAndroidWeb
New September 2026

Create an Information Barriers policy compliance report to identify SharePoint sites, OneDrive accounts,…

Create an Information Barriers policy compliance report to identify SharePoint sites, OneDrive accounts, and user-owned SharePoint Embedded containers that no longer comply after Information Barriers policy changes.

September 2026

Expanding user reporting in Teams to include group calls

Users can report completed or missed group Microsoft Teams calls from the call history as malicious (scam) or nonmalicious (non-scam). Depending on user reported settings, reported calls are sent to the specified reporting mailbox, to Microsoft, or both.

September 2026

Identity Security dashboard and Coverage & Maturity

The Identity Security dashboard provides a centralized view of identity-related security risks and posture across the organization. Coverage & Maturity helps security teams understand how well their identity environment is protected across on-premises, cloud, SaaS, identity providers, and partner technologies, identify coverage…

September 2026

Integrate Microsoft Entra Global Secure Access with Purview to protect text, files, and AI interactions at the network layer

It helps prevent sensitive data from being shared with untrusted cloud applications through browsers, apps, APIs, and add-ins, including generative AI platforms, social media, and collaborative platforms.

September 2026

Integrated Security Operations Center (ISOC) in Microsoft Defender

Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI capabilities together in the Microsoft Defender portal. Starting September 23, 2026, it's available to eligible Microsoft 365 E5 and E7 customers without an active Microsoft Sentinel…

September 2026

Keep conversations moving while files upload

When you share a file in Teams, you no longer need to wait for the upload to finish before continuing your work. Across chats, channels, and meetings, files upload in the background so you can keep collaborating without interruption. Progress indicators keep…

September 2026

Memory scan for Linux

Memory Scan extends Microsoft Defender for Endpoint protection capabilities on Linux by enabling inspection of process memory for known malicious behaviours and memory-resident threats, providing an additional layer of protection against advanced attacks. Memory-resident threats are increasingly challenging for security teams because…

September 2026

Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc)

Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping security teams investigate and respond to threats across both Windows and Linux…

September 2026

Microsoft Defender support for Linux Desktops

Microsoft Defender for Endpoint now extends support to Linux desktops (Public Preview). All Linux distributions currently supported on servers are also supported on Linux desktops. Deployment methods and security capabilities remain consistent across both Linux servers and desktops. For details on licensing…

September 2026

New Microsoft Secure Score recommendations for AI-Readiness

Microsoft Defender now brings together six security recommendations for AI-Readiness to help organizations strengthen endpoint trust against AI-accelerated cyberattacks. Together, these recommendations provide a layered security baseline that helps reduce externally visible entry points, establish hardware-backed trust in device startup, isolate critical…

New September 2026

Separating Teams user reporting settings from email settings

Customers in Worldwide (WW) environments with Defender for Office 365 Plan 1, Defender for Office 365 Plan 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting settings on a separate page at https://security.microsoft.com/securitysettings/teamsUserSubmission. This separation lets you…

August 2026 76

Week of 25 Aug 2026 · release 2608

Activate an eSIM on a corporate-owned Android device

Microsoft Intune now supports single-device eSIM activation for corporate-owned Android Enterprise devices running Android 15 and later. Turn on Preview new device view, select the device, then select Activate eSIM and enter the carrier activation code. Intune sends the request without first…

Android
Week of 25 Aug 2026 · release 2608

Audit mode for the Microsoft Defender Antivirus template for Linux

The Microsoft Defender Antivirus template for Linux, which is part of Intune's Endpoint Security Antivirus policy, now includes a new Audit value for the Enforcement level setting. When you set Enforcement level to Audit, the antivirus engine detects threats in real time…

Linux
Week of 25 Aug 2026 · release 2608

Choose whether to remove eSIMs when wiping one corporate-owned Android device

Microsoft Intune now lets you choose whether to preserve or remove eSIMs when wiping one corporate-owned Android Enterprise device. Turn on Preview new device view, select the device, then select Wipe. By default, the wipe preserves eSIMs; select the eSIM removal option…

Android
Week of 25 Aug 2026 · release 2608

Collect enhanced diagnostic logs from supervised Apple devices

Microsoft Intune now supports Apple's Enhanced Logging device action on supported supervised devices running a compatible OS release. Administrators can start an AppleCare diagnostic-log collection session using an AppleCare-provided token and monitor device-reported status through Declarative Device Management, reducing the need to…

macOSiOS/iPadOS
Week of 25 Aug 2026 · release 2608

Configure screen timeout for corporate Android devices

Microsoft Intune now supports a Screen timeout setting in the Android Enterprise settings catalog, letting you specify how many seconds pass before the screen turns off. Configure it under Devices > Manage devices > Configuration > Create > New policy > Android…

Android
August 2026

Copilot Chat available when using Copilot Search

Copilot Chat will be available for Microsoft 365 Copilot users from the side pane on the right-hand side when using Copilot Search in the Microsoft 365 Copilot app. This allows users to engage with Copilot while browsing universal search without switching pages…

WindowsWeb
Week of 25 Aug 2026 · release 2608

Device inventory for personally owned devices on Android Enterprise

Microsoft Intune now supports device inventory for personally owned Android Enterprise devices with a work profile managed by Android Management API. View these devices from the device's Inventory page alongside corporate-owned devices in Resource Explorer, and query them with Multi-Device Query. Inventory…

Android
August 2026

Enable Sonnet 5 in models menu

Copilot uses a higher default reasoning level with Sonnet 5 for more accurate drafting and edits. Details: What changed: Sonnet 5 is now available in the Copilot models menu in Word and set as the default for higher reasoning tasks. This model…

Web
August 2026

Explain slide selection during PowerPoint Live with Microsoft 365 Copilot

This feature enhances the PowerPoint Live meeting experience by using Copilot to let attendees select slide text and get explanations for the content. Roadmap ID: 557256 Details: What changed: Attendees in PowerPoint Live meetings can now select text on slides and ask…

Windows
August 2026

Generate and edit images in Copilot Cowork

Create and modify images in Copilot Cowork using OpenAI's ChatGPT Images 2.0 model for enhanced visual content generation. Details: What changed: Copilot Cowork integrates OpenAI's ChatGPT Images 2.0 model to generate and edit image artifacts. Previously, image creation required external tools. This…

WindowsmacOSiOS/iPadOSAndroidWeb
Week of 25 Aug 2026 · release 2608

Keep Android device screens on while charging

Microsoft Intune now includes a settings catalog option for keeping fully managed and dedicated Android device screens on while charging. Select one or more modes - AC, USB, or Wireless - to control when the screen stays on. AC and USB support…

Android
Week of 25 Aug 2026 · release 2608

Limit how long an Android work profile can stay off

Microsoft Intune now supports the Number of days work profile is allowed to be switched off setting in the Android Enterprise settings catalog, so you can limit how long a work profile stays turned off. Enter the maximum number of days, with…

Android
Week of 25 Aug 2026 · release 2608

Memory scan setting for Microsoft Defender Antivirus on Linux

Microsoft Intune now supports a memory scan setting in the Microsoft Defender Antivirus template for Linux endpoint security antivirus policies. You can manage memory scan behavior on Linux devices managed through Microsoft Defender for Endpoint security settings management, giving you finer control…

Linux
Week of 25 Aug 2026 · release 2608

New policy settings for Windows

Microsoft Intune now includes new Windows settings catalog options across several administrative template refreshes. Highlights include Turn on Protected Mode controls for Internet Explorer security zones, new Microsoft Edge policies from the Edge 150 template refresh, and a Disconnect if a Remote…

Windows
Week of 25 Aug 2026 · release 2608

New updates to the Apple settings catalog

Microsoft Intune now supports new Settings Catalog options for testing on the OS 27 betas, covering Declarative Device Management areas such as App Settings, Web Content Filter, and Siri Settings for iOS/iPadOS and macOS. Configure them under Devices > Manage devices >…

macOSiOS/iPadOS
Week of 25 Aug 2026 · release 2608

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: Notion by Notion Labs Superhuman Mail by Superhuman Labs Calven by Calven Pty Limited Heijmans by Heijmans Notability by Ginger Labs, Inc. (iOS) Ben for Intune by Thanks Ben Ltd SDP -…

August 2026

Open Outlook emails within Copilot Chat

You can now open Outlook emails directly within any full-app Microsoft 365 Copilot experience for faster browsing and reference. Details: What changed: When clicking on an email reference or source in Microsoft 365 Copilot apps, the email opens alongside Chat instead of…

WindowsmacOSWeb
Week of 25 Aug 2026 · release 2608

Operating system version property in assignment filters is generally available

The operatingSystemVersion property in assignment filters is now generally available for managed devices and managed apps. Use this property to create filter rules that scope your app and policy assignments to devices running a specific OS version or build range. For example,…

August 2026

Organizational Messages now supports Hybrid-joined Devices

Roadmap ID: 503564 Details: What changed: Previously, Organizational Messages were limited to devices fully joined to Azure Active Directory or on-premises Active Directory. Now, hybrid Azure AD joined devices can receive Organizational Messages, expanding device coverage. This update improves message delivery consistency…

Web
August 2026

Outlook Emails in Copilot Notebooks

Outlook Emails as References in Copilot Notebooks bring email content into the notebook experience, enabling users to ground Copilot in the conversations, decisions, and context that drive their work. By adding emails as knowledge sources, users can connect context from their emails…

WindowsWeb
August 2026

Page steering and auto-triggering of pages on mobile

Users can now steer, refine, and edit pages using Copilot commands like "Shorten this page." They can also prompt Copilot to auto-create pages from chat, such as "Create a new page for XYZ." Details: What changed: Copilot now supports page steering on…

iOS/iPadOSAndroid
August 2026

Reference an email with when using Copilot in PowerPoint to create a presentation

You can now reference an email when using Copilot in PowerPoint to create a presentation. Roadmap ID: 555888 Details: What changed: Copilot in PowerPoint now allows referencing email content when creating presentations. Previously, users could not directly incorporate email information into their…

Windows
Week of 25 Aug 2026 · release 2608

Remove an individual eSIM from a corporate-owned Android device

Microsoft Intune now lets you remove a single eSIM from a corporate-owned Android Enterprise device without wiping it. Turn on Preview new device view, select the device, copy the eSIM's ICCID from device inventory, then select Remove eSIM and enter the ICCID.…

Android
Week of 25 Aug 2026 · release 2608

Remove eSIMs during a device wipe with a settings catalog policy

Microsoft Intune now supports the Remove all eSIMs during a device wipe setting in the Android Enterprise settings catalog. Set it to True to request removal of all eSIMs when a corporate-owned device is wiped while the policy applies. The default, False,…

Android
August 2026

Scheduling with Copilot chat in classic Outlook for Windows

Users can now schedule meetings directly from chat or by clicking "Schedule with Copilot" in the UI. Simply ask Copilot to schedule a meeting with colleagues, and it will find available times, book rooms, draft agendas, and send invites—all within the chat…

Windows
August 2026

Select models when using Researcher in Copilot Chat

You can now choose supported Researcher models and modes directly within Chat when adding the Researcher agent to your conversation. Details: What changed: Copilot Chat now includes an option to pick from available Researcher models and modes when you add the Researcher…

WindowsWeb
Week of 25 Aug 2026 · release 2608

Separate device and work profile passwords on Android Enterprise devices

Microsoft Intune now supports the Block one lock for device and work profile setting in the Android Enterprise settings catalog, letting you require separate locks for the device and work profile instead of a shared one. Set it to True after configuring…

Android
August 2026

Simplified design for the Microsoft 365 Copilot app

A refreshed design for the Microsoft 365 Copilot web and desktop app simplifies the user experience to drive engagement with Copilot. This includes updates to the chat home screen, chat response layout, and navigation pane. Roadmap ID: 561488 Details: What changed: The…

WindowsmacOSWeb
Week of 25 Aug 2026 · release 2608

Skip new Apple Setup Assistant panes during enrollment

Microsoft Intune now includes Apple OS 27 Setup Assistant skip keys for Liquid Glass and Accessibility Appearance in Automated Device Enrollment profiles. You can hide these panes to reduce setup interactions and provide a more consistent enrollment experience on supported iPhone, iPad,…

macOSiOS/iPadOS
August 2026

Teams Meetings in Copilot Notebooks

Meetings as References in Copilot Notebooks bring Teams meeting content into the notebook experience, enabling users to ground Copilot on the discussions, decisions, and context that drive their work. By adding meetings as knowledge sources, users can connect transcripts, notes, chats, and…

WindowsiOS/iPadOSAndroidWeb
Week of 25 Aug 2026 · release 2608

Unattended Remote Help sessions for Windows devices

Microsoft Intune now supports unattended Remote Help sessions on physical Windows devices. Authorized helpdesk agents can sign in to a remote device with their own credentials without requiring the user to be present or take action. Helpers can view and control the…

Windows
August 2026

Unified web and work chat experience with dedicated Work IQ button

Use a new Work IQ button located in the top left of the Chat UI to switch access to work data on/off without leaving the chat experience. Details: What changed: Web and work chats are now unified into a single chat interface…

WindowsWeb
August 2026

Updated Copilot Notebooks UX

Users will find an updated, streamlined UX flow within Copilot Notebooks. Roadmap ID: 516042 Details: What changed: The Copilot Notebooks user experience has been revamped with a streamlined flow for opening items and navigating the product. Previously, users faced a more complex…

Web
August 2026

Use Python when Editing with Copilot in Excel

Edit with Copilot helps you work with Python in Excel by executing Python code for advanced analysis, automation, and data transformation with results outputted directly in your workbook. Details: What changed: You can now use Edit with Copilot to perform advanced data…

WindowsmacOSWeb
August 2026

Use voice for Q&A during Read Aloud in Word

Interact in real time with read aloud in Word with Copilot. While your document is being read aloud, you can ask questions with your voice—such as “What does this mean?” or “Summarize this section”—and get answers instantly. No need to pause and…

Windows
Week of 25 Aug 2026 · release 2608

View expanded SIM inventory for corporate-owned Android devices

Microsoft Intune now surfaces expanded SIM inventory for corporate-owned Android Enterprise devices, including EIDs, multiple ICCIDs, and activation state. View these details under Devices > All devices > select a device > Hardware, and use the reported ICCID to identify the correct…

Android
August 2026

Viva Engage private content in Microsoft 365 Copilot

Viva Engage content from private communities and events will be used as grounding source for Microsoft 365 Copilot. When a user queries in Microsoft 365 Copilot, they will only be able to see content they are privileged to access. Roadmap ID: 515144…

Web
Week of 25 Aug 2026 · release 2608

Windows 365 for Agents security baseline

Microsoft Intune now includes a security baseline for Windows 365 for Agents Cloud PCs. Administrators can deploy and customize recommended, device-scoped settings for Windows 11, Microsoft Edge, and Microsoft Defender for Endpoint to establish a consistent security posture for agentic workloads. For…

Windows
August 2026

Work IQ APIs – Unified REST Endpoint for Agents and Workflows

Introduces a new REST endpoint for Work IQ that serves as a unified entry point for invoking agents and workflows, providing a consistent, scalable alternative to legacy Copilot Chat endpoints. Roadmap ID: 559021 Details: What changed: Work IQ now offers a unified…

Web
August 2026

Choose Anthropic models when editing with Copilot in Word

You can choose to select Anthropic models, in addition to OpenAI models, when editing a Word document using Copilot. Roadmap ID: 558440 Details: What changed: Copilot in Word now supports selecting Anthropic AI models alongside existing OpenAI models for document editing. Previously,…

Web
August 2026

Consumption Dashboard tracks Copilot credit usage

The Consumption Dashboard tracks Copilot credit usage across AI services and provides budget information to managers, analysts, and administrators. Roadmap ID: 566302 Details: What changed: The new dashboard shows Copilot credit consumption for Cowork and WorkIQ API services. Access is scoped to…

Web
August 2026

Copilot uses enterprise assets hosted on Adobe Experience Manager when creating presentations

Once you connect your asset library hosted on Adobe Experience Manager to Microsoft 365 and Copilot, Copilot will create presentations using your organization's images. Roadmap ID: 516038 Details: What changed: Copilot in PowerPoint now accesses enterprise image assets hosted on Adobe Experience…

Web
August 2026

Create a presentation with Copilot in PowerPoint directly from the PowerPoint Web App

You can now create a presentation with Copilot in PowerPoint just as you open the PowerPoint web app. Roadmap ID: 560537 Details: What changed: Copilot integration now allows users to start creating presentations directly from the PowerPoint web app home screen for…

Web
August 2026

Outlook: Copilot provides coaching feedback in chat as you draft, edit, and format emails

Copilot now provides coaching feedback on email drafts via chat and can apply suggestions directly to your message in Outlook. Users have the option to choose which suggestions are applied, and Copilot updates your email in place. Roadmap ID: 559418 Details: What…

WindowsmacOSiOS/iPadOSAndroidWeb
August 2026

Outlook: Prepare for meetings with Copilot in classic Outlook for Windows

With so many of us in back-to-back meetings, it can be a real struggle to stay on top of pre-reads, action items, and even what each meeting is about. Copilot quickly prepares you for meetings within minutes by bringing real-time insights and…

Windows
August 2026

Parallel content and identity crawl improves content freshness

Copilot connectors now run content crawl and identity crawl in parallel, making ingested content available to users faster than before. Details: What changed: Previously, content crawl and identity crawl executed sequentially, causing delays before content became accessible in Copilot. Now, both crawls…

Web
August 2026

Planner Agent in group-based basic plans

Planner Agent will now be available for Microsoft 365 Copilot licensed users in all group-based Planner plans, including basic plans. Roadmap ID: 511820 Details: What changed: Planner Agent, previously limited to premium plans, is now available in all group-based Planner plans for…

WindowsmacOSWeb
August 2026

Reference web sources when creating a presentation with Copilot in PowerPoint

You can now ask Copilot in PowerPoint to reference relevant online sources while creating a presentation. Roadmap ID: 555893 Details: What changed: Copilot in PowerPoint now supports source referencing during presentation creation. Previously, users could not directly incorporate live web information as…

macOS
August 2026

ServiceNow connectors support role-based permissions

ServiceNow Knowledge and Catalog connectors now enforce access permissions based on user roles such as admin, knowledge manager, and knowledge admin. Details: What changed: Earlier, permissions in ServiceNow Knowledge and Catalog connectors were determined only by user criteria without considering roles. Now,…

Web
August 2026

Antivirus audit mode for Linux

Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement.Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007 or later. Documentation: Antivirus…

August 2026

App-only authentication for eDiscovery cmdlets in Security & Compliance PowerShell is unsupported

App-only authentication for eDiscovery cmdlets in Security & Compliance PowerShell is unsupported. Transition automations to Microsoft Graph APIs where available; the documented certificate-based authentication steps are best-effort guidance for existing automations and don't change the support status.

August 2026

Auto-labeling policies can target more than 100 SharePoint sites by using an existing adaptive scope…

Auto-labeling policies can target more than 100 SharePoint sites by using an existing adaptive scope with the SharePointAdaptiveScopes parameter with New-AutoSensitivityLabelPolicy.

August 2026

Before enforcing an auto-labeling policy, run it in simulation mode to identify which items it would label without making any changes

Review the match results and source distribution to determine whether the policy is ready to enforce.

August 2026

Guidance for DLP policies in Microsoft Edge for Business now explains policy sync status

Guidance for DLP policies in Microsoft Edge for Business now explains policy sync status, where to investigate managed and unmanaged app activity, and coverage limitations caused by duplicate app catalog entries, encoded traffic, dynamic endpoints, and shared consumer and enterprise URLs.

August 2026

In cross-tenant Microsoft Teams chats and channels, DLP policy enforcement follows the tenant that initiated the conversation

A user's home-tenant DLP policies don't automatically apply when another tenant hosts the chat or thread.

August 2026

Microsoft 365 audit log activities now include Microsoft Defender for Cloud activities, People Skills activities

Microsoft 365 audit log activities now include Microsoft Defender for Cloud activities, People Skills activities, Microsoft 365 Archive file-level policy activities, and Microsoft Purview permission activities.

August 2026

Microsoft Purview support for Anthropic Claude Enterprise now includes data classification, Insider Risk Management

Microsoft Purview support for Anthropic Claude Enterprise now includes data classification, Insider Risk Management, Communication Compliance, eDiscovery, Data Lifecycle Management, and Compliance Manager.

August 2026

Offboarding API support for Linux

Enables organizations to automate the offboarding of Linux servers from Microsoft Defender for Endpoint through the Offboard machine API, simplifying device lifecycle management at scale.Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007 or later. Documentation: Offboarding API support for Linux

August 2026

Permanently delete SharePoint and OneDrive files with Priority Cleanup

After simulation, review, and required approvals, selected files bypass the recycle bins and are no longer discoverable in SharePoint search, Microsoft 365 Copilot, or eDiscovery.

August 2026

Prepare Endpoint DLP for permission changes in macOS 27

Deploy client version 101.26072 or later, configure protection modes, monitor permission status, and notify users if they disable the required Device Control and Data Access permission.

August 2026

Remove a retention hold from an unlicensed OneDrive site by using Security & Compliance PowerShell

Remove a retention hold from an unlicensed OneDrive site by using Security & Compliance PowerShell. The guidance covers tenant-level and site-level holds, prerequisites, and common errors that can block site deletion.

August 2026

Run on-demand classification scans on Windows endpoints to discover sensitive information without waiting for files to be opened or modified

The new guidance covers billing and best practices, monitoring and troubleshooting, and frequently asked questions.

August 2026

Sensitivity label policies for non-Microsoft connected apps

Create auto-labeling policies that protect sensitive data at rest in non-Microsoft connected apps, including Box and Google Workspace. These policies use the existing Microsoft Defender for Cloud Apps connectors and support the same classification engine available for Microsoft 365 locations.

August 2026

Tamper protection in audit mode for Linux

Detects and alerts on unauthorized modifications to Defender configurations, files, directories, processes, and services, including attempts by root users. Tampering activity is surfaced through alerts, the device timeline, and Advanced Hunting without blocking the activity.Available in Microsoft Defender for Endpoint on Linux…

August 2026

The Endpoint DLP capability comparison now clarifies that policies for access by apps not included…

The Endpoint DLP capability comparison now clarifies that policies for access by apps not included in a restricted apps list or restricted app group are supported on Windows but not on macOS.

August 2026

The Insights tab in the policy details panel provides an at-a-glance view of an auto-labeling policy's performance

The Insights tab in the policy details panel provides an at-a-glance view of an auto-labeling policy's performance. The information shown varies depending on whether the policy is running in simulation or enforcement mode, helping you understand how it identifies or labels content.

August 2026

Use data loss prevention policies for non-Microsoft connected apps

Create DLP policies that protect sensitive data at rest in non-Microsoft connected applications, such as Box and Google Workspace. These policies use the existing Microsoft Defender for Cloud Apps connectors and support the same classification engine available for Microsoft 365 locations.

August 2026

Vulnerability assessment for Microsoft Store applications

You can now monitor vulnerabilities on devices running Microsoft Store applications, including Microsoft Teams, Mozilla Firefox, WhatsApp, Slack, Dropbox, DuckDuckGo, Dell Command Documentation: Vulnerability assessment for Microsoft Store applications

July 2026 97

July 2026

Admins can now edit user mappings and query filters for ServiceNow Connector

Support connection edit of user mapping, query filter for ServiceNow Roadmap ID: 503590 Details: What changed: Previously, once the ServiceNow connector was configured, user mappings and query filters could not be changed without recreating the connection. Now, admins can edit these settings…

Web
July 2026

Enable adaptive card refresh in custom engine agents

Adaptive card refresh now works in custom engine agents, improving dynamic content updates. Details: What changed: Adaptive card refresh is enabled for adaptive cards in custom engine agents, allowing cards to update dynamically without user intervention. Previously, adaptive card refresh was not…

Web
July 2026

Floating Copilot icon in File Previewer for OneDrive

A new Copilot icon button provides a quick, visible entry point to Copilot directly within the file previewer in OneDrive. Positioned at the bottom-right corner (instead of the command bar), this button surfaces contextual prompts tailored to the file type and offers…

Web
July 2026

List email attachments in Microsoft 365 Copilot

Users will be able to list the file attachments that they received or sent over email in Microsoft 365 Copilot. Roadmap ID: 497909 Details: What changed: Microsoft 365 Copilot now provides a list of email file attachments from messages you sent or…

WindowsmacOSiOS/iPadOSAndroidWeb
July 2026

Lists in Context IQ

Users will be able to search for and select SharePoint Lists through the Context IQ menu to help ground their prompts when using Copilot Chat. Roadmap ID: 422308 Details: What changed: Previously, users could not directly access SharePoint Lists within Context IQ…

Web
July 2026

Plan and build solutions on SharePoint with Copilot in SharePoint

Copilot in SharePoint lets you plan and build SharePoint solutions using natural language commands. Details: What changed: Copilot in SharePoint now supports creating SharePoint solutions through natural language input. Why: Building SharePoint solutions typically requires technical expertise and time. This change lowers…

Web
July 2026

Redesign Overview experience in Copilot notebooks in OneNote

The Copilot Notebooks Overview now provides a redesigned experience for crisper AI-generated summaries, key insights, and one-click artifacts to move work forward in the notebook. Details: What changed: The Notebook Overview experience has been redesigned with a better layout and direct visibility…

WindowsmacOSWeb
July 2026

Redesign Overview experience in Copilot notebooks in OneNote

The Copilot Notebooks Overview now provides a redesigned experience for crisper AI-generated summaries, key insights, and one-click artifacts to move work forward in the notebook. Details: What changed: The Notebook Overview experience has been redesigned with a better layout and direct visibility…

WindowsmacOSWeb
July 2026

SharePoint list support in Agent Builder

Agent Builder now supports using a SharePoint list as a knowledge source for agents in Microsoft 365 Copilot. Makers can ground an agent in structured list data so users can ask questions and get responses based on information stored in a selected…

WindowsWeb
July 2026

Surface rich images inline within responses

Copilot now displays rich images from files and meetings directly within responses to improve comprehension. Details: What changed: Previously, Copilot responses included text only. Now, it surfaces relevant images inline from files and meetings to provide visual context. This enhancement supports richer…

WindowsWeb
July 2026

Take Screenshot in Copilot

Give users a fast, built‑in way to capture screenshots and include them in Copilot prompts, helping them communicate visual context more easily and receive more accurate, actionable assistance. Roadmap ID: 558105 Details: What changed: Copilot now includes a built-in screenshot capture tool…

Windows
Week of 27 Jul 2026 · release 2607

Collect Windows registry data with the properties catalog

Microsoft Intune now lets you collect Windows registry data through the properties catalog. When you create a device inventory policy, you can define specific registry keys and values to collect from enrolled Windows devices, including a single value, all values directly under…

Windows
Week of 27 Jul 2026 · release 2607

Controlled Configuration for Microsoft Defender antivirus settings (preview)

In preview, Microsoft Intune now supports Controlled Configuration for Microsoft Defender antivirus settings. When you enable it, the Defender antivirus settings delivered by Intune or Microsoft Defender for Endpoint security settings management become authoritative and override configurations from other channels, such as…

Windows
Week of 27 Jul 2026 · release 2607

Custom compliance settings for macOS

Microsoft Intune now supports custom compliance settings for macOS. As an admin, you can define compliance checks using scripts and JSON rules, similar to existing support for Windows and Linux. This capability lets you evaluate device configuration, security posture, and other custom…

macOS
Week of 27 Jul 2026 · release 2607

Dedicated RBAC permission for zero-touch enrollment

Microsoft Intune now provides a dedicated role-based access control (RBAC) permission for Google zero-touch enrollment portal access. Previously, the zero-touch enrollment iframe in the Microsoft Intune admin center required the Update app sync permission, which also grants rights to manage Managed Google…

Android
Week of 27 Jul 2026 · release 2607

Improved on-demand device sync for Windows devices

Microsoft Intune now supports a more comprehensive on-demand sync for Windows devices. When you select the Sync device action in the Microsoft Intune admin center, Intune initiates a full synchronization across key workloads, including configuration policies, apps, and scripts, so devices reflect…

Windows
Week of 27 Jul 2026 · release 2607

New Microsoft Edge settings in the Windows settings catalog

The Microsoft Edge administrative templates were refreshed to Microsoft Edge 149 (version 149.0.4022.21), which adds the latest Microsoft Edge 148 and 149 policy settings to the Windows settings catalog. The new settings are: Allow Local Fonts permission on these sites (LocalFontsAllowedForUrls) Allow…

Windows
Week of 27 Jul 2026 · release 2607

New OneDrive settings in the Windows settings catalog

There are new OneDrive settings in the Windows settings catalog: Set a custom name for the OneDrive folder – sets a custom name for the synced OneDrive folder on the user's device. Enable OpenID Connect (OIDC) authentication for syncing content from an…

Windows
Week of 27 Jul 2026 · release 2607

New Windows App (Azure Virtual Desktop) settings in the Windows settings catalog

There are new Windows App settings in the Windows settings catalog. To see and configure them in Intune, create a Windows settings catalog profile (Devices > Manage devices > Configuration > Create > New policy > Windows 10 and later > Settings…

Windows
Week of 27 Jul 2026 · release 2607

New option for the Remove Default Microsoft Store packages setting

The existing Remove Default Microsoft Store packages setting in the ApplicationManagement area has a new subsetting, Specify additional package family names to remove. It lets you provide a custom list of package family names (PFNs) to remove, in addition to the built-in…

Windows
Week of 27 Jul 2026 · release 2607

New setting to disable the Get Started app

The new Disable Get Started setting prevents the Windows Get Started app from being available to users. For more information, see the Experience policy CSP.

Windows
Week of 27 Jul 2026 · release 2607

New settings available in the Windows settings catalog

Microsoft Intune now includes new settings in the Windows settings catalog for Windows devices. You can configure options for camera behavior, Keyboard Filter controls (for Windows Insider devices), and Windows Subsystem for Linux (WSL). To find them, go to Devices > Manage…

Windows
Week of 27 Jul 2026 · release 2607

Regional support for Microsoft Store apps

Microsoft Intune now supports regional selection for Microsoft Store apps. When you add a Microsoft Store app, you can choose the region (market) whose Store catalog to search and deploy from. Previously, Intune searched only the United States catalog. Now you can…

Windows
Week of 27 Jul 2026 · release 2607

Samsung Knox E-FOTA firmware update management for Android Enterprise devices

Microsoft Intune now integrates with Samsung Knox E-FOTA (Firmware Over-The-Air), so you can manage firmware updates for corporate-owned Samsung devices directly in the Microsoft Intune admin center. Control which firmware version each device receives, deploy updates without user interaction, and schedule downloads…

Android
Week of 27 Jul 2026 · release 2607

Skip Setup Assistant screens for tvOS and visionOS enrollment

Microsoft Intune now supports hiding or showing new Setup Assistant screens during automated device enrollment (ADE) for tvOS and visionOS devices. When you configure an enrollment profile, you can choose which screens, such as Apple ID, Diagnostics Data, and Location Services, appear…

Week of 27 Jul 2026 · release 2607

Updated Visual Studio administrative templates in the Windows settings catalog

The Visual Studio administrative templates were refreshed to version 1.0.184.40051, which adds the latest Visual Studio policy settings to the Windows settings catalog. The new setting is: Disable Model Context Protocol (MCP) (DisableMCP) For more information, see the Visual Studio administrative templates…

Windows
July 2026

Access agents with Model Context Protocol in Office apps

Agents built with the Model Context Protocol (MCP) are available in Word, Excel, PowerPoint, Outlook, and Catalyst. Details: What changed: Users can now access agents built with the Model Context Protocol (MCP) directly within Word, Excel, PowerPoint, Outlook, and Catalyst apps. Previously,…

Web
July 2026

Admins can manage access more precisely with support for nested permissions in Confluence and ServiceNow

Support for hierarchical ACLs for SNOW and Confluence connectors. Roadmap ID: 503587 Details: What changed: The connectors for Confluence and ServiceNow now evaluate parent-level permissions when determining access to child items. Previously, only child item permissions were considered, which could lead to…

Web
July 2026

Copilot Prompt Gallery - Company-wide prompt publishing

Organizations can build their own collections of prompts that are tailored to their business needs and workflows and distribute these to all users within the tenant. Roadmap ID: 486695 Details: What changed: Admins can now build prompt collections specific to their company's…

WindowsWeb
July 2026

Create brand kits from your brand guidelines

Seamlessly create brand kits by uploading your brand guidelines document. Details: What changed: Users can now upload a brand guidelines document to automatically generate brand kits. Previously, creating brand kits required manual setup and configuration. This update streamlines the process and reduces…

Web
July 2026

Manage Federated Copilot Connectors in Microsoft 365 admin center connectors tab

Admins can now deploy and manage Federated Copilot Connectors (MCP-based connectors) directly from the Connectors tab under Copilot in the Microsoft 365 admin center. Details: What changed: Previously, Copilot connectors primarily enabled organizations to index and sync organizational data into Microsoft 365.…

Web
July 2026

Microsoft Edge: v.149 - Modern, unified, and updated Look and Feel

Microsoft Edge will update the Look and Feel to give customers a unified experience across all of Microsoft AI surfaces including Copilot and Bing. This will change multiple elements of the UX such as spacing, corners, fonts, default colors, etc. Roadmap ID:…

Web
July 2026

Submit agent to Agent Store from Agent Builder

Customers can submit their agents built in Agent Builder to the Agent Store under the "Built by your org" section, after admin review and approval in Microsoft 365 Admin Center. This governed flow enables admins to review, approve, and publish submitted agents…

WindowsWeb
July 2026

AI agent posture risk in Microsoft Defender

Microsoft Defender now assesses posture risk for AI agents, including enterprise agents and local agents discovered on endpoint devices. Risk levels are based on active risk indicators, such as configuration, access, runtime activity, endpoint and user context, and active alerts. Security teams…

July 2026

AI agent runtime protection updates

AI agent runtime protection includes these enhancements:- Vendor-supported agent event interfaces now work with standard platform and engine update channels, so no Beta channel configuration is required. Agent-native event inspection now supports Codex CLI and the GitHub Copilot app.- Network inspection is…

July 2026

AI-generated survey insights with Copilot Highlights

Copilot in Viva Glint now generates AI-powered summaries of employee survey results directly within Team Summary and Executive Summary reports, helping leaders quickly understand strengths, opportunities, and trends across their teams. Copilot Highlights surfaces key insights - such as notable score changes,…

Web
July 2026

AI-powered notes after in-person meetings

Easily catch up after in-person and hybrid meetings with AI-powered notes. In Teams Rooms on Android, Facilitator captures notes in real time and displays them on the front of room display or touch board. Available with Teams Rooms Pro.

July 2026

Access Viva communities in Teams

Open your org's Viva communities directly in Teams and stay up to date with notifications that appear in your Activity feed.

July 2026

Added a checklist to help administrators understand auditing, regional availability, label scope, encryption settings

Added a checklist to help administrators understand auditing, regional availability, label scope, encryption settings, sensitive information types, file eligibility, and required roles before creating an auto-labeling policy.

July 2026

Administrators can use Microsoft Fabric governance experiences in the OneLake catalog to understand DLP activity and adoption

These insights help identify evaluated workspaces, locate sensitive information, track policy adoption, and prioritize high-risk assets.

July 2026

Apply brand kit and style to visual creations in Copilot chat

Customize visual outputs in Copilot Chat by selecting style, format, and applying your organization's brand kit automatically. Details: What changed: Copilot Chat now offers built-in controls to select preferred visual styles and formats such as posters, infographics, or images. Users with a…

WindowsmacOSWeb
July 2026

Auto-labeling policies can remove or downgrade sensitivity labels

The documentation explains behaviors that are by design and often interpreted as bugs. These behaviors include activation results that differ from simulation, encryption restrictions, cross-tenant label identities, conflicts with label-application policies, and the effect of label removal on encryption.

July 2026

Auto-labeling policy guidance now identifies supported and unsupported group types and explains membership-propagation delays

Mail-enabled security groups, distribution groups, and Microsoft 365 groups are supported, while mail-disabled, dynamic distribution, and deeply nested groups have limitations.

July 2026

Auto-labeling simulation isn't a completely silent dry run

Auto-labeling simulation isn't a completely silent dry run. Simulation can generate activity alerts, duplicated policies start in simulation, management actions can remain unavailable during provisioning, and the review experience can mix auto-labeling and DLP results in test mode.

July 2026

Call quickly with speed dial

Easily add and edit key contacts by role or priority in the new dedicated speed dial tab in Teams mobile. Updates sync across devices, making your calling experience consistent.

July 2026

Catch up in the Meeting Recaps app

Review past meetings in one place from the Meeting Recaps app. Choose from different recap styles, like audio and video, to suit your personal preference. Quickly filter recaps to find the ones that matter to you most. To learn more, see Get…

July 2026

Configure a manual business continuity and disaster recovery environment for Microsoft Purview Data Map

The guidance covers creating a secondary account, mirroring scans, validating the environment, and requesting account promotion during a regional outage.

July 2026

Copilot Analytics: "All"- licensed user page Copilot dashboard

The Copilot Dashboard adoption page will be updated to show a unified view of Copilot adoption across the organization. Instead of the option to only show Microsoft 365 Copilot (licensed) usage, the page will include all Copilot user adoption, covering both M365…

Web
July 2026

Copilot Chat in Outlook expands to reason over inbox, calendar, and enterprise data

Copilot Chat in Outlook for affected users will expand from reasoning over a single email thread to reasoning over the user's entire inbox, calendar, meetings, and other enterprise data that is already available to them through Microsoft 365. Please see additional details…

WindowsmacOSiOS/iPadOSAndroidWeb
July 2026

Copilot Notebook in OneNote for iPhone and iPad

Users will be able to use Copilot Notebooks in OneNote on iPhone and iPad. Roadmap ID: 511794 Details: What changed: Users can now access Copilot Notebooks directly within OneNote on iPhone and iPad. Previously, this AI-powered workspace was limited to desktop versions.…

iOS/iPadOS
July 2026

Copilot Search Matches on People's Department

Copilot Search can now match on a person's department, and you can find/lookup all people in a given department when searching the people source directly. Roadmap ID: 508527 Details: What changed: Copilot Search includes department information in its matching criteria for people…

Web
July 2026

Create Excel spreadsheets from Copilot Notebooks

Copilot Notebooks allows users to generate Excel spreadsheets using the content and references gathered in a notebook. Copilot drafts a structured spreadsheet grounded in the notebook's context, which can be opened and edited in Excel, helping users move from ideas and source…

WindowsWeb
July 2026

Create PowerPoint presentations from Copilot Notebooks

Copilot Notebooks enables users to generate PowerPoint presentations directly from the content and references collected in a notebook. Using the notebook's curated context, Copilot creates a structured, editable slide deck that users can open and refine in PowerPoint, helping turn research, notes,…

WindowsWeb
July 2026

Create Word documents from Copilot Notebooks

Copilot Notebooks allows users to generate Word documents using the content and references gathered in a notebook. Copilot drafts a structured document grounded in the notebook's context, which can be opened and edited in Word, helping users move from ideas and source…

WindowsWeb
July 2026

Create presentations with Work IQ using Agent Mode in Copilot in PowerPoint

Now with Agent Mode in Copilot in PowerPoint, you can create presentations based on your Work IQ. Build rich presentations without the heavy lift of finding all the right files, meetings, and emails to compose relevant slides. Roadmap ID: 555874 Details: What…

Windows
July 2026

Customize employee self-service agent landing page

Admins can now customize the Employee Self-Service agent landing page with accent colors, categorized prompts, and quick links to improve engagement and branding. Details: What changed: The standard ESS Agent landing page is replaced by an optional rich landing page that supports…

Web
July 2026

Defender Deployment Tool for Linux

Available from Defender for Endpoint on Linux version 101.26042.0011 and later. The Defender Deployment Tool for Linux simplifies deployment by combining installation, onboarding, upgrades, and uninstallation into a single workflow. The tool automates prerequisite validation, supports custom installation paths, enables deployment of…

July 2026

Edit capability for selecting permission reading option for existing ServiceNow Knowledge & Catalog Connections

Earlier admins had to create new connections to adopt to the hierarchical permissions for ServiceNow Knowledge & Catalog Copilot Connectors as the edit capability was missing. Now, admins can easily edit their existing connections to switch between the permission handling option i.e.…

Web
July 2026

Enable watermarks for AI-generated content for Microsoft 365 Copilot

Add watermarks for AI-generated content. Roadmap ID: 547831 Details: What changed: To help provide additional transparency about what content has been generated or altered by using AI in Microsoft 365, watermarks can be added to videos and audio content. A policy setting…

WindowsmacOSiOS/iPadOSAndroidWeb
July 2026

Exchange Online DLP policies can detect classification failures caused by timeouts, throttling, and other scanning errors

Administrators can enable classification-failure detection and use the DocumentScanFailures condition to apply different protection actions for specific failure types.

July 2026

Expanded note capabilities across alerts and cases

Analysts and investigators can now add and view notes on both alerts and cases. System-generated notes are automatically applied when there's a change in alert or case status, assigned user, closure, or case escalation.

July 2026

Expanded user profile details in the unified alert experience add additional user profile signals from Microsoft Entra

Expanded user profile details in the unified alert experience add additional user profile signals from Microsoft Entra, including office location, employee type, department, and last working date.

July 2026

Generated files inherit sensitivity labels

When generating files with Microsoft 365 Copilot, sensitivity labels are automatically applied based on the highest label detected in the source data to protect organizational data. Details: What changed: Microsoft 365 Copilot now evaluates the content used to generate files and applies…

WindowsmacOSiOS/iPadOSAndroidWeb
July 2026

Hiring made easier in Teams

The LinkedIn Hiring Assistant is now integrated in Teams, helping streamline candidate review and hiring manager collaboration.

July 2026

Licensing and configuration locations are documented for client-side Office auto-labeling

The guidance also describes common symptoms caused by missing licenses, roles, regional availability, or transient backend failures.

July 2026

Localized default Mark as and notify email templates

When automatic notifications use the default template, users receive notification emails in their preferred language based on their Outlook language settings. Custom notification templates configured by admins aren't affected. For more information, see Admin review for user reported messages.

July 2026

MAI‑Image‑2‑Efficient is now available in Copilot in PowerPoint

MAI‑Image‑2‑Efficient enables users to generate high‑quality visuals directly in PowerPoint, helping them quickly create and refine slides without leaving their workflow. Details: What changed: Copilot in PowerPoint now includes the MAI‑Image‑2‑Efficient model for image generation. This model is optimized for speed and…

WindowsmacOSWeb
July 2026

Metadata understanding support for queries scoped to SharePoint document libraries or folders

We're introducing column metadata support for queries in Microsoft 365 Copilot when a SharePoint library or folder is attached or its URL is provided. This enhancement improves contextual relevance by enabling Copilot to leverage additional metadata from the selected library, delivering more…

Web
July 2026

Microsoft Defender for Office 365 Plan 1 included in Microsoft 365 E3

Microsoft 365 E3 now includes Microsoft Defender for Office 365 Plan 1. For more information about what's included in each plan, see Microsoft Defender for Office 365 Plan 1 vs. Plan 2 cheat sheet.

July 2026

Microsoft Purview role-group assignments can be configured with an expiration date so that access is revoked automatically

Temporary assignments can last from one day to two years and are supported by most built-in and custom role groups, except eDiscovery Administrator and eDiscovery Manager.

July 2026

Mind maps in Copilot Notebooks are interactive visual artifacts…

Users can explore the mind map, view summaries for individual nodes, and use Notebook chat to get more detail about a node. Available across OneNote and Microsoft 365 Copilot app. Roadmap ID: 559029 Details: What changed: Previously, users reviewed notebook content as…

WindowsWeb
July 2026

Multimodal capture in Copilot Notebooks (iPhone)

Multimodal capture enables users to transcribe audio, take images, and type notes in a single session. Copilot then creates a structured Copilot Page with insights and user-captured content, saved to a user-selected Copilot Notebook. Designed for capturing offline work moments—including in-person conversations,…

iOS/iPadOS
July 2026

OneNote: Copilot Notebooks available in OneNote on Web

Users will now have access to their Copilot Notebooks on the web version of OneNote. Roadmap ID: 511797 Details: What changed: Users can now open and use Copilot Notebooks in OneNote on the web. Previously limited to desktop experiences, Copilot Notebooks are…

Web
July 2026

Open Word, Excel, and PowerPoint, and PDF files in Copilot Chat

Currently, clicking on cited content in Copilot opens files outside of Copilot. With this new feature, content can be opened directly in Copilot Chat to make viewing documents more streamlined alongside chat. This change is not available on the Microsfot 365 Copilot…

WindowsmacOSWeb
July 2026

Priority cleanup policies now require three separate approvals before content can be permanently deleted

Priority cleanup policies now require three separate approvals before content can be permanently deleted: one Priority Cleanup administrator, one retention manager, and one eDiscovery administrator.

July 2026

Protect sensitive data in text and prompts by integrating with Microsoft Entra Global Secure Access (GSA)

This integration enables organizations to intercept and inspect text and AI interactions at the network layer, enforce restrictive actions based on DLP policies, and detect risky user activity through Insider Risk Management. It helps prevent sensitive data from being shared with untrusted…

July 2026

Quickly launch the Microsoft 365 Copilot app on your iOS device

Press the Action button or ask Siri to launch Copilot on your iOS device. Roadmap ID: 485724 Details: What changed: You can now launch the Microsoft 365 Copilot app on iOS by long pressing the device's Action button or by asking Siri.…

iOS/iPadOS
July 2026

Real-time protection for Microsoft Agent 365 tooling servers

Microsoft Defender evaluates tool invocations and responses against security policies and can allow or block interactions with Work IQ MCP and customer MCP tools onboarded to Agent 365. For more information, see Protect AI agents in real time using Microsoft Defender.

July 2026

Real-time voice interactions with Audio Overview

Today, audio overview help you absorb content on the go, but they're one-way—listeners can't clarify or explore without stopping. With real time voice interactions, you can ask questions verbally while listening and get answers instantly - all while staying in the audio…

Web
July 2026

Reference a Teams meeting or chat when creating a presentation with Agent Mode in PowerPoint

You can now reference a Teams meeting or chat when creating a presentation with Agent Mode in PowerPoint. Roadmap IDs: 555885 555884 555883 Details: What changed: Copilot in PowerPoint can now use a referenced Teams meeting or chat as context when creating…

WindowsmacOSWeb
July 2026

Remember sign-in settings on Teams for web

Teams for web now honors your sign-in preference across browser sessions, whether you want to stay signed in or sign in again when you reopen your browser.

July 2026

Reuse content and style from existing PowerPoint presentations with Copilot in PowerPoint

Copilot in PowerPoint now lets you reference existing PowerPoint presentations when creating or editing presentations with Copilot in Power Point. You can reuse text content and style and theme from existing decks, create new presentations based on referenced files, or apply the…

WindowsmacOSWeb
July 2026

Scheduled prompts for Agents

Enables users to schedule recurring prompts to declarative agents like Analyst, Idea Coach and more. Roadmap ID: 531759 Details: What changed: This update enables scheduling of repeated prompts to declarative agents, replacing the prior need to manually initiate each interaction. It supports…

WindowsmacOSWeb
July 2026

Search for keyboard shortcuts

Find keyboard shortcuts quickly in the keyboard shortcut dialog's new search functionality.

July 2026

Share agents to Teams

This feature simplifies agent distribution and increases team awareness, improving collaboration efficiency. Roadmap ID: 557947 Details: What changed: Users can now search for and select Microsoft Teams teams in the agent sharing dialog box to share their Copilot agents. When sharing, users…

Web
July 2026

The Domain investigation page allows you to investigate an Active Directory domain

It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships.

July 2026

Threat detection for Microsoft Agent 365 agents

Microsoft Defender analyzes runtime signals from agent interactions, tool usage, and execution patterns to surface alerts in Microsoft Defender XDR. Detection uses observability data from Microsoft Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot Agent Builder, and agents integrated through the Microsoft Agent…

July 2026

Troubleshoot why a specific SharePoint or OneDrive file was or wasn't labeled

Troubleshoot why a specific SharePoint or OneDrive file was or wasn't labeled. The diagnostic guidance covers unsupported formats, checked-out files, indexing delays, existing higher-priority labels, encryption prerequisites, transient failures, and unexpected labeling.

July 2026

Unified RBAC is the default permission model for new Defender for Office 365 Plan 2 organizations

Starting July 2026, new Microsoft Defender for Office 365 Plan 2 organizations use the Microsoft Defender unified role-based access control (Unified RBAC) model by default. For more information, see Configure Unified RBAC for Microsoft Defender for Office 365 and MC1246006.

July 2026

Unified alert experience combines the Triage Agent and Standard alert dashboards into a single alerts list page

View and manage both classic and agent-triaged alerts from one location, with the ability to preview agent summaries, alert and user details directly on the alerts list page.

July 2026

Use multiple lines on Teams Phone

Stay organized across roles or regions from a single Teams account with Teams Phone-multi line. Switch between up to 10 numbers on your account, each appearing as its own tab.

July 2026

View long running agent tasks in Windows taskbar

Users can see the status of ongoing long running tasks for agentic workflows directly in the Windows taskbar without opening the app. Details: What changed: Long running agents now display task status icons and progress indicators in the Windows taskbar. Previously, users…

Windows

June 2026 113

Week of 29 Jun 2026 · release 2606

Advanced Intune capabilities are being added to Microsoft 365 E3 and E5

Microsoft is adding several Intune Suite capabilities to Microsoft 365 E3 and Microsoft 365 E5 to enable more organizations to use advanced endpoint management and security without a separate add-on. The following capabilities are added to Microsoft Enterprise Mobility + Security E3…

Week of 29 Jun 2026 · release 2606

Auto-update for Enterprise App Management applications

Microsoft Intune now supports automatic updates for Enterprise App Management (EAM) applications. When you enable auto-update for an EAM app with a required assignment, Intune detects when a newer version is available in the EAM catalog and automatically updates the app on…

Windows
Week of 29 Jun 2026 · release 2606

Available macOS PKG apps update automatically when you upload a new version

For available macOS PKG apps, updates now deploy to devices automatically when the same app policy was updated with a new app version, so users no longer need to select Install or Reinstall in Company Portal to get the latest version. When…

macOS
Week of 29 Jun 2026 · release 2606

Enterprise App Management support for GCC High and DoD

Microsoft Intune now extends Enterprise App Management (EAM) to the GCC High (GCCH) and DoD cloud environments. Government organizations can use the EAM enterprise catalog to discover, deploy, and keep prepackaged Microsoft and third-party apps up to date without manual repackaging. A…

Windows
Week of 29 Jun 2026 · release 2606

Intune support for Trustd Mobile as a mobile threat defense partner

You can now use Trustd Mobile as a mobile threat defense partner (MTD) for enrolled devices that run the following platforms: Android 9.0 and later iOS/iPadOS 15.0 and later To learn more about this support, see Use Trustd Mobile with Microsoft Intune.

Week of 29 Jun 2026 · release 2606

Microsoft Tunnel adds support for Red Hat Enterprise Linux 9.7

Microsoft Tunnel Gateway now supports Red Hat Enterprise Linux (RHEL) 9.7 as a Linux server distribution. This support requires the use of Podman 5.8.2 as its default container engine. Customers upgrading from environments using Podman v3 containers should recreate containers and reinstall…

Week of 29 Jun 2026 · release 2606

New Android Enterprise settings in the Intune settings catalog

The settings catalog lists all the settings you can configure in a device policy, and all in one place. The following new Android Enterprise settings are available in the Microsoft Intune settings catalog (Devices > Manage devices > Configuration > Create >…

Android
Week of 29 Jun 2026 · release 2606

New Microsoft Defender Antivirus settings for Linux Server devices

The existing endpoint security Antivirus policy for the Microsoft Defender Antivirus profile on Linux Server now includes new settings you can configure and deploy to your managed Linux devices: Offline security intelligence update - Manage how Microsoft Defender Antivirus keeps its security…

Linux
Week of 29 Jun 2026 · release 2606

New setting added to the Windows security baseline version 25H2

The Intune security baseline for Windows, version 25H2, is updated to include one new setting, Disable Internet Explorer 11 Launch Via COM Automation, with a baseline default of Enabled. This setting was excluded from the version 25H2 baseline at its initial release…

Windows
Week of 29 Jun 2026 · release 2606

New supported OEMConfig apps for Android Enterprise

The following OEMConfig apps are available in Intune for Android Enterprise: FCNT | com.fcnt.arrowsconfig FCNT | com.fcnt.arrowsconfig_test For more information about OEMConfig, see Use and manage Android Enterprise devices with OEMConfig in Microsoft Intune.

Android
Week of 29 Jun 2026 · release 2606

Remote Help support for RemoteApp in Azure Virtual Desktop

Remote Help supports RemoteApp in Azure Virtual Desktop (AVD), enabling help desk agents to securely view and control apps running within RemoteApp sessions. For more information, see Launch Remote Help.

Week of 29 Jun 2026 · release 2606

Support for WPA3-Personal in iOS/iPadOS Wi-Fi profiles

Intune supports WPA3-Personal as a security-type option when configuring Wi-Fi device configuration profiles for iOS/iPadOS. Admins can now select WPA3-Personal alongside existing options such as WPA2-Personal. This feature: Allows managed iOS/iPadOS devices to connect to networks that require the stronger WPA3 protocol.…

iOS/iPadOS
Week of 29 Jun 2026 · release 2606

Updated security baseline for Microsoft 365 Apps for Enterprise

An updated security baseline for Microsoft 365 Apps for Enterprise is now available in Microsoft Intune. This baseline aligns with the most recent Microsoft 365 Apps security guidance and includes updated policy recommendations to help protect against evolving threats. This release is…

Windows
Week of 22 Jun 2026

Microsoft Intune app for Android requires version 2025.11.01 or later

The minimum supported version of the Microsoft Intune app for Android is now version 2025.11.01. This change took effect on May 1, 2026. Users running an older version might experience sign-in failures. Most users have app updates set to automatic and receive…

Android
June 2026

Anthropic's Claude now available in Microsoft 365 Copilot

Anthropic's Claude is now available in Copilot Chat, giving users more flexibility in how they work. Details: What changed: Users can now select Claude as a model option in Copilot Chat for complex analysis, document understanding, and structured content generation. Why: Adding…

WindowsmacOSiOS/iPadOSAndroidWeb
June 2026

Black Forest Lab's FLUX.2 Flex model is available in PowerPoint for Microsoft 365 Copilot

PowerPoint now supports Black Forest Lab's FLUX.2 Flex image generation model, giving users a new option for creating high quality visuals. Details: What changed: Users can now select FLUX.2 Flex when generating images in PowerPoint. The model produces higher‑quality visual output with…

Web
June 2026

Connect 15Five data to surface team priorities and recognition

104646 Connect 15Five with Microsoft 365 Copilot to bring team priorities and recognition into Copilot experiences. Roadmap ID: 515160 Details: What changed: A new Copilot connector enables integration with 15Five. Users can access team priorities and recognition data directly within Copilot. Previously,…

Web
June 2026

Edit with Copilot for PowerPoint uses enterprise assets hosted on multiple SharePoint OALs

Copilot for PowerPoint can now access images stored across multiple Organizational Asset Libraries when creating presentations. Details: What changed: Previously, Copilot could only pull images from a single Organizational Asset Library. It can now access enterprise assets stored across multiple SharePoint OALs,…

WindowsmacOSWeb
June 2026

Infinite scroll chat history

Infinite scroll makes it easier to browse older Copilot chat sessions by loading conversations automatically as users scroll. Roadmap ID: 557348 Details: What changed: Users no longer need to click to load older chats; conversations appear continuously as they scroll. Why: This…

Web
June 2026

MAI‑Image‑2‑Efficient is now available in Copilot in PowerPoint

MAI‑Image‑2‑Efficient enables users to generate high‑quality visuals directly in PowerPoint, helping them quickly create and refine slides without leaving their workflow. Details: What changed: Copilot in PowerPoint now includes the MAI‑Image‑2‑Efficient model for image generation. This model is optimized for speed and…

WindowsmacOSWeb
June 2026

MAI‑Image‑2‑Efficient is now available in Copilot in PowerPoint

MAI‑Image‑2‑Efficient enables users to generate high‑quality visuals directly in PowerPoint, helping them quickly create and refine slides without leaving their workflow. Details: What changed: Copilot in PowerPoint now includes the MAI‑Image‑2‑Efficient model for image generation. This model is optimized for speed and…

WindowsmacOSWeb
June 2026

Modern, unified, and updated look and feel in Microsoft Edge

Microsoft Edge is updating the Copilot experience to create a more unified visual design across Microsoft AI surfaces. Roadmap ID: 559993 Details: What changed: Microsoft Edge will update multiple user experience elements, including spacing, corners, fonts, and default colors, to align more…

Web
June 2026

Use Copilot to get a detailed and contextual explanation for shapes and images (Win32)

Users can now select shapes or images in PowerPoint and ask Copilot to explain them with detailed, contextual information. Details: What changed: The Explain feature in PowerPoint has expanded beyond acronyms, text boxes, tables, and slides. Users can now click Explain on…

WindowsmacOSWeb
Week of 15 Jun 2026

Android Enterprise personally owned devices with a work profile uses Android Management API (AMAPI)

When users enroll their personally owned Android devices in Intune, a work profile is created with a separate partition on the device for the user's work account. These devices are referred to as personally owned devices with a work profile. As part…

Android
Week of 15 Jun 2026

Enrollment time grouping for new Apple ADE enrollment policies generally available

Enrollment time grouping is now generally available for Apple automated device enrollment (ADE) on iOS/iPadOS and macOS. With enrollment time grouping, you can identify a device's Microsoft Entra security group during enrollment, so policies, apps, and settings can be applied earlier in…

Week of 15 Jun 2026

Improvements to the new Intune single device page (preview)

In the Intune admin center, the Devices > All Devices > select a device page is redesigned and available for you to preview. This feature was available in the 2604 service release. After the initial 2604 release, we made the following improvements:…

Week of 15 Jun 2026

Managed Win32 app content now requires HTTPS delivery

Intune now requires HTTPS delivery for managed Win32 app content. This change primarily affects organizations that use Microsoft Connected Cache and haven't configured their cache nodes for HTTPS delivery. Clients that previously pulled content from Connected Cache can still download Intune Win32…

Week of 15 Jun 2026

Microsoft Windows 11 STIG SCAP Benchmark audit baseline

Intune now includes a STIG audit baseline that assesses Windows devices against the recommended configurations defined in the Security Technical Implementation Guides (STIGs) published by the Defense Information Systems Agency (DISA). The initial baseline audits against the Microsoft Windows 11 STIG SCAP…

Windows
Week of 8 Jun 2026 · release 2605

APP Multiple Managed Accounts

Microsoft Intune mobile application management now supports Multiple Managed Accounts, letting users add and manage more than one managed account within the same app. App protection policies apply separately to each account, so you can tailor protection based on the account's organization…

iOS/iPadOS
Week of 8 Jun 2026 · release 2605

Custom top bar elements on Managed Home Screen

You have the option to display custom text in the top bar of the Managed Home Screen (MHS). In addition to the existing choices (serial number, device name, tenant name), you can now select Custom and enter a free-text string of up…

Android
Week of 8 Jun 2026 · release 2605

Detect and block Shadow AI using the properties catalog, device query, and a security baseline (preview)

Using Intune, you can detect and block a Local AI Agent, like OpenClaw, on Windows devices enrolled in Intune. Specifically, you can: Use a Properties catalog policy to collect the Local AI Agent entity. Admins can use this information to identify devices…

Windows
Week of 8 Jun 2026 · release 2605

Grant enhanced security permissions to a Mobile Threat Defense app on Android

A new Mobile Threat Defense role category is available on the Mobile Threat Defense connector configuration page in the Microsoft Intune admin center. The Grant MTD role permissions to \ on enrolled Android COBO and COPE devices toggle lets you grant enhanced…

Android
Week of 8 Jun 2026 · release 2605

In-place renewal of Cloud PKI issuing certification authorities (CAs)

Microsoft Intune now supports in-place renewal of eligible Cloud PKI issuing certification authorities (CAs). Previously, renewing an issuing CA required creating a new CA and manually updating dependent SCEP certificate profiles, which increased operational overhead and configuration risk. With in-place renewal, certificate…

Week of 8 Jun 2026 · release 2605

Managed Home Screen exit lock task mode password now requires a device configuration profile

You can no longer configure the Managed Home Screen exit lock task mode password by using an app configuration policy. To set or update the lock task mode password for Managed Home Screen, create or update a device configuration profile that defines…

Android
Week of 8 Jun 2026 · release 2605

New Block Bluetooth sharing setting in the Android Enterprise settings catalog

There's a new Block Bluetooth sharing setting in the settings catalog (Devices > Manage devices > Configuration > Create > New policy > Android Enterprise for platform > Settings catalog for profile type > General). When set to True, the device can't…

Android
Week of 8 Jun 2026 · release 2605

New Microsoft Edge settings in the Windows settings catalog

There are new Microsoft Edge 148 settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Manage devices > Configuration > Create > New policy > Windows 10 and later…

Windows
Week of 8 Jun 2026 · release 2605

New Wired Networks device configuration profile for iOS/iPadOS

There's a new 802.1x Wired Networks device configuration profile for iOS/iPadOS devices. The feature supports 802.1x Ethernet access controls, which is ideal for M-series iPads that support native resolution screen extension. It allows iPads to securely connect to hot desk docks and…

iOS/iPadOS
Week of 8 Jun 2026 · release 2605

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: Caju AI by Caju AI eYACHO for Biz 7 Intune by MetaMoJi Corporation (iOS) eYACHO Viewer 7 Intune by MetaMoJi Corporation (iOS) Harvey AI by Harvey AI (Android) Notta for Intune by…

Week of 8 Jun 2026 · release 2605

Silence apps on Managed Home Screen to prevent session PIN bypass

For devices using Managed Home Screen (MHS), you can now silence apps whenever MHS prompts the user for authentication, such as during sign-in or at the session PIN screen. When silenced, apps can't start activities, display notifications, appear in recent apps, or…

Android
Week of 8 Jun 2026 · release 2605

Strict Tunnel Mode for Microsoft Tunnel on Android

Microsoft Tunnel now supports Strict Tunnel Mode on Android Enterprise devices. When Strict Tunnel Mode is enabled, all network traffic is forced through the VPN tunnel. If the VPN connection is unavailable or drops, all network traffic on the device is blocked…

Android
Week of 8 Jun 2026 · release 2605

Use DDM to manage Apple Intelligence settings on devices running 26.4 and later

With the release of 26.4, Apple deprecated several intelligence-related settings in the MDM restrictions payload. To manage these settings, use the DDM configurations released in March 2026 instead. In the settings catalog, the following Restrictions are now deprecated: Allow Apple Intelligence Report…

macOSiOS/iPadOS
Week of 8 Jun 2026 · release 2605

Vulnerability Remediation Agent now uses Microsoft Entra agentic identity (preview)

This feature is rolling out to tenants gradually and may take several weeks to become available in your environment. The Vulnerability Remediation Agent is now available to all customers in preview. Previously, the agent was available only to a select group of…

June 2026

Add expected response for agent evaluation test cases

Makers can now add expected responses to agent evaluation test cases manually or through file import. Details: What changed: Test cases now support expected responses and multiple grading methods, including Exact, Partial, Similarity, and Compare Meaning. Why: This helps makers evaluate agent…

Web
June 2026

Automate agent lifecycle management with policy-based rules

Admins can now leverage rules to take large-scale agent management scenarios such as bulk installing first-party (1P) agents and reassigning ownerless agents to appropriate managers, enabling consistent governance and reducing operational overhead in enterprise environments. Roadmap ID: 481518 Details: What changed: Admins…

WindowsWeb
June 2026

Copilot can edit your document by default in Word

The default chat experience with Copilot in Word now allows Copilot to directly edit your document. All changes made by Copilot are fully reviewable and reversible, and users can turn this experience off if needed Roadmap ID: 557673 Details: What changed: Copilot…

Web
June 2026

Federated Copilot Connectors are now generally available

101838 Federated Copilot connectors are now generally available, enabling users to securely connect Microsoft 365 Copilot to supported third-party data sources and retrieve information in real time using the Model Context Protocol (MCP). Details: What changed: Federated Copilot connectors are now available…

Web
June 2026

Grader Framework for Agent Evaluation

The Grader Framework provides flexible evaluation options for agent responses using exact match, similarity, intent, and AI‑based metrics. Details: What changed: Makers can now use multiple grading approaches to evaluate agent performance with more transparency. Why: Different scenarios require different evaluation methods,…

Web
June 2026

Organizational Messages Usage‑based targeting is now generally available in the Microsoft 365 admin center!

Organizational Messages now supports usage‑based targeting in addition to existing group‑based targeting capabilities. This enables admins to deliver Organizational Messages based on real user behavior and engagement patterns rather than static group membership. Roadmap ID: 503563 Details: What changed: Admins can now…

Web
June 2026

Organizational Messages now supports Email messages

Organizational Messages in the Microsoft 365 Admin Center now supports email delivery in addition to other surfaces like the Windows Taskbar, Windows Spotlight, Windows Notification Center, and Teams Popovers. This gives admins another familiar communication channel while keeping messaging within one centralized…

Web
June 2026

Use Microsoft 365 Copilot in model‑driven apps (Work IQ)

Users can now access Microsoft 365 Copilot directly inside model‑driven apps to get answers and take action without switching tools. Details: What changed: Copilot is now embedded in model‑driven apps, enabling users to ask questions, complete tasks, and access context‑aware insights. Why:…

Web
June 2026

A new Convert supported file formats to HTML option is available when adding search results to a review set…

When enabled, cloud-native file formats such as .loop and .page files are converted to HTML, making the content indexed and keyword searchable in the review set and easier to process in post-export workflows.

June 2026

Access Endpoint DLP device attribute data using Advanced Hunting

Query Endpoint DLP device configuration and policy sync attributes at scale through the DeviceInfo table's DlpInfo column in Advanced hunting in the Microsoft Defender portal, instead of relying on point-in-time exports from the Microsoft Purview portal.

June 2026

Added definitions for the following sensitive information types

Added definitions for the following sensitive information types: China physical addresses Colombia national ID Colombia tax identification number Greenland physical addresses Russia physical addresses Russia taxpayer identification number Singapore physical addresses South Africa physical addresses Ukraine physical addresses

June 2026

BYOD support for Windows client using Entra registration

We are excited to announce Bring Your Own Device (BYOD) support for Windows client using Entra-registered devices is now generally available. You can now enable users and partners to access corporate resources from their own devices. Administrators can assign the Private Application…

June 2026

Better chat organization

Muted chats and meeting chats are now grouped together in separate sections to help you keep track of conversations and reduce distractions. To learn more, see Chat in Microsoft Teams meetings.

June 2026

Branded meeting reactions

Express yourself with organization-branded reactions during meetings. Companies can create custom reaction experiences that align with their brand. To learn more, see Use meeting themes in Microsoft Teams.

June 2026

Create a DLP policy that uses device scoping

Scope an Endpoint DLP policy to specific device groups — for example, enforce policy only when Finance users access data from Windows devices, and not when the same users work from macOS — using dynamic device groups defined in Microsoft Entra ID.

June 2026

Domainless SAML IdP federation for workforce tenants

Domainless SAML federation with a SAML Identity Provider allows external users to authenticate into your apps or workforce resources using their IdP-managed credentials, regardless of their email domain. Domainless federation removes the need for domain matching between the user's email and preconfigured…

June 2026

Email and portal notifications for Data Security Investigations

Investigators receive notifications through the Microsoft Purview Notification Center and email when setup completes and investigations are ready to use.

June 2026

Endpoint DLP evidence collection is now available as a data source in Data Security Investigations

Investigators can query data captured by endpoint Data Loss Prevention (DLP) policies on onboarded devices and add the associated content to an investigation scope for AI-powered analysis. This integration enables aggregate analysis of endpoint exfiltration events instead of per-alert triage.

June 2026

Enhanced Defender deployment tool for Windows

The new version of the tool streamlines onboarding and enhances security by:- Bundling the onboarding package directly into the tool's executable.- Generating a key during deployment package creation that is required for running the tool.- Enabling users to configure an expiry date…

June 2026

Enhanced exposure score in Defender Vulnerability Management

The new exposure score model in Defender Vulnerability Management is now generally available. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors such as internet-facing status and criticality. For more information, see…

June 2026

Enhanced matched conditions for Exchange DLP events surfaces detailed non-sensitive information type

Each matched condition includes the condition name, matched value, and source.

June 2026

Entity enrichments with threat intelligence**: Entity pages for IP addresses, domains, URLs, and files now include a

Entity enrichments with threat intelligence: Entity pages for IP addresses, domains, URLs, and files now include a Threat Intelligence Insights tab that surfaces enrichment data from Microsoft Threat Intelligence directly in the investigation workflow. Enrichments include reputation scores, attributed threat reports, infrastructure…

June 2026

Extended Conditional Access protections for Agent's user accounts

Conditional Access now provides broader controls to secure AI agents that have a user account. Administrators can: Target agent's user accounts with greater precision by including or excluding individual agents or dynamically grouping agents using Custom Security Attributes. Protect against risky agent…

June 2026

External users can be directly assigned to Access Packages

This feature allows Entitlement Management admins to directly assign external users who are not in the directory to an access package using the user's email. Users are invited into the tenant as Guest users and are governed (as long as Entra ID…

June 2026

File previews on mobile

Preview PowerPoint and Excel files more quickly in Teams on your mobile device. Open and review content without waiting as long for files to load. To learn more, see Share files in Microsoft Teams.

June 2026

Find files faster

Discover files in chats and channels with improved search and filtering options. Narrow results by file type, sender, and date to quickly locate content. Press Ctrl+F (Windows), Cmd+F (Mac), or select Find in chat to start. To learn more, see Search for…

June 2026

Front-of-room view control

When a Teams Room on Android joins a webinar or structured meeting as a presenter, the front-of-room display will default to attendee view and presenters keep full control from the console. To learn more, see Microsoft Teams Rooms (Android).

June 2026

Improved downloads

Your download manager now appears in the Teams title bar or with a keyboard shortcut to let you monitor downloads without blocking you from other actions in Teams.

June 2026

Improved restore experience for device-bound Authenticator app passkeys on iOS

No action is required. What is changing? Starting August 2026, users will see an improved restore experience for device-bound Authenticator app passkeys for iOS users. No admin or user action is required. With this update: Users who already have iCloud and iCloud…

June 2026

Jailbreak/Root Detection in Authenticator App

Microsoft Authenticator introduced jailbreak/root detection for Microsoft work or school accounts in the Authenticator app. Users with rooted/jailbroken devices will be blocked from adding/using work or school accounts in Authenticator app. Users must move to compliant devices to continue using work or…

June 2026

Local AI agent discovery

Microsoft Defender for Endpoint now automatically discovers supported local AI agents running on onboarded Windows devices — including coding agents and IDE extensions, desktop AI assistants, local AI runtimes, and agent platforms. Discovered agents appear as assets in the AI agent inventory,…

June 2026

Local AI agent discovery on Windows endpoints: as part of the Defender AI agents experience

Discovered agents appear as assets in the AI agent inventory, exposure map, and advanced hunting, giving security teams visibility into local AI agent usage across the organization.

June 2026

Local AI agent discovery — macOS support and new agents

Local AI agent discovery now supports macOS endpoints in addition to Windows. This update also adds discovery support for new agents including Junie CLI, Kiro CLI, Warp, Hermes Agent, Goose Desktop, Perplexity Desktop, Kiro IDE, Devin Desktop (formerly Windsurf), and QClaw. For…

June 2026

Local AI agent runtime protection

Runtime protection for supported local AI agents on Windows endpoints is now available in public preview. Microsoft Defender inspects the agent loop (user prompts, tool calls, and tool responses) and can block risky activity before it executes, helping stop prompt injection and…

June 2026

Local AI agent runtime protection on Windows endpoints: as part of the Defender AI agents experience

Microsoft Defender inspects the agent loop (user prompts, tool calls, and tool responses) and can block risky activity before it executes, helping stop prompt injection and unsafe agent actions at the device level. Blocked and audited events appear as alerts in Microsoft…

June 2026

Meeting impersonation alerts

Teams can now alert you when potential impersonation risks are detected during meetings on iOS and Android, helping you identify suspicious activity more easily.

June 2026

Microsoft Entra Backup and Recovery is now available

Microsoft Entra Backup and Recovery is a built-in solution to help restore your tenant after accidental changes or malicious updates. Always on by default, it automatically backs up critical directory objects — including users, groups, applications, service principals, managed identities, Conditional Access…

June 2026

Microsoft Entra Kerberos key rotation improved reliability for incoming trust referral flows

General availability of Microsoft Entra Kerberos key rotation improved reliability particularly for environments using incoming trust referral flows. Previously, authentication failures could occur during Kerberos key rotation if referral tickets were encrypted with a secondary key. The update enhances validation logic to…

June 2026

New Email is received from > External users condition for the Microsoft 365 Copilot and Copilot Chat policy…

New Email is received from > External users condition for the Microsoft 365 Copilot and Copilot Chat policy location lets DLP policies prevent Copilot from using external email as grounding data, helping reduce prompt injection risk from untrusted senders. See Block external…

June 2026

New Microsoft Secure Score recommendation

Microsoft Secure Score now includes the Reduce unnecessary inbound internet exposure on internet-facing devices recommendation, which helps identify devices that are accessible from the public internet and may represent unnecessary attack surface.Internet-facing devices are primary entry points for attackers and automated scanners,…

June 2026

New built-in Entra role for SOC identity response in Microsoft Defender

Starting June 8 we're introducing a new built-in role in Microsoft Entra—SOC Identity Responder—to further improve how security teams execute identity containment actions initiated from Microsoft Defender using a least-privilege access model. Previously, performing these actions required SOC analysts to hold multiple…

June 2026

On the Coverage and maturity page, the Review and improve coverage side panel…

By default, the panel shows only SaaS applications detected in your environment. Turn off the toggle to see other supported SaaS applications you can onboard to expand your identity coverage.

June 2026

Prevent unauthorized changes to AD groups with AD group enforcement

For customers leveraging group provisioning to AD, this capability ensures that changes to AD groups remain consistent with those managed in Microsoft Entra. With this preview, you can designate specific AD groups so that modifications to those groups can only be made…

June 2026

Quick share for images

Access image sharing options from hover, right-click, overflow menus, and shared tabs. Permissions are preserved for images stored in OneDrive or SharePoint, so the right people maintain access. Images pasted directly in chat don’t support permission-based sharing. To learn more, see Send…

Week of 1 Jun 2026

Remote Help for Windows updated with performance improvements

The latest version of Remote Help for Windows (version 5.2.1037.0) includes general bug fixes and performance improvements to enhance reliability.

June 2026

Report suspicious calls

Flag suspicious calls directly from Teams and optionally block the caller. Your reports help strengthen protections against fraud and impersonation threats. To learn more, see Reporting for Teams calling.

June 2026

Return to where you left off

Teams now preserves your chat layout and open panels when you navigate between conversations, making it easy to pick up where you left off.

June 2026

Rolling out, the sensitivity label setting to prevent connected experiences that analyze content extends…

Rolling out, the sensitivity label setting to prevent connected experiences that analyze content extends to Word, Excel, and PowerPoint across MacOS, iOS, and Android.

June 2026

Rolling out, the sensitivity label setting to prevent connected experiences…

Rolling out, the sensitivity label setting to prevent connected experiences that analyze content now prevents all connected experiences in Word, Excel, and PowerPoint for Windows, rather than a subset of these experiences.

June 2026

SCIM 2.0 APIs for Microsoft Entra ID in US Gov cloud

SCIM 2.0 APIs are now generally available in the US Gov cloud, giving customers, developers, and partners a standards-based option for managing users and groups in Microsoft Entra using the System for Cross-domain Identity Management (SCIM) 2.0 specification. For more information, see:…

June 2026

Search with Copilot

Find chats, files, and other content by asking questions in natural language instead of searching exact keywords. Copilot helps surface information you're looking for across Teams. To learn more, see .

June 2026

Select which generative AI apps to monitor in Insider Risk Management policy indicators

For Microsoft Copilot experiences and Enterprise AI apps, you can now select or deselect generative AI apps for monitoring, reducing alert noise, and avoiding unnecessary pay-as-you-go billing charges.

June 2026

Selective Response Actions enables organizations to tailor high-impact security operations on devices during onboarding

It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering strong protection. Documentation: Selective Response Actions

June 2026

Smarter meeting security

Teams can help identify automated participants in meetings, giving organizers and admins more visibility into who or what is joining.

June 2026

The AgentsInfo table in advanced hunting is now available in preview

The AIAgentsInfo table is transitioning to this new table, which provides a unified schema that supports agent inventory and governance for all agent types, including Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, third-party, and endpoint-discovered agents. Microsoft Agent 365 customers should use…

June 2026

The Identity Security dashboard now includes a new Human identities card that shows your human identities by source

The Identity Security dashboard now includes a new Human identities card that shows your human identities by source (Entra ID, SaaS, and on-premises), giving you a single view of where your human identities live.

June 2026

The Phishing Triage Agent and Security Alert Triage Agent now use the more limited Email & collaboration…

The Phishing Triage Agent and Security Alert Triage Agent now use the more limited Email & collaboration content: Emails associated with alerts (read) permission instead of the broader Email & Collaboration content: All Emails (read) permission. This least-privilege permission restricts agent access…

June 2026

The following advanced hunting schema tables are now generally available

The CloudAuditEvents table contains information about cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud. The CloudDnsEvents table contains information about DNS activity events from cloud infrastructure environments. The CloudProcessEvents table contains information about process events…

May 2026 83

Week of 26 May 2026

Intune RBAC roles have access to Copilot in Intune

When Microsoft Intune is enabled as a data source in Security Copilot, by default: The Microsoft Entra ID Intune Administrator role automatically inherits Security Copilot owner access to Copilot in Intune. All the other built-in and custom Intune role-based access (RBAC) roles…

May 2026

Discover Copilot actions in OneDrive file preview

Users can now see ready‑to‑use Copilot actions directly when previewing files in OneDrive. Details: What changed: When previewing a file, users now see suggested Copilot prompts—such as summarizing documents or generating FAQs—next to the Copilot button. Why: Many users are unsure what…

Web
May 2026

Graph API enhancements for custom connector relevance and UX

Graph API for custom connectors now supports richer configuration options—including icons, visibility controls, metadata, property descriptions, and semantic labels—to improve relevance and user experience. Details: What changed: Developers can now configure icons, visibility settings, connection metadata, property descriptions, and semantic labels for…

Web
May 2026

IT admins can enable Anthropic models for specific users and groups

Roadmap ID: 557371 Admins can now manage access to Anthropic and xAI models for specific users and groups. Details: What changed: New admin controls allow organizations to enable Anthropic as a model provider or xAI model provider settings in the admin center.…

Web
May 2026

Implicit Grounding in Outlook Microsoft 365 Copilot Chat

Users will be able to add emails and text from email threads directly into their prompt context in Microsoft 365 Copilot Chat through simple interactions in Outlook. Details: What changed: Developers can now configure icons, visibility settings, connection metadata, property descriptions, and…

WindowsWeb
May 2026

Managing your tenant with SharePoint Admin Agent

SharePoint Admin Agent helps admins manage their tenant with natural language guidance and actionable insights. Details: What changed: Copilot in the SharePoint admin center now surfaces insights, recommendations, and contextual guidance based on your organization's SharePoint and OneDrive data. Why: Admins need…

Web
May 2026

Open PDFs within Microsoft 365 Copilot Chat

You can now open PDFs directly inside Microsoft 365 Copilot Chat to improve your viewing and analysis experience. Details: What changed: When you click a PDF while using Microsoft 365 Copilot Chat, the file now opens directly within the Copilot experience. Previously,…

WindowsmacOSWeb
May 2026

OpenAI's GPT 5.5 Thinking available in Copilot Chat

GPT 5.5 Thinking expands what Copilot Chat can do by enabling deeper reasoning and more complex problem solving. Details: What changed: Copilot Chat now includes GPT 5.5 Thinking, a model designed for multistep reasoning, structured analysis, and more thoughtful responses. Why: Users…

WindowsmacOSiOS/iPadOSAndroidWeb
May 2026

OpenAI's GPT 5.5 Thinking available in Copilot Chat

GPT 5.5 Thinking expands what Copilot Chat can do by enabling deeper reasoning and more complex problem solving. Details: What changed: Copilot Chat now includes GPT 5.5 Thinking, a model designed for multistep reasoning, structured analysis, and more thoughtful responses. Why: Users…

WindowsmacOSiOS/iPadOSAndroidWeb
May 2026

OpenAI's GPT‑5.5 Instant available in Copilot Chat

OpenAI's GPT‑5.5 Instant improves everyday work in Copilot Chat by delivering more accurate, concise responses with better performance on image analysis and STEM‑related tasks. Details: What changed: GPT-5.5 Instant in Copilot Chat helps provide improved quality of answers for quick responses. Try…

WindowsmacOSiOS/iPadOSAndroidWeb
May 2026

OpenAI's GPT‑5.5 Instant available in Copilot Chat

OpenAI's GPT‑5.5 Instant improves everyday work in Copilot Chat by delivering more accurate, concise responses with better performance on image analysis and STEM‑related tasks. Details: What changed: GPT-5.5 Instant in Copilot Chat helps provide improved quality of answers for quick responses. Try…

WindowsmacOSiOS/iPadOSAndroidWeb
May 2026

Simplified Copilot in Glint enablement using Microsoft 365 controls

Copilot in Viva Glint now uses Microsoft 365 Copilot access controls, simplifying how organizations manage AI-powered insights from employee feedback. Roadmap ID: 551197 What changed: Copilot in Viva Glint now aligns with Microsoft's enterprise AI governance platform. Existing Copilot toggles in the…

Web
Week of 18 May 2026

Guidance for device-reported values in compliance reports

We updated documentation to clarify how to interpret device-reported values in compliance reports. Some compliance reports include a Setting column with values reported directly by the device, providing additional context for noncompliance in scenarios such as custom compliance and Android app configuration…

Week of 11 May 2026

Complete Platform SSO registration during macOS Automated Device Enrollment

On macOS devices enrolled with Automated Device Enrollment (ADE), you can run Platform SSO during device registration. Before you enroll, you: Create an Intune settings catalog policy and configure the Enable Registration During Setup setting. Deploy the Company Portal (5.2604.0 and newer)…

macOS
May 2026

AI-generated survey insights with Copilot Highlights

Copilot in Viva Glint now generates AI-powered summaries of employee survey results directly within Team Summary and Executive Summary reports, helping leaders quickly understand strengths, opportunities, and trends across their teams. Copilot Highlights surfaces key insights-such as notable score changes, benchmark comparisons,…

Web
May 2026

Contextual nudges in Edge offer quick page summaries in Copilot Chat

Use Microsoft Edge for Business adds contextual nudges that make it easier to ask Microsoft 365 Copilot Chat to summarize your open webpage. Roadmap ID: 515167 Details: What changed: Edge for Business introduces contextual nudges attached to the Copilot entry point that…

Web
May 2026

Copilot configuration insights in the Copilot Dashboard Readiness page

The updated Readiness page in the Copilot Dashboard offers personalized configuration insights to help organizations prepare for successful Copilot adoption. Roadmap ID: 551196 Details: What changed The Readiness page now includes tailored recommendations for Copilot configuration settings. Previously, IT leaders had to…

Web
May 2026

Expanded published report recipients

Analysts can now publish Viva Insights Power BI reports to anyone in their organization, expanding access beyond users with Copilot Dashboard permissions. Roadmap ID: 558257 What changed: Previously, analysts could publish Viva Insights Power BI reports only to people who had access…

Web
Week of 4 May 2026

Enhanced app inventory with faster data updates

Intune enhanced app inventory brings faster, more detailed visibility into the apps in your environment to support identification of outdated or risky software. Improved data freshness and richer app metadata provide clearer insight into installed applications, while new controls let you specify…

Windows
May 2026

Account Discovery

Account discovery for connected applications is now generally available in Microsoft Entra ID Governance. This capability provides administrators with visibility into all accounts that exist within connected applications, including orphan accounts. By generating discovery reports directly from the provisioning experience, organizations can…

May 2026

Added the admin permissions (Directory Reader

Added the admin permissions (Directory Reader, Microsoft Edge administration, and Microsoft Intune administration) required to activate DLP policies for unmanaged cloud apps in Microsoft Edge for Business.

May 2026

Automate setting or clearing user attributes values in Lifecycle workflows

We're excited to introduce the User Attribute Updates task in Lifecycle Workflows, extending existing attribute change trigger capabilities with a built-in, customer-ready way to automate attribute updates (set or clear values) directly within a workflow. With a secure, consistent, and auditable experience,…

May 2026

Automatic attack disruption can now isolate compromised devices from the network…

Isolation blocks attacker communication and lateral movement while keeping the device connected to security services. The action is time-limited, scoped to devices involved in the incident, and can be released by security operators at any time.

May 2026

Automatic device isolation (automatic attack disruption)

Microsoft Defender for Endpoint can now automatically isolate compromised devices as part of automatic attack disruption. Isolation blocks most network traffic while keeping the device connected to security services. The action is time-limited, scoped to the incident, and security operators can release…

May 2026

Azure Role assignments can now be governed via Entitlement Management

You can now govern eligible and active assignments to Azure roles at the Management Group, Subscription, and Resource Group levels directly through access packages. This brings role assignment into the same request, approval, and lifecycle governance model as apps, groups, and more…

May 2026

Catch up on Teams chat on mobile

Tap Catch up at the top of your Teams chat list to swipe through the latest activity in conversations. Reply, react, save, and mark read or unread. To learn more, see Catch up on all your conversations in one place.

May 2026

Clarified Edge browser profile scope for cloud app DLP policies

Policies for unmanaged cloud apps on managed devices apply across all Edge profiles (work, personal, and InPrivate); policies for managed apps apply only in the Edge work profile.

May 2026

Clearer code sharing in Teams chat

Now, when you share code in Teams chat, Teams automatically formats it to display line numbers, making it easier to reference specific lines in conversation.

May 2026

Configure offline security intelligence update settings for Linux from the Defender and Intune portals

You can now configure offline security intelligence update settings for Linux directly from the Defender and Intune portals. Documentation: Configure offline security intelligence update settings for Linux from the Defender and Intune portals

May 2026

Consult and merge PSTN calls through DTMF

Meeting organizers can now consult and merge PSTN callers into active Teams meetings, even when navigating a Dual-Tone Multi-Frequency (DTMF) menu is required. To learn more, see Merge calls in Microsoft Teams.

May 2026

Create workflows with slash commands

Reduce context switching by using slash commands in the compose box to create workflows. Change your Teams status, schedule a message, and more.

May 2026

Cross tenant group synchronization allows organizations to synchronize security groups across Microsoft Entra tenants

This feature enables centralized management of group membership in a source tenant while making those groups available in one or more target tenants, simplifying cross-tenant collaboration and reducing administrative overhead associated with managing duplicate groups. With cross tenant group synchronization, organizations can…

May 2026

Custom Reporting populates additional columns and tables…

Custom Reporting populates additional columns and tables in the scanner cluster database so administrators can build their own reports directly against scan results in Power BI or any SQL-based reporting tool, without stitching together per-scan CSV reports.

May 2026

Custom data collection is now generally available

This feature enables organizations to expand and customize telemetry collection beyond default configurations with rule-based filtering for specific events from endpoint devices. The maximum event limit per rule has been updated from 25,000 to 75,000 events per device within a 24-hour rolling…

May 2026

Custom posture reports let admins build tailored views of information protection and DLP activity

Assemble metric and chart cards in sections to answer organization-specific questions that complement the built-in posture reports.

May 2026

Defender Chat experience (Preview) is an open prompt chat assistant built into Microsoft Defender

It helps SOC analysts investigate threats, explore incidents, and answer security questions in plain language, without needing to navigate multiple screens or write complex queries.

May 2026

Defender endpoint security solution for Windows 7 SP1 and Windows Server 2008 R2 SP1

The Defender for endpoint security solution for legacy Windows 7 SP1 and Windows Server 2008 R2 SP1 devices is now generally available. The solution provides advanced protection capabilities and improved functionality for these devices compared to other solutions. The solution is available…

May 2026

Delete meeting recaps

Delete a meeting recording, summary, and notes in one place. On the recap page, select More options > Delete recap content . Shared files stay in their original locations. To learn more, see Recap in Microsoft Teams.

May 2026

Enable soft-delete for Microsoft Entra Device objects

Device Soft Delete, now available in preview, enables administrators to safely remove device objects by moving them to a recoverable state instead of permanently deleting them. This feature allows organizations to restore devices within a defined retention period while preserving critical data…

May 2026

Enhanced admin authorization for Microsoft Entra Connect Sync configuration changes

We're enhancing the security posture of Microsoft Entra Connect Sync by introducing interactive admin authorization for configuration changes. With this update, an authorized administrator will need to sign in and explicitly approve changes to sync settings, ensuring that configuration updates are intentional…

May 2026

Enhanced exposure score in Defender Vulnerability Management

The new exposure score model in Defender Vulnerability Management is now available in preview. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors such as internet-facing status and criticality. For more information,…

May 2026

Expanded policy storage for passkeys (FIDO2) in Microsoft Entra ID

We increased the passkey (FIDO2) policy size limit in the authentication methods policy to a dedicated 20-KB allocation. Previously, all authentication methods shared a single 20-KB policy size limit. With this update, a dedicated 20-KB limit is now allocated specifically to the…

May 2026

For auto-labeling policies that are turned on and target SharePoint and OneDrive

For auto-labeling policies that are turned on and target SharePoint and OneDrive, per-policy review pages let you monitor daily labeling activity, spot-check labeled and failed files, and investigate labeling failures.

May 2026

High Scale Compatibility (HSC) mode for Microsoft Entra External ID

High Scale Compatibility (HSC) mode enables organizations to migrate to Microsoft Entra External ID while preserving their existing user directory. It's designed for large, established customer identity platforms transitioning from Azure AD B2C. With HSC mode, customers can rebuild applications on External…

May 2026

Manage Agent ID sponsorship lifecycle with Lifecycle Workflows

One of the most important parts of governing agent identities is making sure that a delegated human user is always assigned to make sure the agent identity's access to resources are current. If the sponsor is leaving the organization, sponsorship of the…

May 2026

Microsoft Defender Experts for Servers

and Microsoft Defender Experts Hunting - Servers are now offered as standalone offerings for customers who wish to avail managed extended detection and response and threat hunting services for their on-premises and multicloud servers protected by Microsoft Defender for Cloud. These services…

May 2026

Modernized My Account pages

We're excited to announce the upcoming general availability of three redesigned pages in the My Account portal (myaccount.microsoft.com), bringing a modernized experience to help end users manage their account with greater ease and clarity. The redesigned Devices page features a modernized layout…

May 2026

NetBiosName resolution test now informational

The “NetBIOS Name Sysvol Connectivity resolution” test in the AD DS health monitoring agent has been _reclassified_ from an alerting test to an informational test. Going forward, if this test fails, it will no longer generate an alert or require remediation action…

May 2026

New Block access for specific external domains or users sub-option…

New Block access for specific external domains or users sub-option for the Restrict access or encrypt the content in Microsoft 365 locations action lets DLP policies for SharePoint and OneDrive block access to sensitive files for specific external domains or user SMTPs.

May 2026

New guidance for working with large audit search results in Data Security Investigations

When audit searches exceed the approximately 3,000-item limit, use the Audit solution to analyze the full result volume, then split searches into smaller time-based slices for ingestion into an investigation.

May 2026

OCR support in Data Security Investigations

Image files are automatically processed with optical character recognition (OCR), and the extracted text is merged and vectorized for AI analysis.

May 2026

Report suspicious calls

Select Report call in your call options to flag unwanted or malicious activity and help prevent it in the future.

May 2026

Rolling out, a new label policy setting for meetings, Apply meeting label to artifacts

Rolling out, a new label policy setting for meetings, Apply meeting label to artifacts, automatically applies the meeting's sensitivity label to recordings and their transcripts (.mp4 files), and to meeting notes (.loop files).

May 2026

Schedule antivirus scans on Linux

You can now configure scheduled antivirus scans on Microsoft Defender for Endpoint on Linux. Scheduled scans support hourly quick scans, interval-based quick scans, and weekly full scans, with options for low-priority execution, idle-time scheduling, and randomized start times. Configure scans using managed…

May 2026

See the sync status of your sensitivity label publishing policies on the Label policies page

You can now see the sync status of your sensitivity label publishing policies on the Label policies page, giving you visibility into when label policy updates are fully synced across Microsoft 365.

May 2026

Selective Response Actions enables organizations to tailor high-impact security operations on devices during onboarding

It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering strong protection. Documentation: Selective Response Actions

May 2026

Sensitivity labels for Microsoft Entra security groups

Microsoft Entra ID now supports applying Microsoft Purview sensitivity labels to Entra cloud security groups in public preview. Administrators can use labels to govern security group settings such as guest access using the same labels and policies that apply to Microsoft 365…

May 2026

Special badging for relevant chat updates

New purple indicators in Teams chat show which conversations are active and need your attention. They appear for mentions, tags, and activity in followed threads.

May 2026

Stay protected against scammers on Teams calls

Teams now detects when callers might be impersonating your bank, IT admin, or other trusted brands, and warns you. Decline, leave, or report the call instantly.

May 2026

Support for Anthropic Claude (Enterprise) when you add and configure the Anthropic Claude data connector, now in preview

Claude then displays as another AI application alongside Copilot, Copilot Studio, ChatGPT Enterprise, and other AI apps. Use activity explorer to see individual Claude interactions, such as who used Claude, when they used it, and what kinds of content were involved, just…

May 2026

Support for passkeys in Microsoft Entra ID registration campaign

Microsoft Registration Campaigns now supports Passkeys (FIDO2) as an authentication method. Administrators can configure registration campaigns to nudge users to register passkeys during sign-in, helping organizations drive passkey adoption at scale. This first rollout experience is optimized for users who are in…

May 2026

System-preferred authentication expanded to first-factor in Microsoft Entra ID

We're extending system-preferred authentication to apply to the first factor in Microsoft-managed configurations (in addition to second factor). With this change, the system evaluates the credentials registered for a user and selects the highest-ranked authentication method for each step of the sign-in…

May 2026

The "Responsible AI FAQ for Data Security Posture Management" is replaced with the more detailed…

The "Responsible AI FAQ for Data Security Posture Management" is replaced with the more detailed Application card for Data Security Posture Management to better help you understand this solution's AI capabilities, intended uses, limitations, evaluations, safety components, and best practices.

May 2026

The documentation section How to disable sensitivity labels for SharePoint and OneDrive

The documentation section How to disable sensitivity labels for SharePoint and OneDrive (opt-out) now includes labeling behavior if you disable sensitivity labels for SharePoint and Onedrive after they've been enabled.

May 2026

The hunting graph in advanced hunting now includes new identity-focused predefined scenarios

These scenarios help you discover attack paths, privilege escalation routes, and credential access risks across on-premises and cloud environments, including Kerberoast and AS-REP roast paths, domain compromise routes, OAuth application risks, and guest user access to cloud resources.

May 2026

The new version of Data Security Posture Management is now generally available

Partner solutions for non-Microsoft data sources remain in preview, as does the Data Security Posture Agent. This current version provides guided workflows for proactive risk management and streamlines data security operations so you can more confidently adopt AI across your digital estate.

May 2026

To optimize resources, processing is paused for Microsoft 365 data when tenants are inactive…

To optimize resources, processing is paused for Microsoft 365 data when tenants are inactive for more than 60 days, and automatically resume when you return to the solution.

May 2026

Watch past meeting highlights with video recap

Video recap is a new, engaging way to catch up on past meetings. Recorded meetings are clipped into short, narrated highlights that show key conversations, presented content, and more. To learn more, see Video recap in Microsoft Teams.

May 2026

Windows “Do not disturb” settings carry over to Teams

When you set your Windows device to “Do not disturb,” your Teams notifications will be silenced. Notifications will resume after “Do not disturb” is turned off on your device.

May 2026

Workload identity-based authentication for SAP SuccessFactors provisioning integrations

Microsoft Entra is introducing workload identity–based authentication for SAP SuccessFactors provisioning. This new capability allows the Microsoft Entra provisioning service to authenticate to SAP SuccessFactors using Entra workload identity and short‑lived tokens instead of static credentials (username and password). This change helps…

April 2026 119

Week of 27 Apr 2026 · release 2604

Access management for Apple services

You can now use Apple access management settings in Apple Business Manager and Apple School Manager to configure service access for Apple accounts on organization-owned devices. These controls let you choose what devices users can sign in to and which apps and…

macOSiOS/iPadOS
Week of 27 Apr 2026 · release 2604

Autopatch update risk visibility report

The Autopatch update risk visibility report extends the security update status dashboard with granular insight into patch compliance and risk across your managed devices. It classifies devices as Current, Exposed, or Critical and highlights policies contributing to risk, so you can identify…

Windows
Week of 27 Apr 2026 · release 2604

Block location setting for Android Enterprise can keep Location services enabled

On Android Enterprise devices, you can use the General > Block location in the settings catalog to disable the location services on the device and prevent users from turning it on. This setting is now called Location and has three options you…

Android
Week of 27 Apr 2026 · release 2604

Change Review Agent suggestions available inline in Multi Admin Approval (preview)

The Change Review Agent now provides risk-based recommendations directly in the Multi Admin Approval experience for Windows PowerShell scripts. On the My requests and All requests tabs, a new Agent Response column displays when a suggestion is available. You can then select…

Week of 27 Apr 2026 · release 2604

Configure credential manager permissions for Android Enterprise devices

You can now control which applications act as system-level credential providers on managed Android Enterprise devices running Android 14 and higher. Credential providers are responsible for password autofill and passkey storage. To configure credential manager permissions, go to Apps > Android >…

Android
Week of 27 Apr 2026 · release 2604

Direct Android line-of-business app management

You can now manage Android line-of-business (LOB) apps directly in Microsoft Intune without publishing them to Managed Google Play on Android Enterprise corporate-owned fully managed (COBO) and dedicated (COSU) devices. With direct LOB app management, admins can upload APK files directly to…

Android
Week of 27 Apr 2026 · release 2604

Expanded support for Endpoint Privilege Management support approved elevation requests

Intune's Endpoint Privilege Management (EPM) now supports support approved elevation requests from all users of a device. This update expands the utility of support approved file elevations and helps to improve scenarios that involve shared devices. Previously, file elevation requests that require…

Week of 27 Apr 2026 · release 2604

Microsoft Intune supports userless ADE for visionOS and tvOS devices

Microsoft Intune has added support for userless Apple automated device enrollment (ADE) for visionOS and tvOS devices, enabling you to enroll and manage Apple Vision Pro and Apple TV through Apple Business Manager or Apple School Manager. This capability supports ADE without…

Week of 27 Apr 2026 · release 2604

New remote actions to suspend and restore Managed Home Screen on Android devices

Intune has two new remote actions that allow admins to temporarily suspend and restore Managed Home Screen (MHS) on Android devices. These actions let users exit MHS and access the device's default launcher for a defined period, without removing policies or requiring…

Android
Week of 27 Apr 2026 · release 2604

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: Harvey AI by Harvey AI Corporation (iOS) Continia Expense App by Continia Software A/S For more information about protected apps, see Microsoft Intune protected apps.

Week of 27 Apr 2026 · release 2604

Preview the new device page in the Intune admin center (preview)

In the Intune admin center, when you go to Devices > All Devices and select a device, you can see device-specific info, like device properties. This page is redesigned and is available for you to preview. To enable the new experience: In…

Week of 27 Apr 2026 · release 2604

Support for Ubuntu 26.04 LTS

Microsoft Intune now supports Ubuntu 26.04 LTS. Support for Ubuntu 22.04 LTS ends in August 2026. Devices already enrolled on Ubuntu 22.04 remain enrolled, but you should notify users to upgrade to a supported Ubuntu version. You can identify devices running Ubuntu…

Week of 27 Apr 2026 · release 2604

Updated minimum version for Intune Management Extension on Windows

Windows devices managed by Intune need to run Intune Management Extension version 1.58.103.0 or later. Devices on earlier versions no longer receive configurations or updates that depend on the Intune Management Extension, including Win32 app deployments, PowerShell scripts, remediations, and platform scripts.…

Windows
Week of 27 Apr 2026 · release 2604

Updated security baseline for Microsoft Edge v139

Microsoft Edge version 139 security baseline is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations for the Microsoft Edge browser and is the latest available Edge security baseline in Intune. The Edge v139 security baseline includes new settings,…

April 2026

Copilot setting for video generation

A new setting in the Microsoft 365 admin center allows admins to control access to AI video generation features in Microsoft 365 Copilot and supported apps. Details: What changed: Admins can now use a dedicated setting in the Microsoft 365 admin center…

April 2026

Employee Self-Service agent: New rich landing page

This update introduces an optional, customizable landing page for the Employee Self-Service agent that lets organizations highlight key HR and IT resources and align the experience with their branding. Details: What changed: Organizations can now optionally customize the Employee Self-Service agent landing…

April 2026

Rich Bing web answer cards in Copilot Chat

Microsoft 365 Copilot now displays rich, interactive Bing web answer cards-such as Weather and Stocks-directly in chat responses to help users quickly access relevant, real-time information. Roadmap ID: 500865 Details: What changed: Copilot Chat will now show Bing's rich and interactive answer…

WindowsWeb
April 2026

Share agents to Teams

[Web} This feature allows users to share their agent directly with a Microsoft Teams team, making it easier for teams to discover, install, and start using agents together. Roadmap ID: 557947 Details: What changed Users can now share an agent with a…

Week of 20 Apr 2026

Intune Data Warehouse (beta) connector retirement in Power BI

The Intune Data Warehouse (beta) connector v1 in Power BI is retired. If you use Power BI reports that rely on this connector, you need to transition to Intune connector v2 or the OData Feed connector before the transition completes. Power BI…

WindowsmacOSiOS/iPadOSAndroid
Week of 20 Apr 2026

New reporting considerations for compliance policies

New guidance has been added to the Microsoft Intune compliance policy reporting documentation to help explain how device compliance results appear in Intune reports. This update clarifies expected reporting behavior related to device check-in timing and user association, helping you better interpret…

April 2026

Code interpreter now works on files found via Chat search

Analyze enterprise search results with code interpreter Copilot's code interpreter can now analyze files found via enterprise search in Chat, even if they weren't manually uploaded or linked. Roadmap ID: 519570 Details: What changed: Previously, code interpreter only worked on files explicitly…

April 2026

Copilot adoption report updated with streamlined UX and power user insights

The updated Copilot adoption Power BI report introduces a cleaner experience and new insights that help organizations understand how power users engage with Copilot. Roadmap ID: 557674 Details: What changed: The Copilot adoption Power BI report now includes a simplified, more intuitive…

Web
April 2026

Edit scheduled prompts for Copilot

Users can now edit the schedule of their Copilot prompts, giving them more flexibility and control. Roadmap ID: 531912 Details: What changed: You can now adjust the timing of scheduled prompts instead of deleting and recreating them. This update improves usability and…

WindowsmacOSWeb
April 2026

Fewer confirmation prompts for Copilot actions

Action confirmations have been streamlined, so users experience fewer interruptions while still maintaining safety controls. Details: What changed: Copilot now reduces the number of confirmation prompts shown during read actions which don't make changes to external systems. Safety checks remain in place…

Web
April 2026

Microsoft 365 Copilot Chat available in Teams chats, channels, and meetings

Microsoft 365 Copilot Chat integration is expanding to Teams chats, channels, and meetings, with mobile support coming soon. Roadmap ID: 501107 Details: What changed: Microsoft 365 Copilot Chat is now accessible across Teams chats, channels, calling, and meetings. This expands availability beyond…

WindowsmacOSWeb
April 2026

Share OneDrive files with a Copilot-generated summary in Windows

You can now generate a file summary with Copilot and include it directly when sharing OneDrive files in Windows. Roadmap ID: 527840 Details: What changed: A new option in File Explorer and the OneDrive Activity Center lets you summarize a file with…

Windows
April 2026

Smarter answers with embedded image understanding

Declarative Agents can now interpret and ground responses using embedded images in Word, PowerPoint, and PDF files. This enhancement enables Copilot to extract insights from charts, diagrams, and screenshots, improving the accuracy and completeness of answers. Roadmap ID: 531758 Details: What changed:…

Windows
Week of 6 Apr 2026

New TeamViewer connector experience in Microsoft Intune

There is a new TeamViewer integration in Microsoft Intune that simplifies onboarding and improves reliability for remote assistance workflows. The new connector replaces the existing TeamViewer connector experience and provides a more streamlined experience in the Intune admin center. If you're using…

Week of 6 Apr 2026

Support for Android XR devices

Microsoft Intune now supports management of Android XR devices using Android Enterprise dedicated and fully managed enrollment modes. You can enroll Android XR devices, deploy apps through managed Google Play, and apply core security and compliance policies. Android XR devices appear and…

April 2026

$count filtering in sign-ins API

The ability to use $count in sign-ins API requests is now here, allowing customers to perform count computations directly in API requests. For more information, see: Customize Microsoft Graph responses with query parameters.

April 2026

A new Data Security Investigation Contributor role automatically provides Data Security Investigations access…

Members of the Compliance Administrator and Organization Management role groups have administrative and contributor access, while members of the Data Security Management and Insider Risk Management role groups have contributor access without needing explicit role assignment.

April 2026

A new conceptual article, Learn about just-in-time protection, now covers JIT concepts, terms

A new conceptual article, Learn about just-in-time protection, now covers JIT concepts, terms, supported activities, device compatibility, and includes a detailed JIT workflow diagram.

April 2026

A new granular Unified RBAC permission Email & collaboration content: Emails associated with alerts (read)…

A new granular Unified RBAC permission Email & collaboration content: Emails associated with alerts (read) allows analysts to preview or download email messages associated with specific security alerts. For more information, see Email entity page actions.

April 2026

Account Discovery

Microsoft Entra ID Governance now supports account discovery for connected applications in public preview. This capability provides administrators with visibility into all accounts that exist within connected applications, including orphan accounts. By generating discovery reports directly from the provisioning experience, organizations can…

April 2026

Action required from customers

Identify existing provisioning jobs that use the OAuth 2.0 Authorization Code grant. Watch for announcements about affected applications and availability of updated authentication methods. Update and test provisioning job configuration when your application supports a modern authentication method. If an application is…

April 2026

Additional information

Detailed configuration guidance and step-by-step instructions will be published in Microsoft Learn documentation.

April 2026

App-based branding via Branding themes in Microsoft Entra tenants

In Microsoft Entra tenants, customers can create a single, tenant-wide, customized branding experience that applies to all apps. We are introducing a concept of Branding "themes" to allow customers to create different branding experiences for specific applications.

April 2026

As an AP requestor, I can see in My Access who my approver(s) are if the access package owner allows me to

In May, requestors will be able to see the name and email address of approvers for their pending access package requests directly in the My Access portal will be in General Availability. This feature improves transparency and helps streamline communication between requestors…

April 2026

Auto-labeling policies introduce a new flow where you must decide whether…

When you chose to automatically apply a sensitivity label, you can now optionally choose to always overriding an existing label that has a lower priority label, even if it was manually applied. This option was previously available for emails only and now…

April 2026

Automatic spoken language detection

Teams will automatically detect each speaker's spoken language and update it in real time as the conversation evolves. Manual spoken language selection will no longer be available. To learn more, see Multilingual speech recognition in Microsoft Teams.

April 2026

Become a Community expert

Request expert status to contribute trusted answers in Viva Engage. Approved experts are highlighted with a special label next to their names and can endorse accurate and credible responses. To learn more, see Answers in Viva: Answer questions and earn badges.

April 2026

Built-in alert tuning rules are now generally available

Built-in alert tuning rules suppress alerts from common benign activity in Defender for Endpoint and Defender for Office 365 without affecting Automated Investigation and Response (AIR) investigations and email notifications.

April 2026

Configurable Token Lifetime Policies

Configurable token lifetime policies are now generally available in Microsoft Entra ID. This feature allows administrators to customize the lifetimes of access tokens, ID tokens, and SAML tokens issued by the Microsoft identity platform by creating and assigning token lifetime policies to…

April 2026

Control the size of shared content in a meeting

During Teams meetings, drag the divider between shared content and the video gallery to adjust how much space each takes up. 

April 2026

DLP policies for unmanaged cloud apps support a new URL contains text condition that detects…

You can use it as a condition to scope DLP rules to specific URLs, or as an exception to exclude specific URLs from policy enforcement.

April 2026

Data loss prevention policy tip reference for Outlook for Android, iOS, and macOS

A new reference article covering DLP policy tips, supported conditions, oversharing dialogs, and override capabilities for Outlook on Android, iOS, and macOS.

April 2026

Data quality provides on-premises support for Oracle and SQL server

On-premises databases are scanned in on-premises infrastructure to ensure that data doesn't move beyond organizations' premises. You need to set up a Kubernetes cluster to host the runtime that scans these databases.

April 2026

Delegate calls with Microsoft Copilot

Microsoft Copilot can help you answer incoming Teams calls and schedule follow-up appointments, ensuring you stay focused without missing important connections. To learn more, see Use Copilot Call Delegation in Microsoft Teams.

April 2026

Documentation update

Added Scenarios and API overview section. This new section helps developers identify which APIs to use for specific scenarios. For more information, see Scenarios and API overview.

April 2026

Download and upgrade information

Based on your licensing, you can download the installer packages here: Microsoft Identity Manager licensing and downloads | Microsoft Learn SP3 introduces a new upgrade process. Please follow the documented steps carefully: Upgrade Microsoft Identity Manager 2016 from SP2 to SP3 |…

April 2026

Enabling Social Identity Providers in Entra External ID Native Authentication via browser‑delegated (web‑view) flows using SDKs for applications

Build secure sign‑in and sign‑up experiences for applications in Entra External ID using Native Authentication, with Social Identity Provider support such as Google, Facebook, and Apple available through browser‑delegated (web‑view) authentication using developer‑friendly SDKs. For more information, see: Native authentication in Microsoft…

April 2026

Enforce Conditional Access policies like MFA on every PIM activation

Generally available feature for configuring reauthentication with Conditional Access for Microsoft Entra Privileged Identity Management role activation. For more information see: On activation, require Microsoft Entra Conditional Access authentication context

April 2026

Entra CBA Certificate Authority (CA) scoping in Microsoft Entra allows tenant administrators…

This feature enhances the security and manageability of certificate-based authentication (CBA) by ensuring that only authorized users can authenticate using certificates issued by specific CAs. More information at Certificate Authority (CA) scoping

April 2026

Entra CBA as third option in system-preferred MFA methods

General Availability - Due to known issues on iOS platform, the Entra certificate-based authentication (CBA) method was not allowed as a second factor on iOS and CBA was moved to the last place in the system-preferred MFA list as documented at FAQ.…

April 2026

Export policy configuration as a ZIP file containing a point-in-time snapshot of all policy configurations…

Use the export for support requests, configuration reference, and local analysis by using PowerShell or Microsoft 365 Copilot.

April 2026

GSA Cloud Firewall for Remote Networks

Customer can use GSA cloud firewall to apply admin configurable, 5-tuple (source IP, destination IP, protocol, source port, destination port) based filtering for all internet traffic acquired from branch offices through GSA remote networks capability. For more information, see: Configure Global Secure…

April 2026

GSA iOS client support

We are excited to announce the general availability of the iOS Global Secure Access (GSA) client. The Global Secure Access client on iOS and iPadOS requires no new agent installation. It leverages the existing Microsoft Defender for Endpoint (MDE) to route traffic…

April 2026

Issuer Hints for Microsoft Entra CBA

Issuer Hints is generally available now and helps improve the sign‑in experience for Entra Certificate‑Based Authentication (CBA) by ensuring users are prompted to select only certificates that are trusted and valid for their organization. This reduces confusion, minimizes sign‑in errors, and streamlines…

April 2026

Less is more

In the new simplified app bar in Teams, labels are now hidden by default, so you can focus on what matters. To learn more, see Change settings in Microsoft Teams.

April 2026

License Usage

The License Usage page in the Microsoft Entra admin center helps customers optimize their Entra licenses by providing visibility into feature usage across their tenant. It shows how many Entra ID P1, P2, and Suite licenses you own, along with usage of…

April 2026

MIM Service and Portal

SQL Server 2022 and Exchange Server Subscription Edition (SE) Support: Updated integration and database compatibility with the latest SQL and Exchange releases. SharePoint Subscription Edition (SE) Support: The MIM Portal can now be deployed on SharePoint SE. System Center Service Manager Data…

April 2026

MIM Synchronization Service

SQL Server 2022 Support: Full support for installation with and connection to SQL Server 2022. Azure SQL Support: MIM Sync can now use Azure SQL Database, with authentication supported via both System Assigned and User Assigned Managed Identities.

April 2026

Microsoft Defender Experts MDR customers can now see Defender Experts as a distinct entry in the Microsoft Defender portal navigation menu

This feature adds to the existing home page status card as in-portal experiences that provide consistent and predictable access to the service.

April 2026

Microsoft Entra Agent ID platform

The Microsoft Entra Agent ID platform is now generally available. The Agent ID platform provides an identity and authorization framework built specifically for AI agents operating in enterprise environments. It enables developers to create and manage agent identities with enterprise-grade authentication, authorization,…

April 2026

Microsoft Entra Certificate-based authentication (CBA) support on iOS and CBA as second factor

Microsoft Entra Certificate-Based Authentication (CBA) is now generally available on iOS. Native iOS sign-ins now avoid unnecessary password and MFA prompts, enabling CBA as a supported second factor and allowing it to be prioritized as a system‑preferred MFA method. Users can choose…

April 2026

Microsoft Entra ID federation with External ID

By leveraging standards‑based federation, users authenticate with their home tenant while applications hosted in an External ID tenant rely on trusted identity assertions from Entra ID. This approach reduces the need for duplicate accounts, streamlines sign‑in experiences, and allows organizations to extend…

April 2026

Microsoft Identity Manager (MIM) 2016 Service Pack 3 (SP3) is now available

SP3 focuses on stability and supportability, modernizes compatibility with current platform components (SQL Server, SharePoint, and Exchange), and adds an additional deployment option for the Synchronization Service by enabling Azure SQL Database with managed identity authentication—helping reduce operational risk for hybrid identity…

April 2026

Microsoft Teams VDI Optimization for Omnissa on Windows

Omnissa deployments have been brought onto Microsoft Teams' VDI optimization architecture. This will deliver improved performance, greater feature parity with the native desktop client, and more reliability across meeting experiences, all while continuing to benefit from the centralized management, security, and scalability…

April 2026

Migrate from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync

As organizations look to strengthen identity security and advance their Zero Trust strategies, many are looking for simpler, more reliable ways to manage hybrid identity. To support these needs, we’re beginning the transition from Microsoft Entra Connect Sync to the cloud‑native Microsoft…

April 2026

Network Content Filtering based on File Types

Global Secure Access supports network-based content filtering based on file types. This allows you to monitor and control file transfers across the network to GenAI and SaaS apps to prevent unauthorized exfiltration of content. For more information, see: Create a content policy…

April 2026

New Microsoft Secure Score recommendation

Microsoft Secure Score now includes the Ensure devices are updated to Secure Boot 2023 certificates and boot manager, which helps identify devices that haven't yet transitioned to the new Secure Boot 2023 certificates required ahead of the June 2026 expiration.Devices that remain…

April 2026

New bulk import, editing, and moving capabilities can help you quickly scale operations in Unified Catalog

New bulk import, editing, and moving capabilities can help you quickly scale operations in Unified Catalog: Create data products in bulk Create critical data elements in bulk Create glossary terms in bulk and bulk edit glossary terms Move multiple glossary terms between…

April 2026

Newly created Teams call data records (often abbreviated to CDRs,…

Instead, they are included in the new support for Teams call logs retention policies that you create by using PowerShell. These newly supported retention policies let you manage the deletion of calling-related data when this is required for compliance and regulatory requirements.…

April 2026

Organizations using Customer Key can now enable customer-managed key (CMK) encryption for direct export packages in eDiscovery

When enabled, exported investigation data is encrypted at rest using tenant-specific encryption scopes backed by customer-managed keys.

April 2026

Prefetch Workday termination data to customize account disable logic

This Workday connector update resolves termination processing delays observed for workers in APAC and ANZ regions. Admins can now enable termination lookahead setting to prefetch data and tailor deprovisioning logic for accounts in Microsoft Entra ID and on-premises Active Directory. For more…

April 2026

Prevent screen capture during meetings

Screen capture prevention is now supported on Teams for iOS devices. Turn this setting on to protect sensitive information shared during Teams meetings. To learn more, see Prevent screen captures in Microsoft Teams meetings.

April 2026

Proactive AI insights from Data Security Posture Management

The DSPM exfiltration objective card displays risk counts across five fixed categories, giving security teams continuous visibility into recently exfiltrated sensitive data without manual investigation creation.

April 2026

Promotions folder for bulk email (preview)

You can configure anti-spam policies to deliver bulk mail below the BCL threshold to the Promotions folder in supported versions of Outlook. For more information, see Deliver bulk mail below the BCL threshold to the Promotions folder.

April 2026

Quick views in Teams chat

Filter your Teams chats by @mentions, followed threads, and more by selecting Quick views at the top of your chat list. To customize, hover over a category and select More quick view options . To learn more, see Manage notifications in Microsoft Teams.

April 2026

Recommended action

Evaluate the new authentication option once available in your tenant Plan and test migration of existing provisioning jobs to workload identity-based authentication Update any internal documentation or operational processes that reference basic authentication

April 2026

Rolling out, users can now apply sensitivity labels configured for user-defined permissions while using Office for the web

A prerequisite for this functionality is that co-authoring is enabled for the tenant. If this prerequisite isn't in place, users still see the message that they must use a desktop app to apply the label.

April 2026

Stay informed

Please monitor monthly What’s new articles and the Microsoft 365 Message Center for future announcements, migration guidance, deadlines, and documentation.

April 2026

Switch from basic auth to workload identity based auth for SAP SuccessFactors provisioning integrations

Microsoft Entra is introducing workload identity–based authentication for SAP SuccessFactors provisioning. This new capability allows the Microsoft Entra provisioning service to authenticate to SAP SuccessFactors using Entra workload identity and short‑lived tokens instead of static credentials (username and password). This change helps…

April 2026

The AIAgentsInfo table in advanced hunting now includes additional columns…

These fields expand coverage beyond Copilot Studio to all agent types, including Microsoft Foundry, third-party marketplace, and custom line-of-business agents.

April 2026

The Advanced review set explorer (preview) includes a new left navigation pane to browse the review set schema

The Advanced review set explorer (preview) includes a new left navigation pane to browse the review set schema, insert KQL operators, and run sample queries, and a new Getting started tab with basic and advanced query templates to help you build queries…

April 2026

The Label policies page for label publishing policies has a new Export policies option

The Export to Zip selection includes more detailed information about the policies and all sensitivity labels in your tenant.

April 2026

Trigger workflows from messages

Enable common automation scenarios, like approvals, notifications, or follow-up actions, by triggering Teams workflows directly from a chat message. To learn more, see Add or run a workflow in chats, chat messages, channels, and channel posts in Microsoft Teams.

April 2026

Use a one-time glossary migration and asset enablement process to curate data assets and columns with glossary terms

This process allows you to centralize the management of glossary terms by migrating glossary terms created in the classic governance experience into Unified Catalog. When you complete the process, you can curate data assets and columns.

April 2026

View action status in the Activities tab (Preview)

You can now view the current status of automatic attack disruption and predictive shielding actions related to a specific incident. You view this data in the Activities tab of the incident page. The data applies to the Contain user, GPO hardening, Safeboot…

April 2026

What is changing

SCIM provisioning applications that use the OAuth 2.0 Authorization Code grant will be updated to support modern authentication methods, such as OAuth 2.0 Client Credentials and workload identity federation. Existing provisioning jobs will not switch automatically. Customers will need to update job…

April 2026

What this means for you

If you are currently using basic authentication for any of the above SAP SuccessFactors provisioning integrations, you must upgrade to workload identity-based authentication before November 2026 to ensure uninterrupted operation of the integrations. No immediate action is required, but we recommend planning…

April 2026

What's changing

A new authentication option will be available starting May 2026 in the SAP SuccessFactors provisioning apps to use Entra workload identity-based authentication instead of basic authentication. Customers can switch existing provisioning configurations from basic authentication to workload identity–based authentication directly through updated…

April 2026

What's next

Beginning in July 2026, we will begin notifying customers through the M365 Message Center, Entra Connect Health, and targeted emails about their individual transition timelines. The transition will be rolled out in phases, and we will reach out directly to each organization…

April 2026

What's not changing

Once you migrate to Cloud Sync, your hybrid authentication features that enable on‑premises credentials to be used for accessing cloud resources will continue to be available after migration on the Connect Sync config wizard. Start preparing today We recommend that you take…

April 2026

When this is changing

This change will roll out over the coming months, and timing will vary by application. We will share impacted applications, customer deadlines, and supporting documentation through monthly What’s new articles and the Microsoft 365 Message Center.

April 2026

Why this is changing

This update strengthens the security of Microsoft Entra provisioning integrations by moving away from older authentication patterns. Modern methods are better suited for service-to-service scenarios and can reduce credential management overhead, including the need to rotate shared secrets.

March 2026 119

Week of 30 Mar 2026 · release 2603

Declarative Device Management for Apple line-of-business apps on iOS/iPadOS

Microsoft Intune now supports Apple Declarative Device Management (DDM) for required line-of-business apps on devices running iOS/iPadOS 18 and later. By changing the management type to DDM in App information, you can deploy and configure apps using Apple's policy-based model, which improves…

iOS/iPadOS
Week of 30 Mar 2026 · release 2603

Hotpatching default enablement in Windows Autopatch

Starting with the May 2026 Windows security update, hotpatch updates are enabled by default for all eligible devices managed through Windows Autopatch. Hotpatch updates install faster and require fewer restarts, helping devices get secure sooner. If your organization isn't ready for this…

Week of 30 Mar 2026 · release 2603

Improvements to device query for multiple devices

Device query for multiple devices now includes new capabilities to help you work with query results more efficiently. You can use a search text box to search across all resulting rows of a query, use column headers to add filters for specific…

Week of 30 Mar 2026 · release 2603

Intune security baseline for Windows 11, version 25H2

The Windows security baseline for Windows 11, version 25H2 is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations for supported Windows devices and is the latest available Windows security baseline in Intune. The Windows 11, version 25H2 security…

Windows
Week of 30 Mar 2026 · release 2603

Microsoft Intune app for Linux now supports the Microsoft Identity Broker

The Microsoft Intune app for Linux now uses the Microsoft Identity Broker on supported Ubuntu and Red Hat Enterprise Linux (RHEL) distributions. Broker version 2.0.2 and later introduces a major architectural change from the previous Java-based broker. This update enables new single…

Week of 30 Mar 2026 · release 2603

New settings in the Windows settings catalog

There are new settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Configuration profiles > Create profile > Windows 10 and later > Settings catalog). The new policies include:…

Windows
Week of 30 Mar 2026 · release 2603

New supported OEMConfig app for Android Enterprise

The following OEMConfig app is available in Intune for Android Enterprise: Inventus | com.inventus.oemconfig.gen For more information about OEMConfig, see Use and manage Android Enterprise devices with OEMConfig in Microsoft Intune.

Week of 30 Mar 2026 · release 2603

New updates to the Apple settings catalog

The Settings Catalog lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog. There are new settings in the…

macOSiOS/iPadOS
Week of 30 Mar 2026 · release 2603

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: PerfectServe Clinical Collab by PerfectServe Synigo Pulse by Synigo B.V. DeepL for Intune by DeepL SE Foxit PDF Editor by Foxit Software Inc. EasyPlant QC Inspections by Technip Energies (Android) For more…

Week of 30 Mar 2026 · release 2603

Recovery lock features available for macOS devices

On macOS devices, you can configure a recovery OS password that prevents users from booting company-owned devices into recovery mode, reinstalling macOS, and bypassing remote management. Admins can also rotate this password. There are two ways to use this feature: Settings catalog…

macOS
Week of 30 Mar 2026 · release 2603

Remote Help connectivity update for Windows devices

We've improved connectivity when using the Launch Remote Help capability in the Intune admin center for Windows devices. For the best experience, we recommend updating firewall rules to include this new endpoint: *.trouter.communications.svc.cloud.microsoft For the current list of required network endpoints, see…

Windows
Week of 30 Mar 2026 · release 2603

Scoped permissions for Role-based access control (preview)

Intune now includes an opt-in preview to enable Scoped permissions, making your role-based access control (RBAC) configuration more precise. Enabling Scoped permissions is a one-time choice that can't be undone. In the future, this will become the default behavior for all tenants.…

Week of 30 Mar 2026 · release 2603

Support Assistant access expanded to all authenticated users

All authenticated users can now access Support Assistant in the Intune admin center to find solutions and troubleshooting guidance. Creating and managing support tickets still requires a Microsoft Entra role that includes the microsoft.office365.supportTickets permission. For more information, see How to get…

Week of 30 Mar 2026 · release 2603

Support for Red Hat Enterprise Linux 9 and later

Microsoft Intune supports Red Hat Enterprise Linux (RHEL) 9 LTS and RHEL 10 LTS. Support for RHEL 8 LTS will end in July 2026. Devices already enrolled on RHEL 8 will remain enrolled. You can identify devices running RHEL 8 in the…

Week of 30 Mar 2026 · release 2603

Support for system proxy settings in endpoint analytics and Advanced Analytics

Devices configured with system-level (WinHTTP) proxy settings can now send telemetry to endpoint analytics and Advanced Analytics, enabling more comprehensive reporting. Endpoint Privilege Management (EPM) will also include elevation usage data from these devices. No admin action is required. If endpoint analytics…

Windows
March 2026

Bring Asana tasks into Copilot with a connector

Connect Microsoft 365 Copilot to Asana with a Copilot connector so you can query projects and tasks from within Microsoft 365. Roadmap ID: 515175 Details: What changed: Microsoft 365 Copilot now supports an Asana Copilot connector that can index Asana tasks for…

Web
March 2026

Connect Copilot to Smartsheet for project and task management

Microsoft Copilot (Microsoft 365) can now connect to Smartsheet so users can work with collaborative projects and tasks through a Copilot connector. Details: What changed: A new Copilot connector allows Microsoft 365 Copilot to access project and task information stored in Smartsheet.…

Web
March 2026

Connect Copilot with Egnyte for secure file collaboration

Users can connect Microsoft 365 Copilot with Egnyte to collaborate on secure file storage using the Copilot Connector. Roadmap ID: 513283 Details: What changed: Copilot can now access files stored in Egnyte, allowing users to retrieve, summarize, and interact with content without…

Web
March 2026

Connect Copilot with Zendesk Help Center to retrieve support articles

Users can connect Microsoft 365 Copilot with Zendesk Help Center to retrieve support articles and FAQs using the Copilot Connector. Roadmap ID: 513279 Details: What changed: Copilot can now search and summarize content from Zendesk Help Center, including help articles, troubleshooting steps,…

Web
March 2026

Copilot Chat recommends installed agents

Copilot Chat now recommends relevant installed agents when it detects a match with the user's intent. Details: What changed: When a user's prompt aligns with the capabilities of an installed agent, Copilot Chat will suggest that agent directly in the conversation. Previously,…

WindowsWeb
March 2026

Delegate calendar search in Microsoft 365 Copilot

Roadmap ID: 413718 Delegates with calendar access can now search for another user's meetings directly in Copilot Chat. Details: What changed: Delegates can use Copilot Chat to search for meetings on behalf of the person whose calendar they manage. Previously, this required…

WindowsmacOSiOS/iPadOSAndroidWeb
March 2026

Faster connector authentication setup for Gong, GitHub, and Monday

Admins can now set up authentication for Gong, GitHub, and Monday connectors using a simplified, faster OAuth experience. Details: What changed: The connector setup flow now uses a streamlined OAuth process that replaces lengthy manual steps. Admins can complete authentication in minutes…

Web
Week of 24 Mar 2026

Guided scenarios being removed from the Intune admin center

All guided scenarios except Windows 365 Boot are removed from the Microsoft Intune admin center. You can no longer access the guided scenario wizards, but any Intune objects previously created by these wizards remain available and manageable. The Windows 365 Boot guided…

WindowsiOS/iPadOSAndroid
March 2026

Query Bitbucket pull requests with Copilot connectors

Connect Microsoft 365 Copilot to Bitbucket with Copilot connectors so you can query pull requests and related engineering context. Roadmap ID: 515163 Details: What changed: Microsoft 365 Copilot now supports a Bitbucket Pull Request Copilot connector that brings pull request information into…

Web
March 2026

Query Coda docs and wikis with Copilot connectors

Connect Microsoft 365 Copilot to Coda with Copilot connectors so you can query collaborative documents and wikis from Copilot. Roadmap ID: 515165 Details: What changed: Microsoft 365 Copilot now supports a Coda Enterprise Copilot connector that can index Coda documents and pages…

Web
March 2026

Query GitLab merge requests and content with Copilot connectors

Connect Microsoft 365 Copilot to GitLab with Copilot connectors so you can query merge requests and related repository activity. Roadmap ID: 515162 Details: What changed: Microsoft 365 Copilot now supports GitLab merge request connectors, making merge request information discoverable and retrievable in…

Web
March 2026

Scatter image effect

We're introducing a new Scatter image effect that helps users quickly apply a modern, stylized look to AI-generated or uploaded images. Roadmap ID: 537288 Details: What changed: The image editor in Copilot Chat and the Create module now includes a Scatter effect.…

WindowsmacOSiOS/iPadOSAndroidWeb
March 2026

Search Aha! features and ideas in Copilot with a connector

Connect Microsoft 365 Copilot to Aha! with Copilot connectors so you can query product features and customer ideas in Copilot. Roadmap ID: 515159 Details: What changed: Microsoft 365 Copilot now supports an Aha! Copilot connector that can index Aha! features and ideas…

Web
March 2026

Share OneDrive files with a Copilot-generated summary in Windows

You can now generate a file summary with Copilot and include it directly when sharing OneDrive files in Windows. Roadmap ID: 527840 Details: What changed: A new option in File Explorer and the OneDrive Activity Center lets you summarize a file with…

Windows
March 2026

Summarize and Explain actions in PDF reader

Two new Copilot actions-Summarize and Explain-are now available in the Microsoft Edge PDF reader to help users understand content faster. Roadmap ID: 498641 Details: What changed: The built in PDF reader now includes Summarize and Explain options alongside the existing Ask Copilot…

Web
March 2026

Track GitLab issues in Copilot with a connector

Connect Microsoft 365 Copilot to GitLab Issues with Copilot connectors so you can query engineering tasks and bugs from Copilot. Roadmap ID: 515158 Details: What changed: Microsoft 365 Copilot now supports GitLab Issues connectors that can index issue data and make it…

Web
Week of 16 Mar 2026

Improved Remote Help update reporting on macOS

We've improved the update and reporting experience for Remote Help on macOS to make version management more reliable and transparent for IT admins. After you deploy the latest Remote Help client (version 1.0.26012221) through Microsoft Intune, you can now view the full…

March 2026

Ask Copilot directly from the Microsoft Edge address bar

Microsoft Edge lets users send a search query from the address bar directly to Copilot to receive a synthesized, more targeted answer. Roadmap ID: 493287 Details: What changed: When users type a search query in the Microsoft Edge address bar, they can…

Web
March 2026

Connect Copilot to Amazon S3 document repositories

Users can connect Microsoft 365 Copilot to Amazon S3 so Copilot can access structured document repositories through a Copilot connector. Roadmap ID: 513285 Details: What changed: Microsoft 365 Copilot can now connect to Amazon S3 using a Copilot connector, which makes structured…

Web
March 2026

Connect Copilot with Shortcut to manage agile development workflows

Users can connect Microsoft 365 Copilot with Shortcut to manage agile development workflows using the Copilot Connector. Roadmap ID: 515178 Details: What changed: Users can now integrate Shortcut as a data source for Microsoft 365 Copilot. This enables Copilot to retrieve, summarize,…

Web
March 2026

Edit images in PowerPoint with Designer Editor

PowerPoint now includes the Designer Editor for image editing, giving you a modern, intuitive way to refine images directly on your slides without leaving PowerPoint. Details: What changed: You can now use PowerPoint's new AI-powered image editing capabilities to perform tasks such…

WindowsmacOSWeb
March 2026

Edit with Copilot in Excel to enhance your productivity (formerly Agent Mode)

Edit with Copilot in Excel to build and change workbooks, using Excel tools like tables, charts, PivotTables, and formulas to complete complex data tasks faster. Roadmap IDs: 542182, 527835 Details: What changed: A new option is available in Copilot in Excel that…

WindowsmacOSWeb
March 2026

Expanded AI skill inferencing for E3 and E5 users

This update expands AI-powered skill inferencing to Microsoft 365 E3 and E5 users, helping organizations keep user profiles more accurate and up to date. Roadmap ID: 548643 Details: What changed: AI-powered skill inferencing, previously available only to Microsoft 365 Copilot and Microsoft…

WindowsWeb
March 2026

Scope Copilot Chat prompts to Teams channels with Context IQ

You can now search for and select Microsoft Teams channels in Context IQ to ground Copilot Chat prompts in the conversations and content that matter most. Roadmap ID: 429645 Details: What changed: Context IQ now allows you to search for and select…

Web
March 2026

Summarize and explain PDFs with Copilot in Microsoft Edge

Microsoft Edge expands its built-in PDF reader with new Copilot actions that help you quickly summarize or explain PDF content directly in the browser. Roadmap ID: 498641 Details: What changed: The existing Ask Copilot experience in the Microsoft Edge PDF reader now…

Web
Week of 2 Mar 2026 · release 2602

Apple declarative device management (DDM) supports assignment filters

You can use assignment filters in policy assignments for DDM-based configurations, like software updates. This feature is rolling out slowly and should be available for all customers by late March 2026. To learn more about filters, see Use assignment filters to assign…

macOSiOS/iPadOS
Week of 2 Mar 2026 · release 2602

Autopatch update readiness

Autopatch update readiness provides a unified experience for tracking and remediating Windows update issues across Intune-enrolled devices and Windows Autopatch group-enrolled devices. With a single dashboard, admins can view all managed devices, including enrollment status and policy assignments, to better understand update…

Windows
Week of 2 Mar 2026 · release 2602

Intune ending support for legacy Apple MDM software update policies

With the release of iOS 26, iPadOS 26, and macOS 26, Apple has deprecated legacy mobile device management (MDM) software update commands and payloads. As a result, Microsoft Intune will soon end support for creating legacy iOS/iPadOS and macOS software update policies.…

macOSiOS/iPadOS
Week of 2 Mar 2026 · release 2602

Multi-administrator approval support for device compliance and device configuration policies

Multi-administrator approval now supports device configuration policies created through the settings catalog and device compliance policies. When you turn on this feature, any changes you make, including creating, editing, or deleting a policy, must be approved by a second administrator before they…

Week of 2 Mar 2026 · release 2602

New setting controls MDM enrollment during account registration on Windows (preview)

A new setting that affects the Microsoft Entra account registration experience on Windows is available in the Microsoft Intune admin center. The setting, Disable MDM enrollment when adding work or school account on Windows, controls whether devices enroll in MDM during the…

Week of 2 Mar 2026 · release 2602

New settings in the Windows settings catalog

There are new settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Configuration profiles > Create profile > Windows 10 and later > Settings catalog). The new policies include:…

Windows
Week of 2 Mar 2026 · release 2602

New updates to the Apple settings catalog

The Settings Catalog lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog. There are new settings in the…

macOSiOS/iPadOS
Week of 2 Mar 2026 · release 2602

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: Jump by Accio Inc. Mijn InPlanning by Intus Workforce Solutions (Android) For more information about protected apps, see Microsoft Intune protected apps.

Week of 2 Mar 2026 · release 2602

Updates to operators in device query for multiple devices

Device query for multiple devices now includes expanded operator support, clearer query validation, and improved results to make building and interpreting queries easier. New join types supported\ You can now use the following join types when querying across entities: leftsemi rightsemi leftanti…

March 2026

Added support for contextual Teams messages in User reported Teams Messages

When Users report Microsoft Teams messages from chats, channels (standard, shared, and private), and meeting conversations to Microsoft as malicious (security risk), up to fifteen messages before and after the reported message are shared for analysis.

March 2026

Agent Registry consolidation into Microsoft Agent 365

We’re consolidating agent management experiences to make it easier to observe, govern, and secure all agents in your tenant. Agent 365 will be the single source of truth, offering a unified catalog, consistent visibility, and simplified management. What’s changing The Agent registry…

March 2026

Annotate with others on single-shared windows during meetings

When you share a specific application window in a meeting, you and others can now directly annotate on that shared content without you sharing the entire desktop. To learn more, see Use annotation while sharing your screen in Microsoft Teams.

March 2026

Audit search in Data Security Investigations is now generally available

Use audit search to identify and collect content based on user activities recorded in the Microsoft Purview unified audit log, such as accessing, copying, or downloading files, and pull the associated content into your investigation.

March 2026

Auto-labeling policies introduce a new flow where you must decide whether…

When you chose to automatically apply a sensitivity label, you can now optionally choose to always overriding an existing label that has a lower priority label, even if it was manually applied. This option was previously available for emails only and now…

March 2026

Categorization now includes a Standard and Advanced option

Standard categorization can significantly reduce the time it takes to complete processing and the amount of Data Security Investigation Compute Units (compute unit) needed for categorization.

March 2026

Configurable Data Quality thresholds allows users…

Configurable Data Quality thresholds allows users to define minimum acceptable quality scores at the data quality rule and data asset levels to align quality evaluation with business criticality.

March 2026

Configure sampling options when adding search results to a review set in eDiscovery

Choose confidence-based or percentage-based sampling to add a statistically representative subset of search results instead of all items. Completing the Generate statistics process is required to enable sampling.

March 2026

Cross-tenant security group synchronization

We’re introducing cross-tenant group synchronization, a new capability that allows organizations to synchronize security groups across Microsoft Entra tenants. This feature enables centralized management of group membership in a source tenant while making those groups available in one or more target tenants,…

March 2026

Customize the Enter key function in Teams chat

Choose what the Enter key does in a Teams chat by selecting Settings and more  > Settings > Chats and Channels in Teams and choosing an option in When writing a message, press Enter to.

March 2026

Data Security Investigations now supports soft purge for Exchange mailbox items

Soft purge moves items to the recoverable items folder, preserving the ability to restore items based on retention settings. Updated documentation includes guidance for choosing between soft purge and hard purge methods.

March 2026

Data Security Investigations searches now respect compliance boundaries configured with search permissions filters

Investigators whose accounts are scoped by a compliance boundary only see search results for content locations within their permitted boundary.

March 2026

Documentation update

Now that container-level support for sensitivity labels include new collaborative workspaces such as Viva Engage communities and Loop workspaces, the previously titled article "Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 groups, and SharePoint sites" is now renamed Use…

March 2026

Easily find unsent drafts

Select Chat > Drafts in Teams to quickly find messages you've composed but haven't sent yet.

March 2026

Enabling Email and SMS OTP MFA in Entra External ID Native Authentication

Build secure sign‑in and sign‑up experiences for applications in Entra External ID using Native Authentication, with Email and SMS OTP MFA available through developer‑friendly SDKs and APIs..

March 2026

Enhanced image viewing

Scroll through images shared in a chat without distractions. The new Lightbox experience highlights the image you're viewing. Select Show message in the header to go right to the message the image was shared in.

March 2026

Entra Hybrid Join using Entra Kerberos

This new capability enables a Windows device to become Hybrid Entra joined immediately at provisioning time, without waiting for Entra Connect sync or requiring AD FS. By leveraging Entra Kerberos, customers can modernize their hybrid identity architecture while reducing infrastructure complexity and…

March 2026

Expanded Microsoft Purview deployment models with comprehensive step-by-step inline guides for five deployment scenarios

Previously available only as downloadable PPTX and PDF files, each model now includes detailed articles following a step-based workflow.

March 2026

Expanding User reporting in Teams to include Calls

Users can reported completed or missed one-to-one Microsoft Teams calls from the call history as malicious (scam) or non malicious (non-scam) to the specified reporting mailbox, or Microsoft and the reporting mailbox via user reported settings.

March 2026

Extend coverage of data insights to third-party SaaS and IaaS platforms by using Microsoft Sentinel…

Extend coverage of data insights to third-party SaaS and IaaS platforms by using Microsoft Sentinel with partner solutions to provide holistic data insights across Google Cloud Platform, Snowflake, and Databricks.

March 2026

Identity security enhancements

New identity security capabilities help you monitor and manage identity security for human and non-human identities: (Preview) Identity Security dashboard: The Identity Security dashboard provides summary cards for identity providers, on-premises identities, SaaS identities, PAM and IGA integrations, and non-human identities. For…

March 2026

Improved readability for Authentication Methods Policy Update audit logs

Starting in April 2026, the Authentication Methods Policy Update and Authentication Methods Policy Reset audit log activities has been updated to improve readability and clarity. Previously, audit logs included the full authentication methods policy payload in both the old and new values,…

March 2026

Just‑in‑Time Password Migration in Microsoft Entra External ID

Just‑in‑Time Password Migration is now generally available in Microsoft Entra External ID. Customers can migrate user passwords securely at first sign‑in, allowing users to continue using their existing credentials without forced password resets. This enables a smoother transition from Azure AD B2C…

March 2026

Library management for live response is now generally available

This feature provides a centralized view for managing files and scripts used during live response sessions. Documentation: Library management for live response

March 2026

Live meeting indicator for threaded channels

Live meeting indicators make it easy to see and jump right into active threaded channel meetings, keeping you in the loop.

March 2026

Manual labeling for OneNote, supported at the section level

Because retention labels also support labeling at the section level, you might find it helpful to review the architecture diagram for retention policies and retention labels. To enable the support for sensitivity labels, SharePoint and OneDrive must already be enabled for sensitivity…

March 2026

Microsoft Entra Backup and Recovery is now available

Microsoft Entra Backup and Recovery is a built-in solution to help restore your tenant after accidental changes or malicious updates. Always on by default, it automatically backs up critical directory objects — including users, groups, applications, service principals, managed identities, conditional Access…

March 2026

Microsoft Entra Connect Health now enforces TLS 1.2

We’ve completed a full migration to TLS 1.2 for Entra Connect Health and removed legacy TLS 1.1 references as part of security hardening. Ensure your Health agents are up to date and your servers are configured to use TLS 1.2 for outbound…

March 2026

Microsoft Entra passkeys on Windows are now available in public preview

This feature allows users to register device‑bound passkeys directly in the local Windows Hello container and use them to sign in to Microsoft Entra ID with Windows Hello biometrics or PIN. Entra passkeys on Windows behave as standard FIDO2 credentials and can…

March 2026

Microsoft Single Sign-On for Linux support for authenticating with Phish-Resistant MFA credentials

The major improvements that this release provides includes: Enables authentication using CBA/YubiKey with certificate (PRMFA) Removes dependency on Java runtime as part of the Intune install Improved performance and reliability when authenticating to EntraId Provides device trust using Entra Join instead of…

March 2026

More supported languages in audio recap

Audio recap for Teams meetings now generates summaries in Chinese, English (multiple variations), French, German, Italian, Japanese, Portuguese, and Spanish. To learn more, see Listen to audio recaps of your meetings.

March 2026

New M365 group creation experience in My Groups

We’re improving the Microsoft 365 group creation experience in My Groups to give group owners more control and clarity from the start. The updated experience lets you configure key group, email, and security settings during creation—so your group works the way you…

March 2026

New Microsoft Secure Score recommendations

Microsoft Secure Score now includes new recommendations to help organizations reduce exposure to common attack techniques involving remote access and authentication relay attacks: - Block file transfer over RDP: Restricts file transfer capabilities in Remote Desktop Protocol (RDP) sessions. This helps prevent…

March 2026

New guidance for how categorization processes data in Data Security Investigations

Categorization uses relevance scoring to prioritize the most relevant content for each selected category. Updated documentation includes considerations for results, content volume effects, and recommendations for using examination tools for comprehensive analysis.

March 2026

New support for the Data Security Posture Agent in Microsoft Purview

The Data Security Posture agent (preview) in Data Security Investigations helps your organization proactively surface credentials buried in data across your organization at scale.

March 2026

Organization chart enhancements

Our newly designed org chart in profile cards streamlines navigation through reporting relationships, recently viewed profiles, and more. Select Navigate to org chart  in someone's profile card to get started.

March 2026

Passkey Adoption Campaigns with the Conditional Access Optimization Agent

The Conditional Access Optimization Agent now supports passkey adoption campaigns in public preview, helping organizations roll out phishing‑resistant authentication in a structured and automated way. With this capability, the agent can assess user and device readiness, generate a recommended deployment plan, guide…

March 2026

Passkey profiles in Microsoft Entra ID are now generally available

Passkey profiles provide a structured way to manage passkey (FIDO2) authentication by allowing administrators to define multiple profiles with different requirements and target them to specific user groups. Each profile can specify allowed passkey types, attestation requirements, and authenticator restrictions, enabling differentiated…

March 2026

Personal data examinations in Data Security Investigations identify…

Quickly assess which personal data types were exposed after a data security incident, including names, email addresses, financial account numbers, and Social Security numbers, with severity classification and AI-generated reasoning to support regulatory compliance reporting.

March 2026

Phased Rollout with the Conditional Access Agent

You can now use the Conditional Access Optimization Agent to safely roll out _any_ report‑only Conditional Access policy in phases. When you initiate the process, the agent analyzes sign‑in data to recommend a low‑risk, staged deployment plan, starting with smaller user groups…

March 2026

Proactive user containment (contain user)

The proactive user containment (contain user) action as part of the predictive shielding feature is now generally available. This action infuses activity data with exposure data to identify exposed credentials at risk of being compromised and reused to conduct malicious activity. Documentation:…

March 2026

Related Tenants

This feature allows admins to discover related tenants connected to their own by B2B activity or shared billing information. Admins can use this information to request and establish tenant governance relationships, or to quarantine potential risks. For more information, see: Microsoft Entra…

March 2026

SCIM 2.0 APIs for Microsoft Entra ID

SCIM 2.0 APIs give customers, developers, and partners a standards-based option for managing users and groups in Microsoft Entra using the System for Cross-domain Identity Management (SCIM) 2.0 specification. For more information, see: Enable Microsoft Entra SCIM 2.0 APIs.

March 2026

Secure add-on tenant creation

Permissioned users can now create add-on tenants that are owned and governed by their home tenant. Governance is established through tenant governing relationships, granting admins access and control via GDAP. For more information, see: Microsoft Entra tenant governance documentation (preview).

March 2026

Synced passkeys in Microsoft Entra ID

Microsoft Entra ID now supports synced passkeys as a generally available authentication method. Synced passkeys are FIDO2-based credentials that can be stored in built-in or third-party passkey providers and made available across a user’s devices. Administrators can manage the use of synced…

March 2026

Take action in Teams from Mac Spotlight

Set your presence status, open your Teams calendar, compose a message, or open Teams to create a new meeting without leaving Spotlight.

March 2026

Tenant configuration management APIs

Tenant Configuration Management APIs allow organizations to take snapshots of their tenants' current configuration settings in a JSON format and to enforce configuration settings by offering continuous monitoring of drifts. For more information see Overview of the Tenant Configuration Management APIs.

March 2026

Tenant configuration management administration portal experience

Now you can use the Entra admin center to administer tenant configuration management capabilities of Entra tenant governance. You can use this experience to: Create and update monitors that enable you to define the desired state of resources in your tenant across…

March 2026

Tenant governance relationships

This feature allows admins to request and accept tenant governance relationships, which grant admins of the governing tenant access and administrative control over the governed tenant. For more information, see: Microsoft Entra tenant governance documentation (preview).

March 2026

The agent summary tab in the Triage Agent in Insider Risk Management has been enhanced…

The agent summary tab in the Triage Agent in Insider Risk Management has been enhanced to intelligently distill user activity risk into meaningful risk pattern narratives, contextual filtering options, granular activity signals, and provide specific files within alerts.

March 2026

The following advanced hunting schema tables are now available for preview

The CloudPolicyEnforcementEvents table contains policy enforcement evaluation decisions and metadata of security gating events for various cloud platforms protected by the organization's Microsoft Defender for Cloud.

March 2026

The proactive user containment (contain user) action as part of the predictive shielding feature is now generally available

This action infuses activity data with exposure data to identify exposed credentials at risk of being compromised and reused to conduct malicious activity.

March 2026

To improve accuracy and better protect organizational identities, we've made updates to the Secure Score…

To improve accuracy and better protect organizational identities, we've made updates to the Secure Score category calculations. Some security recommendations categorized as Cloud apps recommendations are now considered identity‑related and grouped under the Identity category. While the total Secure Score remains unchanged,…

March 2026

Use federated credentials as a more secure method of authentication to run Fabric data risk assessments

This change is also available for data risk assessments in Data Security Posture Management for AI (classic).

March 2026

Use filters on very large incidents with many alerts and entities or hide specific entities to simplify complex incident graphs

By simplifying the graphs, security teams can focus their investigations on what matters most.

March 2026

Use the new Advanced review set explorer to query review set data with Kusto Query Language (KQL)

Build advanced queries with complex filtering, pattern-based text extraction, and data visualization to analyze and find key information in your review sets.

March 2026

Viva Engage communities now support sensitivity labels applied to their underlying Microsoft 365 groups and connected SharePoint sites

The container label settings supported are privacy and guest access controls, to help you manage consistent protection with other groups and sites that support sensitivity labels. You can manually apply the label in Engage communities, and configure it in label policies as…

February 2026 66

February 2026

Connect Copilot with Azure File Share

Users can connect Copilot with Azure File Share to manage and work with their files using the Copilot Connector. Details: What changed: Copilot can now retrieve and summarize files stored in Azure File Share, providing insights without requiring users to open each…

Web
February 2026

Connect Copilot with Jira Data Center to manage engineering tasks

Users can connect Microsoft 365 Copilot with Jira Data Center to track and manage engineering tasks using the Copilot Connector. Details: What changed: Copilot can now retrieve issues, tasks, and updates from Jira Data Center. Users can analyze engineering progress and blockers…

Web
February 2026

Connect Copilot with Monday.com to track work and team progress

Users can connect Microsoft 365 Copilot with Monday.com to track work and team progress using the Copilot Connector. Roadmap ID: 515177 Details: What changed: Copilot can now pull data from Monday.com boards, tasks, and workflows. This allows users to review team progress…

Web
February 2026

Connect Copilot with Veeva

Users can connect Copilot with Veeva to access promotional materials, quality documents, and regulatory information using the Copilot Connector. Details: What changed: Copilot can now retrieve and summarize approved content stored in Veeva Vault, including compliance and regulatory documents. Why: This supports…

Web
February 2026

Connect Copilot with WordPress.com and WordPress.org

Users can connect Copilot with WordPress.com and WordPress.org to retrieve, summarize, and analyze site content using the Copilot Connector. Details: What changed: Copilot can now pull posts, pages, and site content from WordPress installations, making it easier to analyze or repurpose web…

Web
February 2026

Copilot Studio agent report enhancements

The Copilot Studio agent report includes autonomous agents and provides insights on adoption, impact, time savings, and cost savings. Roadmap ID: 499422 Details: What changed: The agent report now includes autonomous agents with generative orchestration. It also offers new metrics related to…

WindowsmacOSWeb
February 2026

Edit images in PowerPoint with Designer Editor

PowerPoint now includes the Designer Editor for image editing, giving you a modern, intuitive way to refine images directly on your slides without leaving PowerPoint. Details: What changed: You can now use PowerPoint's new AI-powered image editing capabilities to perform tasks such…

WindowsmacOSWeb
February 2026

Embedded knowledge support for declarative agents

Developers can embed knowledge such as PDFs, Word documents, and PowerPoint files for declarative agents. Roadmap ID: 474448 Details: What changed: Declarative agents now support embedded knowledge, allowing developers to include up to 10 local files as grounding resources. Why: This makes…

Web
February 2026

Out-of-box filter support for data sources in Copilot Search

IT admins can customize filters for data sources in Copilot Search without additional development work. Roadmap ID: 502534 Details: What changed: Microsoft 365 Copilot search now includes a dynamic filtering experience that surfaces data source-specific filters. When users select a source (such…

Web
February 2026

Scope grounding for declarative agents to specific data sources

Users can scope grounding for declarative agents to specific data sources. Details: What changed: Users can now define which data sources a declarative agent draws from. This ensures more precise responses and reduces unnecessary information. Why: This gives users more control over…

WindowsWeb
February 2026

Scope grounding for declarative agents to specific data sources

Users can scope grounding for declarative agents to specific data sources. Details: What changed: Users can now define which data sources a declarative agent draws from. This ensures more precise responses and reduces unnecessary information. Why: This gives users more control over…

WindowsWeb
February 2026

Steer presentation length, tone, style, and images with Copilot

Users can adjust presentation length, narrative tone, slide style, and AI-generated images when creating presentations with Copilot. Roadmap ID: 513422 Details: What changed: Copilot now supports more granular controls for customization. Users can specify slide count, tone of messaging, stylistic preferences, and…

WindowsmacOSWeb
February 2026

Use Copilot to get a detailed and contextual explanation

Users can select the "explain" option from the contextual menu that appears by right clicking on objects or content in PowerPoint to receive a detailed and contextual explanation. Roadmap ID: 516565 Details: What changed: Copilot can now provide an explanation of any…

WindowsmacOSWeb
February 2026

Admins can set up connector authentication faster with a simplified experience

Admins can now set up connector authentication faster through a simplified and guided OAuth experience. Details: What changed: Previously, connector authentication required manual steps and extensive documentation. The new experience introduces a streamlined, guided OAuth flow that significantly reduces setup time. Why:…

Web
February 2026

Configure and manage agent manifests in Developer Portal

Developer Portal now supports management and configuration of Agent Blueprints allowing developers to extend Agent 365 capabilities to their agents including enterprise-grade identity, observability, notifications, security, and governed access to Microsoft 365 data. Details: What changed: Developer Portal now supports full lifecycle…

February 2026

Connect Copilot to GitHub Server with Copilot Connector

Connect Copilot to your GitHub Server to retrieve and collaborate on issues, pull requests, and knowledge base content. Details: What changed: The Copilot Connector enables a direct connection to GitHub Server. Users can bring issues, pull requests, and knowledge base content into…

Web
February 2026

Declarative Agents help users stay in their workflow

URL-based dialogs in Declarative Agents allow users to open linked experiences without leaving Copilot, helping them stay focused. Details: What changed: Developers can now enable URL-based dialogs in Declarative Agents. This lets users open external pages or forms directly within Copilot. Previously,…

Web
February 2026

Field teams can accelerate Copilot adoption using champion connectors

Field teams can use getting started guides of champion connectors to guide customers through Copilot adoption with clear, consistent resources. Details: What changed: Field teams can now use getting started guides champion connectors to guide Copilot adoption in top accounts. This adds…

Web
February 2026

More frequent ticket status updates for the ServiceNow Tickets Copilot connector

The ServiceNow Tickets Copilot connector updates ticket status more frequently by ingesting both active and inactive tickets. Roadmap ID: 505437 Details: What changed: The ServiceNow Tickets Copilot connector now ingests both active and inactive tickets by default, improving how often ticket status…

Web
February 2026

Query Miro boards and diagrams with Copilot connectors

Connect Microsoft 365 Copilot to Miro with Copilot connectors so you can query visual boards and diagrams in Copilot. Roadmap ID: 515166 Details: What changed: Microsoft 365 Copilot now supports a Miro Copilot connector, which makes Miro boards discoverable and usable in…

Web
February 2026

Users can refresh Adaptive Cards in agents to view the latest information

Users can refresh Adaptive Cards in agents to ensure they always see the most current information in their workflows. Details: What changed: Users can now refresh Adaptive Cards inside their agents to view updated information. Previously, cards remained static unless the agent…

Web
February 2026

Azure SQL Managed Instance support (SQL MI) is now generally available

You can now measure, understand, and improve the quality of your data in your SQL MI. Both public network and private endpoint configurations are supported. To get started, create a connection similar to Azure SQL database with supported port number, and assess…

February 2026

BYOD support for Windows client using Microsoft Entra registration

Bring Your Own Device (BYOD) support for Windows using Microsoft Entra‑registered devices is now available in public preview. Users and partners can access corporate resources from their own devices. Admins can assign the Private Application traffic profile to internal accounts, including internal…

February 2026

Copilot experience in Teams meetings

Copilot in Teams can analyze chat history, meeting transcripts, and calendar content to generate smart recaps, rewrite messages, and surface relevant insights. To learn more, see Use Copilot in Microsoft Teams meetings.

February 2026

Custom Block pages

When you configure policies blocking your users from accessing a risky, NSFW, or unsanctioned sites or apps in GSA, they receive a clear HTML error message with Microsoft Entra Internet Access branding. We’ve heard from many admins that they’d like to start…

February 2026

Custom banned password lists supported in Microsoft Entra External ID

In addition to the global banned password lists already supported, EEID admins can now add specific strings to block during password creation and reset. For more information, see Password Protection - Custom banned password lists.

February 2026

Data quality scans for standalone data assets enable organizations to measure…

By running scans on assets, organizations can decide whether to associate a data asset to a data product if the data asset is in poor quality.

February 2026

Delegated Workflow Management in Lifecycle Workflows

Lifecycle workflows can now be managed with Administrative Units (AUs), enabling organizations to segment workflows and delegate administration to specific admins. This enhancement ensures that only authorized admins can view, configure, and execute workflows relevant to their scope. Customers are able to…

February 2026

Device authorization grant flow in Microsoft Entra External ID

Similar to Microsoft Entra ID (workforce tenants), Microsoft Entra External ID (external tenants) now supports device authorization grant flow, which allows users to sign in to input-constrained devices such as a smart TV, IoT device, or a printer. For more information, see…

February 2026

Effective settings tab

The Effective settings tab under the device inventory Configuration management tab is now generally available. In this tab, you can view the actual value and configuration source of each security setting on a device. This helps identify configuration attempts that didn't take…

February 2026

Enhanced Defender deployment tool for Windows

The new version of the tool streamlines onboarding and enhances security by:- Bundling the onboarding package directly into the tool's executable.- Generating a key during deployment package creation that is required for running the tool.- Enabling users to configure an expiry date…

February 2026

Expanded attribute support in Lifecycle Workflows attribute changes trigger

The Attribute Changes trigger in Lifecycle Workflows now supports additional attribute types, enabling broader detection of organizational changes. Previously, this trigger was limited to a set of core attributes. With this update, you can configure workflows to respond when any of the…

February 2026

Expanding User reporting in Teams to Defender for Office 365 Plan 1

Users can report external and intra-org Microsoft Teams messages from chats, standard, shared, and private channels, meeting conversations to Microsoft as malicious (security risk) the specified reporting mailbox, or both via user reported settings.

February 2026

External MFA is Generally Available

We're excited to announce that external authentication methods in Microsoft Entra ID is now generally available under a new name: External Multifactor Authentication (External MFA). This capability enables organizations to meet multifactor authentication requirements while continuing to use their preferred MFA provider.…

February 2026

Forward multiple messages at once

Forward up to five messages at a time from a Teams chat or channel. Hover over a message and select More options  . Select Forward > Multiple messages and choose the messages you want to send. Select Next, add recipients, and select Forward.

February 2026

Improved Device Vulnerabilities report experience

To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes the following changes and enhancements:- The Vulnerable devices by Windows 10/11 version over time section is now removed.- The report's filters only include the Device group filter.-…

February 2026

Keep collaborations secure with Trust Indicators

Assess who you're working with by checking Trust Indicators, visual badges that appear next to external people in Teams. Labels are automatically assigned based on the person's relationship with your org. 

February 2026

Library management for live response

You can now view and manage files and scripts used during live response sessions in the Microsoft Defender portal. With this enhancement, you get a centralized view of all uploaded files and their properties, and can upload, view and delete files outside…

February 2026

Microsoft Entra Connect Sync now supports Windows Server 2025

Microsoft Entra Connect Sync now officially supports Windows Server 2025. This means you can confidently install and run Microsoft Entra Connect Sync on servers running Windows Server 2025, enabling your hybrid identity environment to take full advantage of the latest Windows Server…

February 2026

Microsoft Entra Connect security update to block hard match for users with Microsoft Entra roles

What is Hard-matching in Microsoft Entra Connect Sync and Cloud Sync? When Microsoft Entra Connect or Cloud Sync adds new objects from Active Directory, the Microsoft Entra ID service tries to match the incoming object with an Entra object by looking up…

February 2026

Microsoft Entra Provisioning Service available in Microsoft Azure operated by 21Vianet

The Microsoft Entra provisioning service can be used in the 21Vianet / China cloud for the following scenarios: API-driven provisioning, Cloud Sync, Cross-tenant sync between China tenants, SCIM provisioning for the non-gallery / custom application, and on-premises app provisioning (ECMA). Specific gallery…

February 2026

Microsoft Purview Data Quality supports incremental data quality scans by using time-based filtering

By using incremental scans, you can choose between full scans, incremental scans, or both when you run data quality rules on data assets.

February 2026

Microsoft Purview enables software development companies to integrate governance, protection,…

A new list of partner integrations is now available, with links to partner documentation.

February 2026

Network strength indicator in Teams meetings

If your connectivity drops in a meeting, you'll see a notification alerting you that your network connection is weak. You'll also receive suggestions for strengthening and restabilizing it, like turning your video off. 

February 2026

New end user homepage in My Account

The homepage at https://myaccount.microsoft.com has been updated to provide a more task-focused experience. Users will see pending actions like renewing expiring groups, approving access package requests, and setting up MFA directly on the homepage. Quick links to apps, groups, access packages, and…

February 2026

Reference meeting visuals in recap summaries

Teams meeting recaps now include key on-screen moments, like screen shares, directly next to the relevant sections of the summary, so you can see exactly what was being discussed. To learn more, see Recap in Microsoft Teams.

February 2026

Reshape your Teams meeting layout

Resize and reshape your right and top galleries during a Teams meeting to prioritize the content most important to you. 

February 2026

Revoke previously approved access package assignments in My Access

By end of March Microsoft Entra ID Governance approvers can now revoke access to an access package after an approval has already been granted. This gives approvers greater control to respond to changes, mistakes, or updated business needs. With this update, an…

February 2026

Sign-in with username/alias

In Microsoft Entra External ID (EEID), users who authenticate with a local email and password now can also sign in using a username (alias) as an alternate sign-in identifier. This alias can represent a customer or member ID, insurance number, frequent flyer…

February 2026

Support for software product vulnerability data on Windows 7

To provide comprehensive vulnerability management capabilities across all supported Windows versions, Microsoft Defender Vulnerability Management now gathers software product vulnerability data on Windows 7 devices.

February 2026

The client-side improvements for sensitivity labels that extend SharePoint permissions to downloaded documents…

The client-side improvements for sensitivity labels that extend SharePoint permissions to downloaded documents that started to roll out to Windows version 2601+ in January for the Current Channel is complete, and now also available with the Monthly Enterprise Channel.

February 2026

The following advanced hunting schema tables are now generally available

It also includes information and link to the identity that owns the account. The EntraIdSignInEvents table contains information about Microsoft Entra interactive and non-interactive sign-ins. The EntraIdSpnSignInEvents table contains information about Microsoft Entra service principal and managed identity sign-ins. The GraphApiAuditEvents table…

February 2026

The following content types are now generally available for distribution across multiple tenants…

The following content types are now generally available for distribution across multiple tenants in the Microsoft Defender multitenant portal: analytics rules, automation rules, and workbooks.

February 2026

Upcoming Changes – Jailbreak/root Detection in Authenticator App

Starting February 2026, Microsoft Authenticator will introduce jailbreak/root detection for Microsoft Entra credentials in the Authenticator app. The rollout progresses from warning mode → blocking mode. Users must move to compliant devices to continue using Microsoft Entra accounts in Authenticator.

February 2026

View file search results in grid view

When you search for files in Teams, select Files > View all files and switch to Grid view  for a more visual way to browse results.

February 2026

Vulnerable components page renamed to Software components

To reflect Defender Vulnerability Management's visibility into all software components identified in your organization, the Vulnerable components page is now named Software components. Documentation: Software components

February 2026

What's new and release notes documentation updates

The what's new and OS-specific release notes pages are now updated to provide better visibility and access to new features, improvements, and fixes:- The what's new page (this page) is now named New features in Microsoft Defender for Endpoint and includes both…

January 2026 47

January 2026

Advanced understanding for comments and attachments in SNOW KB and Azure DevOps connectors

Copilot now understands content within comments and attachments for ServiceNow KB and Azure DevOps work item connectors. Details: What changed: Previously, Copilot focused on primary content only. Comments and attachments are now included in content understanding. Why: This ensures important context is…

WindowsWeb
January 2026

Bring your own Microsoft Foundry agents into Microsoft 365 Copilot

Bring intelligent agents built and hosted in Microsoft Foundry into to Microsoft 365 Copilot and Microsoft Teams-tailored to your organization's workflows, rules, and compliance needs. What Changed: You can now connect an existing Foundry agent to Microsoft 365 Copilot and Microsoft Teams…

Web
January 2026

Copilot Chat model selector now offers GPT-5.2

Choose GPT-5.2 in Copilot Chat for faster responses or deeper reasoning, improving accuracy and clarity. Details: What changed: The model selector in Copilot Chat now includes GPT-5.2. Users can pick Quick Response for immediate answers or Think Deeper for more thorough reasoning.…

WindowsmacOSiOS/iPadOSAndroidWeb
January 2026

Copilot employee experience outcomes report with Viva Glint

A new Power BI report in Viva Insights shows how Copilot usage relates to employee experience sentiment in Viva Glint. Roadmap ID: 496654 Details: What changed: Previously, Understanding the impact of copilot usage on employee experience outcomes required customers to take the…

Web
January 2026

Copilot icon visibility in Microsoft Edge

Users can now manage the visibility of the Copilot icon in the Microsoft Edge toolbar, while admins can control icon access through policy settings. Roadmap ID: 536579 Details: What changed: Previously, the Copilot icon always appeared in the toolbar. Users can now…

Web
January 2026

Copy an agent from Agent Builder to Copilot Studio

Users can now open agents created in Agent Builder in the Copilot Studio authoring experience. Details: What changed: Previously, agents created in Agent Builder experience were limited in capability. Authors can now move agents into Copilot Studio to access advanced features and…

WindowsWeb
January 2026

Generate PowerPoint grounded on a Copilot page

Create a PowerPoint deck grounded on a Copilot page to present page content quickly. Roadmap ID: 499425 Details: What changed: You can generate a PowerPoint presentation grounded on the content of a Copilot page, enabling rapid presentation creation based on existing information.…

Web
January 2026

Generate icons using AI in Agent Builder

Users can generate custom icons using AI Agent Builder using custom prompts, manually upload their own icon, or select from a set of pre-created icons. Roadmap ID: 502864 Details: What changed: Previously, users relied on default icons or manual uploads. AI-generated icons…

WindowsWeb
January 2026

Improve relevance and personalization by connecting user identities across data sources

Copilot improves relevance and personalization by connecting user identities across multiple data sources. Details: What changed: Previously, identities from third party systems were not linked to the corresponding Microsoft identity, leading to poor response quality esp with people related queries. Copilot now…

WindowsWeb
January 2026

Publish Azure AI Foundry agents to Copilot

Developers can launch AI agents to the Copilot Agent Store effortlessly with no coding required. Roadmap ID: 501112 What Changed: Users have a one-click publishing flow from Azure AI Foundry to the Microsoft 365 Copilot Agent Store. No development experience is required…

Web
January 2026

Users can leverage multi-agent workflows

Agents in Copilot can now use other agents to accomplish work if configured. Users can see the interaction between agents. Details: What changed: Researcher and other agents could call simple APIs but not other AI agents. Now multiple agents will coordinate to…

WindowsWeb
January 2026

Workplace patterns report in Viva Glint

A new report in Viva Glint highlights how employee sentiment relates to workplace patterns and drivers. Roadmap ID: 489229 Details: What changed: Previously, users relied on custom analysis. The Workplace Patterns report now provides out-of-the-box insights. Why: This accelerates access to actionable…

Web
January 2026

Access all your Copilot-generated content in one library

Use the new Library in the Microsoft 365 Copilot app to easily find and manage your Copilot-created images and pages. Roadmap ID: 501783 What changed: A new centralized Library view in Copilot lets users access all their AI-generated assets in one place.…

WindowsmacOSiOS/iPadOSAndroidWeb
January 2026

Admin control to customize AI disclaimers in Copilot Chat

We updated the AI Disclaimer experience in Microsoft Copilot Chat based on customer feedback. To address this, we introduced an admin control that allows organizations to customize how the disclaimer appears, improving user awareness and flexibility. Details: What changed: The AI disclaimer…

WindowsWeb
January 2026

Build smarter agents with GPT-5 in Agent Builder

Create more capable and context-aware Copilot agents powered by GPT-5, delivering richer responses and streamlined experiences for your users. Roadmap ID: 502552 Details: What changed: Declarative agents built in Microsoft 365 Copilot now use GPT-5 as the underlying chat model, enabling advanced…

WindowsmacOSiOS/iPadOSAndroidWeb
January 2026

Connect Dropbox for smarter Copilot file access

Integrate Dropbox with Copilot to access, retrieve, and manage files directly, regardless of where they are stored. Roadmap ID: 513282 What Changed: A new Copilot connector allows you to integrate Dropbox into the Microsoft 365 Copilot experience. Once connected, Copilot can retrieve…

Web
January 2026

Connect Microsoft 365 Copilot with Guru for enhanced insights

Microsoft 365 Copilot can now connect with Guru to surface internal knowledge and team insights, enhancing team collaboration and decision-making. Roadmap ID: 513281 Details: What changed: Previously, Microsoft 365 Copilot operated with its standard integrations. With this update, users can connect Microsoft…

Web
January 2026

Expand Copilot Agents with Mail, People, and Meeting Insights

Copilot declarative agents can now integrate with richer M365 data: mail, people's data, Teams chats, and meeting transcripts. What Changed: Agents can now tap into richer Microsoft 365 data sources - email, Teams chats, meeting transcripts, and people data - to deliver…

WindowsWeb
January 2026

Generate Office documents from agents in Copilot Studio lite

Agents built with Copilot Studio lite can generate PowerPoint decks, Excel spreadsheets, and Word documents via chat, with files saved to OneDrive. Roadmap ID: 506753 Details: What changed: Office skills are available in Copilot Studio lite. Users can chat with an agent…

WindowsWeb
January 2026

Search for meetings by organizer using Copilot Chat

Quickly find meetings scheduled by a specific person to review or prioritize your calendar. Roadmap ID: 503859 What changed: Copilot Chat now lets you search your calendar for meetings organized by a specific individual. Why: Helps users locate calendar items and prioritize…

Windows
January 2026

Simplified ServiceNow tickets setup with per-table ACL rules

Admins can now define ACL permission rules per table for ServiceNow ticket ingestion, reducing setup complexity. Details: What changed: Previously, permissions were selected for all tables combined. Now, admins define permission rules for each selected table, improving control and clarity. Why: Per-table…

Web
January 2026

Smart document management with Google Drive integration

Connect Google Drive to Copilot for smooth collaboration in multiple clouds. What Changed: Copilot can access, reference, and combine insights from Google Drive files, allowing for richer, cross-platform collaboration. Why: This feature ensures Copilot brings content from different sources together, reducing complexity…

Web
January 2026

Template-based knowledge ingestion for ServiceNow Knowledge Connector

ServiceNow Knowledge Connector now ingests articles created using out-of-the-box and custom templates, expanding coverage and flexibility. Roadmap ID: 505436 Details: What changed: Previously, template-based knowledge articles were not ingested. The connector now supports out-of-the-box templates such as FAQ, How to, and What…

Web
January 2026

Ability to convert Source of Authority of synced on-premises AD users to cloud users is now available

We’re pleased to announce the general availability of object-level Source of Authority (SOA) switching for Microsoft Entra ID. With this feature, administrators can transition individual users from being synced with Active Directory (AD) to becoming cloud-managed accounts within Microsoft Entra ID. These…

January 2026

App-based branding via Branding themes in Entra External ID

In Entra External ID (EEID), customers can create a single, tenant-wide, customized branding experience that applies to all apps. We're introducing a concept of Branding "themes" to allow customers to create different branding experiences for specific applications. A new Live Preview feature…

January 2026

Block communication from sender email address and domains in Teams

Admins can directly block malicious domains and email addresses from within the Microsoft Defender portal, seamlessly adding targeted entries to the Teams Admin Center (TAC) blocked domains and users list. This capability enables near real-time protection. When suspicious or abusive external organizations…

January 2026

Client Credentials in Microsoft Entra External ID

We are pleased to announce the general availability of client credentials in Entra External ID. The OAuth 2.0 client credentials grant flow permits a web service (confidential client) to use its own credentials, instead of impersonating a user, to authenticate when calling…

January 2026

Customize recap summaries

View meeting recaps in your desired format with customized recap summaries, available with a Microsoft Copilot license. Choose a ready-made summary template or create your own. To learn more, see Customize recap summaries in Microsoft Teams.

January 2026

Device vulnerabilities report enhancements

To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes several changes and enhancements (learn more).Note: These changes are not yet visible to government cloud customers. Documentation: Device vulnerabilities report

January 2026

Entra Private Access for Domain Controllers

Bring MFA to on‑premises applications when accessed from on‑premises, i.e., local‑to‑local access, while safeguarding domain controllers against identity threats. Enable secure access to private apps that use domain controllers for Kerberos authentication. For more information, see: Configure Microsoft Entra Private Access for…

January 2026

Improved enforcement for All resources policies with resource exclusions

Microsoft Entra Conditional Access is strengthening how policies that target All resources with resource exclusions are enforced in a narrow set of authentication flows. After this change, in user sign‑ins where a client application requests only OIDC or specific directory scopes, Conditional…

January 2026

In advanced hunting, if the query result exceeds the 64-MB size limit

In advanced hunting, if the query result exceeds the 64-MB size limit, the portal now returns the maximum number of records it can within this limit and displays a message indicating that the displayed results are partial due to size constraints.

January 2026

Keep Teams safe from suspicious messages

Help protect your org against phishing and other unwanted messages by flagging suspicious messages or confirming that messages flagged by Teams are safe.

January 2026

Keep your Teams window in view

Pin your Teams window on top in your desktop to always keep it visible above other open windows. Just select Settings and more > Pin window on top  in Teams.

January 2026

Microsoft Entra ID Governance guest billing meter enforcement

Enforcement for the Microsoft Entra ID Governance guest billing meter is now in effect for Entitlement Management and Lifecycle Workflows (Access Reviews will be enforced later in CY26 Q1). To keep using Entra ID Governance premium features for guest users in workforce…

January 2026

Preview messages in your notifications

Now, when you get channel, mention, or reaction notifications, Teams will surface a preview of the message in that notification.

January 2026

Schedule Microsoft Teams meetings from Gmail

Schedule follow-up meetings from your emails. When you use the add-on to schedule a meeting from a specific email, the subject and participants are automatically prepopulated to make meeting scheduling easier. 

January 2026

Service Principal creation audit logs for alerting & monitoring

New audit log properties now make it easy for admins to understand why a service principal was created and who or what triggered it. The logs now surface the provisioning mechanism, the specific SKUs or service plans that enabled just‑in‑time creation, and…

January 2026

Session Control Conditional Access Policies in Entra External ID

EEID admins can configure persistent browser session and sign‑in frequency in Conditional Access. For more information, see Conditional Access: Manage Session Controls Effectively.

January 2026

The BehaviorInfo and BehaviorEntities tables in advanced hunting now include additional columns…

The BehaviorInfo and BehaviorEntities tables in advanced hunting now include additional columns and information about behavior data types and alerts from User and Entity Behavior Analytics (UEBA), providing more insights on the relationships between identified behaviors and entities.

December 2025 21

December 2025

GPT-5 powers Copilot Chat by default

Copilot Chat delivers faster, smarter results using GPT-5 as the default model. Details: What Changed: All Copilot Chat experiences run on GPT-5 by default. Copilot automatically routes prompts to the best-performing models for each task, using fast models for basic tasks and…

WindowsmacOSiOS/iPadOSAndroidWeb
December 2025

Upload Larger Files in Copilot Studio Agent Builder

Agent Builder now supports file uploads up to 512 MB when creating agents, ideal for larger files. Roadmap ID: 500375 Details: What Changed: This increases the upload size limit in Agent Builder to 512 MB, enabling use of larger files as grounding…

WindowsiOS/iPadOSAndroidWeb
December 2025

Advanced hunting now supports custom functions that use tabular parameters

By using tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries.

December 2025

Microsoft Security Copilot in Microsoft Defender now includes the Dynamic Threat Detection Agent, an always-on

Microsoft Security Copilot in Microsoft Defender now includes the Dynamic Threat Detection Agent, an always-on, adaptive backend service that uncovers hidden threats across Defender and Microsoft Sentinel environments.

December 2025

Microsoft Security Copilot in Microsoft Defender now lets you hunt for threats by using natural language with the Threat Hunting Assistant

This agent delivers a complete, conversational threat hunting experience by not only generating queries but also interpreting results, surfacing insights, and guiding you through full hunting sessions.

December 2025

More security for private group joins

Now, joining a private group by code requires direct approval by one of the group owners, ensuring more security and the prevention of unauthorized access to private groups. To learn more, see Use a link or code to join a team in…

December 2025

Multitask with pop-out windows

Open core Teams functions in their own windows to transition seamlessly between your Teams chat, calendar, activity, and more. Simply right-click an icon in Teams and select Open in new window .

December 2025

New Microsoft Secure Score recommendations

Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques: - Disable Remote Registry service on Windows: Prevents remote access to the Windows registry, reducing attack surface and blocking unauthorized configuration changes, privilege escalation, and lateral…

December 2025

The Microsoft Security Copilot Threat Intelligence Briefing Agent in Microsoft Defender is now generally available

It generates threat intelligence briefings based on the latest threat actor activity and both internal and external vulnerability information in a matter of minutes, helping security teams save time by creating customized, relevant reports.

December 2025

The following advanced hunting schema tables are now available for preview

The FileMaliciousContentInfo table contains information about files that Microsoft Defender for Office 365 processed in SharePoint Online, OneDrive, and Microsoft Teams.

December 2025

Triage collection

Use triage collection to prioritize incidents and hunt threats with the Sentinel Model Context Protocol (MCP) server. Documentation: Triage collection

November 2025 25

November 2025

A new Restrict pod access response action is now available when investigating container threats in the Defender portal

This response action blocks sensitive interfaces that allow lateral movement and privilege escalation.

November 2025

Control your front-of-room view in Teams Rooms

When you join a Teams Room on Android, see either the attendee or presenter view on the front-of-room display. Presenters can bring people on and off screen, manage the green room, and switch the front-of-room display view. To learn more, see Host…

November 2025

Defender XDR now includes the predictive shielding capability

Defender XDR now includes the predictive shielding capability, which uses predictive analytics and real-time insights to dynamically infer risk, anticipate attacker progression, and harden your environment before threats materialize.

November 2025

Defender deployment tool- for Windows devices- for Linux devices

The new Defender deployment tool is a lightweight, self-updating application that streamlines onboarding devices to the Defender endpoint security solution. The tool takes care of prerequisites, automates migrations from older solutions, and removes the need for complex onboarding scripts, separate downloads, and…

November 2025

Defender endpoint security solution for Windows 7 SP1 and Windows Server 2008 R2 SP1

A Defender for endpoint security solution is now available for legacy Windows 7 SP1 and Windows Server 2008 R2 SP1 devices. The solution provides advanced protection capabilities and improved functionality for these devices compared to other solutions. The new solution is available…

November 2025

Facilitator Agent enhancements

Facilitator can recognize agendas shared in chat and create live progress trackers in meetings to keep everything on track. If someone invited to a meeting hasn't joined and their name comes up twice in conversation, Facilitator politely nudges them to join in…

November 2025

Forwarded message links

When someone forwards a message, it will now include a link that takes the recipient straight to the original chat or channel it came from. To learn more, see Forward a message in Microsoft Teams.

November 2025

Gain insight with presenter analytics for town halls

View data about a town hall's video quality, audio clarity, and connection stability to ensure smooth content delivery during events. Available with a Teams Premium license.

November 2025

Make Teams mobile your default calling app

No need to switch apps to make Teams calls—set Teams as your default calling app to automatically route all your calls through Teams mobile. To learn more, see Getting started with Microsoft Teams Phone Mobile.

November 2025

Meta Quest VR headset support for immersive events

Our most immersive virtual event experience yet is here—join immersive events from a Meta Quest VR headset to feel like you're standing right there in the room. To learn more, see Attend an immersive event in Microsoft Teams.

November 2025

Microsoft Sentinel customers using the Defender portal, or the Azure portal…

To view these alert types, you must have the Security Administrator or higher role. The Service Source, Detection Source, and Product Name values for these alerts are listed as Microsoft Threat Intelligence.

November 2025

More Microsoft Copilot functionality in Teams

Use Copilot in Teams to generate messages, and insights from chat and channel history and calendar content. Available with a Microsoft Copilot license. To learn more, see Get started with Microsoft Copilot Chat in Teams.

November 2025

New Microsoft Secure Score recommendations

Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques:- Require LDAP client signing or Require LDAP server signing: Helps ensure integrity of directory requests so attackers cannot tamper with or manipulate group memberships or permissions…

November 2025

New predictive shielding response actions

Defender for Endpoint now includes the GPO hardening and Safeboot hardening response actions. These actions are part of the predictive shielding feature, which anticipates and mitigates potential threats before they materialize.

November 2025

Quickly access key actions from the jump list

Open the Teams jump list in your Windows taskbar or Mac menu bar to start a chat or view, join, and schedule meetings.

November 2025

Share your screen on Mac devices

Joining from a Mac? Share your screen and present content using the standard native picker experience when you opt in through settings. To learn more, see Present content in Microsoft Teams meetings.

November 2025

Skip the navigation with settings search

Need to change a specific setting? Search for it in the settings search bar—no navigation necessary. Just type in a keyword, like "notifications" or "dark mode," to go straight to that option. Organize and collaborate in chat and channels Add existing Loop…

November 2025

Stay protected with malicious URL detection

Now, Teams actively protects against potentially harmful links by automatically detecting and warning against malicious URLs shared in Teams chats and channels. 

November 2025

Stay protected with malicious file and URL detection

Now, Teams actively protects against potentially harmful links by automatically detecting and warning against malicious files and URLS shared in Teams chats and channels. When a link is incorrectly identified as a potential threat, flag it to help improve Teams' detection accuracy.

November 2025

The IdentityAccountInfo table in advanced hunting is now available for preview

This table contains information about account information from various sources, including Microsoft Entra ID. It also includes information and link to the identity that owns the account.

November 2025

The overview section of threat analytics now includes additional details about a threat

The overview section of threat analytics now includes additional details about a threat, such as alias, origin, and related intelligence, providing you with more insights on what the threat is and how it might impact your organization.

November 2025

Threat analytics now has an Indicators tab that provides a list of all indicators of compromise (IOCs) associated with a threat

Microsoft researchers update these IOCs in real time as they find new evidence related to the threat. This information helps your security operations center (SOC) and threat intelligence analysts with remediation and proactive hunting.

November 2025

Vulnerability management moves under Exposure management

The Vulnerability Management section in the Microsoft Defender portal is now located under Exposure management. This change is part of the vulnerability management integration to Microsoft Security Exposure Management, which significantly expands the scope and capabilities of the platform. Learn more.

October 2025 21

October 2025

:insert your emoji here:

Quickly insert an emoji into your posts and messages using the updated emoji keyboard shortcut. Just type “:”, followed by the name of the emoji, then type “:” again.  

October 2025

CVE exceptions

You can now use CVE exceptions to exclude specific Common Vulnerabilities and Exposures (CVEs) from analysis in your environment. CVE exceptions allow you to control what type of data is relevant to your organization and to selectively exclude certain data from your…

October 2025

Get quick context with Copilot file summaries

Now available with a Copilot license, you can view concise summaries of shared files in chat to get context without opening them. To view a file's Copilot summary, select Summarize for me on the file thumbnail. To learn more, see Use Copilot in Microsoft Teams chat and channels. 

October 2025

Give feedback faster on certified Teams Phone devices

When you enter a feedback rating from your certified Teams Phone device, Teams will suggest tailored text prompts to help you quickly share what’s working well or needs improvement.  

October 2025

Improved call transfer experience

Ensure smooth call transfers with your certified Teams Phone devices with our improved interface, including the option to Consult first (speak with the recipient before transferring the call to them) and live updates that indicate when a transfer is in-progress and when it’s complete. To learn more, see Transfer a call in…

October 2025

Isolation exclusions

The Isolation exclusions feature is now generally available. Isolation exclusions allow designated processes or endpoints to bypass the restrictions of network isolation. This ensures that essential functions can continue while broader network exposure is limited.

October 2025

Listen to meeting recaps on-the-go

Take a break from your screen and catch up on meetings with podcast-style audio recaps. This feature utilizes AI to transform meeting transcripts into engaging audio summaries. Available with Microsoft 365 and Microsoft Copilot licenses. To learn more, see Listen to audio recaps of your meetings. 

October 2025

Microsoft Defender Experts Hunting reports now include an Emerging threats section that details the proactive

Each report also now includes investigation summaries for nearly every hunt that Defender Experts conduct in your environment, regardless of whether they identified a confirmed threat.

October 2025

Microsoft Defender Experts MDR reports now include a Trends tab that provides you…

The tab visualizes the data according to the incidents' severity, MITRE tactic, and threat type. This section gives you insight into how Defender Experts are tangibly improving your security operations by showing important operational metrics on a month-over-month basis.

October 2025

New Microsoft Secure Score recommendations

Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques:- Block web shell creation on servers (reduces the risk of web-based persistence and remote code execution attacks)- Block use of copied or impersonated system tools (helps…

October 2025

Pop-out Intelligent recap for calls

Access Intelligent recap for recorded or transcribed calls in Teams. Select Calls   in Teams and find the call in your call history. Then, select View recap to open the call’s Intelligent recap and see AI summaries, notes, and more. To learn more, see Recap in Microsoft Teams. 

October 2025

Streamlined connectivity support for US government environments

Defender for Endpoint now supports streamlined connectivity for US government cloud environments. This enhancement simplifies onboarding by reducing the number of required service endpoints and improves reliability across restricted networks. For more information, see the required connectivity settings. Documentation: Streamlined connectivity support…

October 2025

Teams Phone Mobile now available with AT&T

AT&T customers can now make and receive calls across their mobile phone and Teams endpoints using a single phone number.  

October 2025

This update introduces the ability to perform Submit to Microsoft

These actions, previously only available in Threat Explorer, are now accessible via custom queries in Advanced Hunting, enabling security teams to take investigative and response actions more efficiently and programmatically.

September 2025 22

September 2025

Catch up on threads with Copilot

Quickly catch up on posts and threaded channels with thread summaries by Copilot. Thread summaries include key takeaways and a list organized by topic for easy scanning. Available with a Microsoft Copilot license. 

September 2025

Chat privately with webinar organizers and presenters

Private chat between organizers, co-organizers, and presenters is now available before, during, and after webinars, giving time and privacy for coordinating and preparing for the event. 

September 2025

Investigate incidents by using Blast radius analysis

This feature generates an interactive graph showing possible propagation paths from the selected node to predefined critical targets scoped to the user’s permissions.

September 2025

More privacy and stability for live captions and RTT

When meeting transcription is turned off, live captions and RTT will now only show the past five minutes of dialogue instead of the full meeting to protect information. Also, a previous issue that caused data loss when changing caption position has been resolved.  

September 2025

Near real-time URL protection in Teams messages

Known, malicious URLs in Teams messages are delivered with a warning. Messages found to contain malicious URLs up to 48 hours after delivery also receive a warning. The warning is added to messages in internal and external chats and channels for all…

September 2025

Organizer controls in the meeting toolbar

Select Controls  in your meeting controls for quicker access to key organizer meeting options, like lobby settings, attendee mic and camera access, and more. Select View more options for a complete list of customizations. 

September 2025

Prevent screen captures in meetings

Keep information confidential in Teams meetings with Prevent Screen Capture. When Prevent Screen Capture is turned on, the meeting window will turn black if someone attempts to capture the screen. Available in meetings organized with a Teams Premium license.  

September 2025

Run smoother meetings with Facilitator

Add Facilitator, a meeting AI agent, to your Teams meetings to keep them running smoothly and efficiently. Facilitator reminds participants about agenda items and time remaining, captures real-time notes, and much more. Available with a Microsoft Copilot license. To learn more, see Facilitator in Microsoft Teams meetings. 

September 2025

See your mic volume in real time

Know your mic's audio levels with the real-time feedback indicator in Teams meetings. In your meeting controls, you’ll see the Mic icon   fluctuate with your volume levels. You can also select Mic to see the feedback in more detail. 

September 2025

Start a meeting countdown timer

Keep meetings on track with countdown timers. When someone starts a countdown timer, everyone will see in their meeting window and be able to start, stop, pause, or add more time.  

September 2025

Threads in channels

View channel conversations as threads to easily reply to specific messages and keep related conversations grouped in one place. Follow threads to stay informed and view relevant updates in the Followed Threads view. To learn more, see Follow threads in Microsoft Teams. 

September 2025

Ultra-low latency during town halls

Stay in sync when you attend town halls with ultra-low latency, available in events organized with a Teams Premium license. With ultra-low latency, you’ll see organizers, presenters, and shared content in near real-time. 

September 2025

Use tasks in the Microsoft Defender portal to break down incident investigations into actionable steps…

Tasks are displayed alongside Security Copilot insights, guided responses, and reports - giving your team a unified view of progress and next steps. When you onboard Microsoft Sentinel to the Defender portal, tasks you create in Microsoft Sentinel through the Azure portal…

September 2025

Users can report external and intra-org Microsoft Teams messages as non-malicious

Users can report external and intra-org Microsoft Teams messages as non-malicious (not a security risk) from the following locations: Chats Standard, shared, and private channels Meeting conversations

September 2025

macOS configure offline security intelligence updates for Microsoft Defender for Endpoint on macOS

Enables organizations to update security intelligence (antivirus definitions/signatures) on macOS endpoints offline from a local mirror server. Documentation: Configure offline security intelligence updates for Microsoft Defender for Endpoint on macOS

macOS

August 2025 16

August 2025

Create your own keyboard shortcuts

Make keyboard shortcuts your own by customizing commands or choosing a preset layout. In Teams, select Settings and more  > Keyboard shortcuts to pick a layout and make any changes. To learn more, see Keyboard shortcuts for Microsoft Teams.

August 2025

Customize the screen in town halls

Elevate presentations you organized with Teams Premium by customizing your screen with select layouts, backgrounds, and name tags using the Manage what attendees see meeting option. To learn more, see Control town hall production tools in Microsoft Teams. 

August 2025

Defender Experts MDR customers can now incorporate third-party network signals for enrichment

This feature allows our security analysts to gain a more comprehensive view of an attack's path that allows for faster and more thorough detection and response. It also provides customers with a more holistic view of the threat in their environments.

August 2025

Express yourself with multiple emoji reactions

Can't choose which emoji to react with? Respond to messages and posts with more than one! Just hover over a message or post and select multiple emoji reactions that resonate with you. To learn more, see Like or react to messages in…

August 2025

Filter chat and channel search results

Easily find files in your chats and channels by adding a search filter. In a chat or channel, select Find in chat  or Find in channel and select the Has attachment filter to only see results with attachments. To learn more, see…

August 2025

Host 3D virtual events with immersive events

Transform online events into impactful 3D experiences with Teams immersive events. Create, customize, and host interactive events that captivate attendees, strengthen connections, and boost engagement. Schedule immersive events from your calendar in Teams. Customize environments with objects and media that add interest…

August 2025

In advanced hunting, you can now enrich your custom detection rules by creating dynamic alert titles and descriptions

Microsoft Sentinel customers that are onboarded to Microsoft Defender also now have the option to customize the alert frequency when the rule is based only on data that is ingested to Sentinel.

August 2025

In advanced hunting, you can now view all your user-defined rules—both custom detection rules and analytics rules—in the Detection rulespage

This feature also brings the following improvements: You can now filter for every column (in addition to Frequency and Organizational scope). For multiworkspace organizations that onboard multiple workspaces to Microsoft Defender, you can now view the Workspace ID column and filter by…

August 2025

Microsoft Defender Experts MDR and Microsoft Defender Experts Hunting customers can now expand their service…

Microsoft Defender Experts MDR and Microsoft Defender Experts Hunting customers can now expand their service coverage to include server and cloud workloads protected by Microsoft Defender for Cloud through the respective add-ons, Microsoft Defender Experts for Servers and Microsoft Defender Experts Hunting…

August 2025

Personalize meeting templates

Simplify your scheduling experience in Teams Premium by pre-saving meeting options as templates you can use to quickly organize meetings.  To learn more, see Personal meeting templates in Microsoft Teams. 

August 2025

The Sensitivity label filter is now available in the Incidents and Alerts queues in the Microsoft Defender portal

This filter lets you filter incidents and alerts based on the sensitivity label assigned to the affected resources.

August 2025

The following advanced hunting schema tables are now available for preview

The following advanced hunting schema tables are now available for preview: The CloudStorageAggregatedEvents table contains information about storage activity and related events The IdentityEvents table contains information about identity events obtained from other cloud identity service providers

August 2025

View all your saved messages

Open Chat  in Teams and select Saved  under Quick views to see all your saved messages. Select one to open the conversation it was in and review or reply directly. 

July 2025 4

July 2025

Intelligent recap available for unscheduled town halls

Now, unscheduled town hall participants using Android devices can access intelligent recap and catch up on parts they missed, see AI-generated notes and follow-up tasks, and more. To learn more, see Recap in Microsoft Teams.

July 2025

The DisruptionAndResponseEvents table, now available in advanced hunting

These events include both block and policy application events related to triggered attack disruption policies, and automatic actions that were taken across related workloads. Increase your visibility and awareness of active, complex attacks disrupted by attack disruption to understand the attacks' scope,…

July 2025

Users can report external and intra-org Microsoft Teams messages from chats, standard, shared, and private channels

Users can report external and intra-org Microsoft Teams messages from chats, standard, shared, and private channels, meeting conversations to Microsoft as malicious (security risk) the specified reporting mailbox, or both via user reported settings.

June 2025 6

June 2025

Call waiting beep

Now, if you’re already on a call, you’ll hear a call waiting beep when another call comes in. 

June 2025

Defender for Office 365 is now able to detect and classify mail bombing attacks

Mail bombing is a distributed denial of service (DDoS) attack that typically subscribes recipients to a large number of legitimate newsletters and services. The resulting volume of incoming email within minutes intends to overwhelm the recipient's mailbox and email security systems, and…

June 2025

In advanced hunting, Microsoft Defender portal users can now use the adx() operator to query tables stored in Azure Data Explorer

You no longer need to go to log analytics in Microsoft Sentinel to use this operator if you're already in Microsoft Defender.

June 2025

Microsoft Copilot now provides suggested prompts as part of incident summaries in the Microsoft Defender portal

Suggested prompts help you get more insights into the specific assets involved in an incident.

June 2025

More ringtone options in Teams for mobile

Choose from more ringtones to personalize call experiences and differentiate between call types. To change your ringtone, tap your profile picture and tap Settings > Calling . 

May 2025 5

May 2025

Defender portal users who onboard Microsoft Sentinel and enable the User and Entity Behavior Analytics

This latest version now includes the largest possible set of fields common to both Defender and Azure portals.

May 2025

Highlight your security operations achievements and the impact of Microsoft Defender by using the unified security summary

The unified security summary is available in the Microsoft Defender portal and streamlines the process for SOC teams to generate security reports, saving time usually spent on collecting data from various sources and creating reports.

May 2025

In advanced hunting, you can now view all your user-defined rules—both custom detection rules…

This feature also brings the following improvements: You can now filter for every column (in addition to Frequency and Organizational scope). For multiworkspace organizations that onboard multiple workspaces to Microsoft Defender, you can now view the Workspace ID column and filter by…

May 2025

In government cloud environments, Take action replaces the Message actions drop down list on the Email tab

For 100 or fewer messages selected in Threat Explorer, SecOps personnel can take multiple actions on the selected messages from the same page. For example: Purge email messages or propose email remediation. Submit messages to Microsoft. Trigger investigations. Create block entries in…

May 2025

The following advanced hunting schema tables are now available for preview…

The following advanced hunting schema tables are now available for preview to help you look through Microsoft Teams events and related information: The MessageEvents table contains details about messages sent and received within your organization at the time of delivery The MessagePostDeliveryEvents…

March 2025 2

March 2025

Create allow entries directly in the Tenant Allow/Block List

You can now create allow entries for domains & addresses and URLs directly in the Tenant Allow/Block List. This capability is available in Microsoft 365 Worldwide, GCC, GCC High, DoD, and Office 365 operated by 21Vianet.

March 2025

User reported messages by non-Microsoft add-ins can be sent to Microsoft for analysis

In user reported settings, admins can select Monitor reported messages in Outlook > Use a non-Microsoft add-in button. In the Reported message destination section, select Microsoft and my reporting mailbox, and then provide the email address of the internal Exchange Online mailbox…

January 2025 1

January 2025

Use the built-in Report button in Outlook

Use the built-in Report button in Outlook: The built-in Report button in Outlook for iOS version 4.2508 or, later and Android version 4.2446 or later now supports the user reported settings experience to report messages as Phishing, Junk, and Not Junk.

December 2024 1

December 2024

Considerations for integrating non-Microsoft security services with Microsoft 365

Considerations for integrating non-Microsoft security services with Microsoft 365: Considerations and recommendations for deploying a defense-in-depth email security strategy using non-Microsoft security services.

November 2024 1

November 2024

Introducing LLM-based BEC detection and classification

Microsoft Defender for Office 365 now detects BEC attacks using large language model (LLM)-based filters to analyze an email's language and infer intent. To learn more, see our blog post Microsoft Ignite: Redefining email security with LLMs to tackle a new era…

October 2024 1

October 2024

Tenant Allow/Block List in Microsoft 365 now supports IPv6 address

The Tenant Allow/Block List now supports allowing and blocking IPv6 addresses. It's available in Microsoft 365 Worldwide, GCC, GCC High, DoD, and Office 365 operated by 21Vianet environments.

September 2024 4

September 2024

Admins can see policy what-if insights for the bulk complaint level (BCL) threshold, spoof, and impersonation settings

This capability lets admins confidently tune their settings without anxiety about possible repercussions on users.

September 2024

Use the built-in Report button in Outlook: The built-in Report button in Outlook for Mac v16.89

Use the built-in Report button in Outlook: The built-in Report button in Outlook for Mac v16.89 (24090815) or later now supports the user reported settings experience to report messages as Phishing, Junk, and Not Junk.

September 2024

We're updating the end user experience for allowlist and blocklist management of their email messages

We're updating the end user experience for allowlist and blocklist management of their email messages. With one click, users can block email from unwanted senders and prevent those messages from appearing in their default quarantine view and in quarantine notifications. Users can…

September 2024

With one click, SecOps personnel can take a quarantine release action directly from Explorer

With one click, SecOps personnel can take a quarantine release action directly from Explorer (Threat Explorer) or the Email entity page (no need to go to the Quarantine page in the Defender portal).

August 2024 4

August 2024

Use the built-in Report button in Outlook

Use the built-in Report button in Outlook: The built-in Report button in Outlook for Microsoft 365 now supports the user reported settings experience to report messages as Phishing, Junk, and Not Junk.

August 2024

We're rolling out new details into who or what was responsible for releasing a message from quarantine

We're rolling out new details into who or what was responsible for releasing a message from quarantine. These details are included in the email summary flyout that's accessible from the Quarantine page. For more information, see View quarantined email.

July 2024 7

July 2024

(GA) Learning hub resources have moved from the Microsoft Defender portal to learn.microsoft.com

Access Microsoft Defender XDR Ninja training, learning paths, training modules and more. Browse the list of learning paths, and filter by product, role, level, and subject.

July 2024

(GA) SecOps personnel can now release email messages from quarantine or move messages from quarantine back…

This capability allows security operators to manage false positives more efficiently and without losing context.

July 2024

45 days after last used date

The value Remove allow entry after > 45 days after last used date is now the default on new allow entries from submissions. The existing allow entries in the Tenant Allow/Block List can also be modified to include the value Remove allow…

July 2024

Learning hub resources have moved from the Microsoft Defender portal to learn.microsoft.com

Access Microsoft Defender XDR Ninja training, learning paths, training modules and more. Browse the list of learning paths, and filter by product, role, level, and subject.

July 2024

SecOps personnel can now release email messages from quarantine or move messages from quarantine back…

This capability allows security operators to manage false positives more efficiently and without losing context.

July 2024

We're introducing intra-org protection data into three of our core customer facing reports: the Mailflow status…

We're introducing intra-org protection data into three of our core customer facing reports: the Mailflow status report, Threat protection status report, and Top senders and recipient report. Admins and security operators now have insight into how the built-in security features for all…

May 2024 4

May 2024

Automated end user feedback

The user submission automatic feedback response capability in Microsoft Defender for Office 365 enables organizations to automatically respond to end user submissions of phishing based on the verdict from the automated investigation. Learn more.

May 2024

Integration with Soft delete: Sender's copy clean-up is incorporated as part of the Soft delete action

Integration with Soft delete: Sender's copy clean-up is incorporated as part of the Soft delete action. Wide support: This action is supported across various Defender XDR platforms including Threat Explorer, Take Action wizard from the email entity, Summary Panel, Advanced hunting, and…

May 2024

Top level domain and subdomain blocking in Tenant Allow/Block List

You can create block entries under domains & email addresses, using the format .TLD, where TLD can be any top-level domain or .SD1.TLD, .SD2.SD1.TLD, .SD3.SD2.SD1.TLD, and similar patterns for subdomain blocking. The entries block all email received from or sent to any…

May 2024

We're introducing Sender's copy clean-up features in Threat Explorer, email entity, Summary Panel, and…

We're introducing Sender's copy clean-up features in Threat Explorer, email entity, Summary Panel, and Advanced hunting. These new features streamline the process of managing Sent items, particularly for admins who use the actions Move to mailbox folder > Soft delete and Move…

April 2024 3

April 2024

Enhanced clarity in submissions results

Admins and security operators now see enhanced results within submissions across email, Microsoft Teams messages, email attachments, URLs, and user-reported messages. These updates aim to eliminate any ambiguity associated with the current submission results. The results are refined to ensure clarity, consistency,…

April 2024

Last used date

added to Tenant Allow/Block List entries for domains and email addresses, files, and URLs.

April 2024

Take action replaces the Message actions drop down list on the Email tab

For 100 or fewer messages selected in Threat Explorer, SecOps personnel can take multiple actions on the selected messages from the same page. For example: Purge email messages or propose email remediation. Submit messages to Microsoft. Trigger investigations. Block entries in the…

March 2024 2

March 2024

Copy simulation functionality in Attack simulation training

Admins can now duplicate existing simulations and customize them to their specific requirements. This feature saves time and effort by using previously launched simulations as templates when creating new ones. Learn more.

February 2024 1

February 2024

Hunting and responding to QR code-based attacks

Security teams are now able to see the URLs extracted from QR codes with QR code as URL source on the URL tab of the Email entity page, and QRCode in the UrlLocation column of EmailUrlInfo table in Advanced Hunting. You can…

January 2024 2

January 2024

Providing intent while submitting is now generally available

Admins can identify if they're submitting an item to Microsoft for a second opinion or they're submitting the message because it's malicious and was missed by Microsoft. With this change, Microsoft analyses of admin submitted messages (email and Microsoft Teams), URLs, and…

December 2023 2

December 2023

Microsoft Defender unified RBAC is now generally available

Defender unified RBAC supports all Defender for Office 365 scenarios previously controlled by Email & collaboration permissions and Exchange Online permissions. To learn more about the supported workloads and data resources, see Microsoft Defender unified role-based access control (RBAC). Tip Defender unified…

December 2023

QR code related phishing protection in the built-in security features for all cloud mailboxes and in Microsoft Defender for Office 365

New detection capabilities using image detection, threat signals, URL analysis now extracts QR codes from URLs and blocks QR code based phishing attacks from the body of an email. To learn more, see our blog.

November 2023 2

November 2023

The Tenant Allow/Block Listsupports more entries in each category (Domains & email addresses, Files, and URLs):

The Tenant Allow/Block Listsupports more entries in each category (Domains & email addresses, Files, and URLs): Microsoft Defender for Office 365 Plan 2 supports 10,000 block entries and 5,000 allow entries (via admin submissions) in each category. Microsoft Defender for Office 365…

October 2023 2

October 2023

Exchange Online permission management in Defender for Office 365 is now supported in Microsoft Defender unified role-based access control (RBAC)

In addition to the existing support for Email & collaboration permissions, Defender unified RBAC now also supports protection-related Exchange Online permissions. To learn more about the supported Exchange Online permissions, see Exchange Online permissions mapping.

September 2023 2

August 2023 2

August 2023

Default intra-organizational protection

By default, messages sent between internal users that are identified as high confidence phishing are quarantined. Admins change this setting in the default anti-spam policy or in custom policies (opt-out of intra-org protection or include other spam filtering verdicts). For configuration information,…

August 2023

If the User reported settings in the organization send user reported messages (email and Microsoft Teams) to Microsoft

If the User reported settings in the organization send user reported messages (email and Microsoft Teams) to Microsoft (exclusively or in addition to the reporting mailbox), we now do the same checks as when admins submit messages to Microsoft for analysis from…

July 2023 2

July 2023

Use anti-phishing policies to control what happens to messages where the sender fails explicit DMARC checks…

Use anti-phishing policies to control what happens to messages where the sender fails explicit DMARC checks and the DMARC policy is set to p=quarantine or p=reject.

July 2023

User tagsare now fully integrated with Defender for Office 365 reports, including

User tagsare now fully integrated with Defender for Office 365 reports, including: Threat protection status report Compromised users report Top senders and recipients report URL protection report

May 2023 1

May 2023

Built-in reporting in Outlook on the web supports reporting messages from shared mailboxes or other mailboxes by a delegate

Shared mailboxes require Send As or Send On Behalf permission for the user. Other mailboxes require Send As or Send On Behalf permission and Read and Manage permissions for the delegate.

April 2023 2

April 2023

Using machine learning to drive more effective simulations in Attack Simulation and Training

Using machine learning to drive more effective simulations in Attack Simulation and Training: Make use of intelligent predicted compromise rate (PCR) and Microsoft Defender for Office 365 payload recommendations for utilizing high-quality payloads in your simulation.

March 2023 3

March 2023

Built-in protection: Safe Links time of click protection enabled for email

By default, Microsoft now protects URLs in email messages at time of click as part of this update to Safe Links settings (EnableSafeLinksForEmail) within the Built-in protection preset security policy. To learn about the specific Safe Links protections in the Built-in protection…

March 2023

Collaboration security for Microsoft Teams

With the increased use of collaboration tools like Microsoft Teams, the possibility of malicious attacks using URLs and messages has increased as well. Microsoft Defender for Office 365 is extending its Safe Links protection with increased capabilities for zero-hour auto purge (ZAP),…

March 2023

Quarantine notifications enabled in preset security policies

If your organization enabled or will enable the Standard or Strict preset security policies, the policies are automatically updated to use the new DefaultFullAccessWithNotificationPolicy quarantine policy (notifications enabled) wherever the DefaultFullAccessPolicy (notifications disabled) was used. To learn more about quarantine notifications, see…

January 2023 3

January 2023

Automatic Tenant Allow/Block List expiration management is now available in Microsoft Defender for Office 365

Microsoft now automatically removes allow entries from the Tenant Allow/Block List once the system has learned from it. Alternatively, Microsoft extends the expiration time of the allow entries if the system hasn't learned yet. This behavior prevents legitimate email from going to…

January 2023

Configuring non-Microsoft phishing simulations in Advanced Delivery

We expanded "Simulation URLs to allow" limit to 30 URLs. To learn how to configure, see Configure the delivery of non-Microsoft phishing simulations to users and unfiltered messages to SecOps mailboxes

January 2023

Enhanced user telemetry in the simulation reports in Attack Simulation Training: As part of our enhanced user telemetry

Enhanced user telemetry in the simulation reports in Attack Simulation Training: As part of our enhanced user telemetry, administrators can now view more details about how their targeted users are interacting with the phishing payload from phishing simulation campaigns.

December 2022 2

December 2022

The new Microsoft Defender XDR role-based access control (RBAC) model, with support for Microsoft Defender for Office

The new Microsoft Defender XDR role-based access control (RBAC) model, with support for Microsoft Defender for Office, is now available in public preview.

October 2022 3

October 2022

Enhancement in URL click alerts

With the new lookback scenario, the "A potentially malicious URL click was detected" alert now includes any clicks during the past 48 hours (for email) from the time the malicious URL verdict is identified.

October 2022

Manage allows and blocks in the Tenant Allow/Block List: With allow expiry management (currently in Private Preview)

Customers in government cloud environments are now able to create allow and block entries for URLs and file attachments in the Tenant Allow/Block List using admin submissions for URLs and email attachments. The data submitted through the submissions experience doesn't leave the…

September 2022 12

September 2022

Anti-spoofing enhancement for internal domains and senders

For spoofing protection, the allowed senders or domains defined in the anti-spam policy and within user allowlists must now pass email authentication for the allowed messages to be honored. The change only affects messages that are considered to be internal (the sender…

September 2022

Automatic redirection from Office 365 Security & Compliance Center to Microsoft Defender portal

Automatic redirection begins for users accessing the security solutions in Office 365 Security & Compliance center (protection.office.com) to the appropriate solutions in Microsoft Defender portal (security.microsoft.com). This change is for all security workflows like (for example, Alerts, Threat Management, and Reports). Redirection…

September 2022

Automatic redirection from Office action center to unified action center

The action center in the Email & Collaboration section Email & collaboration > Review > Action centerhttps://security.microsoft.com/threatincidents is automatically redirected to Actions & Submissions > Action center > Historyhttps://security.microsoft.com/action-center/history.

September 2022

Built-in protection

A profile that enables a base level of Safe Links and Safe Attachments protection that's on by default for all Defender for Office 365 customers. To learn more about this new policy and order of precedence, see Preset security policies. To learn…

September 2022

Bulk Complaint Level

is now available in the EmailEvents table in Advanced Hunting with numeric BCL values from 0 to 9. A higher BCL score indicates that bulk message is more likely to generate complaints and is more likely to be spam.

September 2022

Global Administrators^\*^ and Security Administrators can turn on or off redirection…

Important ^\*^ Microsoft strongly advocates for the principle of least privilege. Assigning accounts only the minimum permissions necessary to perform their tasks helps reduce security risks and strengthens your organization's overall protection. Global Administrator is a highly privileged role that you should…

September 2022

Items in the Office 365 Security & Compliance Center unrelated related to security aren't redirected to…

Items in the Office 365 Security & Compliance Center unrelated related to security aren't redirected to Microsoft Defender XDR. For compliance solutions redirection to Microsoft 365 Compliance Center, see Message Center post 244886.

September 2022

This change impacts all customers who use the Office 365 Security & Compliance Center (protection.office.com)

This change impacts all customers who use the Office 365 Security & Compliance Center (protection.office.com). For example: Microsoft Defender for Office (Plan 1 or Plan 2) Microsoft 365 E3 / E5 Office 365 E3 / E5 For the full list, see Microsoft…

September 2022

This change impacts all users who sign in to the Office 365 Security and Compliance portal (protection.office.com)

This change impacts all users who sign in to the Office 365 Security and Compliance portal (protection.office.com), including security teams and end-users who access the Email Quarantine experience, at the Microsoft Defender Portal > Review > Quarantine.

July 2022 1

June 2022 7

June 2022

Configurable impersonation protection custom users and domains and increased scope within Preset policies

Configure impersonation protection settings for custom users and custom domains within Preset Strict/Standard policies and automatically protect your targeted users and targeted domain against impersonation attacks.

June 2022

Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365

Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365: Introducing GCC, GCC-H, and DoD availability of differentiated protection for priority accounts.

June 2022

Simplifying the quarantine experience (part two) in Microsoft Defender XDR for office 365

Simplifying the quarantine experience (part two) in Microsoft Defender XDR for office 365: Highlights additional features to make the quarantine experience even easier to use.

April 2022 3

April 2022

Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365

Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365: Introducing the general availability of differentiated protection for priority accounts.

April 2022

Introducing the URLClickEvents table in Microsoft Defender XDR Advanced Hunting

Introducing the URLClickEvents table in Microsoft Defender XDR Advanced Hunting: Introducing the UrlClickEvents table in advanced hunting with Microsoft Defender for Office 365.

April 2022

Manual email remediation enhancements: Bringing manual email purge actions taken in Microsoft Defender…

Manual email remediation enhancements: Bringing manual email purge actions taken in Microsoft Defender for Office 365 to the Microsoft Defender XDR (M365D) unified Action Center using a new action-focused investigation.

March 2022 1

January 2022 1

January 2022

Updated Hunting and Investigation Experiences for Microsoft Defender for Office 365

Updated Hunting and Investigation Experiences for Microsoft Defender for Office 365: Introducing the email summary panel for experiences in Defender for Office 365, along with experience updates for Threat Explorer and Real-time detections.

October 2021 2

September 2021 3

September 2021

Quarantine policies: Admins can configure granular control for recipient access to quarantined messages…

Video of admin experience Video of end-user experience Other new capabilities coming to the quarantine experience are described in this blog post: Simplifying the Quarantine experience.

August 2021 2

August 2021

Add allow entries to the Tenant Allow/Block List if the blocked message was submitted as part of the admin submission process

Depending on the nature of the block, the submitted URL, file, and/or sender allow entries are added to the Tenant Allow/Block List. In most cases, the allows entries are added to give the system some time and allow it naturally, if warranted.…

August 2021

Admin review for reported messages: Admins can now send templated messages back to end users after they review reported messages

The templates can be customized for your organization and based on your admin's verdict as well.

July 2021 6

July 2021

Advanced Delivery: Introducing a new capability…

Advanced Delivery: Introducing a new capability for configuring the delivery of non-Microsoft phishing simulations to users and unfiltered messages to security operation mailboxes.

July 2021

New alert policies for the following scenarios: compromised mailboxes, Forms phishing

New alert policies for the following scenarios: compromised mailboxes, Forms phishing, malicious mails delivered due to overrides and rounding out ZAP Suspicious email forwarding activity User restricted from sharing forms and collecting responses Form blocked due to potential phishing attempt Form flagged…

July 2021

User Tagsare now integrated into Microsoft Defender for Office 365 alerting experiences, including

Tags are also available in the unified alerts queue in the Microsoft Defender portal (Microsoft Defender for Office 365 Plan 2)

June 2021 1

June 2021

New first contact safety tip setting within anti-phishing policies

This safety tip is shown when recipients first receive an email from a sender or don't often receive email from a sender.

Source: Microsoft's documentation (Microsoft Learn and the open-source docs on GitHub). Texts are Microsoft's, in English. "New" means: appeared in the last 14 days. Microsoft may change features and dates.