New and upcoming features for Intune, Entra, Teams, Defender (XDR, Endpoint, Office 365), Purview and Microsoft 365 Copilot in one place, straight from Microsoft's documentation. Updated every 4 hours.
The Intune Policy Configuration Agent will update to use a Microsoft Entra agentic identity instead of a human user identity. This enables the agent to run policy configuration actions securely and independently. For existing agents, admins will be able to transition to…
The Intune Policy Configuration Agent will update to use a Microsoft Entra agentic identity instead of a human user identity. This enables the agent to run policy configuration actions securely and independently.
For existing agents, admins will be able to transition to an agentic identity from the agent's Settings tab by selecting Create new identity. After the identity is provisioned, the agent will now run on behalf of the logged-in user and the information will be scoped by the permissions of that account. For new agents, an agentic identity will be auto provisioned at setup.
A new capability for Windows Autopilot device preparation will be available soon: device association. Device association binds a Windows device to your organization and enables advanced functionality such as streamlined out-of-box experience (OOBE) pages, device naming before enrollment, and device-based targeting. It…
A new capability for Windows Autopilot device preparation will be available soon: device association. Device association binds a Windows device to your organization and enables advanced functionality such as streamlined out-of-box experience (OOBE) pages, device naming before enrollment, and device-based targeting. It also improves onboarding security by verifying device identity before enrollment through hardware-based attestation and TPM-backed cryptographic validation, helping ensure that only trusted devices can access organizational resources.
You'll be able to configure Microsoft Defender for Endpoint to open automatically during out-of-box setup for supported corporate-owned Android Enterprise devices. After you configure the Defender for Endpoint connector, turn on Grant MTD role permissions, and assign the Defender app as required,…
You'll be able to configure Microsoft Defender for Endpoint to open automatically during out-of-box setup for supported corporate-owned Android Enterprise devices. After you configure the Defender for Endpoint connector, turn on Grant MTD role permissions, and assign the Defender app as required, you'll enable this experience from Endpoint security > Defender for Endpoint. Intune will open Defender during enrollment so users can complete its initial configuration as part of device setup. If configuration isn't completed, the Intune setup step will remain available so users can open Defender again. This experience will help ensure that Defender is configured before enrollment finishes.
You'll be able to use Microsoft Intune bulk device actions to activate eSIMs on up to 100 supported corporate-owned Android Enterprise devices running Android 15 or later by using a carrier activation server URL. When you bulk wipe supported devices, Intune will…
You'll be able to use Microsoft Intune bulk device actions to activate eSIMs on up to 100 supported corporate-owned Android Enterprise devices running Android 15 or later by using a carrier activation server URL. When you bulk wipe supported devices, Intune will preserve eSIM data plans by default, and you'll be able to choose to remove them when needed. These bulk actions will help you deploy or retire devices more efficiently without configuring each device individually. Personally owned Android Enterprise work profile devices won't be supported.
The Certificate Connector for Microsoft Intune will surface new health and status signals in the admin center, so you can spot certificate-issuance problems early. You'll get clear indicators for common failure conditions — such as the connector being unable to reach the…
The Certificate Connector for Microsoft Intune will surface new health and status signals in the admin center, so you can spot certificate-issuance problems early. You'll get clear indicators for common failure conditions — such as the connector being unable to reach the certification authority (CA), the connector's service account lacking permission to issue or revoke certificates, or certificate requests being rejected because of a template mismatch with your SCEP or PKCS profile. Each signal includes guidance to help you investigate and remediate before devices relying on certificate-based authentication hit access, sign-in, or compliance issues.
Microsoft Intune will introduce client-driven compliance evaluation for Windows devices to reduce delays in compliance reporting. Supported devices will detect important state changes locally and proactively request a compliance re-evaluation when it matters, instead of waiting for the next scheduled check-in. As…
Microsoft Intune will introduce client-driven compliance evaluation for Windows devices to reduce delays in compliance reporting. Supported devices will detect important state changes locally and proactively request a compliance re-evaluation when it matters, instead of waiting for the next scheduled check-in. As an admin, you'll see faster updates for remediation, reporting, and access decisions. This capability will roll out in preview for Windows devices.
Windows Autopatch currently offers limited control over the deployment of quality updates. Today, the expedite mechanism focuses on deploying the latest security update and doesn't let admins select specific quality update releases or apply different deployment schedules, which can limit compliance, validation,…
Windows Autopatch currently offers limited control over the deployment of quality updates. Today, the expedite mechanism focuses on deploying the latest security update and doesn't let admins select specific quality update releases or apply different deployment schedules, which can limit compliance, validation, and operational planning scenarios.
Soon, Windows Autopatch will let you explicitly approve, auto-approve, reject, and schedule quality updates by update type, using the same approval infrastructure used for driver updates. This unified model helps you control what content is deployed and when, so you can align rollout timing with testing, compliance, and business readiness requirements. You'll be able to independently manage:
The iOS/iPadOS Company Portal will support Declarative Volume-Purchased Program (VPP) app downloads from the Apps tab. Declarative VPP apps provide an improved end-user experience by reducing app installation latency, allowing for automatic overnight app updates, and providing the end user with a…
The iOS/iPadOS Company Portal will support Declarative Volume-Purchased Program (VPP) app downloads from the Apps tab. Declarative VPP apps provide an improved end-user experience by reducing app installation latency, allowing for automatic overnight app updates, and providing the end user with a live status of an app installation. If you choose not to use Declarative VPP apps, there will be no changes to the admin and user experience.
Advanced Analytics will extend device query for multiple devices to cover app inventory data on Windows. Building on the existing multi-device query for hardware inventory, you'll be able to use Kusto Query Language (KQL) to investigate installed applications across your entire Windows…
Advanced Analytics will extend device query for multiple devices to cover app inventory data on Windows. Building on the existing multi-device query for hardware inventory, you'll be able to use Kusto Query Language (KQL) to investigate installed applications across your entire Windows fleet—identifying versions, surfacing outdated or unwanted software, and producing detailed reports without targeting devices one at a time. Multi-device app inventory queries will run against collected inventory data, so you get fleet-wide answers for compliance reviews, vulnerability triage, and license-tracking scenarios.
On macOS devices, the Disable MAC address randomization setting will be available for Wi-Fi profiles. Use this setting to disable MAC address randomization on managed macOS devices. When connecting to a network, devices can present a randomized MAC address instead of the…
On macOS devices, the Disable MAC address randomization setting will be available for Wi-Fi profiles. Use this setting to disable MAC address randomization on managed macOS devices.
When connecting to a network, devices can present a randomized MAC address instead of the physical MAC address. Using randomized MAC addresses is recommended for privacy, as it's harder to track a device by its MAC address. However, randomized MAC addresses break functionality that relies on a static MAC address, including network access control (NAC).
Microsoft Intune will support Apple's Enforce Routes feature in iOS/iPadOS and macOS VPN profiles. This feature helps prevent situations where VPN traffic accidentally or maliciously goes outside the VPN tunnel, like what happens with de-cloaking risks. It ensures VPN routing aligns with…
Microsoft Intune will support Apple's Enforce Routes feature in iOS/iPadOS and macOS VPN profiles.
This feature helps prevent situations where VPN traffic accidentally or maliciously goes outside the VPN tunnel, like what happens with de-cloaking risks. It ensures VPN routing aligns with Apple's platform semantics.
When you configure this feature in Intune, routing behavior is defined using Include all networks and Exclude local networks settings. Intune automatically derives the appropriate Enforce Routes configuration based on these selections to ensure consistent and predictable device behavior.
Automatically mark Windows devices as noncompliant when prohibited local AI agents, such as OpenClaw, are discovered on the device. As an admin, you'll be able to configure a list of prohibited agents in a Windows compliance policy. When a prohibited agent is…
Automatically mark Windows devices as noncompliant when prohibited local AI agents, such as OpenClaw, are discovered on the device. As an admin, you'll be able to configure a list of prohibited agents in a Windows compliance policy. When a prohibited agent is detected, the device reports as noncompliant and Conditional Access takes effect. The device returns to a compliant state once the agent is removed.
Microsoft Intune will add new Apple settings for supported iOS/iPadOS and macOS devices. You'll be able to configure the new options by using Settings Catalog profiles in the Microsoft Intune admin center. These settings will expand the device management controls available through…
Microsoft Intune will add new Apple settings for supported iOS/iPadOS and macOS devices. You'll be able to configure the new options by using Settings Catalog profiles in the Microsoft Intune admin center. These settings will expand the device management controls available through Intune and help you manage Apple devices with a consistent policy workflow. To see these settings, go to Devices > Manage devices > Configuration > Create > New policy > iOS/iPadOS or macOS for platform > Settings catalog for profile type.
We're adding a new Microsoft Defender Updates template for Linux endpoint security antivirus policies. This template will include four new settings for managing Microsoft Defender for Endpoint agent auto-update behavior on Linux devices attached via MDE attach. You will be able to…
We're adding a new Microsoft Defender Updates template for Linux endpoint security antivirus policies. This template will include four new settings for managing Microsoft Defender for Endpoint agent auto-update behavior on Linux devices attached via MDE attach. You will be able to configure update channels and scheduling for Defender engine, platform, and security intelligence updates.
You'll be able to use Remote Help in US Government Community Cloud High (GCCH) environments. This expansion extends the same secure, cloud-based remote assistance capabilities currently available in GCC to GCCH tenants. IT support staff will be able to establish Remote Help…
You'll be able to use Remote Help in US Government Community Cloud High (GCCH) environments. This expansion extends the same secure, cloud-based remote assistance capabilities currently available in GCC to GCCH tenants. IT support staff will be able to establish Remote Help sessions with end users on GCCH-enrolled devices, providing real-time troubleshooting with role-based access controls through Intune. Both helpers and sharers must sign in with their organization's Microsoft Entra ID accounts.
For Android Enterprise dedicated devices using Managed Home Screen (MHS) with Microsoft Entra shared device mode, Intune will allow admins to requiring users to complete MHS authentication state before allowing protected activities in MAM-integrated apps. When MHS requires sign-in or session PIN…
For Android Enterprise dedicated devices using Managed Home Screen (MHS) with Microsoft Entra shared device mode, Intune will allow admins to requiring users to complete MHS authentication state before allowing protected activities in MAM-integrated apps. When MHS requires sign-in or session PIN authentication, users will still be able to complete limited actions, such as accepting or declining incoming calls. If a user tries to open another protected activity, the app will return them to MHS to authenticate. After authentication, protected app activities will become available normally. This behavior will help prevent users from bypassing the MHS session PIN while preserving critical communication actions.
We're fixing how scope tags work with Endpoint Privilege Management (EPM) reports. With this change, EPM reports will respect the report viewer's assigned scope and display the details for only the users and devices that the report user is scoped to view.
We're fixing how scope tags work with Endpoint Privilege Management (EPM) reports. With this change, EPM reports will respect the report viewer's assigned scope and display the details for only the users and devices that the report user is scoped to view.
The Scoped permissions setting for role-based access control (RBAC) will move from public preview to general availability. Scoped permissions prevents Intune from merging permissions across multiple role assignments that share the same permission category but use different scope tags. When enabled, each…
The Scoped permissions setting for role-based access control (RBAC) will move from public preview to general availability. Scoped permissions prevents Intune from merging permissions across multiple role assignments that share the same permission category but use different scope tags. When enabled, each role assignment's permissions apply only within its own scope tag context, giving admins exactly the access you intended.
When this feature reaches general availability, Scoped permissions will become the default behavior for all tenants.
If you haven't enabled Scoped permissions yet, use the Permissions Assessment Report at Tenant administration > Roles > Settings to preview how permissions will change before opting in.
Deployments and Deployments plans will give you a new way to roll out apps and configuration policies in Intune. Instead of assigning to all targeted groups at once, you'll be able to stage a rollout across multiple rings, control the timing of…
Deployments and Deployments plans will give you a new way to roll out apps and configuration policies in Intune. Instead of assigning to all targeted groups at once, you'll be able to stage a rollout across multiple rings, control the timing of each ring, and monitor progress from a new Deployments experience in the Intune admin center. Plans provide reusable templates that define standardized rollout patterns for delivering a payload across devices in controlled stages, or rings. Deployments integrate with Multiple Admin Approval for change control. This helps you reduce risk when introducing changes to large device fleets.
You'll be able to use the endpoint security policy for Device control (Attack surface reduction policy) from Microsoft Intune with the devices you manage through the Microsoft Defender for Endpoint security settings management capability. Device control policies are part of endpoint security…
Applies to the following when you use the Windows platform:
Windows 10
Windows 11
When this change takes effect, devices that are assigned this policy while managed by Defender for Endpoint but not enrolled with Intune, will now apply the settings from the policy. Check your policy to make sure only the devices you intend to receive this policy will get it.
Microsoft Intune will update its minimum supported operating-system version after Apple releases iOS and iPadOS 27. Intune device management, the Company Portal, and app protection policies will require iOS/iPadOS 18 or later for standard supported scenarios. You'll be able to use Intune…
Microsoft Intune will update its minimum supported operating-system version after Apple releases iOS and iPadOS 27. Intune device management, the Company Portal, and app protection policies will require iOS/iPadOS 18 or later for standard supported scenarios. You'll be able to use Intune reports to identify affected devices and users and plan operating-system upgrades before the change. Userless devices enrolled through Automated Device Enrollment have a separate support statement and should be evaluated using the applicable guidance.
Microsoft Intune will update its minimum supported macOS version after Apple releases macOS 27. Intune, the Company Portal, and the Intune management agent will support macOS 15 and later. Devices running macOS 14 or earlier that are already enrolled will remain enrolled,…
Microsoft Intune will update its minimum supported macOS version after Apple releases macOS 27. Intune, the Company Portal, and the Intune management agent will support macOS 15 and later. Devices running macOS 14 or earlier that are already enrolled will remain enrolled, but new devices on those versions won't be able to enroll. You'll be able to use Intune reporting to identify affected devices and plan upgrades. Devices enrolled without user affinity have a separate support statement.
The new report provides SharePoint Advanced Management admins complete item-level details of permissions granted to special SharePoint groups: Everyone and Everyone except external users. Roadmap ID: 561038 Details: What changed: The SharePoint Admin Center now includes a detailed report that shows item-level…
The new report provides SharePoint Advanced Management admins complete item-level details of permissions granted to special SharePoint groups: Everyone and Everyone except external users.
What changed: The SharePoint Admin Center now includes a detailed report that shows item-level permissions for special SharePoint groups: Everyone and Everyone except external users. Previously, admins had limited visibility into these item-level permissions. This report helps identify exactly which items have these special SharePoint groups as recipients, improving permission auditing and security management.
Why: Admins need precise visibility into permissions granted to broad groups to manage access risks effectively.
This report enables admins to:
Audit permissions at a granular level
Detect unintended access
Enhance security compliance
Try this:
Open the SharePoint Admin Center and navigate to Advanced Management > All features > Data access governance reports.
Select the new report 'Sites and files shared via special SharePoint group' and trigger the relevant report.
Export the prepared report and review item-level permission details.
Why this matters: Detailed permission reports help prevent unauthorized access and support compliance with organizational security policies.
Business impact: Teams can better manage SharePoint permissions, reducing security risks and simplifying audits.
Personal impact: Admins save time identifying and resolving permission issues with clearer, item-level insights.
Deeper insights into Cowork adoption and impact, accessible from Copilot dashboard and Consumption dashboard in the Microsoft 365 services tab. Includes export capability. All metrics can be queried by analysts with the new Consumption query (credit usage data) and through the Person…
Deeper insights into Cowork adoption and impact, accessible from Copilot dashboard and Consumption dashboard in the Microsoft 365 services tab. Includes export capability. All metrics can be queried by analysts with the new Consumption query (credit usage data) and through the Person query (Cowork usage data) in advanced insights.
What changed: The Consumption dashboard and Copilot dashboard now include expanded metrics on Cowork adoption and its impact. Analysts can export data and use the new Consumption query in advanced insights to explore all metrics. Previously, such detailed analytics and export options were unavailable.
Why: Providing deeper, exportable insights enables data-driven decisions about AI usage and investment, improving transparency and cost management.
Try this:
Open the Copilot dashboard in Copilot analytics.
Navigate to the Consumption dashboard > Microsoft 365 Services tab to view Cowork metrics.
Use the export option or run the Consumption query or Person query including Cowork usage metrics in advanced insights for detailed analysis.
Why this matters: Better visibility into AI adoption helps organizations optimize usage and understand its business impact.
Business impact: Teams gain actionable data to manage AI resource allocation and measure productivity improvements.
Personal impact: You can analyze Cowork usage trends and costs more effectively, supporting informed decision-making.
Details: What changed: Copilot now supports user defined custom skills, allowing users to extend its capabilities with personalized commands and workflows in PowerPoint. Previously, Copilot operated only with built-in skills and predefined functions in PowerPoint. This update enables customization within Microsoft 365…
Create custom skills in Copilot in PowerPoint for tailored workflows for your specific presentation needs.
Details:
What changed: Copilot now supports user defined custom skills, allowing users to extend its capabilities with personalized commands and workflows in PowerPoint. Previously, Copilot operated only with built-in skills and predefined functions in PowerPoint. This update enables customization within Microsoft 365 security and compliance standards.
Why: Users need more flexibility to automate unique presentation tasks and workflows. Custom skills let users:
Define specific commands suited to their content style.
Automate repetitive or specialized tasks.
Enhance productivity by tailoring Copilot to their needs.
Try this:
Open PowerPoint and access the Copilot pane.
Select 'Create custom skill' to define new commands.
Test your custom skill within your presentation workflow.
Why this matters: Custom skills let users personalize Copilot to match their unique presentation workflows, reducing manual effort.
Business impact: Teams can standardize and automate specialized presentation tasks, improving consistency and efficiency.
Personal impact: You save time by automating repetitive tasks and gain more control over Copilot’s assistance.
Admins can now edit query string and user identity mapping rules directly in connector settings without opening a support ticket. Details: What changed: Query string parameters and user identity mapping rules are now editable after a connection is created. Admins can update…
Admins can now edit query string and user identity mapping rules directly in connector settings without opening a support ticket.
Details:
What changed: Query string parameters and user identity mapping rules are now editable after a connection is created. Admins can update them in the Microsoft 365 admin center under Settings > Search & intelligence > Data sources, then select the connection and edit its configuration. Previously, these values were fixed at connection setup and changing them required support intervention.
Why: Source systems change, teams re-scope projects, filters need tightening, and identity mappings drift as directory attributes are updated. Locking these rules at setup meant every adjustment became a support request, leaving connections stale or over-scoped in the interim.
Try this:
Go to the Microsoft 365 admin center > Settings > Search & intelligence > Data sources.
Select your connection (for example, Azure DevOps or ServiceNow) and open its configuration.
Update the query string or user identity mapping rule and save.
Confirm the change took effect on the next crawl and spot-check results for an affected user.
Why this matters: Access scope and content scope are now self-serve. Admins can correct a mis-scoped connection or a broken identity mapping in minutes instead of waiting on a support cycle.
Business impact: Faster remediation when a connection surfaces content to the wrong audience, fewer support tickets per connection, and configuration that keeps pace with changes in the source system—all of which support access-governance and compliance commitments.
Personal impact: You fix scoping and permission-mapping issues yourself, on your own schedule, instead of filing a ticket and waiting for someone else to make a change.
You can now reference files saved in SharePoint libraries and OneDrive folders when creating a presentation with Copilot in PowerPoint. Roadmap ID: 555897 Details: What changed: Copilot in PowerPoint can now recognize references to files stored in SharePoint and OneDrive when you…
You can now reference files saved in SharePoint libraries and OneDrive folders when creating a presentation with Copilot in PowerPoint.
What changed: Copilot in PowerPoint can now recognize references to files stored in SharePoint and OneDrive when you mention them in your prompt, such as by file or document name. Previously, these implicit file references were not supported for files stored in these locations. This update makes it easier to use relevant Microsoft 365 content without manually attaching or uploading the file.
Why: This change makes it easier to create presentations using content you already have in Microsoft 365. You can naturally reference a relevant file in your prompt, and Copilot can use that file as context when creating your presentation.
Try this:
Open PowerPoint and start creating a presentation with Copilot.
In your prompt, reference a file saved in SharePoint or OneDrive by the document name and/or owner of the document.
Ask Copilot to create a presentation using information from that file. For example: “Create a presentation summarizing the key findings from the DOCUMENT NAME.”
Why this matters: You can bring existing SharePoint and OneDrive content into your presentation workflow more naturally, without first locating the file and manually attaching it.
Business impact: Teams can create presentations faster by integrating cloud-stored resources without switching apps or manually uploading files.
Personal impact: You save time locating and incorporating relevant files, reducing friction in presentation creation.
The Regenerate action lets you quickly get an alternative response to your latest prompt using options like Try Again or Switch Model, helping you explore different answers and improve output quality. Details: What changed: Previously, users had to re-enter prompts to get…
The Regenerate action lets you quickly get an alternative response to your latest prompt using options like Try Again or Switch Model, helping you explore different answers and improve output quality.
Details:
What changed: Previously, users had to re-enter prompts to get different responses from Copilot. Now, the Regenerate action provides simple buttons to request alternative answers or switch AI models without starting over. This streamlines refining outputs and exploring variations.
Why: This change reduces friction when iterating on AI-generated content, enabling faster exploration of ideas and improved response quality.
Try this:
Enter a prompt in Microsoft 365 Copilot Chat.
At the end of Copilot's response, open the "More options" menu.
Select 'Try Again' to get a new response.
Choose 'Switch Model' to see answers from a different AI model.
Why this matters: Quickly generating alternative responses helps users find the best information or phrasing without repeating input steps.
Business impact: Teams can iterate on AI-generated content more efficiently, improving decision-making and content creation speed.
Personal impact: You save time by refining outputs with fewer steps and can explore more options easily.
Microsoft 365 Chat brings the power of conversational AI directly into Microsoft 365 Copilot Search, enabling users to move effortlessly from finding information to acting on it. Search results become the foundation for contextual chat, allowing you to ask follow-up questions, synthesize…
Microsoft 365 Chat brings the power of conversational AI directly into Microsoft 365 Copilot Search, enabling users to move effortlessly from finding information to acting on it. Search results become the foundation for contextual chat, allowing you to ask follow-up questions, synthesize insights, and generate content—all in one unified experience. This integration reduces workflow fragmentation, accelerates decision-making, and delivers a more intuitive way to interact with your organization’s knowledge.
What changed: Microsoft 365 Copilot Search now embeds conversational AI chat directly within search results. Previously, users had to switch between search and chat tools separately. This update allows follow-up questions, insight synthesis, and content generation based on search context in a unified interface, reducing workflow fragmentation.
Why: Integrating chat with search streamlines user interaction with organizational knowledge, accelerating decision-making and reducing the need to switch tools.
Try this:
Open Microsoft 365 Copilot Search.
Enter a query and review the search results.
Use the chat pane to ask follow-up questions or generate content based on the results.
Why this matters: This integration simplifies workflows by combining search and chat, helping users act on information faster.
Business impact: Teams experience faster decision cycles and less disruption from switching between search and chat applications.
Personal impact: You save time by accessing search results and conversational AI in one place, reducing task switching.
Users can report scheduled or Meet now Microsoft Teams meetings or individual meeting participants as a security concern during or after the meeting. Users can also report a meeting participant that was incorrectly identified as suspicious as not a security concern. Depending…
Users can report scheduled or Meet now Microsoft Teams meetings or individual meeting participants as a security concern during or after the meeting. Users can also report a meeting participant that was incorrectly identified as suspicious as not a security concern. Depending on Teams user reported settings, reported meeting and participant metadata is sent to the specified reporting mailbox, to Microsoft, or both.
Users can now sort Outlook Mail results by date in ascending or descending order within Copilot Search. Details: What changed: Copilot Search now includes a "Sort by" filter for Outlook Mail results, allowing sorting by date in both ascending and descending order.…
Users can now sort Outlook Mail results by date in ascending or descending order within Copilot Search.
Details:
What changed: Copilot Search now includes a "Sort by" filter for Outlook Mail results, allowing sorting by date in both ascending and descending order. Previously, search results were presented without sorting options, limiting users' ability to organize emails by date. This update improves result relevance and user control over mail searches.
Why: Sorting mail results by date helps users quickly find recent or older emails, improving efficiency in managing Outlook Mail through Copilot Search.
Try this:
Open Copilot Search and enter your query.
Select the "Sort by" filter above the Outlook Mail results.
Choose ascending or descending date order to reorder the emails.
Why this matters: Sorting mail results by date saves time and reduces effort when locating specific emails in large mailboxes.
Business impact: Teams can respond faster by locating relevant emails without manually scanning unsorted search results.
Personal impact: You spend less time searching through emails and more time focusing on important messages.
Users can quickly add references to a Copilot Notebook through the Quick Access section in Search on the Microsoft Copilot app. Roadmap ID: 510099 Details: What changed: Users can now add references directly to their Copilot Notebooks from the Quick Access section…
Users can quickly add references to a Copilot Notebook through the Quick Access section in Search on the Microsoft Copilot app.
What changed: Users can now add references directly to their Copilot Notebooks from the Quick Access section in Search on the Microsoft Copilot app. Previously, adding references required navigating through multiple menus within the notebook interface. This update streamlines the process by enabling users to open the context menu (…) next to an item and select Add to > Notebook to save the reference.
Why: This change reduces the steps needed to organize important information, making it faster to collect and manage references in Copilot Notebooks. It improves user efficiency by integrating notebook management into the search experience.
Try this:
Open the Microsoft Copilot app and go to Search.
In the Quick Access section, click the context menu (…) next to an item.
Select Add to > Notebook and choose the desired Copilot Notebook.
Why this matters: Simplifying how users add references helps them keep their notebooks organized and accessible without disrupting their workflow.
Business impact: Teams can capture and share relevant information more efficiently, improving collaboration and knowledge management.
Personal impact: You save time by adding references to notebooks directly from search results, reducing the need to switch between app sections.
Microsoft 365 Copilot now supports more natural language triage actions in Outlook, including deleting, moving, copying, categorizing messages, and managing inbox rules and folders with confirmation prompts for bulk or mailbox changes. Details: What changed: Building on existing triage commands like pin…
Microsoft 365 Copilot now supports more natural language triage actions in Outlook, including deleting, moving, copying, categorizing messages, and managing inbox rules and folders with confirmation prompts for bulk or mailbox changes.
Details:
What changed: Building on existing triage commands like pin and flag when using Chat with work data in Outlook, users can now delete, move, copy, and categorize emails using natural language. It also supports creating, managing rules, and creating folders. Copilot requests confirmation before acting on more than five emails or making changes to inbox rules. These features work across Classic and New Outlook for Windows, Outlook on the web, Outlook for Mac, and Outlook mobile.
Why: Expanding triage actions allows users to manage their inbox more efficiently at scale, reducing manual effort and improving email organization.
Try this:
Microsoft 365 Copilot Chat in Outlook, type commands such as:
Delete all unread newsletters from last week.
Move emails from Contoso about invoices to my Finance folder.
Why this matters: More triage options in Copilot help users maintain a cleaner, better-organized inbox with less manual work.
Business impact: Teams improve email management efficiency and reduce time spent on repetitive inbox tasks.
Personal impact: You save time and reduce inbox clutter by using natural language to perform complex email management tasks.
The Microsoft Copilot app is now supported on Apple CarPlay for hands-free use. Details: What changed: The Microsoft Copilot app now integrates with Apple CarPlay, allowing users to activate Copilot using voice commands while driving. Previously, Copilot was not accessible through CarPlay,…
The Microsoft Copilot app is now supported on Apple CarPlay for hands-free use.
Details:
What changed: The Microsoft Copilot app now integrates with Apple CarPlay, allowing users to activate Copilot using voice commands while driving. Previously, Copilot was not accessible through CarPlay, requiring manual device interaction. This update enhances safety by enabling hands-free productivity on the go.
Why: Integrating Copilot with CarPlay supports safer driving by minimizing distractions and allows users to prepare for their day or brainstorm ideas without handling their device.
Try this:
Connect your iPhone to Apple CarPlay in your vehicle.
On your CarPlay screen, select Microsoft Copilot.
Say “Hey, Siri, ask Copilot" to start a chat.
Interact with Copilot hands-free to get information or plan tasks.
Why this matters: Hands-free Copilot access while driving improves safety and helps users stay productive during commutes, transforming otherwise idle time into valuable work moments.
Business impact: Teams can maintain productivity while commuting, enabling continuous work and idea generation safely.
Personal impact: You reduce distractions while driving and can efficiently use Copilot during travel.
If your organization blocks the Copilot Chat in the Microsoft 365 Copilot app, you can provide a link to company policy or internal guidance for users who are blocked from accessing Copilot Chat in the Microsoft 365 Copilot app. Details: What changed:…
If your organization blocks the Copilot Chat in the Microsoft 365 Copilot app, you can provide a link to company policy or internal guidance for users who are blocked from accessing Copilot Chat in the Microsoft 365 Copilot app.
Details:
What changed: When the Microsoft 365 Copilot app is blocked by organizational policy, admins can now provide a link to company policy or internal guidance for users who are blocked from accessing Copilot Chat in the Microsoft 365 Copilot app. This update improves communication by providing context and guidance through a customized policy link.
Why: Users often need clarity on access restrictions to avoid confusion and support requests. Providing a link to additional messaging help users understand organizational policies and reduce help desk inquiries.
Try this:
In the Microsoft 365 admin center, navigate to the Copilot app access settings.
Add a link to your internal policy documentation.
Save the settings to apply the link to blocked users.
Why this matters: Clear communication about access restrictions improves user experience and reduces support workload.
Business impact: IT teams can manage user expectations and reduce help desk tickets related to Copilot app access issues.
Personal impact: Users receive clear explanations for access blocks, reducing confusion and frustration.
Understand who is building a habit using Copilot with the new power user insights in Copilot dashboard Roadmap ID: 560705 Details: What changed: The Copilot dashboard in Microsoft Viva Analytics introduces new power user insights. Previously, habit-building data was limited. Now, administrators…
Understand who is building a habit using Copilot with the new power user insights in Copilot dashboard
What changed: The Copilot dashboard in Microsoft Viva Analytics introduces new power user insights. Previously, habit-building data was limited. Now, administrators can identify users with high Copilot engagement to better support adoption and training.
Why: Understanding which users actively use Copilot helps organizations tailor support and measure adoption success more effectively.
Try this:
Open the Microsoft Viva Copilot dashboard.
Navigate to the power user insights section.
Review user engagement metrics to identify active Copilot users.
Why this matters: Identifying power users enables targeted training and support to increase overall Copilot adoption.
Business impact: Teams gain visibility into Copilot usage patterns, improving change management and user enablement strategies.
Personal impact: You can focus training efforts on users who will benefit most, accelerating Copilot proficiency.
We're upgrading our topic assignment pipeline to be powered by Copilot, delivering significantly improved accuracy in categorizing survey comments into relevant topics. Roadmap ID: 553224 Details: What changed: The topic assignment pipeline in Viva Glint now uses Copilot to categorize survey comments…
We're upgrading our topic assignment pipeline to be powered by Copilot, delivering significantly improved accuracy in categorizing survey comments into relevant topics.
What changed: The topic assignment pipeline in Viva Glint now uses Copilot to categorize survey comments more accurately. Five new topics—Psychological Safety, Artificial Intelligence, Privacy & Data Use, Hybrid Work, and Ethics—are added to the taxonomy. This feature is controlled by the existing Glint Copilot VFAM toggle and applies only to ad-hoc and recurring surveys at launch.
Why: Enhancing topic assignment with Copilot increases the precision of feedback categorization, helping organizations better understand employee sentiments. Adding new topics reflects evolving workplace priorities and ensures more relevant analysis.
Try this:
Verify that the Glint Copilot VFAM toggle is enabled for your entire organization.
Launch an ad-hoc or recurring survey to collect employee feedback.
Review the assigned topics in survey results, including the new topic categories.
Why this matters: Accurate topic assignment helps teams identify and address key employee concerns more effectively.
Business impact: Teams gain clearer insights from survey feedback, enabling more targeted action plans and improved employee engagement strategies.
Personal impact: You receive more relevant feedback categorizations, reducing manual review time and improving focus on critical issues.
The Copilot chat pane is now built into Microsoft Forms, helping users improve forms and quizzes, draft and send invitations, and analyze responses. Available to Microsoft 365 Copilot licensed business users through the Copilot icon in Forms. Roadmap ID: 553136 Details: What…
The Copilot chat pane is now built into Microsoft Forms, helping users improve forms and quizzes, draft and send invitations, and analyze responses. Available to Microsoft 365 Copilot licensed business users through the Copilot icon in Forms.
What changed: Microsoft Forms now includes the Copilot chat pane with Forms-specific capabilities for recommending improvements, drafting invitations, and analyzing results. Previously, these tasks required manual effort without integrated Copilot support. Available to Microsoft 365 Copilot licensed business users through the Copilot icon in Forms.
Why: Integrating Copilot capabilities reduces the time and expertise needed to create, distribute, and analyze forms. This streamlines workflows and improves form quality with AI assistance.
Try this:
Open Microsoft Forms and click the 'Copilot' icon.
Ask Copilot to review and suggest improvements for your form.
Use Copilot to make changes to your form or to draft and send invitations to respondents.
Request analysis of form responses through the chat interface.
Why this matters: This integration simplifies form management by providing AI-powered help directly within Forms, reducing manual tasks.
Business impact: Teams can create higher-quality forms faster and gain insights without switching tools or requiring specialized skills.
Personal impact: You save time on form design, distribution, and analysis by using AI assistance within the familiar Forms interface.
A day level Copilot adoption Power BI report reflecting the most recent copilot activity & freshest insights. Roadmap ID: 561325 Details: What changed: The Copilot usage snapshot report in Microsoft Viva now updates at the day level instead of aggregated periods. This…
A day level Copilot adoption Power BI report reflecting the most recent copilot activity & freshest insights.
What changed: The Copilot usage snapshot report in Microsoft Viva now updates at the day level instead of aggregated periods. This change provides latest visibility into Copilot adoption trends and activity. The report refreshes with the latest data daily, improving accuracy and relevance for decision makers monitoring usage patterns.
Why: More granular daily data helps organizations track Copilot adoption and engagement more precisely. Users can now:
Identify daily usage spikes or drops.
Monitor adoption trends with up-to-date information.
Make timely decisions based on fresh insights.
Try this:
Open the Copilot adoption Power BI report in Microsoft Viva.
Review daily usage metrics and trends.
Use filters to analyze specific time frames or user groups.
Why this matters: Daily data updates enable more responsive management of Copilot adoption and better alignment with organizational goals.
Business impact: Teams gain timely insights to adjust training and support strategies based on current Copilot usage patterns.
Personal impact: You can quickly identify changes in Copilot adoption and respond proactively to organizational needs.
Create user-defined custom skills in Copilot to tailor assistance to your specific presentation needs. Details: What changed: Copilot now supports user-defined custom skills in PowerPoint, allowing users to extend its capabilities with personalized commands and workflows. Previously, Copilot operated only with built-in…
Create user-defined custom skills in Copilot to tailor assistance to your specific presentation needs.
Details:
What changed: Copilot now supports user-defined custom skills in PowerPoint, allowing users to extend its capabilities with personalized commands and workflows. Previously, Copilot operated only with built-in skills and predefined functions. This update enables customization within Microsoft 365 security and compliance standards.
Why: Users need more flexibility to automate unique presentation tasks and workflows. Custom skills let users:
Define specific commands suited to their content style.
Automate repetitive or specialized tasks.
Enhance productivity by tailoring Copilot to their needs.
Try this:
Open PowerPoint and access the Copilot pane.
Select 'Create custom skill' to define new commands.
Test your custom skill within your presentation workflow.
Why this matters: Custom skills let users personalize Copilot to match their unique presentation workflows, reducing manual effort.
Business impact: Teams can standardize and automate specialized presentation tasks, improving consistency and efficiency.
Personal impact: You save time by automating repetitive tasks and gain more control over Copilot’s assistance.
Copilot Cowork helps you delegate complex work by describing the outcome you need. Cowork gathers context from your emails, meetings, chats, files, and business data, works across tools and systems, and returns completed results. Details: What changed: Copilot Cowork introduces a new…
Copilot Cowork helps you delegate complex work by describing the outcome you need. Cowork gathers context from your emails, meetings, chats, files, and business data, works across tools and systems, and returns completed results.
Details:
What changed: Copilot Cowork introduces a new way to get work done: delegate an outcome, not just a task. Cowork can understand your goal, gather the right context from your Microsoft 365 data combined with external sources, coordinate work across tools, and complete multi-step actions with your approval. Work remains grounded in your organization's data and governed by existing Microsoft 365 security, privacy, and compliance controls.
Why: Completing complex work across multiple communication and collaboration tools involves coordinating information from multiple sources, researching context, and completing a series of interconnected steps. Copilot Cowork streamlines this by delivering meaningful outcomes while keeping you informed and in control.
Try this:
Switch from Chat to Cowork in the Copilot app.
Describe the task and outcome you want to achieve, including sources, actions, and deliverables.
Review the plan and progress as Cowork works on your behalf.
Receive completed outputs that are grounded in your organization's work data and reduce manual effort.
Why this matters: Instead of manually coordinating work across emails, meetings, documents, and applications, users can delegate complex work and focus on higher-value decisions.
Business impact: Organizations can accelerate work across teams by reducing time spent coordinating, researching, and executing multi-step processes, improving operational efficiency and consistency.
Personal impact: You save time by delegating tasks without switching between multiple apps, context gathering, and execution needed to deliver results.
Microsoft is announcing the General Availability (GA) of federated Copilot connectors for Microsoft 365 Copilot. Federated Copilot connectors enable users to securely connect Copilot to popular third-party sources and retrieve data in real time using the Model Context Protocol (MCP). These connectors…
Microsoft is announcing the General Availability (GA) of federated Copilot connectors for Microsoft 365 Copilot. Federated Copilot connectors enable users to securely connect Copilot to popular third-party sources and retrieve data in real time using the Model Context Protocol (MCP). These connectors do not store or index customer data in Microsoft services; access occurs in real time using the user’s identity, while administrators retain full governance and control through the Microsoft 365 admin center. With GA, federated Copilot connectors will be supported in Researcher, Microsoft 365 Chat, and when editing with Copilot in Excel, enabling users to bring external data directly into their workflows.
What changed: Federated Copilot connectors now allow Microsoft 365 Copilot users to connect securely to popular third-party data sources in real time using the Model Context Protocol (MCP). Unlike previous methods, these connectors do not store or index customer data in Microsoft services. Administrators maintain full governance and control through the Microsoft 365 admin center. These connectors are supported in Researcher, Microsoft 365 Chat, and when editing with Copilot in Excel.
Why: This change enhances data security and compliance by ensuring customer data remains within third-party environments and is accessed only with user identity and admin oversight.
Try this:
Open Microsoft 365 Chat, Researcher, or when editing with Copilot in Excel.
Select a federated Copilot connector to connect to a third-party data source.
Retrieve and use real-time data within your workflow.
Why this matters: Secure real-time data access without storing sensitive information in Microsoft services reduces compliance risks.
Business impact: Organizations can safely integrate external data into Microsoft 365 workflows while maintaining strict governance controls.
Personal impact: You can access up-to-date third-party data directly in Microsoft 365 apps without additional login steps or data duplication.
Copilot will be able to find meetings based on topics or keywords from relevant data like meeting body, chat, and transcription. The search for meetings based on transcript text is based on meetings in last two months. Roadmap ID: 559110 Details: What…
Copilot will be able to find meetings based on topics or keywords from relevant data like meeting body, chat, and transcription. The search for meetings based on transcript text is based on meetings in last two months.
What changed: Copilot now searches meetings using topics or keywords found in the meeting body, chat messages, and transcription text from the past two months. Previously, meeting searches were limited and did not include chat or transcript content. This change improves search accuracy and relevance across multiple data sources.
Why: Users need to locate meetings related to specific subjects quickly. Including chat and transcription data in searches provides a more comprehensive view and saves time.
Try this:
Open Copilot and enter a topic or keyword in the search box.
Review the list of meetings that include the keyword in the body, chat, or transcript.
Select a meeting to view details and related content.
Why this matters: This update helps users find relevant meetings more efficiently by searching all related meeting content.
Business impact: Teams can access complete meeting information faster, improving collaboration and decision-making.
Personal impact: You spend less time searching for meetings and more time preparing for relevant discussions.
A centralized dashboard in Insights shows GitHub Copilot AI consumption, cost, and adoption metrics across your organization. Roadmap ID: 566470 Details: What changed: The new dashboard consolidates GitHub Copilot AI usage and cost data in one location within Workplace Analytics Insights. Previously,…
A centralized dashboard in Insights shows GitHub Copilot AI consumption, cost, and adoption metrics across your organization.
What changed: The new dashboard consolidates GitHub Copilot AI usage and cost data in one location within Workplace Analytics Insights. Previously, administrators and analysts had to gather this information from multiple sources. The dashboard supports tracking spend against budgets and provides detailed adoption metrics for managers, Insights analysts, and global admins.
Why: Organizations need clear visibility into AI-related costs to manage budgets effectively. This dashboard simplifies cost tracking and supports data-driven decisions about GitHub Copilot investments.
Try this:
Open Workplace Analytics and navigate to the Insights dashboard.
Select the GitHub Copilot AI cost dashboard from the available reports.
Review usage, cost, and adoption metrics to monitor spend and user engagement.
Why this matters: Centralizing AI cost and usage data helps organizations control expenses and optimize GitHub Copilot adoption.
Business impact: Teams can better manage AI budgets and align GitHub Copilot investments with organizational priorities.
Personal impact: You gain quick access to cost and usage data, reducing time spent gathering information and improving budget oversight.
We added integrated extensibility experience support for declarative agents in Copilot Chat in Outlook. This release note covers availability in classic Outlook for Windows. Roadmap ID: 481559 Details: What changed: Users are now able to customize their Copilot experience in classic Outlook…
We added integrated extensibility experience support for declarative agents in Copilot Chat in Outlook. This release note covers availability in classic Outlook for Windows.
What changed: Users are now able to customize their Copilot experience in classic Outlook with Declarative Agents through integrated extensibility experience (plugins, adaptive cards, card actions, task modules, etc.), Outlook integrations (mail and calendar actions, enterprise connectors), and additional extensibility provider agent actions and orchestration logic. This now aligns classic Outlook with other Copilot Chat experiences, delivering consistent agent capabilities across platforms.
Why: Extending agent integrated extensibility experience support to classic Outlook for Windows allows more users to benefit from automated assistance and task management within their familiar email environment leveraging extensibility provider agent actions and orchestration logic.
Try this:
Open classic Outlook for Windows.
Access Copilot Chat from the ribbon or sidebar.
Interact with available Copilot agents to automate tasks or get assistance.
Why this matters: Bringing agent extensibility support to classic Outlook enhances productivity by integrating automation directly into users' primary email client.
Business impact: Teams using classic Outlook can leverage Copilot agents through integrated extensibility experience.
Personal impact: You gain automated assistance within your existing Outlook environment, now leveraging integrated extensibility experience, reducing manual effort, expanding declarative agents' capabilities, and improving efficiency.
In Copilot in Excel, the response contains links to highlight where changes are made in your workbook. Navigate directly to new sheets, tables, ranges, and objects like charts and shapes. Details: What changed: In the Copilot chat response, there now is a…
In Copilot in Excel, the response contains links to highlight where changes are made in your workbook. Navigate directly to new sheets, tables, ranges, and objects like charts and shapes.
Details:
What changed: In the Copilot chat response, there now is a link you can click that will take you directly to changes in the workbook. Previously, you would need to locate the change in the response and navigate in the sheet on your own.
Why: We want you to understand where copilot made edits and connect you to them directly from the chat response. This will help build confidence in the changes and allow you to review while you're reading the response in the chat pane.
Try this:
Send a prompt to Copilot where the workbook is modified.
The chat response will show the changes in a different format with a highlight to indicate a link you can click for navigation. New Sheets, tables, ranges, and objects will be highlighted.
Why this matters: The feature allows quick review of document changes made by Copilot, increasing transparency of the edits.
Business impact: Teams can understand changes made while reading the response from Copilot and quickly navigate to those places for review.
Personal impact: You can review the Copilot Edits in your document.
The new Copilot Notebooks design in the Microsoft 365 Copilot app now lets users organize related chats, output creations, and references into a persistent AI workspace. Copilot uses the Notebook's accumulated context to ground responses, so work continues across sessions instead of…
The new Copilot Notebooks design in the Microsoft 365 Copilot app now lets users organize related chats, output creations, and references into a persistent AI workspace. Copilot uses the Notebook's accumulated context to ground responses, so work continues across sessions instead of starting over each time. While this is the quicker, light-weight Notebooks experience, you can still find the fuller, workspace-forward experience in OneNote.
What changed: The Microsoft 365 Copilot app introduces a new Notebooks design. In the Copilot app, users can quickly chat with Copilot, explore references, and create artifacts. The full-featured Notebooks experience remains available in OneNote, while the app offers a lighter, faster version.
Why: This change improves productivity by preserving conversation context, reducing repetitive input and enabling ongoing work across sessions. It also provides flexibility by offering both a lightweight app experience and a comprehensive OneNote workspace.
Try this:
Open the Microsoft 365 Copilot app.
Create a new Notebook to start organizing related chats and outputs.
Access your Notebook in the app or open it in OneNote for advanced features.
Why this matters: Maintaining AI context across sessions helps users work more efficiently without losing progress or repeating information.
Business impact: Teams can collaborate with persistent AI workspaces that improve continuity and reduce time spent reestablishing context.
Personal impact: You save time by continuing conversations seamlessly and keeping related information organized in one place.
We are introducing a new dedicated License Requests page in the Microsoft 365 Admin Center to help admins more easily discover, review, and manage Microsoft 365 Copilot license requests submitted by users. Roadmap ID: 561206 Details: What changed: The Microsoft 365 Admin…
We are introducing a new dedicated License Requests page in the Microsoft 365 Admin Center to help admins more easily discover, review, and manage Microsoft 365 Copilot license requests submitted by users.
What changed: The Microsoft 365 Admin Center now includes a dedicated License Requests page for Microsoft 365 Copilot. Previously, admins had to locate license requests through multiple menus or notifications. This new page centralizes all Copilot license requests, improving visibility and management efficiency. The page supports sorting, filtering, and bulk actions on license requests, enhancing administrative control and security oversight.
Why: Admins need a streamlined way to handle Copilot license requests to reduce delays and errors in license allocation. This change enables admins to:
Quickly identify pending license requests
Approve or deny requests efficiently
Maintain better control over license distribution and compliance
Try this:
Open the Microsoft 365 Admin Center and select 'License Requests' from the navigation menu.
Review pending Microsoft 365 Copilot license requests and use filters to sort by user or date.
Approve or deny requests directly from the License Requests page.
Why this matters: Centralizing license requests reduces administrative overhead and speeds up user access to Microsoft 365 Copilot licenses.
Business impact: IT teams can manage Copilot license requests more efficiently, improving license compliance and reducing support tickets.
Personal impact: Admins save time reviewing and processing license requests, enabling faster user onboarding to Copilot.
Buildings, rooms and desks that are added to the Places directory will have new profile cards, accessible from Copilot Chat and across other Microsoft 365 entry points. Roadmap ID: 553219 Details: What changed: Buildings, rooms, and desks added to the Places directory…
Buildings, rooms and desks that are added to the Places directory will have new profile cards, accessible from Copilot Chat and across other Microsoft 365 entry points.
What changed: Buildings, rooms, and desks added to the Places directory now have dedicated profile cards. These cards are accessible through Copilot Chat and various Microsoft 365 interfaces, providing quick access to location details. Previously, such detailed location information was not consolidated or easily accessible within Microsoft 365. This update improves navigation and resource management without impacting security.
Why: Providing detailed profile cards for physical spaces helps users find and manage locations efficiently, improving workplace coordination and resource utilization.
Try this:
Open Copilot Chat in Microsoft 365.
Search for a building, room, or desk name.
View the profile card with detailed information and availability.
Why this matters: Quick access to location details reduces time spent searching for workspace resources and supports better planning.
Business impact: Facilities and teams can manage space usage more effectively, improving workplace experience and operational efficiency.
Personal impact: You quickly find and reserve appropriate workspaces, reducing delays and interruptions during your day.
A new admin control in the People Skills settings lets administrators permanently remove their organization's People Skills data from the tenant. With this new control, organizations can delete their entire skills library along with all users confirmed, inferred, and imported skills data—giving…
A new admin control in the People Skills settings lets administrators permanently remove their organization's People Skills data from the tenant. With this new control, organizations can delete their entire skills library along with all users confirmed, inferred, and imported skills data—giving them full control to offboard from People Skills in support of data governance and compliance needs. Once deletion is initiated, skills will no longer appear on user profile cards or be used across Microsoft 365 skills-based experiences such as Copilot and Viva. The control is admin-only with no automatic changes.
What changed: Administrators can now permanently remove the entire People Skills library and all associated user skills data from their tenant. Previously, there was no direct option to delete this data. Once deleted, skills no longer appear on user profiles or in Microsoft 365 experiences like Copilot and Viva. This control is admin-only and requires manual initiation.
Why: Providing a deletion control supports data governance and compliance by allowing organizations to fully offboard from People Skills and manage sensitive data responsibly.
Try this:
Open the Microsoft 365 admin center and navigate to People Skills settings.
Select the option to delete the organization's People Skills data.
Confirm the deletion to permanently remove all skills data from the tenant.
Why this matters: This control ensures organizations can comply with data policies by fully removing sensitive skills data when needed.
Business impact: Organizations gain full control over People Skills data lifecycle, supporting compliance and data privacy requirements.
Personal impact: Admins reduce risk by securely deleting skills data, ensuring user profiles and skills-based features reflect current organizational policies.
Introducing built-in Planner Agent chat with natural language Q&A, smart task discovery, and in-plan task management. Roadmap ID: 560532 Details: What changed: Planner integrates Planner Agent chat directly into the app, enabling users to ask questions and manage tasks using natural language.…
Introducing built-in Planner Agent chat with natural language Q&A, smart task discovery, and in-plan task management.
What changed: Planner integrates Planner Agent chat directly into the app, enabling users to ask questions and manage tasks using natural language. Previously, task management required manual navigation and filtering. The chat supports smart discovery of relevant tasks and allows in-plan updates through conversational commands.
Why: Adding natural language chat simplifies task management by reducing the need to navigate complex menus and filters. This speeds up task updates and improves user productivity.
Try this:
Open Planner and select the Copilot icon in the bottom right corner.
Ask a question like "Show me tasks due this week."
Use chat commands to update task status or filter your view.
Review the chat responses and task updates in your plan.
Why this matters: Natural language chat makes task management more intuitive and accessible, reducing friction in daily planning.
Business impact: Teams can manage and update tasks faster, improving project tracking and collaboration.
Personal impact: You save time by managing tasks through simple chat commands instead of manual navigation.
Roadmap ID: 502529 Details: What changed: Connector admins now have access to pre-setup guides that outline configuration steps before deployment. They can edit settings post-setup and receive actionable error messages with alerting support. These improvements enhance troubleshooting and proactive management of Connectors.…
Pre-setup guides, editability, actionable errors & alerting support available for Connector admins.
What changed: Connector admins now have access to pre-setup guides that outline configuration steps before deployment. They can edit settings post-setup and receive actionable error messages with alerting support. These improvements enhance troubleshooting and proactive management of Connectors.
Why: Providing detailed setup guidance and clear error alerts helps admins configure Connectors correctly and resolve issues faster, reducing downtime and misconfigurations.
Try this:
Open the Connector admin portal.
Review the pre-setup guide before configuring a Connector.
Edit Connector settings as needed and monitor alerts for errors.
Why this matters: Clear guidance and alerts reduce configuration errors and improve Connector reliability.
Business impact: Admins can maintain Connector health more efficiently, minimizing service interruptions and support tickets.
Personal impact: You spend less time troubleshooting and more time managing Connectors proactively.
Users can now view Copilot usage details directly within the Show Changes pane in Excel. Details: What changed: Previously, Copilot activity was not visible in the Show Changes pane. Now, the pane includes on-card attribution showing when Copilot made edits or suggestions.…
Users can now view Copilot usage details directly within the Show Changes pane in Excel.
Details:
What changed: Previously, Copilot activity was not visible in the Show Changes pane. Now, the pane includes on-card attribution showing when Copilot made edits or suggestions. This transparency helps users track AI contributions alongside manual changes.
Why: Providing clear visibility into Copilot’s actions increases user trust and accountability when reviewing workbook changes.
Try this:
Open an Excel workbook with Copilot edits.
Select Review tab, then click Show Changes.
Look for Copilot attribution cards indicating AI-generated changes.
Why this matters: Understanding which changes come from Copilot helps users verify and manage AI-assisted edits.
Business impact: Teams can audit AI contributions more effectively, improving collaboration and change management.
Personal impact: You gain confidence reviewing workbook edits knowing which changes Copilot made.
When users search for an email in Microsoft 365 Copilot search, that email's attachments now appear as pills directly on the result, so users can spot and open attachments without opening the email. Details: What changed: Email results in Microsoft 365 Copilot…
When users search for an email in Microsoft 365 Copilot search, that email's attachments now appear as pills directly on the result, so users can spot and open attachments without opening the email.
Details:
What changed: Email results in Microsoft 365 Copilot search now display the email's attachments as inline pills within the search results. When a user's query surfaces an email, any attachments on that email are shown as clickable pills on the result, letting users navigate straight to a file. Previously, attachments were not surfaced on email results, users had to open the email to find and access them.
Why: Surfacing attachments as pills on email results improves discoverability and saves clicks. Users can now:
At a glance, see which emails have attachments and what they are.
Open an attachment directly from the results page without first opening the email.
Move faster from a search to the exact file they need.
Try this:
Open Microsoft 365 Copilot search.
Search for an email you know has attachments.
On the matching email result, look for the attachment pills.
Click a pill to open the attachment directly.
Why this matters: Showing attachments in line with email results removes an extra step, making it faster to find and open the files buried in your emails.
Business impact: Teams reach the files attached to key emails faster, reducing back-and-forth and speeding up collaboration and decision making.
Personal impact: You save time by spotting and opening email attachments right from your search results, without opening each email to hunt for them.
Enable Global and Insights admins to turn on additional attributes as filters in Power BI reports, including reserved attributes and your organization’s custom attributes. Users who have access to Power BI reports can then use these newly enabled filters to tailor reports…
Enable Global and Insights admins to turn on additional attributes as filters in Power BI reports, including reserved attributes and your organization’s custom attributes. Users who have access to Power BI reports can then use these newly enabled filters to tailor reports to their business needs.
What changed: Admins now have the option to activate more attribute filters in Workplace Analytics Power BI reports. These include reserved attributes and custom attributes defined by the organization. Previously, filtering options were limited to default attributes, restricting report customization.
Why: This update provides more granular control over report filtering, enabling more relevant and actionable insights tailored to organizational contexts.
Try this:
As a Global or Insights admin, go to the Workplace Analytics admin center.
Enable additional reserved and custom attributes as filters.
In Power BI, use the new filters to customize your reports.
Why this matters: Enhanced filtering improves report relevance and helps users focus on the data that matters most to their roles and goals.
Business impact: Teams gain more precise analytics capabilities, supporting better-informed decisions based on tailored data views.
Personal impact: You can create more customized reports that reflect your specific business questions, saving time on data preparation.
Vision in Microsoft 365 Copilot helps you make faster, more informed decisions by understanding context from what you share on screen or camera. Copilot can analyze visual inputs from shared desktop screens and provide detailed insights about the content. You can also…
Vision in Microsoft 365 Copilot helps you make faster, more informed decisions by understanding context from what you share on screen or camera. Copilot can analyze visual inputs from shared desktop screens and provide detailed insights about the content. You can also use vision on mobile during a real-time voice session to share your device camera, front or back, and ask questions about what is in front of you. Copilot analyzes the live camera feed or desktop screen in real time and provides spoken, context-aware answers grounded in work and web data.
What changed: Copilot now processes live visual data from desktop screen sharing and mobile device cameras during voice sessions. Previously, Copilot relied on text and static data inputs only. Vision interprets the live feed in real time and delivers spoken answers grounded in work and web data, enhancing decision-making.
Why: Analyzing visual context from screens and cameras accelerates understanding and supports faster, informed decisions without switching apps.
Try this:
Share your desktop screen in a Microsoft 365 Copilot session and ask questions about visible content.
During a voice session on mobile, activate the camera and point it at an object or document.
Ask Copilot questions about the live camera feed and listen to spoken, context-aware answers.
Why this matters: Real-time visual analysis reduces information gaps and streamlines workflows by integrating visual context into conversations.
Business impact: Teams can collaborate more effectively with instant insights from shared visual content across devices.
Personal impact: You gain the ability to quickly understand and act on visual information without manual searching or switching contexts.
Create an Information Barriers policy compliance report to identify SharePoint sites, OneDrive accounts, and user-owned SharePoint Embedded containers that no longer comply after Information Barriers policy changes.
Users can report completed or missed group Microsoft Teams calls from the call history as malicious (scam) or nonmalicious (non-scam). Depending on user reported settings, reported calls are sent to the specified reporting mailbox, to Microsoft, or both.
Users can report completed or missed group Microsoft Teams calls from the call history as malicious (scam) or nonmalicious (non-scam). Depending on user reported settings, reported calls are sent to the specified reporting mailbox, to Microsoft, or both.
The Identity Security dashboard provides a centralized view of identity-related security risks and posture across the organization. Coverage & Maturity helps security teams understand how well their identity environment is protected across on-premises, cloud, SaaS, identity providers, and partner technologies, identify coverage…
The Identity Security dashboard provides a centralized view of identity-related security risks and posture across the organization. Coverage & Maturity helps security teams understand how well their identity environment is protected across on-premises, cloud, SaaS, identity providers, and partner technologies, identify coverage and deployment gaps, and prioritize the actions required to improve identity security posture. For more information, see Coverage & Maturity.
It helps prevent sensitive data from being shared with untrusted cloud applications through browsers, apps, APIs, and add-ins, including generative AI platforms, social media, and collaborative platforms.
Integrate Microsoft Entra Global Secure Access with Purview to protect text, files, and AI interactions at the network layer, enforce restrictive actions based on DLP policies, and detect risky user activity through Insider Risk Management. It helps prevent sensitive data from being shared with untrusted cloud applications through browsers, apps, APIs, and add-ins, including generative AI platforms, social media, and collaborative platforms. See Learn about Microsoft Purview Network Data Security.
Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI capabilities together in the Microsoft Defender portal. Starting September 23, 2026, it's available to eligible Microsoft 365 E5 and E7 customers without an active Microsoft Sentinel…
Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI capabilities together in the Microsoft Defender portal. Starting September 23, 2026, it's available to eligible Microsoft 365 E5 and E7 customers without an active Microsoft Sentinel workspace. For more information, see ISOC in Microsoft Defender.
When you share a file in Teams, you no longer need to wait for the upload to finish before continuing your work. Across chats, channels, and meetings, files upload in the background so you can keep collaborating without interruption. Progress indicators keep…
When you share a file in Teams, you no longer need to wait for the upload to finish before continuing your work. Across chats, channels, and meetings, files upload in the background so you can keep collaborating without interruption. Progress indicators keep you informed, and your files appear in the conversation as soon as they're ready, creating a more seamless collaboration experience that reduces wait times and helps you stay focused on work. To learn more, see Send a file, picture, or link in Microsoft Teams.
Memory Scan extends Microsoft Defender for Endpoint protection capabilities on Linux by enabling inspection of process memory for known malicious behaviours and memory-resident threats, providing an additional layer of protection against advanced attacks. Memory-resident threats are increasingly challenging for security teams because…
Memory Scan extends Microsoft Defender for Endpoint protection capabilities on Linux by enabling inspection of process memory for known malicious behaviours and memory-resident threats, providing an additional layer of protection against advanced attacks. Memory-resident threats are increasingly challenging for security teams because they can execute directly in memory with little or no footprint on disk, making them more difficult to detect using traditional file-based scanning techniques. Memory Scan helps improve visibility into these threats and strengthens protection against sophisticated attack methods such as in-memory malware and malicious code injection.Available in Defender version 101.26071.0005 or later in Insiders-slow channel.
Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping security teams investigate and respond to threats across both Windows and Linux…
Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping security teams investigate and respond to threats across both Windows and Linux workloads.Available in Public Preview. To enroll, complete the registration form.
Microsoft Defender for Endpoint now extends support to Linux desktops (Public Preview). All Linux distributions currently supported on servers are also supported on Linux desktops. Deployment methods and security capabilities remain consistent across both Linux servers and desktops. For details on licensing…
Microsoft Defender for Endpoint now extends support to Linux desktops (Public Preview). All Linux distributions currently supported on servers are also supported on Linux desktops. Deployment methods and security capabilities remain consistent across both Linux servers and desktops. For details on licensing and supported distributions, see prerequisites for Microsoft Defender on Linux
Microsoft Defender now brings together six security recommendations for AI-Readiness to help organizations strengthen endpoint trust against AI-accelerated cyberattacks. Together, these recommendations provide a layered security baseline that helps reduce externally visible entry points, establish hardware-backed trust in device startup, isolate critical…
Microsoft Defender now brings together six security recommendations for AI-Readiness to help organizations strengthen endpoint trust against AI-accelerated cyberattacks. Together, these recommendations provide a layered security baseline that helps reduce externally visible entry points, establish hardware-backed trust in device startup, isolate critical Windows security functions, protect kernel code integrity, and limit the reuse of local administrator credentials for lateral movement.In the Microsoft Defender portal, go to Exposure Management > Recommendations > Devices > Misconfigurations, and filter by the AI-Readiness tag to view the complete recommendation set, affected devices, exposed critical devices, points achieved, and potential impact on the Devices Secure Score. Use this view to prioritize remediation, assign ownership, track exceptions, and monitor adoption throughout the device estate.Four new recommendations are available for AI-Readiness:- Establish a hardware root of trust with TPM 2.0: Helps protect cryptographic keys, device identity, and boot measurements with hardware-backed security.- Isolate critical security functions with VBS: Helps protect critical security functions in an isolated environment that is separate from the operating system kernel.- Enforce kernel code integrity with HVCI: Helps validate kernel-mode code, block untrusted code, and prevent executable kernel memory from being writable.- Limit lateral movement with Windows LAPS: Helps prevent local administrator credentials from being reused by managing a unique password for each device.The AI-Readiness collection also includes two existing recommendations:- Reduce unnecessary internet exposure on internet-facing devices: Helps identify and remediate devices that are unnecessarily accessible from the public internet.- Protect the startup process with Secure Boot: Helps ensure that devices start by using trusted firmware and software.
Customers in Worldwide (WW) environments with Defender for Office 365 Plan 1, Defender for Office 365 Plan 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting settings on a separate page at https://security.microsoft.com/securitysettings/teamsUserSubmission. This separation lets you…
Customers in Worldwide (WW) environments with Defender for Office 365 Plan 1, Defender for Office 365 Plan 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting settings on a separate page at https://security.microsoft.com/securitysettings/teamsUserSubmission. This separation lets you configure different reporting destinations for Teams and Outlook user reports. For more information, see MC1478463.
Microsoft Intune now supports single-device eSIM activation for corporate-owned Android Enterprise devices running Android 15 and later. Turn on Preview new device view, select the device, then select Activate eSIM and enter the carrier activation code. Intune sends the request without first…
Microsoft Intune now supports single-device eSIM activation for corporate-owned Android Enterprise devices running Android 15 and later. Turn on Preview new device view, select the device, then select Activate eSIM and enter the carrier activation code. Intune sends the request without first blocking it based on reported eSIM slot capacity and surfaces errors returned by Google. Personally owned work profile devices aren't supported.
The Microsoft Defender Antivirus template for Linux, which is part of Intune's Endpoint Security Antivirus policy, now includes a new Audit value for the Enforcement level setting. When you set Enforcement level to Audit, the antivirus engine detects threats in real time…
The Microsoft Defender Antivirus template for Linux, which is part of Intune's Endpoint Security Antivirus policy, now includes a new Audit value for the Enforcement level setting. When you set Enforcement level to Audit, the antivirus engine detects threats in real time but doesn't automatically remediate them. Malware detections are reported as alerts in the Microsoft Defender portal through real-time scanning, without quarantining the malicious files. Audit mode gives you visibility into the threat landscape before you turn on full protection.
Microsoft Intune now lets you choose whether to preserve or remove eSIMs when wiping one corporate-owned Android Enterprise device. Turn on Preview new device view, select the device, then select Wipe. By default, the wipe preserves eSIMs; select the eSIM removal option…
Microsoft Intune now lets you choose whether to preserve or remove eSIMs when wiping one corporate-owned Android Enterprise device. Turn on Preview new device view, select the device, then select Wipe. By default, the wipe preserves eSIMs; select the eSIM removal option only when you want the wipe to remove them. Personally owned work profile devices aren't supported.
Microsoft Intune now supports Apple's Enhanced Logging device action on supported supervised devices running a compatible OS release. Administrators can start an AppleCare diagnostic-log collection session using an AppleCare-provided token and monitor device-reported status through Declarative Device Management, reducing the need to…
Microsoft Intune now supports Apple's Enhanced Logging device action on supported supervised devices running a compatible OS release. Administrators can start an AppleCare diagnostic-log collection session using an AppleCare-provided token and monitor device-reported status through Declarative Device Management, reducing the need to coordinate manual log collection with the device user.
The following eSIM features are rolling out and might not be available to all tenants yet.
Microsoft Intune now supports a Screen timeout setting in the Android Enterprise settings catalog, letting you specify how many seconds pass before the screen turns off. Configure it under Devices > Manage devices > Configuration > Create > New policy > Android…
Microsoft Intune now supports a Screen timeout setting in the Android Enterprise settings catalog, letting you specify how many seconds pass before the screen turns off. Configure it under Devices > Manage devices > Configuration > Create > New policy > Android Enterprise > Settings catalog. The value must stay at or below Time to lock screen and applies to fully managed and dedicated devices on Android 9 and later, and corporate-owned work profile devices on Android 15 and later.
Copilot Chat will be available for Microsoft 365 Copilot users from the side pane on the right-hand side when using Copilot Search in the Microsoft 365 Copilot app. This allows users to engage with Copilot while browsing universal search without switching pages…
Copilot Chat will be available for Microsoft 365 Copilot users from the side pane on the right-hand side when using Copilot Search in the Microsoft 365 Copilot app. This allows users to engage with Copilot while browsing universal search without switching pages or losing context.
What changed: Copilot chat is now accessible from the right-hand side pane during Copilot Search for users with the AI SKU. Previously, users had to switch pages to use Copilot chat, interrupting their workflow.
Why: Integrating chat in the side pane keeps Copilot accessible alongside search results, improving multitasking and reducing context switching.
Try this:
Open Copilot Search in the Microsoft 365 Copilot app.
Engage with your search results or ask questions in the search box to open Copilot chat.
Interact with Copilot chat while browsing search results.
Why this matters: This integration helps users maintain focus by combining search and chat in one view.
Business impact: Teams can work more efficiently by accessing AI assistance without disrupting their search workflows.
Personal impact: You save time by getting AI help without switching screens or losing your search context.
Microsoft Intune now supports device inventory for personally owned Android Enterprise devices with a work profile managed by Android Management API. View these devices from the device's Inventory page alongside corporate-owned devices in Resource Explorer, and query them with Multi-Device Query. Inventory…
Microsoft Intune now supports device inventory for personally owned Android Enterprise devices with a work profile managed by Android Management API. View these devices from the device's Inventory page alongside corporate-owned devices in Resource Explorer, and query them with Multi-Device Query. Inventory data is a subset of corporate-owned data; properties such as IMEI, ICCID, and MAC address aren't available. This gives you more consistent analytics across mixed corporate and BYOD environments.
Copilot uses a higher default reasoning level with Sonnet 5 for more accurate drafting and edits. Details: What changed: Sonnet 5 is now available in the Copilot models menu in Word and set as the default for higher reasoning tasks. This model…
Copilot uses a higher default reasoning level with Sonnet 5 for more accurate drafting and edits.
Details:
What changed: Sonnet 5 is now available in the Copilot models menu in Word and set as the default for higher reasoning tasks. This model improves the accuracy and quality of drafts and edits compared to previous versions. It enhances complex language understanding while maintaining compliance with Microsoft 365 security standards.
Why: Enabling Sonnet 5 raises the default reasoning level to improve content quality and reduce errors.
Users can now:
Generate more precise and contextually relevant text
Receive improved suggestions for complex edits
Experience better handling of nuanced language
Try this:
Open a Word document and activate Copilot.
Verify Sonnet 5 is selected in the models menu.
Use Copilot to draft or edit complex content for improved results.
Why this matters: Higher reasoning levels improve the quality and reliability of AI-generated content, reducing manual corrections.
Business impact: Teams benefit from more accurate document drafts, accelerating review cycles and decision-making.
Personal impact: You save time by receiving higher-quality suggestions that require fewer edits.
This feature enhances the PowerPoint Live meeting experience by using Copilot to let attendees select slide text and get explanations for the content. Roadmap ID: 557256 Details: What changed: Attendees in PowerPoint Live meetings can now select text on slides and ask…
This feature enhances the PowerPoint Live meeting experience by using Copilot to let attendees select slide text and get explanations for the content.
What changed: Attendees in PowerPoint Live meetings can now select text on slides and ask Copilot for explanations, unlike before when slide content was static and non-interactive. This feature works within Microsoft 365 PowerPoint Live sessions and maintains data security by processing content within the meeting environment.
Why: This change improves meeting engagement and comprehension by enabling attendees to interact directly with slide content and get immediate clarifications without leaving the presentation.
Try this:
Join a PowerPoint Live meeting as an attendee.
Select any text on a slide.
Copilot explains it for you in the side pane.
Why this matters: Attendees gain better understanding of slide content, which supports clearer communication and more effective meetings.
Business impact: Teams can collaborate more effectively during presentations by reducing misunderstandings and the need for follow-up questions.
Personal impact: You can quickly clarify complex slide content during meetings, saving time and improving focus.
Create and modify images in Copilot Cowork using OpenAI's ChatGPT Images 2.0 model for enhanced visual content generation. Details: What changed: Copilot Cowork integrates OpenAI's ChatGPT Images 2.0 model to generate and edit image artifacts. Previously, image creation required external tools. This…
Create and modify images in Copilot Cowork using OpenAI's ChatGPT Images 2.0 model for enhanced visual content generation.
Details:
What changed: Copilot Cowork integrates OpenAI's ChatGPT Images 2.0 model to generate and edit image artifacts. Previously, image creation required external tools. This update enables in-app image generation and editing, streamlining creative workflows.
Why: Embedding image generation within Copilot Cowork reduces context switching and accelerates content creation.
Try this:
Open Copilot Cowork.
Enter a description to create an image using ChatGPT Images 2.0.
Use editing tools to refine the image within Cowork.
Why this matters: Integrated image generation enhances creativity and productivity by keeping visual content creation within the collaboration environment.
Business impact: Teams can produce visual assets in their workflow without relying on separate design software.
Personal impact: You save time by generating and editing images directly in your collaboration workspace.
Microsoft Intune now includes a settings catalog option for keeping fully managed and dedicated Android device screens on while charging. Select one or more modes - AC, USB, or Wireless - to control when the screen stays on. AC and USB support…
Microsoft Intune now includes a settings catalog option for keeping fully managed and dedicated Android device screens on while charging. Select one or more modes - AC, USB, or Wireless - to control when the screen stays on. AC and USB support Android 6.0 and later; wireless charging requires Android 8.1 and later. No modes are selected by default.
Microsoft Intune now supports the Number of days work profile is allowed to be switched off setting in the Android Enterprise settings catalog, so you can limit how long a work profile stays turned off. Enter the maximum number of days, with…
Microsoft Intune now supports the Number of days work profile is allowed to be switched off setting in the Android Enterprise settings catalog, so you can limit how long a work profile stays turned off. Enter the maximum number of days, with a minimum of three, or enter 0 to disable the restriction. There's no documented upper limit, giving you flexibility for your organization's needs.
Microsoft Intune now supports a memory scan setting in the Microsoft Defender Antivirus template for Linux endpoint security antivirus policies. You can manage memory scan behavior on Linux devices managed through Microsoft Defender for Endpoint security settings management, giving you finer control…
Microsoft Intune now supports a memory scan setting in the Microsoft Defender Antivirus template for Linux endpoint security antivirus policies. You can manage memory scan behavior on Linux devices managed through Microsoft Defender for Endpoint security settings management, giving you finer control over how Defender inspects memory on your Linux endpoints.
Microsoft Intune now includes new Windows settings catalog options across several administrative template refreshes. Highlights include Turn on Protected Mode controls for Internet Explorer security zones, new Microsoft Edge policies from the Edge 150 template refresh, and a Disconnect if a Remote…
Microsoft Intune now includes new Windows settings catalog options across several administrative template refreshes. Highlights include Turn on Protected Mode controls for Internet Explorer security zones, new Microsoft Edge policies from the Edge 150 template refresh, and a Disconnect if a Remote Desktop Services session when no smart card is present option for interactive logon. The Microsoft Office templates also gained new settings. Create a Windows settings catalog profile to configure them.
Microsoft Intune now supports new Settings Catalog options for testing on the OS 27 betas, covering Declarative Device Management areas such as App Settings, Web Content Filter, and Siri Settings for iOS/iPadOS and macOS. Configure them under Devices > Manage devices >…
Microsoft Intune now supports new Settings Catalog options for testing on the OS 27 betas, covering Declarative Device Management areas such as App Settings, Web Content Filter, and Siri Settings for iOS/iPadOS and macOS. Configure them under Devices > Manage devices > Configuration > Create > New policy > iOS/iPadOS or macOS > Settings catalog. This lets you test upcoming Apple management controls ahead of general availability.
The following protected apps are now available for Microsoft Intune: Notion by Notion Labs Superhuman Mail by Superhuman Labs Calven by Calven Pty Limited Heijmans by Heijmans Notability by Ginger Labs, Inc. (iOS) Ben for Intune by Thanks Ben Ltd SDP -…
The following protected apps are now available for Microsoft Intune:
You can now open Outlook emails directly within any full-app Microsoft 365 Copilot experience for faster browsing and reference. Details: What changed: When clicking on an email reference or source in Microsoft 365 Copilot apps, the email opens alongside Chat instead of…
You can now open Outlook emails directly within any full-app Microsoft 365 Copilot experience for faster browsing and reference.
Details:
What changed: When clicking on an email reference or source in Microsoft 365 Copilot apps, the email opens alongside Chat instead of requiring a separate Outlook window. Previously, users had to switch apps to view email content. This integration streamlines access to email information within the Copilot environment.
Why: This change reduces context switching and speeds up information retrieval by keeping emails accessible within the Copilot workspace.
Try this:
In a Microsoft 365 Copilot app, locate an email reference.
Click the email link to open it in Chat.
Browse the email content alongside your chat or tasks.
Why this matters: Quick access to emails within Copilot improves productivity and decision making by keeping relevant information in one place.
Business impact: Teams can collaborate more efficiently by referencing emails without leaving the Copilot interface.
Personal impact: You save time by avoiding app switching and can respond to emails faster within your workflow.
The operatingSystemVersion property in assignment filters is now generally available for managed devices and managed apps. Use this property to create filter rules that scope your app and policy assignments to devices running a specific OS version or build range. For example,…
The operatingSystemVersion property in assignment filters is now generally available for managed devices and managed apps. Use this property to create filter rules that scope your app and policy assignments to devices running a specific OS version or build range. For example, create an assignment filter that pilots a configuration on a newer build before rolling it out broadly or excludes devices that haven't yet updated.
You can build rules using the rule editor or the rule syntax text box, with the same operators available for other filter properties. Existing assignments continue to work without changes.
Roadmap ID: 503564 Details: What changed: Previously, Organizational Messages were limited to devices fully joined to Azure Active Directory or on-premises Active Directory. Now, hybrid Azure AD joined devices can receive Organizational Messages, expanding device coverage. This update improves message delivery consistency…
Organizational Messages now supports Hybrid-joined Devices.
What changed: Previously, Organizational Messages were limited to devices fully joined to Azure Active Directory or on-premises Active Directory. Now, hybrid Azure AD joined devices can receive Organizational Messages, expanding device coverage. This update improves message delivery consistency across device management environments.
Why: Supporting hybrid-joined devices ensures that organizations using both on-premises and cloud identity management can communicate important messages uniformly. This reduces gaps in message reach and improves compliance.
Try this:
Open the Microsoft 365 admin center.
Navigate to the Organizational Messages section.
Create or update a message and target hybrid Azure AD joined devices to verify delivery.
Why this matters: This change ensures all managed devices receive critical organizational communications regardless of their join type.
Business impact: IT teams can now rely on Organizational Messages to reach hybrid device fleets without additional configuration or tools.
Personal impact: Users on hybrid-joined devices receive timely organizational updates, reducing confusion and support requests.
Outlook Emails as References in Copilot Notebooks bring email content into the notebook experience, enabling users to ground Copilot in the conversations, decisions, and context that drive their work. By adding emails as knowledge sources, users can connect context from their emails…
Outlook Emails as References in Copilot Notebooks bring email content into the notebook experience, enabling users to ground Copilot in the conversations, decisions, and context that drive their work. By adding emails as knowledge sources, users can connect context from their emails directly to their projects, enriching notebooks beyond files alone and improving downstream outputs like presentations and briefs. Available in Copilot Notebooks across Microsoft 365.
What changed: Users can now add Outlook emails as knowledge sources within Copilot Notebooks across Microsoft 365. Previously, notebooks included only files and other documents. This update enables Copilot to use email content to provide richer context for outputs like presentations and briefs.
Why: Integrating emails into notebooks grounds Copilot in the full context of work conversations and decisions, improving the relevance and accuracy of generated content.
Try this:
Open a Copilot Notebook in Microsoft 365.
Select Add content and choose Outlook emails.
Pick relevant emails to include as references in your notebook.
Why this matters: Including emails enriches project context, helping users create more informed and connected work outputs.
Business impact: Teams can leverage email conversations directly in collaborative notebooks, enhancing project alignment and knowledge sharing.
Personal impact: You gain a streamlined way to incorporate important email context into your work, saving time and improving output quality.
Users can now steer, refine, and edit pages using Copilot commands like "Shorten this page." They can also prompt Copilot to auto-create pages from chat, such as "Create a new page for XYZ." Details: What changed: Copilot now supports page steering on…
Users can now steer, refine, and edit pages using Copilot commands like "Shorten this page." They can also prompt Copilot to auto-create pages from chat, such as "Create a new page for XYZ."
Details:
What changed: Copilot now supports page steering on mobile devices, allowing users to modify page content with natural language commands. Previously, users had to manually edit pages without AI assistance. Additionally, Copilot can auto-trigger new page creation from chat prompts, streamlining content generation.
Why: These changes simplify content management on mobile by reducing manual editing and speeding up page creation, improving user productivity and content accuracy.
Try this:
Open a page on your mobile device and say, "Shorten this page."
In chat, type "Create a new page for [topic]."
Review and edit the generated page content as needed.
Why this matters: This update reduces friction in mobile content editing and creation, enabling faster and more precise page management.
Business impact: Teams can produce and refine content more efficiently on mobile, supporting faster collaboration and information sharing.
Personal impact: You save time editing pages and can quickly generate new content without switching devices or apps.
You can now reference an email when using Copilot in PowerPoint to create a presentation. Roadmap ID: 555888 Details: What changed: Copilot in PowerPoint now allows referencing email content when creating presentations. Previously, users could not directly incorporate email information into their…
You can now reference an email when using Copilot in PowerPoint to create a presentation.
What changed: Copilot in PowerPoint now allows referencing email content when creating presentations. Previously, users could not directly incorporate email information into their presentations using Copilot. This integration enhances content accuracy and context while maintaining Microsoft 365 security standards.
Why: Referencing emails directly streamlines presentation creation by reducing manual content transfer and errors. It helps users build presentations that reflect up-to-date communication without switching apps.
Try this:
Open PowerPoint and start a presentation.
Open the Copilot pane.
Enter a prompt and reference an email you would like to incorporate in your deck. You can reference an email by its subject, the senders, and time frame or date it was sent.
Review the output slides where Copilot has used the email information.
Why this matters: Including email content directly reduces errors and speeds up the presentation creation process.
Business impact: Teams can quickly create presentations that incorporate relevant email information, improving communication clarity.
Personal impact: You save time by avoiding manual copying from emails and ensure your presentations include the latest information.
Microsoft Intune now lets you remove a single eSIM from a corporate-owned Android Enterprise device without wiping it. Turn on Preview new device view, select the device, copy the eSIM's ICCID from device inventory, then select Remove eSIM and enter the ICCID.…
Microsoft Intune now lets you remove a single eSIM from a corporate-owned Android Enterprise device without wiping it. Turn on Preview new device view, select the device, copy the eSIM's ICCID from device inventory, then select Remove eSIM and enter the ICCID. The action supports fully managed and dedicated devices on Android 15 and later, and work profile devices on Android 17 and later.
Microsoft Intune now supports the Remove all eSIMs during a device wipe setting in the Android Enterprise settings catalog. Set it to True to request removal of all eSIMs when a corporate-owned device is wiped while the policy applies. The default, False,…
Microsoft Intune now supports the Remove all eSIMs during a device wipe setting in the Android Enterprise settings catalog. Set it to True to request removal of all eSIMs when a corporate-owned device is wiped while the policy applies. The default, False, doesn't request removal, although the operating system might still remove eSIMs when required. The setting supports Android 15 and later.
Users can now schedule meetings directly from chat or by clicking "Schedule with Copilot" in the UI. Simply ask Copilot to schedule a meeting with colleagues, and it will find available times, book rooms, draft agendas, and send invites—all within the chat…
Users can now schedule meetings directly from chat or by clicking "Schedule with Copilot" in the UI. Simply ask Copilot to schedule a meeting with colleagues, and it will find available times, book rooms, draft agendas, and send invites—all within the chat experience. This feature is available to users with a Microsoft 365 Copilot license.
What changed: Copilot now enables meeting scheduling within classic Outlook for Windows through chat commands or the "Schedule with Copilot" button. It finds available times, books rooms, drafts agendas, and sends invites automatically. Previously, scheduling required manual steps outside of chat. This feature requires a Microsoft 365 Copilot license and is rolling out in phases.
Why: Integrating scheduling into Copilot chat streamlines meeting setup, reducing manual coordination and saving time.
Try this:
Open classic Outlook for Windows.
Start a chat with Copilot or click "Schedule with Copilot" in the UI.
Ask Copilot to schedule a meeting with colleagues.
Review and send the meeting invite.
Why this matters: This change simplifies meeting scheduling by automating availability checks and invites within the chat experience.
Business impact: Teams can reduce scheduling delays and improve meeting coordination efficiency.
Personal impact: You save time by letting Copilot handle meeting logistics directly from Outlook chat.
You can now choose supported Researcher models and modes directly within Chat when adding the Researcher agent to your conversation. Details: What changed: Copilot Chat now includes an option to pick from available Researcher models and modes when you add the Researcher…
You can now choose supported Researcher models and modes directly within Chat when adding the Researcher agent to your conversation.
Details:
What changed: Copilot Chat now includes an option to pick from available Researcher models and modes when you add the Researcher agent to your prompt. Previously, users had no direct control over which Researcher model was used during chat interactions, limiting customization. This update enables tailored research experiences based on the selected model.
Why: Allowing users to select Researcher models provides more control over the research process and improves result relevance by matching the model to the task.
Try this:
Start a new Chat and add the Researcher agent to your prompt.
Select the desired Researcher model from the model selector menu.
Continue the conversation using the chosen model for tailored research results.
Why this matters: Choosing the appropriate Researcher model helps users get more accurate and relevant information during research tasks.
Business impact: Teams can customize research workflows to better fit specific project needs, improving efficiency and output quality.
Personal impact: You gain flexibility to tailor research assistance, saving time by getting more relevant answers faster.
Microsoft Intune now supports the Block one lock for device and work profile setting in the Android Enterprise settings catalog, letting you require separate locks for the device and work profile instead of a shared one. Set it to True after configuring…
Microsoft Intune now supports the Block one lock for device and work profile setting in the Android Enterprise settings catalog, letting you require separate locks for the device and work profile instead of a shared one. Set it to True after configuring a work profile password requirement. The default, False, allows a common lock. The setting supports Android 9 and later.
A refreshed design for the Microsoft 365 Copilot web and desktop app simplifies the user experience to drive engagement with Copilot. This includes updates to the chat home screen, chat response layout, and navigation pane. Roadmap ID: 561488 Details: What changed: The…
A refreshed design for the Microsoft 365 Copilot web and desktop app simplifies the user experience to drive engagement with Copilot. This includes updates to the chat home screen, chat response layout, and navigation pane.
What changed: The Microsoft 365 Copilot app now features an updated chat home screen, a streamlined chat response layout, and a redesigned navigation pane. The new design helps users more easily navigate the app and stay focused across web and desktop platforms.
Why: Simplifying the app interface helps users engage more easily with Copilot, reducing the time needed to find features and improving overall usability.
Try this:
Open the Microsoft 365 Copilot app on web or desktop.
Explore the updated chat home screen to quickly access recent conversations.
Use the new navigation pane to switch between chats and tools more efficiently.
Why this matters: A clearer interface helps users interact with Copilot faster and more intuitively, increasing productivity.
Business impact: Teams experience smoother collaboration with fewer interruptions caused by navigation or layout confusion.
Personal impact: You spend less time navigating the app and more time focusing on your tasks.
Microsoft Intune now includes Apple OS 27 Setup Assistant skip keys for Liquid Glass and Accessibility Appearance in Automated Device Enrollment profiles. You can hide these panes to reduce setup interactions and provide a more consistent enrollment experience on supported iPhone, iPad,…
Microsoft Intune now includes Apple OS 27 Setup Assistant skip keys for Liquid Glass and Accessibility Appearance in Automated Device Enrollment profiles. You can hide these panes to reduce setup interactions and provide a more consistent enrollment experience on supported iPhone, iPad, and Mac devices.
Meetings as References in Copilot Notebooks bring Teams meeting content into the notebook experience, enabling users to ground Copilot on the discussions, decisions, and context that drive their work. By adding meetings as knowledge sources, users can connect transcripts, notes, chats, and…
Meetings as References in Copilot Notebooks bring Teams meeting content into the notebook experience, enabling users to ground Copilot on the discussions, decisions, and context that drive their work. By adding meetings as knowledge sources, users can connect transcripts, notes, chats, and shared content directly to their projects, enriching notebooks beyond files alone and improving downstream outputs like presentations and briefs.
Available in Copilot Notebooks across Microsoft 365.
What changed: Copilot notebooks now include Teams meetings as knowledge sources, allowing users to link meeting transcripts, notes, chats, and shared files within their notebooks. Previously, notebooks only supported files as references. This integration enriches project context and improves outputs like presentations and briefs. It is available across Microsoft 365 Copilot notebooks.
Why: Incorporating meeting content helps ground Copilot’s responses in real discussions and decisions, providing more relevant and comprehensive project insights. This reduces the need to manually gather meeting information.
Try this:
Open a Copilot notebook in Microsoft 365.
Select 'Add reference' and choose a Teams meeting from your recent meetings.
Review linked transcripts, notes, and shared content within the notebook.
Why this matters: Connecting meeting content directly to projects saves time and improves the accuracy of outputs by providing richer context.
Business impact: Teams can collaborate more effectively by having meeting discussions and decisions integrated into project documentation.
Personal impact: You spend less time searching for meeting details and can create more informed summaries and presentations.
Microsoft Intune now supports unattended Remote Help sessions on physical Windows devices. Authorized helpdesk agents can sign in to a remote device with their own credentials without requiring the user to be present or take action. Helpers can view and control the…
Microsoft Intune now supports unattended Remote Help sessions on physical Windows devices. Authorized helpdesk agents can sign in to a remote device with their own credentials without requiring the user to be present or take action. Helpers can view and control the device to troubleshoot issues and complete support tasks remotely.
Use a new Work IQ button located in the top left of the Chat UI to switch access to work data on/off without leaving the chat experience. Details: What changed: Web and work chats are now unified into a single chat interface…
Use a new Work IQ button located in the top left of the Chat UI to switch access to work data on/off without leaving the chat experience.
Details:
What changed: Web and work chats are now unified into a single chat interface that now has a dedicated Work IQ button to control access to work data. Previously, users switched between separate web and work chat tabs, increasing cognitive load and inconsistency. This change unifies the chat experience and simplifies how users control access to work data when using chat.
Why: Combining chats into one interface with a toggle reduces confusion and streamlines user workflows by providing quick control over access to work data.
Try this:
Open Microsoft 365 Copilot Chat.
Locate the Work IQ button in the top left of the Chat interface.
Work date is on by default; enable or disable work data access as needed by selecting the button.
Why this matters: A unified chat interface reduces switching and helps users focus on their tasks with clearer data context.
Business impact: Teams benefit from a consistent chat experience that improves productivity and reduces user errors.
Personal impact: You spend less time navigating tabs and more time interacting with relevant data.
Users will find an updated, streamlined UX flow within Copilot Notebooks. Roadmap ID: 516042 Details: What changed: The Copilot Notebooks user experience has been revamped with a streamlined flow for opening items and navigating the product. Previously, users faced a more complex…
Users will find an updated, streamlined UX flow within Copilot Notebooks.
What changed: The Copilot Notebooks user experience has been revamped with a streamlined flow for opening items and navigating the product. Previously, users faced a more complex and less cohesive interface. The new design simplifies common tasks and enhances consistency across the product.
Why: Simplifying the user interface reduces friction and helps users work more efficiently within Copilot Notebooks.
Try this:
Open Copilot Notebooks from the Microsoft 365 app launcher.
Use the updated navigation pane to browse notebooks and sections.
Open and edit notebook items with the new streamlined controls.
Why this matters: A simpler, more cohesive interface helps users focus on content creation and reduces time spent on navigation.
Business impact: Teams experience smoother collaboration and faster access to notebook content, improving productivity.
Personal impact: You spend less time navigating and more time working on your notebooks.
Edit with Copilot helps you work with Python in Excel by executing Python code for advanced analysis, automation, and data transformation with results outputted directly in your workbook. Details: What changed: You can now use Edit with Copilot to perform advanced data…
Edit with Copilot helps you work with Python in Excel by executing Python code for advanced analysis, automation, and data transformation with results outputted directly in your workbook.
Details:
What changed: You can now use Edit with Copilot to perform advanced data analysis (statistics, simulations, advanced visualizations etc.) with your workbook data. Existing security and execution controls continue to help manage how code runs.
Why: Python is widely used for data analysis, visualization, and automation. Bringing Copilot-assisted Python editing into Excel helps users move from intent to working analysis faster without switching tools.
Try this:
Open an Excel workbook with data you want to analyze.
Open Edit with Copilot.
Ask Copilot to complete a task like summarizing trends, cleaning data, or creating a visualization with Python.
Review the output and inspect the results in Excel.
Why this matters: This makes advanced analysis more approachable by pairing Python’s flexibility with Copilot’s assistance and Excel’s familiar workspace.
Business impact: Teams can accelerate reporting, analysis, and repeatable data workflows in Excel, helping reduce manual effort and improve consistency.
Personal impact: You can complete more advanced data tasks in Excel with Copilot’s help.
Interact in real time with read aloud in Word with Copilot. While your document is being read aloud, you can ask questions with your voice—such as “What does this mean?” or “Summarize this section”—and get answers instantly. No need to pause and…
Interact in real time with read aloud in Word with Copilot. While your document is being read aloud, you can ask questions with your voice—such as “What does this mean?” or “Summarize this section”—and get answers instantly. No need to pause and search manually. This keeps you in context, reduces interruptions, and helps you understand and act faster.
What changed: Word’s Read Aloud now supports real-time voice interactions powered by Copilot Q&A. Previously, users had to pause reading to search or edit manually. Now, users can ask questions like “What does this mean?” or “Summarize this section” and receive immediate responses without stopping the audio.
Why: This change helps users maintain focus and context while improving comprehension and productivity by enabling seamless voice-driven interaction during document reading.
Try this:
Open a Word document and start Read Aloud from the Review tab.
While listening, say a question such as “Explain this paragraph.”
Listen to Copilot’s spoken answer without pausing the reading.
Why this matters: Real-time voice Q&A reduces interruptions and helps users understand content faster, improving accessibility and workflow.
Business impact: Teams can review and comprehend documents more efficiently, reducing time spent switching between reading and searching.
Personal impact: You save time and maintain focus by getting instant explanations without stopping the reading experience.
Microsoft Intune now surfaces expanded SIM inventory for corporate-owned Android Enterprise devices, including EIDs, multiple ICCIDs, and activation state. View these details under Devices > All devices > select a device > Hardware, and use the reported ICCID to identify the correct…
Microsoft Intune now surfaces expanded SIM inventory for corporate-owned Android Enterprise devices, including EIDs, multiple ICCIDs, and activation state. View these details under Devices > All devices > select a device > Hardware, and use the reported ICCID to identify the correct eSIM for a removal action. EID reporting requires Android 13 and later; full inventory requires Android 15 and later.
Viva Engage content from private communities and events will be used as grounding source for Microsoft 365 Copilot. When a user queries in Microsoft 365 Copilot, they will only be able to see content they are privileged to access. Roadmap ID: 515144…
Viva Engage content from private communities and events will be used as grounding source for Microsoft 365 Copilot. When a user queries in Microsoft 365 Copilot, they will only be able to see content they are privileged to access.
What changed: Microsoft 365 Copilot includes private Engage community and event content when responding to queries. Previously, Copilot did not incorporate private community data. Users only see content they have permission to access, maintaining security and privacy.
Why: Including private community content ensures Copilot provides more relevant and comprehensive answers while respecting access controls.
Try this:
Open Microsoft 365 Copilot.
Ask a question related to your private Engage communities or events.
Review the response that includes content you are authorized to view.
Why this matters: This change enhances Copilot’s relevance by incorporating private organizational knowledge securely.
Business impact: Teams gain improved insights from private discussions without compromising data security.
Personal impact: You receive more accurate answers that include your private community knowledge, improving productivity.
Microsoft Intune now includes a security baseline for Windows 365 for Agents Cloud PCs. Administrators can deploy and customize recommended, device-scoped settings for Windows 11, Microsoft Edge, and Microsoft Defender for Endpoint to establish a consistent security posture for agentic workloads. For…
Microsoft Intune now includes a security baseline for Windows 365 for Agents Cloud PCs. Administrators can deploy and customize recommended, device-scoped settings for Windows 11, Microsoft Edge, and Microsoft Defender for Endpoint to establish a consistent security posture for agentic workloads.
Introduces a new REST endpoint for Work IQ that serves as a unified entry point for invoking agents and workflows, providing a consistent, scalable alternative to legacy Copilot Chat endpoints. Roadmap ID: 559021 Details: What changed: Work IQ now offers a unified…
Introduces a new REST endpoint for Work IQ that serves as a unified entry point for invoking agents and workflows, providing a consistent, scalable alternative to legacy Copilot Chat endpoints.
What changed: Work IQ now offers a unified REST endpoint to invoke agents and workflows, replacing multiple legacy Copilot Chat endpoints. This endpoint standardizes access methods, improves scalability, and simplifies integration for developers working within Microsoft 365 environments.
Why: The unified REST endpoint reduces complexity and enhances scalability, making it easier to integrate and manage agents and workflows programmatically.
Try this:
Use the new Work IQ REST endpoint URL in your API calls.
Send requests to invoke specific agents or workflows.
Monitor responses to manage workflow execution consistently.
Why this matters: A consistent and scalable endpoint simplifies development and improves reliability when integrating Work IQ agents and workflows.
Business impact: Developers and IT teams benefit from easier integration and management of automated workflows, supporting more robust business processes.
Personal impact: You experience reduced integration complexity and more reliable workflow execution, saving time on development and troubleshooting.
You can choose to select Anthropic models, in addition to OpenAI models, when editing a Word document using Copilot. Roadmap ID: 558440 Details: What changed: Copilot in Word now supports selecting Anthropic AI models alongside existing OpenAI models for document editing. Previously,…
You can choose to select Anthropic models, in addition to OpenAI models, when editing a Word document using Copilot.
What changed: Copilot in Word now supports selecting Anthropic AI models alongside existing OpenAI models for document editing. Previously, users could only use OpenAI models. This update expands AI model options, allowing users to pick the model that best fits their editing needs.
Why: Offering Anthropic models provides users with more AI choices, improving flexibility and potentially enhancing editing quality based on different model strengths.
Try this:
Open a Word document and launch Copilot.
In the model selection menu, choose Anthropic models.
Use Copilot to edit your document with the selected model.
Why this matters: Having multiple AI model options lets users tailor Copilot’s editing assistance to their preferences and document requirements.
Business impact: Teams can leverage diverse AI capabilities in Word, improving document quality and collaboration efficiency.
Personal impact: You gain more control over AI editing, enabling better results and a more personalized writing experience.
The Consumption Dashboard tracks Copilot credit usage across AI services and provides budget information to managers, analysts, and administrators. Roadmap ID: 566302 Details: What changed: The new dashboard shows Copilot credit consumption for Cowork and WorkIQ API services. Access is scoped to…
The Consumption Dashboard tracks Copilot credit usage across AI services and provides budget information to managers, analysts, and administrators.
What changed: The new dashboard shows Copilot credit consumption for Cowork and WorkIQ API services. Access is scoped to managers with at least five direct reports, Insights analysts, and Global administrators. It is enabled by default and requires usage-based billing setup via Cost Management in the Microsoft 365 admin center. Tenant-wide leader access is not included in this release. A Cost Management query template is added for Insights analysts and Global administrators in Advanced Insights.
Why: This change provides immediate visibility into AI service costs and usage, helping organizations monitor and manage their Copilot credit spending effectively.
Try this:
Open Microsoft Viva Insights and navigate to the Consumption Dashboard.
Review Copilot credit usage for Cowork and WorkIQ API services.
For advanced analysis, use the new Cost Management query template in Advanced Insights.
Why this matters: Tracking AI service costs helps organizations control budgets and optimize resource allocation.
Business impact: Microsoft 365 administrators, managers, and analysts gain scoped access to cost data, enabling better budget oversight without exposing tenant-wide information.
Personal impact: You can monitor AI usage costs relevant to your team, reducing unexpected charges and improving financial planning.
Once you connect your asset library hosted on Adobe Experience Manager to Microsoft 365 and Copilot, Copilot will create presentations using your organization's images. Roadmap ID: 516038 Details: What changed: Copilot in PowerPoint now accesses enterprise image assets hosted on Adobe Experience…
Once you connect your asset library hosted on Adobe Experience Manager to Microsoft 365 and Copilot, Copilot will create presentations using your organization's images.
What changed: Copilot in PowerPoint now accesses enterprise image assets hosted on Adobe Experience Manager when creating presentations in Edit mode. Previously, Copilot used only publicly available or user-uploaded images. This integration requires connecting your Adobe Experience Manager library to Microsoft 365, ensuring secure use of approved organizational content.
Why: Using enterprise-hosted assets ensures brand consistency and compliance by leveraging approved images. It also streamlines presentation creation by providing direct access to your organization's visual resources.
Try this:
Connect your Adobe Experience Manager asset library to Microsoft 365.
Open PowerPoint and enter Edit mode with Copilot.
Request Copilot to create or enhance slides using your organization's images.
Why this matters: This change helps maintain brand standards and improves efficiency by integrating trusted enterprise assets directly into presentations.
Business impact: Teams can create presentations faster with consistent branding and reduce risks related to unauthorized image use.
Personal impact: You save time searching for approved images and ensure your presentations align with company standards.
You can now create a presentation with Copilot in PowerPoint just as you open the PowerPoint web app. Roadmap ID: 560537 Details: What changed: Copilot integration now allows users to start creating presentations directly from the PowerPoint web app home screen for…
You can now create a presentation with Copilot in PowerPoint just as you open the PowerPoint web app.
What changed: Copilot integration now allows users to start creating presentations directly from the PowerPoint web app home screen for those with Microsoft 365 Copilot Basic and Premium. Previously, users had to open an existing file or create a blank presentation before accessing Copilot features. This update streamlines the workflow by launching Copilot immediately upon opening the app.
Why: This change simplifies the presentation creation process, reducing steps and enabling faster generation of content with Copilot assistance.
Try this:
Open the PowerPoint web app in your browser.
Select the Copilot option on the home screen to start a new presentation.
Follow prompts to generate slides based on your input.
Why this matters: Starting presentations directly with Copilot saves time and lowers the barrier to creating professional content.
Business impact: Teams can accelerate presentation development and reduce delays caused by manual slide creation.
Personal impact: You spend less time setting up presentations and more time focusing on content quality.
Copilot now provides coaching feedback on email drafts via chat and can apply suggestions directly to your message in Outlook. Users have the option to choose which suggestions are applied, and Copilot updates your email in place. Roadmap ID: 559418 Details: What…
Copilot now provides coaching feedback on email drafts via chat and can apply suggestions directly to your message in Outlook. Users have the option to choose which suggestions are applied, and Copilot updates your email in place.
What changed: Previously, Outlook users obtained coaching feedback in canvas and could only apply all suggestions at once. Now, Copilot chat offers the suggestions and users can choose which suggestions to apply, further refine those suggestions and Copilot chat will update the email content in place.
Why: This update helps users improve email clarity and professionalism by providing actionable feedback during composition, reducing the need for manual revisions.
Try this:
Open Outlook and start composing a new email.
Click Get Coaching. 3 The Copilot chat pane automatically opens with coaching suggestions.
Use the chat to iterate on the suggestions or select ones to apply directly to your draft.
Why this matters: Real-time coaching improves communication quality and saves time editing emails.
Business impact: Teams benefit from clearer, more effective email communication with less editing effort.
Personal impact: You save time refining emails and gain confidence in your messaging.
With so many of us in back-to-back meetings, it can be a real struggle to stay on top of pre-reads, action items, and even what each meeting is about. Copilot quickly prepares you for meetings within minutes by bringing real-time insights and…
With so many of us in back-to-back meetings, it can be a real struggle to stay on top of pre-reads, action items, and even what each meeting is about. Copilot quickly prepares you for meetings within minutes by bringing real-time insights and summarizing relevant context, tasks, documents, and other resources. You can also chat directly with Copilot to prepare more deeply, to ensure you're ready to go. This feature is already available in the new Outlook for Windows, Web, Mac, and Mobile and is now being adding to classic Outlook for Windows. It is only available for users with a Microsoft 365 Copilot license.
What changed: Copilot now provides real-time meeting preparation in classic Outlook for Windows by summarizing relevant context, action items, and documents. Users can chat with Copilot to deepen preparation. This feature was already available in new Outlook for Windows, Web, Mac, and Mobile and now extends to classic Outlook. It requires a Microsoft 365 Copilot license.
Why: This update helps users manage back-to-back meetings by quickly delivering essential information and reducing preparation time.
Try this:
Open classic Outlook for Windows.
Select a meeting and open Copilot.
Review the summary of meeting context, tasks, and documents.
Chat with Copilot to ask for additional details or clarifications.
Why this matters: Quick access to meeting insights helps users stay informed and ready, improving meeting effectiveness.
Business impact: Teams benefit from better-prepared meetings, leading to more productive discussions and decisions.
Personal impact: You reduce time spent gathering meeting materials and increase confidence going into meetings.
Copilot connectors now run content crawl and identity crawl in parallel, making ingested content available to users faster than before. Details: What changed: Previously, content crawl and identity crawl executed sequentially, causing delays before content became accessible in Copilot. Now, both crawls…
Copilot connectors now run content crawl and identity crawl in parallel, making ingested content available to users faster than before.
Details:
What changed: Previously, content crawl and identity crawl executed sequentially, causing delays before content became accessible in Copilot. Now, both crawls run in parallel, reducing total processing time. This change improves content freshness and availability without compromising security or permission accuracy.
Why: Sequential crawling delayed content availability, impacting user productivity.
Parallel execution enables:
Faster ingestion of new and updated content
Quicker reflection of identity and permission changes
Try this:
Add or update content in your connected data source.
Observe that content appears in Copilot results sooner than before.
Check that permissions and identity information remain accurate.
Why this matters: Faster content availability helps users access the latest information promptly, supporting timely decision-making.
Business impact: Teams benefit from reduced latency in content updates, improving collaboration and information flow.
Personal impact: You spend less time waiting for new content to appear, increasing efficiency in your work.
Planner Agent will now be available for Microsoft 365 Copilot licensed users in all group-based Planner plans, including basic plans. Roadmap ID: 511820 Details: What changed: Planner Agent, previously limited to premium plans, is now available in all group-based Planner plans for…
Planner Agent will now be available for Microsoft 365 Copilot licensed users in all group-based Planner plans, including basic plans.
What changed: Planner Agent, previously limited to premium plans, is now available in all group-based Planner plans for users with a Microsoft 365 Copilot license. This expands access to Planner Agent features such as task execution and status reporting within basic plans, enhancing productivity without requiring plan upgrades.
Why: Extending Planner Agent to basic plans allows more users to benefit from AI-powered task management, improving team collaboration and efficiency.
Try this:
Open Microsoft Planner with your Microsoft 365 Copilot license.
Access your group-based Planner plan, including basic plans.
Use Planner Agent features like task execution and status reporting to manage your work.
Why this matters: Providing Planner Agent in basic plans democratizes AI task management tools across more teams and projects.
Business impact: Teams using basic Planner plans gain AI assistance, improving task tracking and project outcomes without extra licensing costs.
Personal impact: You can manage tasks smarter and save time using Planner Agent features regardless of your plan tier.
You can now ask Copilot in PowerPoint to reference relevant online sources while creating a presentation. Roadmap ID: 555893 Details: What changed: Copilot in PowerPoint now supports source referencing during presentation creation. Previously, users could not directly incorporate live web information as…
You can now ask Copilot in PowerPoint to reference relevant online sources while creating a presentation.
What changed: Copilot in PowerPoint now supports source referencing during presentation creation. Previously, users could not directly incorporate live web information as source material within Copilot in PowerPoint. This update enables Copilot to gather relevant information from the web and use referenced sources while respecting web content security and privacy standards.
Why: Source referencing helps improve presentation accuracy, relevance, and timeliness by allowing Copilot to use current online information. This reduces manual research and makes it easier to create presentations grounded in up-to-date sources.
Try this:
Open PowerPoint and start a new presentation in Copilot.
Ask Copilot to create a presentation on a topic that would benefit from current web information.
Review the generated slides and source references.
Why this matters: Referencing web sources streamlines research and content creation, helping users create presentations with relevant, up-to-date information.
Business impact: Teams can create presentations grounded in current web information faster, improving research efficiency, collaboration, and content quality.
Personal impact: You save time by letting Copilot incorporate relevant web source information into your slides.
ServiceNow Knowledge and Catalog connectors now enforce access permissions based on user roles such as admin, knowledge manager, and knowledge admin. Details: What changed: Earlier, permissions in ServiceNow Knowledge and Catalog connectors were determined only by user criteria without considering roles. Now,…
ServiceNow Knowledge and Catalog connectors now enforce access permissions based on user roles such as admin, knowledge manager, and knowledge admin.
Details:
What changed: Earlier, permissions in ServiceNow Knowledge and Catalog connectors were determined only by user criteria without considering roles. Now, the connectors evaluate access based on the user's assigned roles in ServiceNow, enabling more granular and accurate permission enforcement for knowledge articles and catalog items. This enhances security by aligning access with organizational role definitions.
Why: Role-based access control aligns permissions with organizational policies and reduces unauthorized access.
This update allows:
More precise permission management
Better compliance with ServiceNow role assignments
Try this:
Assign roles like admin or knowledge manager to users in ServiceNow.
Access knowledge articles or catalog items through Copilot connectors.
Verify that access matches the assigned roles.
Why this matters: Role-based permissions ensure users see only the content they are authorized to access, improving data security.
Business impact: Organizations can enforce ServiceNow role policies consistently across Copilot connectors, reducing risk of permission errors.
Personal impact: You access relevant knowledge and catalog items securely based on your assigned roles without unnecessary restrictions or exposure.
Added guidance describing how to provide external users access to open files protected by user-defined permissions sensitivity labels. For more information, see Limitations.
Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement.Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007 or later. Documentation: Antivirus…
Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement.Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007 or later.
App-only authentication for eDiscovery cmdlets in Security & Compliance PowerShell is unsupported. Transition automations to Microsoft Graph APIs where available; the documented certificate-based authentication steps are best-effort guidance for existing automations and don't change the support status.
App-only authentication for eDiscovery cmdlets in Security & Compliance PowerShell is unsupported. Transition automations to Microsoft Graph APIs where available; the documented certificate-based authentication steps are best-effort guidance for existing automations and don't change the support status.
Auto-labeling policies can target more than 100 SharePoint sites by using an existing adaptive scope with the SharePointAdaptiveScopes parameter with New-AutoSensitivityLabelPolicy.
Review the match results and source distribution to determine whether the policy is ready to enforce.
Before enforcing an auto-labeling policy, run it in simulation mode to identify which items it would label without making any changes. Review the match results and source distribution to determine whether the policy is ready to enforce.
Guidance for DLP policies in Microsoft Edge for Business now explains policy sync status, where to investigate managed and unmanaged app activity, and coverage limitations caused by duplicate app catalog entries, encoded traffic, dynamic endpoints, and shared consumer and enterprise URLs.
Guidance for DLP policies in Microsoft Edge for Business now explains policy sync status, where to investigate managed and unmanaged app activity, and coverage limitations caused by duplicate app catalog entries, encoded traffic, dynamic endpoints, and shared consumer and enterprise URLs.
If an Exchange DLP policy uses sensitivity labels as a condition and policy tips while mandatory labeling is enabled, selecting a label from the mandatory-labeling prompt doesn't reevaluate the policy tip. The configured DLP action is still enforced.
If an active auto-labeling policy stops matching Exchange email because a rule failed to load, contact Microsoft Support to identify the affected rule.
Microsoft 365 audit log activities now include Microsoft Defender for Cloud activities, People Skills activities, Microsoft 365 Archive file-level policy activities, and Microsoft Purview permission activities.
Microsoft Purview support for Anthropic Claude Enterprise now includes data classification, Insider Risk Management, Communication Compliance, eDiscovery, Data Lifecycle Management, and Compliance Manager.
Enables organizations to automate the offboarding of Linux servers from Microsoft Defender for Endpoint through the Offboard machine API, simplifying device lifecycle management at scale.Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007 or later. Documentation: Offboarding API support for Linux
Enables organizations to automate the offboarding of Linux servers from Microsoft Defender for Endpoint through the Offboard machine API, simplifying device lifecycle management at scale.Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007 or later.
After simulation, review, and required approvals, selected files bypass the recycle bins and are no longer discoverable in SharePoint search, Microsoft 365 Copilot, or eDiscovery.
Deploy client version 101.26072 or later, configure protection modes, monitor permission status, and notify users if they disable the required Device Control and Data Access permission.
Prepare Endpoint DLP for permission changes in macOS 27. Deploy client version 101.26072 or later, configure protection modes, monitor permission status, and notify users if they disable the required Device Control and Data Access permission.
Remove a retention hold from an unlicensed OneDrive site by using Security & Compliance PowerShell. The guidance covers tenant-level and site-level holds, prerequisites, and common errors that can block site deletion.
Create auto-labeling policies that protect sensitive data at rest in non-Microsoft connected apps, including Box and Google Workspace. These policies use the existing Microsoft Defender for Cloud Apps connectors and support the same classification engine available for Microsoft 365 locations.
Sensitivity label policies for non-Microsoft connected apps. Create auto-labeling policies that protect sensitive data at rest in non-Microsoft connected apps, including Box and Google Workspace. These policies use the existing Microsoft Defender for Cloud Apps connectors and support the same classification engine available for Microsoft 365 locations.
Detects and alerts on unauthorized modifications to Defender configurations, files, directories, processes, and services, including attempts by root users. Tampering activity is surfaced through alerts, the device timeline, and Advanced Hunting without blocking the activity.Available in Microsoft Defender for Endpoint on Linux…
Detects and alerts on unauthorized modifications to Defender configurations, files, directories, processes, and services, including attempts by root users. Tampering activity is surfaced through alerts, the device timeline, and Advanced Hunting without blocking the activity.Available in Microsoft Defender for Endpoint on Linux version 101.26072.0004 or later in Insiders-slow channel.
The Endpoint DLP capability comparison now clarifies that policies for access by apps not included in a restricted apps list or restricted app group are supported on Windows but not on macOS.
The Endpoint DLP capability comparison now clarifies that policies for access by apps not included in a restricted apps list or restricted app group are supported on Windows but not on macOS.
The Insights tab in the policy details panel provides an at-a-glance view of an auto-labeling policy's performance. The information shown varies depending on whether the policy is running in simulation or enforcement mode, helping you understand how it identifies or labels content.
The Insights tab in the policy details panel provides an at-a-glance view of an auto-labeling policy's performance. The information shown varies depending on whether the policy is running in simulation or enforcement mode, helping you understand how it identifies or labels content.
Create DLP policies that protect sensitive data at rest in non-Microsoft connected applications, such as Box and Google Workspace. These policies use the existing Microsoft Defender for Cloud Apps connectors and support the same classification engine available for Microsoft 365 locations.
Use data loss prevention policies for non-Microsoft connected apps. Create DLP policies that protect sensitive data at rest in non-Microsoft connected applications, such as Box and Google Workspace. These policies use the existing Microsoft Defender for Cloud Apps connectors and support the same classification engine available for Microsoft 365 locations.
You can now monitor vulnerabilities on devices running Microsoft Store applications, including Microsoft Teams, Mozilla Firefox, WhatsApp, Slack, Dropbox, DuckDuckGo, Dell Command Documentation: Vulnerability assessment for Microsoft Store applications
You can now monitor vulnerabilities on devices running Microsoft Store applications, including Microsoft Teams, Mozilla Firefox, WhatsApp, Slack, Dropbox, DuckDuckGo, Dell Command
Learn how to identify and remove delay holds before recalculating mailbox hold status.
When you remove the last hold from an inactive mailbox, Microsoft 365 automatically applies a 30-day delay hold. Learn how to identify and remove delay holds before recalculating mailbox hold status.
Support connection edit of user mapping, query filter for ServiceNow Roadmap ID: 503590 Details: What changed: Previously, once the ServiceNow connector was configured, user mappings and query filters could not be changed without recreating the connection. Now, admins can edit these settings…
Support connection edit of user mapping, query filter for ServiceNow
What changed: Previously, once the ServiceNow connector was configured, user mappings and query filters could not be changed without recreating the connection. Now, admins can edit these settings directly within the connector configuration. This update enhances security by allowing precise control over data queries and user access mappings without disrupting the connection.
Why: Allowing edits to user mappings and query filters reduces the need to recreate connectors, saving time and minimizing configuration errors. It also improves data security by enabling more granular control over what data is accessed and how users are mapped.
Try this:
Open the Microsoft 365 admin center and navigate to the Copilot Extensibility connectors.
Select the ServiceNow connector and choose 'Edit connection.'
Update user mappings or query filters as needed and save changes.
Why this matters: This change streamlines connector management and enhances security by enabling ongoing adjustments without downtime.
Business impact: Teams can maintain accurate data synchronization and user access without interrupting workflows or recreating connectors.
Personal impact: Admins save time managing connectors and reduce errors by editing settings directly instead of recreating connections.
Adaptive card refresh now works in custom engine agents, improving dynamic content updates. Details: What changed: Adaptive card refresh is enabled for adaptive cards in custom engine agents, allowing cards to update dynamically without user intervention. Previously, adaptive card refresh was not…
Adaptive card refresh now works in custom engine agents, improving dynamic content updates.
Details:
What changed: Adaptive card refresh is enabled for adaptive cards in custom engine agents, allowing cards to update dynamically without user intervention. Previously, adaptive card refresh was not supported in these agents, limiting real-time content updates. This change enhances responsiveness and user interaction within custom agent scenarios.
Why: Enabling adaptive card refresh in custom engine agents allows for more interactive and up-to-date user experiences. It reduces the need for manual refreshes and improves the accuracy of displayed information.
Try this:
Create or open a custom engine agent in the Copilot Extensibility environment.
Add an adaptive card that supports refresh actions.
Trigger the adaptive card refresh to see updated content without reloading the agent.
Why this matters: Dynamic content updates in custom agents improve user engagement and ensure information remains current without extra user steps.
Business impact: Teams using custom engine agents benefit from more interactive workflows and reduced manual refresh overhead.
Personal impact: You experience smoother interactions with adaptive cards that update automatically, saving time and reducing friction.
A new Copilot icon button provides a quick, visible entry point to Copilot directly within the file previewer in OneDrive. Positioned at the bottom-right corner (instead of the command bar), this button surfaces contextual prompts tailored to the file type and offers…
A new Copilot icon button provides a quick, visible entry point to Copilot directly within the file previewer in OneDrive. Positioned at the bottom-right corner (instead of the command bar), this button surfaces contextual prompts tailored to the file type and offers seamless access to Copilot chat, making it easier to get insights and take action without leaving the preview experience.
What changed: The file previewer in OneDrive and SharePoint now shows a floating Copilot button at the bottom right corner instead of the command bar. This button offers prompts tailored to the file type and quick access to Copilot chat. Previously, users had to open Copilot separately to get insights on files.
Why: Placing Copilot directly in the file previewer reduces steps to get contextual assistance, improving workflow efficiency.
Try this:
Open a file in OneDrive or SharePoint previewer.
Click the Copilot button at the bottom right.
Use the contextual prompts or start a chat to get insights about the file.
Why this matters: This update makes it easier to get file-specific help without leaving the preview experience.
Business impact: Teams can review and act on file content faster with integrated Copilot access during preview.
Personal impact: You save time by accessing tailored Copilot assistance directly within file previews.
Users will be able to list the file attachments that they received or sent over email in Microsoft 365 Copilot. Roadmap ID: 497909 Details: What changed: Microsoft 365 Copilot now provides a list of email file attachments from messages you sent or…
Users will be able to list the file attachments that they received or sent over email in Microsoft 365 Copilot.
What changed: Microsoft 365 Copilot now provides a list of email file attachments from messages you sent or received. Previously, users had to manually search emails to find attachments. This update improves visibility and access to files directly through Copilot chat.
Why: Finding email attachments quickly is essential for efficient communication and file management. This change reduces time spent searching and improves workflow.
Try this:
Open Microsoft 365 Copilot chat.
Ask to list email attachments from a specific sender or date.
Review the generated list of files attached to those emails.
Why this matters: Quick access to email attachments saves time and reduces the risk of missing important files.
Business impact: Teams can retrieve shared documents faster, improving collaboration and reducing delays.
Personal impact: You spend less time searching emails and more time focusing on tasks that require those attachments.
Users will be able to search for and select SharePoint Lists through the Context IQ menu to help ground their prompts when using Copilot Chat. Roadmap ID: 422308 Details: What changed: Previously, users could not directly access SharePoint Lists within Context IQ…
Users will be able to search for and select SharePoint Lists through the Context IQ menu to help ground their prompts when using Copilot Chat.
What changed: Previously, users could not directly access SharePoint Lists within Context IQ when composing prompts in Copilot Chat. Now, users can search for and select specific SharePoint Lists to ground their prompts, improving relevance and accuracy. This integration supports Microsoft 365 security and compliance policies for data access.
Why: This change helps users target their Copilot Chat prompts to specific SharePoint Lists, reducing irrelevant results and improving productivity when working with list data.
Try this:
Open Copilot Chat and click the Context IQ menu.
Search for a SharePoint List by name.
Select the desired list to scope your prompt before entering your query.
Why this matters: Scoping prompts to SharePoint Lists helps users get more precise and useful responses from Copilot Chat.
Business impact: Teams can collaborate more effectively by referencing exact SharePoint Lists in their Copilot Chat interactions.
Personal impact: You save time by quickly narrowing Copilot Chat responses to relevant list data without manual filtering.
Copilot in SharePoint lets you plan and build SharePoint solutions using natural language commands. Details: What changed: Copilot in SharePoint now supports creating SharePoint solutions through natural language input. Why: Building SharePoint solutions typically requires technical expertise and time. This change lowers…
Copilot in SharePoint lets you plan and build SharePoint solutions using natural language commands.
Details:
What changed: Copilot in SharePoint now supports creating SharePoint solutions through natural language input.
Why: Building SharePoint solutions typically requires technical expertise and time. This change lowers the barrier by enabling users to describe their needs in natural language, accelerating development and reducing errors.
Try this:
Visit the Build node of the SharePoint start page.
Describe your goal in the top text box that asks what you would like to build today.
Enter a natural language request to plan or build a SharePoint solution.
Review and customize the generated SharePoint site.
Why this matters: Simplifying SharePoint solution creation empowers more users to create better solutions faster.
Business impact: Teams can deploy SharePoint solutions faster, improving collaboration.
Personal impact: You can create SharePoint sites using natural language, saving time and effort.
The Copilot Notebooks Overview now provides a redesigned experience for crisper AI-generated summaries, key insights, and one-click artifacts to move work forward in the notebook. Details: What changed: The Notebook Overview experience has been redesigned with a better layout and direct visibility…
The Copilot Notebooks Overview now provides a redesigned experience for crisper AI-generated summaries, key insights, and one-click artifacts to move work forward in the notebook.
Details:
What changed: The Notebook Overview experience has been redesigned with a better layout and direct visibility of meaningful artifacts users can create in the notebook in one click.
Why: This redesign helps users quickly grasp notebook context and take relevant actions without spending time on manual content review.
Try this:
Open a Copilot Notebook and navigate to the Overview Page.
Review the AI-generated summary and key insights.
Use the one-click artifact creation option to create content focused on the context and content of the notebook.
Why this matters: Reduce time spent getting a quick summary and key insights of the notebook content, easily see and use one-click artifacts that help move your work forward in the notebook.
Business impact: Teams can collaborate more effectively by accessing summarized notebook information, actionable insights, creating new artifacts quickly.
Personal impact: You save time understanding notebook content and can act faster on relevant information.
The Copilot Notebooks Overview now provides a redesigned experience for crisper AI-generated summaries, key insights, and one-click artifacts to move work forward in the notebook. Details: What changed: The Notebook Overview experience has been redesigned with a better layout and direct visibility…
The Copilot Notebooks Overview now provides a redesigned experience for crisper AI-generated summaries, key insights, and one-click artifacts to move work forward in the notebook.
Details:
What changed: The Notebook Overview experience has been redesigned with a better layout and direct visibility of meaningful artifacts users can create in the notebook in one click.
Why: This redesign helps users quickly grasp notebook context and take relevant actions without spending time on manual content review.
Try this:
Open a Copilot Notebook and navigate to the Overview Page.
Review the AI-generated summary and key insights.
Use the one-click artifact creation option to create content focused on the context and content of the notebook.
Why this matters: Reduce time spent getting a quick summary and key insights of the notebook content, easily see and use one-click artifacts that help move your work forward in the notebook.
Business impact: Teams can collaborate more effectively by accessing summarized notebook information, actionable insights, creating new artifacts quickly.
Personal impact: You save time understanding notebook content and can act faster on relevant information.
Agent Builder now supports using a SharePoint list as a knowledge source for agents in Microsoft 365 Copilot. Makers can ground an agent in structured list data so users can ask questions and get responses based on information stored in a selected…
Agent Builder now supports using a SharePoint list as a knowledge source for agents in Microsoft 365 Copilot. Makers can ground an agent in structured list data so users can ask questions and get responses based on information stored in a selected SharePoint list. For this release, each agent can reference one SharePoint list with up to 20,000 items, alongside other knowledge source types. Support for list attachments and lookup columns is not yet available.
What changed: Each agent can now reference one SharePoint list with up to 20,000 items alongside other knowledge sources. Previously, agents could not use SharePoint lists as a data source. Support for list attachments and lookup columns is not yet available, which limits some data types.
Why: This change allows makers to ground agents in structured SharePoint list data, improving the relevance and accuracy of responses. It expands the types of data agents can use without requiring custom integrations.
Try this:
Open Agent Builder and create or edit an agent.
Select SharePoint list as a knowledge source.
Choose a SharePoint list with up to 20,000 items to ground your agent.
Why this matters: Using SharePoint lists as a knowledge source lets agents answer questions based on structured organizational data, improving user support and information access.
Business impact: Teams can leverage existing SharePoint lists to build more informed agents, reducing manual data preparation and integration efforts.
Personal impact: You can create agents that provide accurate answers from your SharePoint data, saving time on information retrieval.
Copilot now displays rich images from files and meetings directly within responses to improve comprehension. Details: What changed: Previously, Copilot responses included text only. Now, it surfaces relevant images inline from files and meetings to provide visual context. This enhancement supports richer…
Copilot now displays rich images from files and meetings directly within responses to improve comprehension.
Details:
What changed: Previously, Copilot responses included text only. Now, it surfaces relevant images inline from files and meetings to provide visual context. This enhancement supports richer content formats while maintaining data security and compliance with Microsoft 365 policies. This applies to Microsoft 365 Copilot licenses only.
Why: Visual information helps users understand complex content faster and reduces the need to switch between apps or documents.
Try this:
Ask Copilot a question related to your meeting notes or documents.
Review the inline images that appear alongside the text response.
Click images to open the source file or meeting content for more details.
Why this matters: Including images directly in responses helps users grasp information quickly and reduces context switching.
Business impact: Teams can collaborate more effectively by accessing visual content without leaving the Copilot interface.
Personal impact: You save time by seeing relevant images immediately, improving comprehension and decision-making.
Give users a fast, built‑in way to capture screenshots and include them in Copilot prompts, helping them communicate visual context more easily and receive more accurate, actionable assistance. Roadmap ID: 558105 Details: What changed: Copilot now includes a built-in screenshot capture tool…
Give users a fast, built‑in way to capture screenshots and include them in Copilot prompts, helping them communicate visual context more easily and receive more accurate, actionable assistance.
What changed: Copilot now includes a built-in screenshot capture tool that lets users add images directly to their prompts. Previously, users had to capture and upload screenshots manually outside Copilot. This integration improves prompt clarity and response relevance without exposing sensitive data externally.
Why: Visual context helps Copilot understand user requests better, leading to more precise and actionable responses.
Try this:
In Copilot chat, select the screenshot capture button.
Capture the desired screen area.
Include the screenshot in your prompt and submit for assistance.
Why this matters: Adding screenshots reduces miscommunication and speeds up problem resolution with Copilot.
Business impact: Users get a simpler UX to include visuals when using Copilot to help reduce confusion and support interactions.
Personal impact: You save time explaining problems and get more accurate help by sharing visual information instantly.
Microsoft Intune now lets you collect Windows registry data through the properties catalog. When you create a device inventory policy, you can define specific registry keys and values to collect from enrolled Windows devices, including a single value, all values directly under…
Microsoft Intune now lets you collect Windows registry data through the properties catalog. When you create a device inventory policy, you can define specific registry keys and values to collect from enrolled Windows devices, including a single value, all values directly under a key, or the same value across subkeys under HKEY_LOCAL_MACHINE. This gives you richer device state visibility and advanced querying without custom scripts.
In preview, Microsoft Intune now supports Controlled Configuration for Microsoft Defender antivirus settings. When you enable it, the Defender antivirus settings delivered by Intune or Microsoft Defender for Endpoint security settings management become authoritative and override configurations from other channels, such as…
In preview, Microsoft Intune now supports Controlled Configuration for Microsoft Defender antivirus settings. When you enable it, the Defender antivirus settings delivered by Intune or Microsoft Defender for Endpoint security settings management become authoritative and override configurations from other channels, such as Group Policy, Configuration Manager, and local scripts. Extending Tamper Protection, this capability locks settings to your defined values for consistent and predictable device states.
Microsoft Intune now supports custom compliance settings for macOS. As an admin, you can define compliance checks using scripts and JSON rules, similar to existing support for Windows and Linux. This capability lets you evaluate device configuration, security posture, and other custom…
Microsoft Intune now supports custom compliance settings for macOS. As an admin, you can define compliance checks using scripts and JSON rules, similar to existing support for Windows and Linux. This capability lets you evaluate device configuration, security posture, and other custom attributes not covered by built-in settings. Results appear alongside standard compliance reporting in the Intune admin center.
Microsoft Intune now provides a dedicated role-based access control (RBAC) permission for Google zero-touch enrollment portal access. Previously, the zero-touch enrollment iframe in the Microsoft Intune admin center required the Update app sync permission, which also grants rights to manage Managed Google…
Microsoft Intune now provides a dedicated role-based access control (RBAC) permission for Google zero-touch enrollment portal access. Previously, the zero-touch enrollment iframe in the Microsoft Intune admin center required the Update app sync permission, which also grants rights to manage Managed Google Play app sync. With the dedicated permission, you can grant zero-touch enrollment portal access independently from app management permissions.
Microsoft Intune now supports a more comprehensive on-demand sync for Windows devices. When you select the Sync device action in the Microsoft Intune admin center, Intune initiates a full synchronization across key workloads, including configuration policies, apps, and scripts, so devices reflect…
Microsoft Intune now supports a more comprehensive on-demand sync for Windows devices. When you select the Sync device action in the Microsoft Intune admin center, Intune initiates a full synchronization across key workloads, including configuration policies, apps, and scripts, so devices reflect your latest changes faster. This capability is especially useful during troubleshooting, incident response, and high-priority rollouts.
The Microsoft Edge administrative templates were refreshed to Microsoft Edge 149 (version 149.0.4022.21), which adds the latest Microsoft Edge 148 and 149 policy settings to the Windows settings catalog. The new settings are: Allow Local Fonts permission on these sites (LocalFontsAllowedForUrls) Allow…
The Microsoft Edge administrative templates were refreshed to Microsoft Edge 149 (version 149.0.4022.21), which adds the latest Microsoft Edge 148 and 149 policy settings to the Windows settings catalog. The new settings are:
There are new OneDrive settings in the Windows settings catalog: Set a custom name for the OneDrive folder – sets a custom name for the synced OneDrive folder on the user's device. Enable OpenID Connect (OIDC) authentication for syncing content from an…
There are new OneDrive settings in the Windows settings catalog:
Set a custom name for the OneDrive folder – sets a custom name for the synced OneDrive folder on the user's device.
Enable OpenID Connect (OIDC) authentication for syncing content from an on-prem SharePoint Server using the OneDrive sync app – lets the OneDrive sync app authenticate to an on-premises SharePoint Server using OpenID Connect when the server supports it.
Specify the Application ID URI for your Entra application for OIDC – specifies the Application ID URI for your Microsoft Entra application used for OIDC when it differs from your SharePoint Server URL.
Prevent users at your organization from enabling offline mode in OneDrive on the web – blocks users from turning on offline mode for OneDrive on the web.
Prevent users at your organization from enabling offline mode in OneDrive on the web for libraries and folders that are shared from other organizations – blocks offline mode for libraries and folders shared from other organizations.
Hard-delete the contents of a folder shortcut when unmounted – permanently deletes the contents of a folder shortcut when it is unmounted instead of moving them to the Recycle Bin.
Hard-delete contents of a folder shortcut when a user loses permissions to the folder – permanently deletes the contents of a folder shortcut when the user loses permissions to that folder.
There are new Windows App settings in the Windows settings catalog. To see and configure them in Intune, create a Windows settings catalog profile (Devices > Manage devices > Configuration > Create > New policy > Windows 10 and later > Settings…
There are new Windows App settings in the Windows settings catalog. To see and configure them in Intune, create a Windows settings catalog profile (Devices > Manage devices > Configuration > Create > New policy > Windows 10 and later > Settings catalog). The new settings are:
Turn off automatic updates for Windows App – controls whether Windows App automatically checks for and installs updates.
Automatically log off users after inactive interval – signs users out of Windows App after a set period of inactivity.
Skip First Run Experience (FRE) – skips the first-run experience so users go straight to their resources.
Admin Release Ring Policy – sets the update release ring (channel) that Windows App follows.
Automatically create Windows App shortcuts to desktop – creates desktop shortcuts for published Windows App resources.
The existing Remove Default Microsoft Store packages setting in the ApplicationManagement area has a new subsetting, Specify additional package family names to remove. It lets you provide a custom list of package family names (PFNs) to remove, in addition to the built-in…
The existing Remove Default Microsoft Store packages setting in the ApplicationManagement area has a new subsetting, Specify additional package family names to remove. It lets you provide a custom list of package family names (PFNs) to remove, in addition to the built-in default set of Microsoft Store packages. For more information, see the ApplicationManagement policy CSP.
The new Disable Get Started setting prevents the Windows Get Started app from being available to users. For more information, see the Experience policy CSP.
The new Disable Get Started setting prevents the Windows Get Started app from being available to users. For more information, see the Experience policy CSP.
Microsoft Intune now includes new settings in the Windows settings catalog for Windows devices. You can configure options for camera behavior, Keyboard Filter controls (for Windows Insider devices), and Windows Subsystem for Linux (WSL). To find them, go to Devices > Manage…
Microsoft Intune now includes new settings in the Windows settings catalog for Windows devices. You can configure options for camera behavior, Keyboard Filter controls (for Windows Insider devices), and Windows Subsystem for Linux (WSL). To find them, go to Devices > Manage devices > Configuration > Create > New policy > Windows 10 and later > Settings catalog.
Microsoft Intune now supports regional selection for Microsoft Store apps. When you add a Microsoft Store app, you can choose the region (market) whose Store catalog to search and deploy from. Previously, Intune searched only the United States catalog. Now you can…
Microsoft Intune now supports regional selection for Microsoft Store apps. When you add a Microsoft Store app, you can choose the region (market) whose Store catalog to search and deploy from. Previously, Intune searched only the United States catalog. Now you can deploy apps published for specific markets, such as Japan or Spain, that aren't available in the US catalog.
Microsoft Intune now integrates with Samsung Knox E-FOTA (Firmware Over-The-Air), so you can manage firmware updates for corporate-owned Samsung devices directly in the Microsoft Intune admin center. Control which firmware version each device receives, deploy updates without user interaction, and schedule downloads…
Microsoft Intune now integrates with Samsung Knox E-FOTA (Firmware Over-The-Air), so you can manage firmware updates for corporate-owned Samsung devices directly in the Microsoft Intune admin center. Control which firmware version each device receives, deploy updates without user interaction, and schedule downloads and installations to reduce downtime.
Microsoft Intune now supports hiding or showing new Setup Assistant screens during automated device enrollment (ADE) for tvOS and visionOS devices. When you configure an enrollment profile, you can choose which screens, such as Apple ID, Diagnostics Data, and Location Services, appear…
Microsoft Intune now supports hiding or showing new Setup Assistant screens during automated device enrollment (ADE) for tvOS and visionOS devices. When you configure an enrollment profile, you can choose which screens, such as Apple ID, Diagnostics Data, and Location Services, appear during setup. By default, these screens are shown.
The Visual Studio administrative templates were refreshed to version 1.0.184.40051, which adds the latest Visual Studio policy settings to the Windows settings catalog. The new setting is: Disable Model Context Protocol (MCP) (DisableMCP) For more information, see the Visual Studio administrative templates…
The Visual Studio administrative templates were refreshed to version 1.0.184.40051, which adds the latest Visual Studio policy settings to the Windows settings catalog. The new setting is:
Agents built with the Model Context Protocol (MCP) are available in Word, Excel, PowerPoint, Outlook, and Catalyst. Details: What changed: Users can now access agents built with the Model Context Protocol (MCP) directly within Word, Excel, PowerPoint, Outlook, and Catalyst apps. Previously,…
Agents built with the Model Context Protocol (MCP) are available in Word, Excel, PowerPoint, Outlook, and Catalyst.
Details:
What changed: Users can now access agents built with the Model Context Protocol (MCP) directly within Word, Excel, PowerPoint, Outlook, and Catalyst apps. Previously, these agents were not integrated into these Office applications. This update enables seamless agent interactions using MCP across multiple Microsoft 365 apps.
Why: Integrating MCP agents into core Office apps improves user productivity by providing contextual assistance and data retrieval without switching applications.
Try this:
Open Word, Excel, PowerPoint, Outlook, or Catalyst.
Access the Copilot pane.
Interact with MCP-enabled agents to get contextual assistance.
Why this matters: This integration brings consistent agent support across popular Office apps, enhancing workflow continuity.
Business impact: Teams can leverage MCP agents within familiar Office environments, reducing context switching and improving collaboration.
Personal impact: You gain faster access to intelligent assistance within your everyday Office apps, saving time and effort.
Support for hierarchical ACLs for SNOW and Confluence connectors. Roadmap ID: 503587 Details: What changed: The connectors for Confluence and ServiceNow now evaluate parent-level permissions when determining access to child items. Previously, only child item permissions were considered, which could lead to…
Support for hierarchical ACLs for SNOW and Confluence connectors.
What changed: The connectors for Confluence and ServiceNow now evaluate parent-level permissions when determining access to child items. Previously, only child item permissions were considered, which could lead to inconsistent access control. This update supports nested permissions, improving security and compliance.
Why: Supporting hierarchical permissions ensures that access control aligns with organizational policies and reduces unauthorized data exposure in Copilot extensibility scenarios.
Try this:
Review your Confluence or ServiceNow catalog permissions.
Configure parent and child item permissions to reflect your organizational hierarchy.
Verify access control behavior in Microsoft Copilot to confirm hierarchical permissions are enforced.
Why this matters: Accurate permission evaluation prevents unauthorized access and maintains data security across integrated systems.
Business impact: Security teams can enforce consistent access policies across multiple platforms, reducing risk of data leaks.
Personal impact: Users see search and content results that respect organizational permission structures, reducing confusion and access issues.
Organizations can build their own collections of prompts that are tailored to their business needs and workflows and distribute these to all users within the tenant. Roadmap ID: 486695 Details: What changed: Admins can now build prompt collections specific to their company's…
Organizations can build their own collections of prompts that are tailored to their business needs and workflows and distribute these to all users within the tenant.
What changed: Admins can now build prompt collections specific to their company's needs and publish them tenant-wide through the Copilot Prompt Gallery. Previously, users only had access to default prompts without centralized management or customization options.
Why: This change allows organizations to standardize and optimize Copilot usage by providing prompts aligned with internal processes and terminology.
Try this:
Open the Copilot Prompt Gallery in the Microsoft 365 admin center.
Create a new prompt collection tailored to your business workflows.
Publish the collection to all users in your tenant for consistent access.
Why this matters: Centralized prompt management improves user efficiency and ensures Copilot responses align with company standards.
Business impact: Teams gain consistent access to relevant prompts, reducing training needs and improving productivity.
Personal impact: Users benefit from prompts that reflect their daily tasks, saving time and reducing guesswork.
Seamlessly create brand kits by uploading your brand guidelines document. Details: What changed: Users can now upload a brand guidelines document to automatically generate brand kits. Previously, creating brand kits required manual setup and configuration. This update streamlines the process and reduces…
Seamlessly create brand kits by uploading your brand guidelines document.
Details:
What changed: Users can now upload a brand guidelines document to automatically generate brand kits. Previously, creating brand kits required manual setup and configuration. This update streamlines the process and reduces setup errors.
Why: This change simplifies brand kit creation by automating the extraction of brand elements from guidelines, saving time and ensuring consistency.
Try this:
Open the brand kit creation tool.
Upload your brand guidelines document.
Review and customize the generated brand kit.
Why this matters: Automating brand kit creation helps maintain brand consistency and reduces manual effort.
Business impact: Teams can produce standardized brand assets faster, improving brand compliance across projects.
Personal impact: You save time setting up brand kits and reduce errors from manual configuration.
Admins can now deploy and manage Federated Copilot Connectors (MCP-based connectors) directly from the Connectors tab under Copilot in the Microsoft 365 admin center. Details: What changed: Previously, Copilot connectors primarily enabled organizations to index and sync organizational data into Microsoft 365.…
Admins can now deploy and manage Federated Copilot Connectors (MCP-based connectors) directly from the Connectors tab under Copilot in the Microsoft 365 admin center.
Details:
What changed: Previously, Copilot connectors primarily enabled organizations to index and sync organizational data into Microsoft 365. With Federated Copilot connectors, admins can now enable connections to external data sources through the Model Context Protocol (MCP), including custom line-of-business applications and publicly available MCP servers. These connectors use user-level authentication to access data at runtime, eliminating the need for organizational indexing while preserving existing source permissions.
Why: Organizations need a centralized way to govern and manage both indexed and federated data connections used by Microsoft 365 Copilot. Bringing Federated Copilot Connectors into the Connectors experience simplifies administration while maintaining security and compliance controls.
Try this:
Sign in to Microsoft 365 admin center.
Navigate to Copilot, and then Connectors.
Deploy or update Federated Copilot Connectors for users.
Why this matters: Provides centralized governance for MCP-based connectors, reduces administrative overhead, and accelerates deployment of approved external data sources across the organization.
Business impact: IT teams can efficiently manage Copilot connectors at scale, improving governance and deployment speed.
Personal impact: Users gain faster access to approved external tools and data sources in Copilot while benefiting from secure, user-scoped access that respects existing permissions.
Microsoft Edge will update the Look and Feel to give customers a unified experience across all of Microsoft AI surfaces including Copilot and Bing. This will change multiple elements of the UX such as spacing, corners, fonts, default colors, etc. Roadmap ID:…
Microsoft Edge will update the Look and Feel to give customers a unified experience across all of Microsoft AI surfaces including Copilot and Bing. This will change multiple elements of the UX such as spacing, corners, fonts, default colors, etc.
What changed: Microsoft Edge version 149 introduces a refreshed user interface that aligns with the design language used in Copilot and Bing. Changes include updated spacing, rounded corners, new font styles, and revised default color schemes. This unified design enhances consistency across Microsoft AI products without affecting browser functionality or security settings.
Why: Updating the interface creates a cohesive experience across Microsoft AI tools, reducing user confusion and improving visual comfort. Consistent design helps users transition smoothly between Edge, Copilot, and Bing.
Try this:
Open Microsoft Edge and notice the updated spacing and corner styles.
Compare font styles and colors with those in Copilot or Bing.
Use the browser as usual to experience the consistent design across AI surfaces.
Why this matters: A consistent design across Microsoft AI tools improves usability and reduces the learning curve for users working with multiple Microsoft products.
Business impact: Teams benefit from a unified interface that simplifies training and support for Microsoft AI tools integrated with Edge.
Personal impact: You experience a visually coherent environment that reduces distraction and makes navigation more intuitive.
Customers can submit their agents built in Agent Builder to the Agent Store under the "Built by your org" section, after admin review and approval in Microsoft 365 Admin Center. This governed flow enables admins to review, approve, and publish submitted agents…
Customers can submit their agents built in Agent Builder to the Agent Store under the "Built by your org" section, after admin review and approval in Microsoft 365 Admin Center. This governed flow enables admins to review, approve, and publish submitted agents so that they can be discovered and used by others in the Agent Store. This helps organizations share validated agents at scale while maintaining quality and governance.
What changed: Customers can submit agents created in Agent Builder to the Agent Store after admin review and approval in the Microsoft 365 Admin Center. Previously, there was no governed process for publishing custom agents at scale. This update introduces a controlled workflow that maintains quality and governance while enabling agent sharing within organizations.
Why: This change helps organizations share validated custom agents securely and efficiently. Admin review ensures agents meet organizational standards before publication.
Try this:
Build an agent in Agent Builder.
Submit the agent for admin review in the Microsoft 365 Admin Center.
After approval, find the agent published under 'Built by your org' in the Agent Store.
Why this matters: Governed submission protects organizational security while enabling wider use of custom Copilot agents.
Business impact: Organizations can scale agent deployment with centralized control, improving collaboration and compliance.
Personal impact: You gain access to trusted, organization-approved agents that enhance productivity and reduce duplicated effort.
Microsoft Defender now assesses posture risk for AI agents, including enterprise agents and local agents discovered on endpoint devices. Risk levels are based on active risk indicators, such as configuration, access, runtime activity, endpoint and user context, and active alerts. Security teams…
Microsoft Defender now assesses posture risk for AI agents, including enterprise agents and local agents discovered on endpoint devices. Risk levels are based on active risk indicators, such as configuration, access, runtime activity, endpoint and user context, and active alerts. Security teams can use posture risk and recommendations to prioritize risky agents and improve agent security posture. For more information, see AI agent posture risk in Microsoft Defender.
AI agent runtime protection includes these enhancements:- Vendor-supported agent event interfaces now work with standard platform and engine update channels, so no Beta channel configuration is required. Agent-native event inspection now supports Codex CLI and the GitHub Copilot app.- Network inspection is…
AI agent runtime protection includes these enhancements:- Vendor-supported agent event interfaces now work with standard platform and engine update channels, so no Beta channel configuration is required. Agent-native event inspection now supports Codex CLI and the GitHub Copilot app.- Network inspection is now supported for agents that don't expose vendor-supported event interfaces, including OpenClaw and similar Node.js-based Claw agents.For more information, see AI agent runtime protection with Microsoft Defender for Endpoint.
Copilot in Viva Glint now generates AI-powered summaries of employee survey results directly within Team Summary and Executive Summary reports, helping leaders quickly understand strengths, opportunities, and trends across their teams. Copilot Highlights surfaces key insights - such as notable score changes,…
Copilot in Viva Glint now generates AI-powered summaries of employee survey results directly within Team Summary and Executive Summary reports, helping leaders quickly understand strengths, opportunities, and trends across their teams. Copilot Highlights surfaces key insights - such as notable score changes, benchmark comparisons, and response rate confidence - so leaders can move from data to action faster. With general availability, Copilot Highlights expands to support multilingual summaries, enabling global organizations to deliver AI-generated survey insights in their preferred language.
What changed: Copilot Highlights automatically creates AI-generated summaries that highlight key insights such as score changes, benchmark comparisons, and response rate confidence. This feature is now generally available and supports multilingual summaries for global organizations. Previously, leaders had to manually analyze survey data without AI assistance.
Why: Automated AI summaries reduce the time leaders spend interpreting survey data and improve understanding of team strengths and opportunities across languages.
Try this:
Open a Team Summary or Executive Summary report in Viva Glint.
Review the Copilot Highlights section for AI-generated insights.
Switch the summary language using the language selector to view multilingual reports.
Why this matters: AI-powered insights help leaders quickly identify trends and act on employee feedback without manual data analysis.
Business impact: Organizations accelerate decision-making and improve employee engagement strategies with faster access to actionable survey insights.
Personal impact: You gain clear, concise survey summaries that save time and support informed leadership decisions.
Easily catch up after in-person and hybrid meetings with AI-powered notes. In Teams Rooms on Android, Facilitator captures notes in real time and displays them on the front of room display or touch board. Available with Teams Rooms Pro.
Easily catch up after in-person and hybrid meetings with AI-powered notes. In Teams Rooms on Android, Facilitator captures notes in real time and displays them on the front of room display or touch board. Available with Teams Rooms Pro.
Added a checklist to help administrators understand auditing, regional availability, label scope, encryption settings, sensitive information types, file eligibility, and required roles before creating an auto-labeling policy.
Added a checklist to help administrators understand auditing, regional availability, label scope, encryption settings, sensitive information types, file eligibility, and required roles before creating an auto-labeling policy.
These insights help identify evaluated workspaces, locate sensitive information, track policy adoption, and prioritize high-risk assets.
Administrators can use Microsoft Fabric governance experiences in the OneLake catalog to understand DLP activity and adoption. These insights help identify evaluated workspaces, locate sensitive information, track policy adoption, and prioritize high-risk assets.
Customize visual outputs in Copilot Chat by selecting style, format, and applying your organization's brand kit automatically. Details: What changed: Copilot Chat now offers built-in controls to select preferred visual styles and formats such as posters, infographics, or images. Users with a…
Customize visual outputs in Copilot Chat by selecting style, format, and applying your organization's brand kit automatically.
Details:
What changed: Copilot Chat now offers built-in controls to select preferred visual styles and formats such as posters, infographics, or images. Users with a Microsoft 365 Copilot license can apply their organization's brand kit directly, eliminating the need to upload assets or describe styles manually. This feature is available across Windows, Mac, and web platforms.
Why: This change streamlines creating on-brand visual content, reducing manual editing and ensuring consistent brand presentation from the start.
Try this:
Open Copilot Chat and enter a prompt for a visual creation.
Add the image generation capability from the + menu so you can choose a preferred visual style.
Apply your organization's brand kit and select the desired format before generating the output.
Why this matters: Automatically applying brand kits ensures consistent branding and reduces time spent on manual adjustments.
Business impact: Teams produce branded visual content faster and maintain brand consistency across communications.
Personal impact: You save time editing visuals and create professional, on-brand content with fewer steps.
The documentation explains behaviors that are by design and often interpreted as bugs. These behaviors include activation results that differ from simulation, encryption restrictions, cross-tenant label identities, conflicts with label-application policies, and the effect of label removal on encryption.
Auto-labeling policies can remove or downgrade sensitivity labels. The documentation explains behaviors that are by design and often interpreted as bugs. These behaviors include activation results that differ from simulation, encryption restrictions, cross-tenant label identities, conflicts with label-application policies, and the effect of label removal on encryption.
Mail-enabled security groups, distribution groups, and Microsoft 365 groups are supported, while mail-disabled, dynamic distribution, and deeply nested groups have limitations.
Auto-labeling simulation isn't a completely silent dry run. Simulation can generate activity alerts, duplicated policies start in simulation, management actions can remain unavailable during provisioning, and the review experience can mix auto-labeling and DLP results in test mode.
Auto-labeling simulation isn't a completely silent dry run. Simulation can generate activity alerts, duplicated policies start in simulation, management actions can remain unavailable during provisioning, and the review experience can mix auto-labeling and DLP results in test mode.
Easily add and edit key contacts by role or priority in the new dedicated speed dial tab in Teams mobile. Updates sync across devices, making your calling experience consistent.
Easily add and edit key contacts by role or priority in the new dedicated speed dial tab in Teams mobile. Updates sync across devices, making your calling experience consistent.
Review past meetings in one place from the Meeting Recaps app. Choose from different recap styles, like audio and video, to suit your personal preference. Quickly filter recaps to find the ones that matter to you most. To learn more, see Get…
Review past meetings in one place from the Meeting Recaps app. Choose from different recap styles, like audio and video, to suit your personal preference. Quickly filter recaps to find the ones that matter to you most. To learn more, see Get started with the Meeting Recaps app in Microsoft Teams.
The guidance covers creating a secondary account, mirroring scans, validating the environment, and requesting account promotion during a regional outage.
The Copilot Dashboard adoption page will be updated to show a unified view of Copilot adoption across the organization. Instead of the option to only show Microsoft 365 Copilot (licensed) usage, the page will include all Copilot user adoption, covering both M365…
The Copilot Dashboard adoption page will be updated to show a unified view of Copilot adoption across the organization. Instead of the option to only show Microsoft 365 Copilot (licensed) usage, the page will include all Copilot user adoption, covering both M365 Copilot and Copilot Chat usage that does not require a license. A License filter will allow users to switch between All, M365 Copilot (licensed), and Copilot Chat (unlicensed) views
What changed: The adoption page now includes the option to filter on all Copilot user adoption data instead of only Microsoft 365 Copilot licensed usage. A License filter lets users switch views between All, Microsoft 365 Copilot (licensed), and Copilot Chat (unlicensed) usage. This update provides a comprehensive view of Copilot adoption without compromising user privacy or security.
Why: Organizations need a complete picture of Copilot usage to understand adoption trends and optimize deployment. This change consolidates data for easier analysis and decision-making.
Try this:
Open the Copilot Dashboard adoption landing page.
Use the License filter dropdown to select All, Microsoft 365 Copilot (licensed), or Copilot Chat (unlicensed).
Review adoption metrics for the selected user group.
Why this matters: A unified dashboard helps administrators monitor all Copilot usage efficiently, supporting better resource planning and user support.
Business impact: Teams gain clearer insights into Copilot adoption across all user types, improving management and training strategies.
Personal impact: You can quickly access comprehensive adoption data without switching between multiple reports, saving time.
Copilot Chat in Outlook for affected users will expand from reasoning over a single email thread to reasoning over the user's entire inbox, calendar, meetings, and other enterprise data that is already available to them through Microsoft 365. Please see additional details…
Copilot Chat in Outlook for affected users will expand from reasoning over a single email thread to reasoning over the user's entire inbox, calendar, meetings, and other enterprise data that is already available to them through Microsoft 365. Please see additional details in our documentation under Organizational Data.
What changed: Copilot Chat expands its data scope from limited message context to include full inbox, calendar, and enterprise data. Previously, reasoning was restricted to recent messages. This change enhances contextual understanding and response accuracy without requiring a Microsoft 365 Copilot license.
Copilot Chat in Outlook for affected users will expand from reasoning over a single email thread to reasoning over the user's entire inbox, calendar, meetings, and other enterprise data that is already available to them through Microsoft 365. Please see additional details in our documentation under Organizational Data.
Users will be able to ask Copilot Chat to:
Locate and summarize information across their mailbox (for example, "What are the latest updates from my manager about project X?").
Uncover action items and follow-ups from across email and meetings.
Help manage their calendar, such as identifying upcoming commitments or gaps.
Why: Access to broader data enables more comprehensive and relevant assistance, improving user productivity and decision-making.
Try this:
Open Outlook and start Copilot Chat.
Ask questions involving your calendar or inbox content.
Review responses that incorporate enterprise data context.
Why this matters: Broader data access allows Copilot Chat to provide more accurate and context-aware assistance in Outlook.
Business impact: Teams gain improved collaboration and scheduling support through enhanced Copilot Chat capabilities.
Personal impact: You can use Copilot Chat in Outlook to ask questions about your inbox, calendar, meetings, and other limited data and take action directly in Outlook.
Users will be able to use Copilot Notebooks in OneNote on iPhone and iPad. Roadmap ID: 511794 Details: What changed: Users can now access Copilot Notebooks directly within OneNote on iPhone and iPad. Previously, this AI-powered workspace was limited to desktop versions.…
Users will be able to use Copilot Notebooks in OneNote on iPhone and iPad.
What changed: Users can now access Copilot Notebooks directly within OneNote on iPhone and iPad. Previously, this AI-powered workspace was limited to desktop versions. The integration supports organizing and interacting with content using AI features on mobile devices.
Why: Extending Copilot Notebook to mobile devices enables users to manage and act on their notes anytime, improving productivity and content accessibility on the go.
Try this:
Open OneNote on your iPhone or iPad.
Select or create a notebook to open the Copilot Notebook workspace.
Use the AI-powered tools to organize and analyze your notes within the app.
Why this matters: Having AI-powered note organization on mobile devices helps users stay productive and make decisions without needing a desktop.
Business impact: Teams can collaborate and manage important content more effectively across devices, supporting remote and mobile work scenarios.
Personal impact: You gain the ability to organize and act on your notes using AI tools wherever you use your iPhone or iPad, saving time and effort.
Copilot Search can now match on a person's department, and you can find/lookup all people in a given department when searching the people source directly. Roadmap ID: 508527 Details: What changed: Copilot Search includes department information in its matching criteria for people…
Copilot Search can now match on a person's department, and you can find/lookup all people in a given department when searching the people source directly.
What changed: Copilot Search includes department information in its matching criteria for people queries. Users can directly search the people source to list all contacts within a specific department. This improves search precision by filtering results based on organizational structure.
Why: Department-based matching helps users locate relevant contacts within organizational units, streamlining communication and access to subject matter experts.
Try this:
Open Copilot Search and select the people source.
Enter a department name to find all people in that department.
Review the filtered list of contacts associated with the department.
Why this matters: Department matching simplifies finding colleagues within specific teams or units, supporting efficient collaboration.
Business impact: Teams can quickly identify and engage department members, improving workflow coordination.
Personal impact: You reduce time spent searching for contacts by department, enabling faster outreach.
Copilot Notebooks allows users to generate Excel spreadsheets using the content and references gathered in a notebook. Copilot drafts a structured spreadsheet grounded in the notebook's context, which can be opened and edited in Excel, helping users move from ideas and source…
Copilot Notebooks allows users to generate Excel spreadsheets using the content and references gathered in a notebook. Copilot drafts a structured spreadsheet grounded in the notebook's context, which can be opened and edited in Excel, helping users move from ideas and source material to a ready‑to‑use spreadsheet with fewer manual steps.
What changed: Previously, users manually created Excel spreadsheets from notebook content. Now, Copilot drafts structured spreadsheets grounded in the notebook's context, which users can open and edit in Excel. This reduces manual steps and improves accuracy by leveraging gathered content and references.
Why: This feature accelerates data organization and reduces errors by automating spreadsheet creation from existing notebook material.
Try this:
Open a Copilot Notebook containing your content and references.
Select the option to generate an Excel spreadsheet.
Open the drafted spreadsheet in Excel to review and edit.
Why this matters: Automating spreadsheet creation saves time and helps users focus on analysis rather than data entry.
Business impact: Teams can quickly convert research and notes into actionable Excel data, improving productivity.
Personal impact: You reduce manual work and speed up the process of creating usable spreadsheets.
Copilot Notebooks enables users to generate PowerPoint presentations directly from the content and references collected in a notebook. Using the notebook's curated context, Copilot creates a structured, editable slide deck that users can open and refine in PowerPoint, helping turn research, notes,…
Copilot Notebooks enables users to generate PowerPoint presentations directly from the content and references collected in a notebook. Using the notebook's curated context, Copilot creates a structured, editable slide deck that users can open and refine in PowerPoint, helping turn research, notes, and insights into shareable presentations more quickly.
What changed: Previously, users had to manually transfer notes and research into PowerPoint slides. Now, Copilot Notebooks uses curated notebook context to automatically create structured, editable slide decks compatible with PowerPoint. This reduces manual effort and maintains source reference integrity.
Why: This change streamlines the transition from research and notes to presentations, saving time and reducing errors in slide creation.
Try this:
Open a notebook in Copilot Notebooks.
Select 'Quick create' then 'PowerPoint presentation' from the left pane. .
View the generated slide deck within Copilot Notebooks and edit via chat OR
Open the generated slide deck in PowerPoint to review and edit.
Why this matters: Turning notes into presentations quickly helps users share insights without redundant work.
Business impact: Teams can accelerate presentation development and improve collaboration by using consistent source material.
Personal impact: You save time creating presentations and reduce manual formatting tasks.
Copilot Notebooks allows users to generate Word documents using the content and references gathered in a notebook. Copilot drafts a structured document grounded in the notebook's context, which can be opened and edited in Word, helping users move from ideas and source…
Copilot Notebooks allows users to generate Word documents using the content and references gathered in a notebook. Copilot drafts a structured document grounded in the notebook's context, which can be opened and edited in Word, helping users move from ideas and source material to a ready‑to‑use document with fewer manual steps.
What changed: Users previously needed to manually compile notes and source material into Word documents. Now, Copilot Notebooks automatically generates a structured draft based on notebook context. The draft opens in Word for further editing, reducing manual compilation steps.
Why: This update reduces the time and effort needed to convert ideas and research into usable documents.
Try this:
Open your notebook in Copilot Notebooks.
Click 'Create' and 'Document' from the dropdown menu.
Edit the generated document in Word to finalize content further.
Why this matters: Faster document creation helps users focus on refining ideas instead of formatting and compiling content.
Business impact: Teams improve productivity by quickly producing draft documents grounded in verified source material.
Personal impact: You spend less time assembling documents and more time on content quality.
Now with Agent Mode in Copilot in PowerPoint, you can create presentations based on your Work IQ. Build rich presentations without the heavy lift of finding all the right files, meetings, and emails to compose relevant slides. Roadmap ID: 555874 Details: What…
Now with Agent Mode in Copilot in PowerPoint, you can create presentations based on your Work IQ. Build rich presentations without the heavy lift of finding all the right files, meetings, and emails to compose relevant slides.
What changed: Copilot in PowerPoint now uses Work IQ to automatically gather relevant files, meetings, and emails to help build presentations. Previously, users manually searched for and compiled these resources. This integration reduces manual effort and improves content relevance while maintaining data security by accessing only authorized content.
Why: Finding and compiling all relevant information for presentations is time-consuming and error-prone. This change streamlines content gathering, saving time and improving slide accuracy.
Try this:
Open PowerPoint and select 'Edit with Copilot'.
Choose to create a presentation based on your Work IQ.
Review and customize the generated slides with the gathered content.
Why this matters: Automatically sourcing relevant content reduces preparation time and ensures presentations reflect the most current and comprehensive information.
Business impact: Teams create presentations faster with more accurate, context-rich content without manual data collection.
Personal impact: You spend less time searching for files and emails, enabling quicker presentation creation with less effort.
Admins can now customize the Employee Self-Service agent landing page with accent colors, categorized prompts, and quick links to improve engagement and branding. Details: What changed: The standard ESS Agent landing page is replaced by an optional rich landing page that supports…
Admins can now customize the Employee Self-Service agent landing page with accent colors, categorized prompts, and quick links to improve engagement and branding.
Details:
What changed: The standard ESS Agent landing page is replaced by an optional rich landing page that supports organizational branding through accent colors. Admins can organize starter prompts into categories and add quick links to HR and IT resources using CSV templates. If no customization is applied, the default Copilot settings remain. This update maintains compliance with Microsoft 365 security and admin controls.
Why: Providing a customizable landing page helps organizations tailor the ESS Agent experience to their branding and employee needs, increasing adoption and support efficiency.
Try this:
Publish an ESS Agent in Copilot Studio.
In the Microsoft 365 admin center, upload CSV templates to configure accent colors, prompt categories, and quick links.
Save and publish changes to update the ESS Agent landing page.
Why this matters: Customization improves employee engagement and makes it easier to access relevant resources quickly.
Business impact: HR and IT teams can deliver a branded, organized self-service experience that reduces support requests.
Personal impact: Employees find answers faster with a tailored interface, saving time and effort.
Available from Defender for Endpoint on Linux version 101.26042.0011 and later. The Defender Deployment Tool for Linux simplifies deployment by combining installation, onboarding, upgrades, and uninstallation into a single workflow. The tool automates prerequisite validation, supports custom installation paths, enables deployment of…
Available from Defender for Endpoint on Linux version 101.26042.0011 and later. The Defender Deployment Tool for Linux simplifies deployment by combining installation, onboarding, upgrades, and uninstallation into a single workflow. The tool automates prerequisite validation, supports custom installation paths, enables deployment of specific Defender versions from preferred update channels, and works seamlessly in environments that use local repositories. In addition to a simplified deployment experience, customers can now gain complete visibility into deployment progress through Device Timeline integration, providing step-by-step installation, upgrade, and onboarding status, Advanced Hunting queries for fleet-wide deployment monitoring, and detailed error reporting, including deployment stage, status, exit code, and failure reason to simplify troubleshooting. These capabilities help administrators quickly identify deployment issues, track onboarding progress, and understand deployment outcomes across their Linux estate. Available from Defender version 101.26042.0011 onwards.
Earlier admins had to create new connections to adopt to the hierarchical permissions for ServiceNow Knowledge & Catalog Copilot Connectors as the edit capability was missing. Now, admins can easily edit their existing connections to switch between the permission handling option i.e.…
Earlier admins had to create new connections to adopt to the hierarchical permissions for ServiceNow Knowledge & Catalog Copilot Connectors as the edit capability was missing. Now, admins can easily edit their existing connections to switch between the permission handling option i.e. Simple vs Advanced to quickly adopt to the hierarchical permission feature.
What changed: Previously, admins had to create new connections to adopt hierarchical permissions for ServiceNow Knowledge and Catalog Copilot Connectors because editing was not supported. Now, they can modify existing connections to choose between simple and advanced permission handling, enabling faster adoption of hierarchical permissions without recreating connections.
Why: Adding edit capability simplifies management and reduces administrative overhead when updating permission settings for ServiceNow integrations.
Try this:
Open the Copilot Extensibility admin portal.
Select an existing ServiceNow Knowledge or Catalog connection.
Choose 'Edit' and switch the permission handling option between Simple and Advanced.
Save changes to apply the new permission mode.
Why this matters: This update streamlines permission management and accelerates deployment of hierarchical permissions for ServiceNow connectors.
Business impact: Admins save time and reduce errors by updating permissions without recreating connections, improving governance and security compliance.
Personal impact: You spend less time managing ServiceNow connections and can quickly adapt permission settings to meet organizational policies.
Add watermarks for AI-generated content. Roadmap ID: 547831 Details: What changed: To help provide additional transparency about what content has been generated or altered by using AI in Microsoft 365, watermarks can be added to videos and audio content. A policy setting…
What changed: To help provide additional transparency about what content has been generated or altered by using AI in Microsoft 365, watermarks can be added to videos and audio content. A policy setting controls your organization's ability to add a visual or audio watermark to video and audio content that your users generate or alter by using AI in Microsoft 365.
Why: Adding watermarks increases transparency and helps prevent misuse or misattribution of AI-generated content.
Try this:
To turn on watermarks for video and audio content that your users generate or alter by using AI in Microsoft 365, you need to use the "Include a watermark when content from Microsoft 365 is generated or altered by AI" policy. This policy is available only in Cloud Policy service for Microsoft 365. If you want to add a watermark to video and audio content, you need to set this policy to Enabled. If you set this policy to Disabled or Not configured, a visual or audio watermark isn't added.
This policy doesn't apply to images. Instead, your users will be able to turn on watermarks for images by going to Settings & Privacy > Privacy > Data options at https://myaccount.microsoft.com.
Why this matters: To help provide additional transparency about what content has been generated or altered by using AI in Microsoft 365.
Business impact: Organizations can control when to add watermarks to AI-generated video and audio content.
Personal impact: You gain confidence that your AI-generated content is properly labeled.
Administrators can enable classification-failure detection and use the DocumentScanFailures condition to apply different protection actions for specific failure types.
Exchange Online DLP policies can detect classification failures caused by timeouts, throttling, and other scanning errors. Administrators can enable classification-failure detection and use the DocumentScanFailures condition to apply different protection actions for specific failure types.
Analysts and investigators can now add and view notes on both alerts and cases. System-generated notes are automatically applied when there's a change in alert or case status, assigned user, closure, or case escalation.
Expanded note capabilities across alerts and cases. Analysts and investigators can now add and view notes on both alerts and cases. System-generated notes are automatically applied when there's a change in alert or case status, assigned user, closure, or case escalation.
Expanded user profile details in the unified alert experience add additional user profile signals from Microsoft Entra, including office location, employee type, department, and last working date.
Expanded user profile details in the unified alert experience add additional user profile signals from Microsoft Entra, including office location, employee type, department, and last working date.
When generating files with Microsoft 365 Copilot, sensitivity labels are automatically applied based on the highest label detected in the source data to protect organizational data. Details: What changed: Microsoft 365 Copilot now evaluates the content used to generate files and applies…
When generating files with Microsoft 365 Copilot, sensitivity labels are automatically applied based on the highest label detected in the source data to protect organizational data.
Details:
What changed: Microsoft 365 Copilot now evaluates the content used to generate files and applies the highest sensitivity label found in the referenced data. Previously, generated files did not inherit sensitivity labels automatically, which could lead to inconsistent data protection. If Copilot cannot apply a label, users receive a clear notification to address the missing label before sharing or storing the file.
Why: This change ensures generated documents comply with your organization's data governance policies by inheriting appropriate protection levels. It reduces the risk of accidental data exposure from unlabeled files.
Try this:
Generate a file using Microsoft 365 Copilot.
Check the file properties to verify the applied sensitivity label.
If notified of a missing label, manually apply the correct sensitivity label before sharing.
Why this matters: Automatically applying sensitivity labels helps maintain consistent data protection and compliance across all generated content.
Business impact: Teams reduce the risk of data leaks by ensuring all Copilot-generated files follow organizational labeling policies without extra manual steps.
Personal impact: You avoid the risk of sharing unlabeled sensitive files and save time by not having to manually label generated documents.
The guidance also describes common symptoms caused by missing licenses, roles, regional availability, or transient backend failures.
Licensing and configuration locations are documented for client-side Office auto-labeling, service-side auto-labeling policies, and container-level labels. The guidance also describes common symptoms caused by missing licenses, roles, regional availability, or transient backend failures.
When automatic notifications use the default template, users receive notification emails in their preferred language based on their Outlook language settings. Custom notification templates configured by admins aren't affected. For more information, see Admin review for user reported messages.
When automatic notifications use the default template, users receive notification emails in their preferred language based on their Outlook language settings. Custom notification templates configured by admins aren't affected. For more information, see Admin review for user reported messages.
MAI‑Image‑2‑Efficient enables users to generate high‑quality visuals directly in PowerPoint, helping them quickly create and refine slides without leaving their workflow. Details: What changed: Copilot in PowerPoint now includes the MAI‑Image‑2‑Efficient model for image generation. This model is optimized for speed and…
MAI‑Image‑2‑Efficient enables users to generate high‑quality visuals directly in PowerPoint, helping them quickly create and refine slides without leaving their workflow.
Details:
What changed: Copilot in PowerPoint now includes the MAI‑Image‑2‑Efficient model for image generation. This model is optimized for speed and efficiency, allowing users to rapidly iterate on visual ideas, create real‑time slide content, and update visuals across presentations more easily than before.
Why: This update helps users produce polished, professional visuals faster, reducing the need to switch tools or search for external images.
Try this:
Ask Copilot to generate a visual that matches the theme of your slide.
Replace an existing image by prompting Copilot to create an updated version.
Use Copilot to quickly explore multiple visual concepts during early slide drafting.
Why this matters: To help provide additional transparency about what content has been generated or altered by using AI in Microsoft 365
Business impact: Speeds up presentation creation and ensures teams can produce consistent, high‑quality visuals.
Personal impact: Helps individuals express ideas visually with less effort
We're introducing column metadata support for queries in Microsoft 365 Copilot when a SharePoint library or folder is attached or its URL is provided. This enhancement improves contextual relevance by enabling Copilot to leverage additional metadata from the selected library, delivering more…
We're introducing column metadata support for queries in Microsoft 365 Copilot when a SharePoint library or folder is attached or its URL is provided. This enhancement improves contextual relevance by enabling Copilot to leverage additional metadata from the selected library, delivering more accurate and meaningful results.
What changed: Copilot queries that target SharePoint document libraries or folders now leverage column metadata when the library or folder is attached or its URL is provided. Previously, Copilot did not use this metadata, limiting contextual understanding. This update improves accuracy and relevance of query results by incorporating additional metadata fields.
Why: Using column metadata enhances Copilot's ability to understand the context of documents, providing more precise and meaningful responses.
Try this:
Attach a SharePoint document library or folder URL in Microsoft 365 Copilot.
Enter a query referencing documents in the selected library or folder.
Review the results that now reflect metadata context for improved accuracy.
Why this matters: Better metadata understanding leads to more relevant and actionable information from SharePoint content.
Business impact: Teams gain improved insights from SharePoint documents, supporting better decision-making and collaboration.
Personal impact: You receive more accurate query results, reducing time spent searching for relevant documents.
Microsoft 365 E3 now includes Microsoft Defender for Office 365 Plan 1. For more information about what's included in each plan, see Microsoft Defender for Office 365 Plan 1 vs. Plan 2 cheat sheet.
Temporary assignments can last from one day to two years and are supported by most built-in and custom role groups, except eDiscovery Administrator and eDiscovery Manager.
Microsoft Purview role-group assignments can be configured with an expiration date so that access is revoked automatically. Temporary assignments can last from one day to two years and are supported by most built-in and custom role groups, except eDiscovery Administrator and eDiscovery Manager.
Users can explore the mind map, view summaries for individual nodes, and use Notebook chat to get more detail about a node. Available across OneNote and Microsoft 365 Copilot app. Roadmap ID: 559029 Details: What changed: Previously, users reviewed notebook content as…
Mind maps in Copilot Notebooks are interactive visual artifacts that help users understand notebook content through a grounded map of key topics, themes, and relationships. Users can explore the mind map, view summaries for individual nodes, and use Notebook chat to get more detail about a node. Available across OneNote and Microsoft 365 Copilot app.
What changed: Previously, users reviewed notebook content as linear notes. Now, mind maps visualize topics, themes, and connections interactively. Users can click nodes for summaries and use Notebook chat to ask questions about specific nodes. This feature is available in OneNote and Microsoft 365 Copilot app.
Why: Mind maps help users grasp complex information structures more intuitively and explore content dynamically.
Try this:
Open a notebook in OneNote or Microsoft 365 Copilot App.
Select 'Quick create' then 'Mind map' in the left pane to create a visual topic map. 3. Click nodes to read summaries or ask questions in Notebook chat.
Why this matters: Visualizing content relationships improves comprehension and supports more effective research and decision-making.
Business impact: Teams gain clearer insights into project or research data, enhancing collaboration and knowledge sharing.
Personal impact: You understand complex content faster and can explore details without searching through notes.
Multimodal capture enables users to transcribe audio, take images, and type notes in a single session. Copilot then creates a structured Copilot Page with insights and user-captured content, saved to a user-selected Copilot Notebook. Designed for capturing offline work moments—including in-person conversations,…
Multimodal capture enables users to transcribe audio, take images, and type notes in a single session. Copilot then creates a structured Copilot Page with insights and user-captured content, saved to a user-selected Copilot Notebook. Designed for capturing offline work moments—including in-person conversations, whiteboard sessions, and personal notes. Other endpoints coming soon.
What changed: OneNote on iPhone now supports multimodal recording in Copilot Notebooks, combining audio transcription, image capture, and typed notes in a single session. Copilot organizes this content into a structured page with insights. Previously, users had to capture these elements separately. This feature supports offline scenarios like meetings and whiteboard sessions. Other platforms will add this capability soon.
Why: This update streamlines capturing diverse content types during offline work moments, making note-taking more efficient and organized.
Try this:
Open the OneNote app.
Go to Copilot Notebooks.
On the notebook list page, tap Capture to transcribe the discussion, take photos, and type notes during the session.
Why this matters: Combining multiple input types in one session reduces friction and preserves richer context from in-person interactions.
Business impact: Teams can capture and share comprehensive meeting notes and ideas more effectively, improving knowledge retention.
Personal impact: You save time by capturing and organizing diverse content simultaneously, enhancing your note-taking experience.
Users will now have access to their Copilot Notebooks on the web version of OneNote. Roadmap ID: 511797 Details: What changed: Users can now open and use Copilot Notebooks in OneNote on the web. Previously limited to desktop experiences, Copilot Notebooks are…
Users will now have access to their Copilot Notebooks on the web version of OneNote.
What changed: Users can now open and use Copilot Notebooks in OneNote on the web. Previously limited to desktop experiences, Copilot Notebooks are now available in the browser, allowing users to ground Copilot on notebook content, generate insights, synthesize information, and create content directly from their notes across devices while adhering to Microsoft 365 security policies.
Why: Providing Copilot Notebook on OneNote web enables users to work seamlessly across devices and locations without losing AI assistance.
Try this:
Open OneNote on your web browser (onenote.cloud.microsoft)
Select 'Create Copilot Notebook' in the left pane OR center screen
Use AI features to generate insights, artifacts, and more.
Why this matters: You gain the ability to analyze your notes with AI anytime, reducing friction in your workflow.
Business impact: Teams benefit from consistent AI-powered note management regardless of device or location.
Personal impact: You gain the ability to organize and analyze notes with AI anytime, reducing friction in your workflow.
Currently, clicking on cited content in Copilot opens files outside of Copilot. With this new feature, content can be opened directly in Copilot Chat to make viewing documents more streamlined alongside chat. This change is not available on the Microsfot 365 Copilot…
Currently, clicking on cited content in Copilot opens files outside of Copilot. With this new feature, content can be opened directly in Copilot Chat to make viewing documents more streamlined alongside chat. This change is not available on the Microsfot 365 Copilot mobile app or when using Copilot in Edge, Copilot in Excel, Copilot in Word, and Copilot PowerPoint.
What changed: Previously, clicking on cited content in Copilot opened files in a new browser tab outside of Copilot. Now, Word, Excel, PowerPoint, and PDF files open directly within Copilot Chat, allowing users to view documents alongside their chat session. This feature is not available on the Copilot mobile app or when using Copilot in Edge, Excel, Word, or PowerPoint applications.
Why: Opening files directly in Copilot Chat reduces context switching and improves workflow efficiency by keeping documents and chat in one interface.
Try this:
In Copilot Chat, click a cited Word, Excel, or PowerPoint, or PDF file link.
View the file open directly within the Copilot Chat pane.
Interact with the document while continuing your chat session.
Why this matters: Viewing documents alongside chat helps users stay focused and speeds up collaboration and information review.
Business impact: Teams can collaborate more efficiently by reducing the need to switch between multiple tabs or applications.
Personal impact: You save time and reduce distractions by accessing files directly within your chat environment.
Priority cleanup policies now require three separate approvals before content can be permanently deleted: one Priority Cleanup administrator, one retention manager, and one eDiscovery administrator.
Priority cleanup policies now require three separate approvals before content can be permanently deleted: one Priority Cleanup administrator, one retention manager, and one eDiscovery administrator.
Microsoft Defender for Office 365 now detects prompt injection attacks hidden in inbound email. For more information, see Prompt injection protection in Microsoft Defender for Office 365.
This integration enables organizations to intercept and inspect text and AI interactions at the network layer, enforce restrictive actions based on DLP policies, and detect risky user activity through Insider Risk Management. It helps prevent sensitive data from being shared with untrusted…
Protect sensitive data in text and prompts by integrating with Microsoft Entra Global Secure Access (GSA). This integration enables organizations to intercept and inspect text and AI interactions at the network layer, enforce restrictive actions based on DLP policies, and detect risky user activity through Insider Risk Management. It helps prevent sensitive data from being shared with untrusted cloud applications through browsers, apps, APIs, and add-ins, including generative AI platforms, social media, and collaborative platforms. See Learn about Microsoft Purview Network Data Security.
Press the Action button or ask Siri to launch Copilot on your iOS device. Roadmap ID: 485724 Details: What changed: You can now launch the Microsoft 365 Copilot app on iOS by long pressing the device's Action button or by asking Siri.…
Press the Action button or ask Siri to launch Copilot on your iOS device.
What changed: You can now launch the Microsoft 365 Copilot app on iOS by long pressing the device's Action button or by asking Siri. Previously, launching Copilot required manually opening the app from the home screen. This update enables faster, hands-free access while maintaining device security controls.
Why: This change reduces the steps needed to start Copilot, improving user efficiency and supporting accessibility through voice commands.
Try this:
Long press the Action button on your iOS device to open Copilot.
Say "Hey Siri, open Copilot" to launch the app using voice.
Begin chatting or issuing commands immediately after launch.
Why this matters: Faster and easier access to Copilot helps users get assistance quickly, especially when multitasking or using accessibility features.
Business impact: Teams benefit from quicker Copilot access, enabling faster information retrieval and task execution on iOS devices.
Personal impact: You save time launching Copilot and can start interactions without navigating menus or typing.
Microsoft Defender evaluates tool invocations and responses against security policies and can allow or block interactions with Work IQ MCP and customer MCP tools onboarded to Agent 365. For more information, see Protect AI agents in real time using Microsoft Defender.
Microsoft Defender evaluates tool invocations and responses against security policies and can allow or block interactions with Work IQ MCP and customer MCP tools onboarded to Agent 365. For more information, see Protect AI agents in real time using Microsoft Defender.
Today, audio overview help you absorb content on the go, but they're one-way—listeners can't clarify or explore without stopping. With real time voice interactions, you can ask questions verbally while listening and get answers instantly - all while staying in the audio…
Today, audio overview help you absorb content on the go, but they're one-way—listeners can't clarify or explore without stopping. With real time voice interactions, you can ask questions verbally while listening and get answers instantly - all while staying in the audio experience.
What changed: Audio Overview in Word now supports real-time voice interactions, allowing listeners to ask questions and receive immediate answers without pausing or switching apps. Previously, audio summaries were one-way experiences requiring manual searches to explore content further. This update maintains continuous listening while enabling dynamic, conversational engagement.
Why: This change removes interruptions caused by pausing and searching, helping users understand content faster and stay focused on the discussion. It transforms passive listening into an interactive experience that supports deeper comprehension.
Try this:
Open a Word document in Web and generate an audio overview summary.
While listening, unmute and ask a question related to the content.
Hear instant answers without stopping the audio playback.
Why this matters: Users can explore and clarify information naturally during audio playback, improving comprehension without breaking their flow.
Business impact: Teams benefit from more efficient knowledge sharing and faster understanding of document content during meetings or commutes.
Personal impact: You save time by getting answers instantly while listening, reducing the need to pause and manually search for information.
You can now reference a Teams meeting or chat when creating a presentation with Agent Mode in PowerPoint. Roadmap IDs: 555885 555884 555883 Details: What changed: Copilot in PowerPoint can now use a referenced Teams meeting or chat as context when creating…
You can now reference a Teams meeting or chat when creating a presentation with Agent Mode in PowerPoint.
What changed: Copilot in PowerPoint can now use a referenced Teams meeting or chat as context when creating a presentation. Users can enter a prompt that mentions the relevant Teams meeting or chat, and Copilot will generate a deck based on that content. This integration supports referencing meetings and chat messages securely within the presentation creation process.
Why: This makes it easier to turn Teams conversations, meeting outcomes, and chat discussions into presentation-ready content without manually summarizing or transferring notes.
Try this:
Open PowerPoint and start Copilot.
Enter a prompt that references the Teams meeting or chat you want to use in your presentation.
Press Enter. Copilot will create a presentation using the referenced Teams content.
Why this matters: This reduces friction by turning Teams meeting and chat content into presentation-ready slides directly in PowerPoint.
Business impact: Users can create presentations faster with accurate, up-to-date information from meetings, improving collaboration and decision-making.
Personal impact: You save time by avoiding manual content transfer and reduce errors when preparing presentations.
Teams for web now honors your sign-in preference across browser sessions, whether you want to stay signed in or sign in again when you reopen your browser.
Teams for web now honors your sign-in preference across browser sessions, whether you want to stay signed in or sign in again when you reopen your browser.
Copilot in PowerPoint now lets you reference existing PowerPoint presentations when creating or editing presentations with Copilot in Power Point. You can reuse text content and style and theme from existing decks, create new presentations based on referenced files, or apply the…
Copilot in PowerPoint now lets you reference existing PowerPoint presentations when creating or editing presentations with Copilot in Power Point. You can reuse text content and style and theme from existing decks, create new presentations based on referenced files, or apply the style of one presentation to another—helping you work faster while maintaining consistency across presentations.
What changed: Previously, Copilot in power point could not directly use content or styling from another PowerPoint presentation as part of a presentation creation or editing workflow. With this update, users can:
Reference an existing PowerPoint presentation when creating a new presentation.
Reuse style & text content from existing presentations to build new presentations faster.
Apply the style, theme, and visual formatting of one presentation to another.
Maintain consistency across presentations while reducing manual copy-and-paste work.
This capability respects existing file permissions and access controls.
Why: Reusing presentation content is a common workflow. This update helps users create and update presentations more efficiently by using Copilot to reuse existing content, layouts, and visual styles from other presentations
Try this:
Create a presentation using content from an existing deck:
Open PowerPoint and start edit with Copilot.
Select Reference file and choose a PowerPoint presentation.
Ask Copilot to create a new presentation using content or style from the referenced file.
Apply the style of one presentation to another.
Apply the style of one presentation to another:
Open an existing presentation.
Start edit with Copilot.
Select Reference file and choose a PowerPoint presentation whose style you want to reuse.
Ask Copilot to apply the style, theme, or formatting from the referenced presentation.
Why this matters: Reusing existing presentation content and styling is a fundamental presentation workflow. This update makes it easier to build on prior work, maintain consistency, and adapt presentations for new audiences or scenarios without starting from scratch.
Business impact: Organizations can accelerate presentation creation, reduce duplicate effort, and maintain consistent content, layout and visual styles across presentations.
Personal impact: Spend less time recreating content and formatting, reduce manual edits, and create polished presentations more quickly using existing presentations as a starting point.
Enables users to schedule recurring prompts to declarative agents like Analyst, Idea Coach and more. Roadmap ID: 531759 Details: What changed: This update enables scheduling of repeated prompts to declarative agents, replacing the prior need to manually initiate each interaction. It supports…
Enables users to schedule recurring prompts to declarative agents like Analyst, Idea Coach and more.
What changed: This update enables scheduling of repeated prompts to declarative agents, replacing the prior need to manually initiate each interaction. It supports consistent engagement with agents for ongoing tasks or insights.
Why: Automating prompt scheduling reduces manual effort and ensures timely agent responses for routine workflows.
Try this:
Open the Microsoft 365 Copilot app.
Select an agent such as Analyst or Idea Coach.
Choose the schedule option and set recurring prompt frequency.
Why this matters: Scheduled prompts help maintain regular agent interactions, improving productivity and task consistency.
Business impact: Teams benefit from automated agent engagement, reducing oversight and improving workflow continuity.
Personal impact: Users save time by automating repetitive requests and receive timely insights without manual prompting.
This feature simplifies agent distribution and increases team awareness, improving collaboration efficiency. Roadmap ID: 557947 Details: What changed: Users can now search for and select Microsoft Teams teams in the agent sharing dialog box to share their Copilot agents. When sharing, users…
This feature simplifies agent distribution and increases team awareness, improving collaboration efficiency.
What changed: Users can now search for and select Microsoft Teams teams in the agent sharing dialog box to share their Copilot agents. When sharing, users can send a notification to the team's main channel to inform members and provide an easy installation link. Previously, sharing agents required manual communication outside Teams.
Why: Sharing agents directly in Teams streamlines collaboration and accelerates agent adoption by reducing communication friction.
Try this:
Open the agent sharing dialog in Copilot Studio.
Search for and select a Microsoft Teams team.
Send a notification to the team's main channel to share the agent.
Why this matters: Broader data access allows Copilot Chat to provide more accurate and context-aware assistance in Outlook.
Business impact: Teams can onboard Copilot agents faster and ensure all members are informed and equipped to use them.
Personal impact: You save time sharing agents and reduce the need for separate communications to notify team members.
It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships.
The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more information, see Investigate a domain.
Microsoft Defender analyzes runtime signals from agent interactions, tool usage, and execution patterns to surface alerts in Microsoft Defender XDR. Detection uses observability data from Microsoft Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot Agent Builder, and agents integrated through the Microsoft Agent…
Microsoft Defender analyzes runtime signals from agent interactions, tool usage, and execution patterns to surface alerts in Microsoft Defender XDR. Detection uses observability data from Microsoft Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot Agent Builder, and agents integrated through the Microsoft Agent 365 SDK. Analysts can investigate alerts through incidents and advanced hunting. For more information, see Detect and investigate threats to AI agents using Microsoft Defender.
Troubleshoot why a specific SharePoint or OneDrive file was or wasn't labeled. The diagnostic guidance covers unsupported formats, checked-out files, indexing delays, existing higher-priority labels, encryption prerequisites, transient failures, and unexpected labeling.
Starting July 2026, new Microsoft Defender for Office 365 Plan 2 organizations use the Microsoft Defender unified role-based access control (Unified RBAC) model by default. For more information, see Configure Unified RBAC for Microsoft Defender for Office 365 and MC1246006.
View and manage both classic and agent-triaged alerts from one location, with the ability to preview agent summaries, alert and user details directly on the alerts list page.
Unified alert experience combines the Triage Agent and Standard alert dashboards into a single alerts list page. View and manage both classic and agent-triaged alerts from one location, with the ability to preview agent summaries, alert and user details directly on the alerts list page.
Stay organized across roles or regions from a single Teams account with Teams Phone-multi line. Switch between up to 10 numbers on your account, each appearing as its own tab.
Stay organized across roles or regions from a single Teams account with Teams Phone-multi line. Switch between up to 10 numbers on your account, each appearing as its own tab.
Users can see the status of ongoing long running tasks for agentic workflows directly in the Windows taskbar without opening the app. Details: What changed: Long running agents now display task status icons and progress indicators in the Windows taskbar. Previously, users…
Users can see the status of ongoing long running tasks for agentic workflows directly in the Windows taskbar without opening the app.
Details:
What changed: Long running agents now display task status icons and progress indicators in the Windows taskbar. Previously, users had to open the Microsoft 365 Copilot app to monitor these workflows. This update provides real-time visibility and quick access to task states, improving user awareness and reducing app switching.
Why: This change enhances productivity by allowing users to track workflow progress at a glance, minimizing interruptions and improving task management.
Try this:
Start a long running task using the Microsoft 365 Copilot app.
Observe the task status icon in the Windows taskbar.
Click the icon to view details or manage the task without launching the full app.
Why this matters: Quick status updates reduce the need to switch contexts and help users stay informed about critical workflows.
Business impact: Teams benefit from improved monitoring of automated processes, leading to faster issue detection and resolution.
Personal impact: You save time by tracking tasks without interrupting your current work or opening additional windows.
Microsoft is adding several Intune Suite capabilities to Microsoft 365 E3 and Microsoft 365 E5 to enable more organizations to use advanced endpoint management and security without a separate add-on. The following capabilities are added to Microsoft Enterprise Mobility + Security E3…
Microsoft is adding several Intune Suite capabilities to Microsoft 365 E3 and Microsoft 365 E5 to enable more organizations to use advanced endpoint management and security without a separate add-on.
The following capabilities are added to Microsoft Enterprise Mobility + Security E3 (EMS E3), which is included with Microsoft 365 E3:
Remote Help
Advanced Analytics
Intune Plan 2, which includes Microsoft Tunnel for mobile application management (MAM), specialty device management, and firmware over-the-air (FOTA) updates for supported devices
Microsoft 365 E5 includes all Microsoft 365 E3 capabilities, plus:
Endpoint Privilege Management
Enterprise Application Management
Microsoft Cloud PKI
These capabilities are gradually rolling out. Eligible tenants are automatically provisioned, and no action is required. Before the change takes effect in your tenant, Microsoft posts a notification in the Microsoft 365 admin center 30 days in advance.
This update applies to commercial Microsoft 365 E3 and E5. There are no changes to the Education (EDU) or frontline worker (FLW) plans at this time. For Government plans, Intune Suite packaging is planned to align with the equivalent enterprise plans, subject to compliance and regulatory requirements. For the capabilities currently supported in GCC High and DoD, see Supported Intune features in GCC High and DoD.
Microsoft Intune now supports automatic updates for Enterprise App Management (EAM) applications. When you enable auto-update for an EAM app with a required assignment, Intune detects when a newer version is available in the EAM catalog and automatically updates the app on…
Microsoft Intune now supports automatic updates for Enterprise App Management (EAM) applications. When you enable auto-update for an EAM app with a required assignment, Intune detects when a newer version is available in the EAM catalog and automatically updates the app on targeted devices. This eliminates manual packaging and supersedence workflows, reduces update maintenance at scale, and helps keep devices secure with timely updates.
For available macOS PKG apps, updates now deploy to devices automatically when the same app policy was updated with a new app version, so users no longer need to select Install or Reinstall in Company Portal to get the latest version. When…
For available macOS PKG apps, updates now deploy to devices automatically when the same app policy was updated with a new app version, so users no longer need to select Install or Reinstall in Company Portal to get the latest version. When you edit an existing available app policy with a newer version of the app that uses the same bundle ID, Intune deploys the update to the device automatically.
Automatic updates apply when both of the following are true:
You upload an updated version of the app to Intune.
The user already installed the app on the device.
This behavior requires the Microsoft Intune management agent for macOS version 2606.013 or later.
Microsoft Intune now extends Enterprise App Management (EAM) to the GCC High (GCCH) and DoD cloud environments. Government organizations can use the EAM enterprise catalog to discover, deploy, and keep prepackaged Microsoft and third-party apps up to date without manual repackaging. A…
Microsoft Intune now extends Enterprise App Management (EAM) to the GCC High (GCCH) and DoD cloud environments. Government organizations can use the EAM enterprise catalog to discover, deploy, and keep prepackaged Microsoft and third-party apps up to date without manual repackaging. A secure cross-cloud integration model maintains the compliance boundaries and authentication requirements expected for government tenants.
You can now use Trustd Mobile as a mobile threat defense partner (MTD) for enrolled devices that run the following platforms: Android 9.0 and later iOS/iPadOS 15.0 and later To learn more about this support, see Use Trustd Mobile with Microsoft Intune.
You can now use Trustd Mobile as a mobile threat defense partner (MTD) for enrolled devices that run the following platforms:
Microsoft Tunnel Gateway now supports Red Hat Enterprise Linux (RHEL) 9.7 as a Linux server distribution. This support requires the use of Podman 5.8.2 as its default container engine. Customers upgrading from environments using Podman v3 containers should recreate containers and reinstall…
Microsoft Tunnel Gateway now supports Red Hat Enterprise Linux (RHEL) 9.7 as a Linux server distribution.
This support requires the use of Podman 5.8.2 as its default container engine. Customers upgrading from environments using Podman v3 containers should recreate containers and reinstall Microsoft Tunnel, as those containers aren't compatible with newer Podman versions.
Like other RHEL 9.x versions, RHEL 9.7 doesn't automatically load the ip_tables module into the Linux kernel. When you use this version, plan to manually load ip_tables before you install Tunnel.
The settings catalog lists all the settings you can configure in a device policy, and all in one place. The following new Android Enterprise settings are available in the Microsoft Intune settings catalog (Devices > Manage devices > Configuration > Create >…
The settings catalog lists all the settings you can configure in a device policy, and all in one place. The following new Android Enterprise settings are available in the Microsoft Intune settings catalog (Devices > Manage devices > Configuration > Create > New policy > Android Enterprise for platform > Settings catalog for profile type).
Applications
Setting
Description
Applies to
Block apps from exposing app functions
This setting controls whether managed apps can expose app functions — programmatic actions that other apps and on-device assistants or AI agents can invoke inside the app. If True, apps on fully managed devices and apps in the work profile on corporate-owned devices are blocked from exposing app functions. If False (default OS behavior), apps are allowed to expose app functions.
COBO, COSU, COPE
Block widgets from work profile apps
If True, allows users to access widgets exposed by apps in the work profile on the device's home screen. If False, prevents access to these widgets. By default, the OS might allow widget access.
COPE
Connectivity
Setting
Description
Applies to
Allow selection of a preferential network service
If True, the device gives priority to the specified network service over other available options, such as an enterprise slice on 5G networks. If False, the device connects using its default network selection process.
COBO, COSU, COPE
Block airplane mode
If True, the device is prevented from enabling airplane mode. If False, the device follows the default airplane mode behavior of the OS.
COBO, COSU, COPE
Block cellular 2G
If True, the device prevents cellular 2G functionality, restricting user access to the setting. If False (default), the device follows the default cellular 2G behavior of the OS. Supported on Android 14 and later.
COBO, COSU, COPE
Block configuring cell broadcasts
If True, the device is prevented from receiving cell broadcast messages, such as emergency alerts. If False (default), Intune doesn't change or update this setting, and the OS might allow the reception of cell broadcast messages.
COBO, COSU, COPE
Block configuring mobile networks
True prevents users from configuring or modifying mobile network settings on the device. If False (default), Intune doesn't change or update this setting and the OS might allow users to adjust mobile network settings.
COBO, COSU, COPE
Block configuring VPN
If True, users can't add, edit, or remove VPN configurations on the device. If False or not configured, the device follows the default VPN configuration behavior of the OS.
COBO, COSU, COPE
Block network reset
If True, the device won't reset network settings even if a reset is attempted. If False (default), the device follows the default network reset behavior of the OS.
COBO, COSU, COPE
Block outgoing calls
If True, users are prevented from making outgoing calls on the device. If False (default), Intune doesn't change or update this setting, and the OS might allow outgoing calls.
COBO, COSU, COPE
Block SMS
If True, the device is prevented from sending or receiving SMS messages, restricting text communication. If False (default), the device follows the default SMS behavior of the OS.
COBO, COSU, COPE
Block ultra wideband
If True, the device prevents ultra wideband functionality, restricting user access to the setting. If False (default), the device follows the default ultra wideband behavior of the OS. Supported on Android 14 and later.
COBO, COSU, COPE
Select minimum Wi-Fi security level
Select the minimum Wi-Fi security level required for the device to connect to Wi-Fi networks. Options are Open network security, Personal network security, Enterprise network security, and Enterprise 192-bit network security. The default is Open network security, which allows the device to connect to all types of Wi-Fi networks. Supported on Android 13 and later.
COBO, COSU, COPE
General
Setting
Description
Applies to
Block printing
If True, the device is prevented from printing documents. If False (default), the device follows the default printing behavior of the OS.
COBO, COSU, COPE
Block setting user icon
If True, users are prevented from changing their user icon or profile image on the device. If False (default), Intune doesn't change or update this setting, and the OS might allow users to modify their user icon.
COBO, COSU, COPE
Block setting wallpaper
If True, users are prevented from changing the wallpaper on the device. If False (default), Intune doesn't change or update this setting, and the OS might allow users to change the wallpaper.
COBO, COSU, COPE
Block users from adding eSIM profiles
If True, users can't add eSIM profiles to the device. If False (default), users can add eSIM profiles based on the default behavior of the OS.
The existing endpoint security Antivirus policy for the Microsoft Defender Antivirus profile on Linux Server now includes new settings you can configure and deploy to your managed Linux devices: Offline security intelligence update - Manage how Microsoft Defender Antivirus keeps its security…
The existing endpoint security Antivirus policy for the Microsoft Defender Antivirus profile on Linux Server now includes new settings you can configure and deploy to your managed Linux devices:
Offline security intelligence update - Manage how Microsoft Defender Antivirus keeps its security intelligence current on Linux Server devices, including updates while the device is offline.
Scheduled scan - Manage when Microsoft Defender Antivirus runs scheduled scans on Linux devices.
These settings:
Are added to the existing endpoint security Antivirus policy for the Microsoft Defender Antivirus profile on Linux. No new profile is required. By default, they're set to Not configured.
Are supported for Linux Server devices enrolled with Intune, and for Linux devices managed through the Microsoft Defender for Endpoint security settings management scenario, which supports devices that are managed by Defender for Endpoint but not enrolled with Intune.
The Intune security baseline for Windows, version 25H2, is updated to include one new setting, Disable Internet Explorer 11 Launch Via COM Automation, with a baseline default of Enabled. This setting was excluded from the version 25H2 baseline at its initial release…
The Intune security baseline for Windows, version 25H2, is updated to include one new setting, Disable Internet Explorer 11 Launch Via COM Automation, with a baseline default of Enabled.
This setting was excluded from the version 25H2 baseline at its initial release due to a known issue, which is now resolved. When enabled, the setting prevents Internet Explorer 11 from being launched through COM automation, which reduces the attack surface on managed devices.
This change is an update to an existing baseline version, not a new baseline version. The new setting isn't visible in a baseline profile's properties until you edit and save the profile:
Pre-existing baseline profiles: To add the new setting to a profile you created before this update, select and then Edit the profile, and then Save it. When you open the profile for editing, the new setting appears with its baseline default configuration. You can reconfigure the setting before you save, or save with no changes to apply the baseline default. After you save, Intune deploys the setting to the assigned groups at the next device check-in. If you don't edit and save the profile, the setting doesn't take effect.
New baseline profiles: When you create a profile that uses the Windows security baseline version 25H2, or update an existing profile to version 25H2, that profile includes the new setting along with all the previously available settings.
The following OEMConfig apps are available in Intune for Android Enterprise: FCNT | com.fcnt.arrowsconfig FCNT | com.fcnt.arrowsconfig_test For more information about OEMConfig, see Use and manage Android Enterprise devices with OEMConfig in Microsoft Intune.
The following OEMConfig apps are available in Intune for Android Enterprise:
Remote Help supports RemoteApp in Azure Virtual Desktop (AVD), enabling help desk agents to securely view and control apps running within RemoteApp sessions. For more information, see Launch Remote Help.
Remote Help supports RemoteApp in Azure Virtual Desktop (AVD), enabling help desk agents to securely view and control apps running within RemoteApp sessions. For more information, see Launch Remote Help.
Intune supports WPA3-Personal as a security-type option when configuring Wi-Fi device configuration profiles for iOS/iPadOS. Admins can now select WPA3-Personal alongside existing options such as WPA2-Personal. This feature: Allows managed iOS/iPadOS devices to connect to networks that require the stronger WPA3 protocol.…
Intune supports WPA3-Personal as a security-type option when configuring Wi-Fi device configuration profiles for iOS/iPadOS. Admins can now select WPA3-Personal alongside existing options such as WPA2-Personal.
This feature:
Allows managed iOS/iPadOS devices to connect to networks that require the stronger WPA3 protocol.
Brings iOS/iPadOS in line with the latest Wi-Fi Alliance security standards and helps organizations meet evolving network-security requirements.
Support for WPA3 on Windows, Android, and macOS platforms and for WPA3-Enterprise will be available in a future release (no ETA).
An updated security baseline for Microsoft 365 Apps for Enterprise is now available in Microsoft Intune. This baseline aligns with the most recent Microsoft 365 Apps security guidance and includes updated policy recommendations to help protect against evolving threats. This release is…
An updated security baseline for Microsoft 365 Apps for Enterprise is now available in Microsoft Intune. This baseline aligns with the most recent Microsoft 365 Apps security guidance and includes updated policy recommendations to help protect against evolving threats.
This release is version v2512, which skips the previously published version found in the Security Compliance Toolkit (v2412). Review the new baseline carefully before you adopt it.
The following three settings aren't available in this baseline release and are expected to be added in a future update. The parent setting to these three, (VBA Macro Notification Settings set to Disable all except digitally signed macros) is still included in the v2512 release:
Require macros to be signed by a trusted publisher: Pending availability in the Settings Catalog.
Block certificates originating from the current user store only: Pending availability in the Settings Catalog.
Require Extended Key Usage (EKU) for code signing: Pending availability in the Settings Catalog.
The minimum supported version of the Microsoft Intune app for Android is now version 2025.11.01. This change took effect on May 1, 2026. Users running an older version might experience sign-in failures. Most users have app updates set to automatic and receive…
The minimum supported version of the Microsoft Intune app for Android is now version 2025.11.01. This change took effect on May 1, 2026. Users running an older version might experience sign-in failures.
Most users have app updates set to automatic and receive the updated app without taking any action. Users not running a supported version should update the Microsoft Intune app to the latest version to resolve any sign-in issues.
To check which devices are affected, go to Apps > Monitor > Discovered apps and find the Microsoft Intune app to identify devices running older versions.
Anthropic's Claude is now available in Copilot Chat, giving users more flexibility in how they work. Details: What changed: Users can now select Claude as a model option in Copilot Chat for complex analysis, document understanding, and structured content generation. Why: Adding…
Anthropic's Claude is now available in Copilot Chat, giving users more flexibility in how they work.
Details:
What changed: Users can now select Claude as a model option in Copilot Chat for complex analysis, document understanding, and structured content generation.
Why: Adding Claude gives users more flexibility to choose the model that best fits their needs.
Try this:
Use Claude to analyze a long document.
Ask Claude to break down a complex topic.
Request a multistep plan or structured outline.
Why this matters:
Business impact: Broadens access to different AI models, giving teams more flexibility to choose the model that best fits their needs.
Personal impact: Provides users with another option for generating detailed analysis, structured outputs, and high-quality content.
PowerPoint now supports Black Forest Lab's FLUX.2 Flex image generation model, giving users a new option for creating high quality visuals. Details: What changed: Users can now select FLUX.2 Flex when generating images in PowerPoint. The model produces higher‑quality visual output with…
PowerPoint now supports Black Forest Lab's FLUX.2 Flex image generation model, giving users a new option for creating high quality visuals.
Details:
What changed: Users can now select FLUX.2 Flex when generating images in PowerPoint. The model produces higher‑quality visual output with improved text and layout rendering.
Why: Adding another image generation model gives users more creative control and helps them produce visuals that better match their presentation needs.
Try this:
Choose FLUX.2 Flex when generating a slide background.
Create an image with text elements to see improved rendering.
Generate multiple layout variations to compare visual styles.
Why this matters:
Business impact: Enhances presentation quality and visual communication.
104646 Connect 15Five with Microsoft 365 Copilot to bring team priorities and recognition into Copilot experiences. Roadmap ID: 515160 Details: What changed: A new Copilot connector enables integration with 15Five. Users can access team priorities and recognition data directly within Copilot. Previously,…
104646
Connect 15Five with Microsoft 365 Copilot to bring team priorities and recognition into Copilot experiences.
What changed: A new Copilot connector enables integration with 15Five. Users can access team priorities and recognition data directly within Copilot. Previously, this information was not available through Copilot.
Why: Customers want easier access to external team insights without switching tools.
Try this:
Connect your 15Five account through the Copilot connector.
Ask Copilot to surface team priorities.
Review team recognition insights directly in Copilot.
Why this matters:
Business impact: Centralizes team insights and reduces time spent switching between tools.
Personal impact: Makes it easier to stay informed about team priorities and recognition.
Copilot for PowerPoint can now access images stored across multiple Organizational Asset Libraries when creating presentations. Details: What changed: Previously, Copilot could only pull images from a single Organizational Asset Library. It can now access enterprise assets stored across multiple SharePoint OALs,…
Copilot for PowerPoint can now access images stored across multiple Organizational Asset Libraries when creating presentations.
Details:
What changed: Previously, Copilot could only pull images from a single Organizational Asset Library. It can now access enterprise assets stored across multiple SharePoint OALs, enabling richer and more flexible content generation.
Why: This update ensures Copilot can use the full range of approved organizational visuals, improving brand consistency and content quality.
Try this:
Go to Insert>Picture>Brand Images: See all your OALs and pick Images from the OAL you want.
Ask Copilot to create a slide using your organization's approved imagery.
Generate multiple slide variations using assets from different OALs.
Use Copilot to update a presentation with the latest brand‑approved visuals.
Why this matters:
Business impact: Strengthens brand consistency and improves content creation workflows.
Personal impact: Makes it easier to build polished, on‑brand presentations.
Infinite scroll makes it easier to browse older Copilot chat sessions by loading conversations automatically as users scroll. Roadmap ID: 557348 Details: What changed: Users no longer need to click to load older chats; conversations appear continuously as they scroll. Why: This…
Infinite scroll makes it easier to browse older Copilot chat sessions by loading conversations automatically as users scroll.
MAI‑Image‑2‑Efficient enables users to generate high‑quality visuals directly in PowerPoint, helping them quickly create and refine slides without leaving their workflow. Details: What changed: Copilot in PowerPoint now includes the MAI‑Image‑2‑Efficient model for image generation. This model is optimized for speed and…
MAI‑Image‑2‑Efficient enables users to generate high‑quality visuals directly in PowerPoint, helping them quickly create and refine slides without leaving their workflow.
Details:
What changed: Copilot in PowerPoint now includes the MAI‑Image‑2‑Efficient model for image generation. This model is optimized for speed and efficiency, allowing users to rapidly iterate on visual ideas, create real‑time slide content, and update visuals across presentations more easily than before.
Why: This update helps users produce polished, professional visuals faster, reducing the need to switch tools or search for external images.
Try this:
Ask Copilot to generate a visual that matches the theme of your slide.
Replace an existing image by prompting Copilot to create an updated version.
Use Copilot to quickly explore multiple visual concepts during early slide drafting.
Why this matters:
Business impact: Speeds up presentation creation and ensures teams can produce consistent, high‑quality visuals.
Personal impact: Helps individuals express ideas visually with less effort
MAI‑Image‑2‑Efficient enables users to generate high‑quality visuals directly in PowerPoint, helping them quickly create and refine slides without leaving their workflow. Details: What changed: Copilot in PowerPoint now includes the MAI‑Image‑2‑Efficient model for image generation. This model is optimized for speed and…
MAI‑Image‑2‑Efficient enables users to generate high‑quality visuals directly in PowerPoint, helping them quickly create and refine slides without leaving their workflow.
Details:
What changed: Copilot in PowerPoint now includes the MAI‑Image‑2‑Efficient model for image generation. This model is optimized for speed and efficiency, allowing users to rapidly iterate on visual ideas, create real‑time slide content, and update visuals across presentations more easily than before.
Why: This update helps users produce polished, professional visuals faster, reducing the need to switch tools or search for external images.
Try this:
Ask Copilot to generate a visual that matches the theme of your slide.
Replace an existing image by prompting Copilot to create an updated version.
Use Copilot to quickly explore multiple visual concepts during early slide drafting.
Why this matters:
Business impact: Speeds up presentation creation and ensures teams can produce consistent, high‑quality visuals.
Personal impact: Helps individuals express ideas visually with less effort
Microsoft Edge is updating the Copilot experience to create a more unified visual design across Microsoft AI surfaces. Roadmap ID: 559993 Details: What changed: Microsoft Edge will update multiple user experience elements, including spacing, corners, fonts, and default colors, to align more…
Microsoft Edge is updating the Copilot experience to create a more unified visual design across Microsoft AI surfaces.
What changed: Microsoft Edge will update multiple user experience elements, including spacing, corners, fonts, and default colors, to align more closely with other Microsoft AI experiences such as Copilot and Bing.
Why: This change creates a more modern and unified experience across Microsoft AI surfaces.
Try this:
Open Copilot in Edge and review the updated visual design.
Compare the new spacing, fonts, and colors with other Microsoft AI experiences you use.
Update screenshots or internal training content if your organization documents the prior interface.
Why this matters:
Business impact: Supports consistency across tools and can reduce the need for separate guidance on different AI interfaces.
Personal impact: Makes the experience feel more familiar and easier to navigate across Microsoft AI products.
Users can now select shapes or images in PowerPoint and ask Copilot to explain them with detailed, contextual information. Details: What changed: The Explain feature in PowerPoint has expanded beyond acronyms, text boxes, tables, and slides. Users can now click Explain on…
Users can now select shapes or images in PowerPoint and ask Copilot to explain them with detailed, contextual information.
Details:
What changed: The Explain feature in PowerPoint has expanded beyond acronyms, text boxes, tables, and slides. Users can now click Explain on shapes and images to receive a contextual description of the selected object. This builds on earlier releases and broadens Copilot's ability to interpret visual elements.
Why: This enhancement helps users better understand visual content, making it easier to review, edit, or present information accurately.
Try this:
Select an image and choose Explain to get a summary of what it depicts.
Click Explain on a shape to understand its purpose in a diagram.
Use explanations to prepare speaker notes or refine slide content.
Why this matters:
Business impact: Improves clarity and accuracy when reviewing or collaborating on presentations.
Personal impact: Makes it easier to create polished, professional images.
When users enroll their personally owned Android devices in Intune, a work profile is created with a separate partition on the device for the user's work account. These devices are referred to as personally owned devices with a work profile. As part…
When users enroll their personally owned Android devices in Intune, a work profile is created with a separate partition on the device for the user's work account. These devices are referred to as personally owned devices with a work profile.
As part of the Intune move to the Android Management API (opens Android's web site), there are some updates for personally owned devices that enroll in Intune:
Web based enrollment for an improved enrollment flow and experience - Users don't have to install an app to enroll in Intune. Web enrollment is tenant wide.
New implementation for how Intune delivers policies - Modern update on how Intune delivers and monitors policies on Android personally owned devices with a work profile. This change also aligns with how Intune manages policies on corporate owned devices with a work profile, fully managed, and dedicated devices. You can scale your migration to targeted groups.
To use these features, opt in through the Microsoft Intune admin center:
Web based enrollment: Devices > Device Onboarding > Enrollment > Android> Personally owned devices with a work profile > Use web enrollment for all users enrolling into Android personally-owned work profile management
Policy: Devices > Manage devices > Configuration > Create > New policy > Android Enterprise > Move to Android Management API
Enrollment time grouping is now generally available for Apple automated device enrollment (ADE) on iOS/iPadOS and macOS. With enrollment time grouping, you can identify a device's Microsoft Entra security group during enrollment, so policies, apps, and settings can be applied earlier in…
Enrollment time grouping is now generally available for Apple automated device enrollment (ADE) on iOS/iPadOS and macOS. With enrollment time grouping, you can identify a device's Microsoft Entra security group during enrollment, so policies, apps, and settings can be applied earlier in the setup process.
Enrollment time grouping is supported in new Apple ADE enrollment policies. For requirements and setup details, see Set up enrollment time grouping. With the enrollment time grouping availability to iOS/iPadOS and macOS, we're also making the new Apple enrollment policies experience avaialble. Please check our previous blog post to learn more. (https://techcommunity.microsoft.com/blog/intunecustomersuccess/new-iosipados-visionos-tvos-and-macos-ade-enrollment-policies-experience/4393531)
In the Intune admin center, the Devices > All Devices > select a device page is redesigned and available for you to preview. This feature was available in the 2604 service release. After the initial 2604 release, we made the following improvements:…
In the Intune admin center, the Devices > All Devices > select a device page is redesigned and available for you to preview. This feature was available in the 2604 service release.
After the initial 2604 release, we made the following improvements:
After you select one of the following device actions, you can temporarily view passcodes and PINs in the Device action status table:
Intune now requires HTTPS delivery for managed Win32 app content. This change primarily affects organizations that use Microsoft Connected Cache and haven't configured their cache nodes for HTTPS delivery. Clients that previously pulled content from Connected Cache can still download Intune Win32…
Intune now requires HTTPS delivery for managed Win32 app content. This change primarily affects organizations that use Microsoft Connected Cache and haven't configured their cache nodes for HTTPS delivery. Clients that previously pulled content from Connected Cache can still download Intune Win32 apps, but those requests bypass the cache nodes and fall back to the content delivery network (CDN). This behavior can increase internet traffic and bandwidth usage.
Intune now includes a STIG audit baseline that assesses Windows devices against the recommended configurations defined in the Security Technical Implementation Guides (STIGs) published by the Defense Information Systems Agency (DISA). The initial baseline audits against the Microsoft Windows 11 STIG SCAP…
Intune now includes a STIG audit baseline that assesses Windows devices against the recommended configurations defined in the Security Technical Implementation Guides (STIGs) published by the Defense Information Systems Agency (DISA). The initial baseline audits against the Microsoft Windows 11 STIG SCAP BenchmarkVersion 2, Release 7 (benchmark date: January 5, 2026).
Unlike other Intune security baselines that configure and enforce settings, the STIG audit baseline is audit-only. It evaluates the current state of a device's configuration and generates detailed audit reports without changing any configured settings, helping organizations demonstrate compliance with DoD security recommendations. Audit results have a documented mapping to NIST XCCDF result categories for formal DISA compliance reporting, and Graph API support enables programmatic data retrieval and cross-tenant assessment aggregation.
Microsoft Intune mobile application management now supports Multiple Managed Accounts, letting users add and manage more than one managed account within the same app. App protection policies apply separately to each account, so you can tailor protection based on the account's organization…
Microsoft Intune mobile application management now supports Multiple Managed Accounts, letting users add and manage more than one managed account within the same app. App protection policies apply separately to each account, so you can tailor protection based on the account's organization or tenant. This capability helps consultants, acquisition teams, or users with multiple mailboxes stay productive without switching devices.
Currently we support Multiple Managed Accounts in Microsoft Teams on iOS/iPadOS (v8.10.0 or later). Support for additional apps and platforms is coming soon.
This feature is gradually rolling out and may not yet be available in your tenant.
You have the option to display custom text in the top bar of the Managed Home Screen (MHS). In addition to the existing choices (serial number, device name, tenant name), you can now select Custom and enter a free-text string of up…
You have the option to display custom text in the top bar of the Managed Home Screen (MHS). In addition to the existing choices (serial number, device name, tenant name), you can now select Custom and enter a free-text string of up to 63 characters. Custom strings support dynamic variables: {{SerialNumber}}, {{DeviceName}}, and {{TenantName}}. This is useful for kiosk scenarios such as checkout devices, departmental tagging, or any case where staff need a quick visual identifier.
Using Intune, you can detect and block a Local AI Agent, like OpenClaw, on Windows devices enrolled in Intune. Specifically, you can: Use a Properties catalog policy to collect the Local AI Agent entity. Admins can use this information to identify devices…
Using Intune, you can detect and block a Local AI Agent, like OpenClaw, on Windows devices enrolled in Intune. Specifically, you can:
Use a Properties catalog policy to collect the Local AI Agent entity. Admins can use this information to identify devices where OpenClaw is present or active.
Use Device Query to view devices with a Local AI Agent, like OpenClaw.
A new Mobile Threat Defense role category is available on the Mobile Threat Defense connector configuration page in the Microsoft Intune admin center. The Grant MTD role permissions to \ on enrolled Android COBO and COPE devices toggle lets you grant enhanced…
A new Mobile Threat Defense role category is available on the Mobile Threat Defense connector configuration page in the Microsoft Intune admin center. The Grant MTD role permissions to \<MTD partner name\> on enrolled Android COBO and COPE devices toggle lets you grant enhanced security permissions to one Mobile Threat Defense partner app, such as Microsoft Defender for Endpoint or a supported third-party partner, on enrolled Android Enterprise corporate-owned fully managed (COBO) and Android Enterprise corporate-owned work profile (COPE) devices.
When you turn on this toggle, the selected MTD app receives the following exemptions on targeted devices:
Suspension — The app is prevented from being suspended.
Hibernation — The app is prevented from entering hibernation.
Power restrictions — The app is exempt from power-related restrictions such as app standby, and can start foreground services from the background.
User controls — Users can't clear app data or force-stop the app.
These exemptions help the MTD app maintain continuous threat protection without interruption from system or user actions. Only one MTD partner can hold these permissions per tenant.
For Microsoft Defender for Endpoint, a second toggle is also available: Automatically launch Microsoft Defender for Endpoint during setup on Android COBO and COPE devices. When enabled, the Defender for Endpoint app automatically launches during device setup, allowing it to complete its initial configuration without requiring the user to manually open it.
Microsoft Intune now supports in-place renewal of eligible Cloud PKI issuing certification authorities (CAs). Previously, renewing an issuing CA required creating a new CA and manually updating dependent SCEP certificate profiles, which increased operational overhead and configuration risk. With in-place renewal, certificate…
Microsoft Intune now supports in-place renewal of eligible Cloud PKI issuing certification authorities (CAs). Previously, renewing an issuing CA required creating a new CA and manually updating dependent SCEP certificate profiles, which increased operational overhead and configuration risk. With in-place renewal, certificate issuance continues uninterrupted for scenarios such as Wi-Fi, VPN, and email, without changes to existing SCEP profiles or device assignments.
You can no longer configure the Managed Home Screen exit lock task mode password by using an app configuration policy. To set or update the lock task mode password for Managed Home Screen, create or update a device configuration profile that defines…
You can no longer configure the Managed Home Screen exit lock task mode password by using an app configuration policy. To set or update the lock task mode password for Managed Home Screen, create or update a device configuration profile that defines the lock task mode password policy.
There's a new Block Bluetooth sharing setting in the settings catalog (Devices > Manage devices > Configuration > Create > New policy > Android Enterprise for platform > Settings catalog for profile type > General). When set to True, the device can't…
There's a new Block Bluetooth sharing setting in the settings catalog (Devices > Manage devices > Configuration > Create > New policy > Android Enterprise for platform > Settings catalog for profile type > General). When set to True, the device can't share content over Bluetooth. When set to False, Intune doesn't change or update this setting. By default, the OS has the following behavior:
Fully managed and dedicated devices allow Bluetooth sharing.
Corporate-owned devices with a work profile block Bluetooth sharing.
There are new Microsoft Edge 148 settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Manage devices > Configuration > Create > New policy > Windows 10 and later…
There are new Microsoft Edge 148 settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Manage devices > Configuration > Create > New policy > Windows 10 and later for platform > Settings catalog for profile type).
The new policies include:
Microsoft Edge > Startup, home page and new tab page > Configure whether the Discover or Work feed tabs are shown on the New Tab Page
This policy configures whether the Discover or Work feed tabs are shown on the New Tab Page. By default, both Work and Discover tabs are enabled. Your options:
EnableBothWorkDiscover: If you set this value or don't configure this policy, Microsoft Edge shows both the Work and Discover feed tabs on the new tab page.
EnableOnlyWork: Microsoft Edge shows only the Work feed tab on the new tab page.
EnableOnlyDiscover: Microsoft Edge shows only the Discover feed tab on the new tab page.
Microsoft Edge > Identity and sign-in > Allow M365 authentication popups in work profiles
This policy controls whether Microsoft Edge allows Microsoft 365 authentication pop-ups to bypass the pop-up blocker in work profiles. When users are signed in with a work account, some Microsoft 365 sites, like microsoft.com, cloud.microsoft.com, and visualstudio.com, might open authentication pop-ups to login.microsoftonline.com, login.live.com, or login.microsoft.com. These pop-ups are required to complete sign-in.
Your options:
If you enable this policy or don't configure it, Microsoft 365 authentication pop-ups are allowed in work profiles.
If you disable this policy, Microsoft 365 authentication pop-ups follow the default settings like other pop-ups. Users can choose to allow or block them, but they aren't automatically allowed.
This policy only applies to work profiles. In personal profiles, Microsoft 365 authentication pop-ups are always allowed regardless of this policy's configuration.
Microsoft Edge > Automatically open Copilot side pane with contextual insights for links opened from Outlook
This policy controls whether Microsoft Edge automatically opens the Microsoft Copilot side pane when users open web links from Outlook emails sent from the same tenant. Starting in Microsoft Edge version 148, when users open eligible links from Outlook emails sent from the same tenant, Microsoft Edge automatically opens the Copilot side pane with contextual insights. Copilot can use the originating Outlook email as context to surface relevant insights and suggested next steps alongside the web content.
Your options:
If you enable this policy or don't configure it, the Copilot side pane opens automatically when users open links from Outlook emails sent from the same tenant.
If you disable this policy, the Copilot side pane doesn't open automatically when users open links from Outlook emails sent from the same tenant.
Microsoft Edge > List of URL patterns for which developer tools are allowed to be opened
This policy controls where developer tools can be used in Microsoft Edge by specifying an allowlist of URL patterns. URL patterns are matched against the URL of every frame on the page being inspected.
Microsoft Edge > List of URL patterns for which developer tools are blocked
This policy specifies URL patterns where developer tools are blocked. For information on the URL format, see Filter formats for URL list-based policies. URL patterns are evaluated against the URL of every frame on the page being inspected. If any frame matches a pattern in this policy, developer tools are blocked for the entire page.
Microsoft Edge > Maximum number of concurrent connections to the proxy server for WebSocket requests
Specifies the maximum number of simultaneous connections to a proxy server for WebSocket requests. To configure limits for non-WebSocket requests, see the MaxConnectionsPerProxy policy.
If you don't configure this policy, the default value of 32 is used. Some web applications maintain multiple concurrent connections, like long-lived or hanging requests. Setting a value lower than the default may cause networking delays when many such applications are open. Some proxy servers can't handle a high number of concurrent connections per client. In these cases, reducing the value of this policy might improve reliability. The supported range is 6 to 256:
Values less than 6 are treated as 6.
Values greater than 256 are treated as 256.
Modify this value only if required by your proxy server configuration or network environment.
Microsoft Edge > Controls the availability of browsing with Copilot in Microsoft Edge
When browsing with Copilot is enabled, users can explicitly invoke it for a query. It isn't invoked automatically. Browsing with Copilot is available only on domains specified in the Browsing with Copilot Allowed URLs policy and is blocked on domains specified in the Browsing with Copilot Blocked URLs policy. If no domains are configured in the allow list, browsing with Copilot is effectively disabled.
This feature is available only to users with an active Microsoft 365 Copilot subscription. For more information about configuring browsing with Copilot, see Configure browsing with Copilot.
Your options:
If you enable this policy, browsing with Copilot is turned on for all users who receive the policy, and users can't turn it off.
If you disable this policy, browsing with Copilot is turned off for all users who receive the policy, and users can't turn it on.
If you don't configure this policy, browsing with Copilot is off by default, and users can turn it on.
Microsoft Edge > Browsing with Copilot Allowed URLs
Allows you to define a list of URLs where browsing with Copilot is available. Users can't modify this list.
Your options:
If you enable this policy, browsing with Copilot is available only on the sites specified in the list. To allow a broader set of sites while blocking specific exceptions, configure this policy together with the Browsing with Copilot Blocked URLs policy. For example, you can include * to allow all sites, and then use the block list to restrict access to specific URLs. You can define exceptions based on schemes, subdomains, ports, or origins. When multiple filters apply, the most specific match determines whether a URL is allowed or blocked. The block list takes precedence over the allow list.
Browsing with Copilot supports only HTTP and HTTPS protocols. Wildcards (*) are supported, and subdomains are matched even without wildcards. This policy applies only to the site origin; any path specified in the URL pattern is ignored. For guidance on formatting URL patterns, see Filter formats for URL list-based policies. Example value:
Microsoft Edge > Browsing with Copilot Blocked URLs
Controls the list of URLs where browsing with Copilot is blocked. Users can't modify this list. Use this policy to define exceptions to broader allowlists. For example, you can set Browsing with Copilot Allowed URLs to * to allow all sites, and then use this policy to block access to specific URLs. This policy supports blocking by scheme, subdomain, or port. When multiple URL patterns apply, the most specific match determines whether access is allowed or blocked. Blocklist entries take precedence over allowlist entries.
If you don't configure this policy, no exceptions are applied to Browsing with Copilot Allowed URLs. Browsing with Copilot supports only HTTP and HTTPS protocols. Wildcards (*) are supported, and subdomains are matched even without wildcards. URL matching is based on the site origin only; any path specified in the pattern is ignored. For information about URL pattern format, see Filter formats for URL list-based policies. Example value:
This policy configures the availability of the Copilot new tab page in Microsoft Edge for Business. The Copilot new tab page combines search and chat into a single input box and includes personalized cards that provide quick access to relevant files, calendar events, and suggested Copilot prompts. Users who don't have a Microsoft 365 Copilot license might experience limited relevance in Copilot prompt card content.
Most policies that customize the New Tab Page are supported on the Copilot new tab page. For a complete list of supported and unsupported policies, see Configure the Copilot new tab page. This policy applies only to Microsoft Entra ID profiles and controls the Copilot new tab page experience in Microsoft Edge for Business. This policy doesn't apply to the Copilot new tab page on personal Microsoft account profiles.
Your options:
If you enable this policy, the Copilot new tab page is turned on.
If you disable or don't configure this policy, the Copilot new tab page is turned off. When the policy isn't configured, users can turn it on via user settings.
Microsoft Edge > Manageability > Allow MAM enrollment when managed device has Purview DLP policy configured
Controls whether Microsoft Edge allows Mobile Application Management (MAM) enrollment on managed devices when Microsoft Purview Data Loss Prevention (DLP) is configured.
Your options:
If you enable this policy, MAM enrollment is allowed even when Purview DLP is detected on the device.
If you disable or don't configure this policy, MAM enrollment is blocked when Purview DLP is detected on the device.
There's a new 802.1x Wired Networks device configuration profile for iOS/iPadOS devices. The feature supports 802.1x Ethernet access controls, which is ideal for M-series iPads that support native resolution screen extension. It allows iPads to securely connect to hot desk docks and…
There's a new 802.1x Wired Networks device configuration profile for iOS/iPadOS devices. The feature supports 802.1x Ethernet access controls, which is ideal for M-series iPads that support native resolution screen extension. It allows iPads to securely connect to hot desk docks and monitors using wired access.
This profile:
Supports EAP protocols, like TLS, PEAP, and TTLS
Is similar to the macOS wired network profile experience
This feature helps with secure enterprise deployments for iPads in education, finance, and other regulated industries.
The following protected apps are now available for Microsoft Intune: Caju AI by Caju AI eYACHO for Biz 7 Intune by MetaMoJi Corporation (iOS) eYACHO Viewer 7 Intune by MetaMoJi Corporation (iOS) Harvey AI by Harvey AI (Android) Notta for Intune by…
The following protected apps are now available for Microsoft Intune:
Caju AI by Caju AI
eYACHO for Biz 7 Intune by MetaMoJi Corporation (iOS)
eYACHO Viewer 7 Intune by MetaMoJi Corporation (iOS)
For devices using Managed Home Screen (MHS), you can now silence apps whenever MHS prompts the user for authentication, such as during sign-in or at the session PIN screen. When silenced, apps can't start activities, display notifications, appear in recent apps, or…
For devices using Managed Home Screen (MHS), you can now silence apps whenever MHS prompts the user for authentication, such as during sign-in or at the session PIN screen. When silenced, apps can't start activities, display notifications, appear in recent apps, or trigger toasts, dialogs, or device ringing. You can configure an allowlist of apps that remain unsilenced during the locked state, ensuring that critical communications like calls aren't interrupted. This feature is opt-in and configurable, allowing your organization to tailor the experience to its operational needs. Once the device is unlocked, all apps automatically return to their normal state.
Microsoft Tunnel now supports Strict Tunnel Mode on Android Enterprise devices. When Strict Tunnel Mode is enabled, all network traffic is forced through the VPN tunnel. If the VPN connection is unavailable or drops, all network traffic on the device is blocked…
Microsoft Tunnel now supports Strict Tunnel Mode on Android Enterprise devices. When Strict Tunnel Mode is enabled, all network traffic is forced through the VPN tunnel. If the VPN connection is unavailable or drops, all network traffic on the device is blocked until the VPN reconnects, preventing apps from accessing the public internet outside of the tunnel.
Strict Tunnel Mode is available when a Microsoft Tunnel VPN profile is configured with Always-on VPN. Admins can configure an app exclusion list to allow specific apps to bypass the tunnel and connect directly to the network, regardless of VPN connection status.
Strict Tunnel Mode requires devices enrolled through Android Management API (AM API). For unenrolled devices using Microsoft Tunnel for Mobile Application Management (MAM), Strict Tunnel Mode is available through the Microsoft Edge app configuration policy.
With the release of 26.4, Apple deprecated several intelligence-related settings in the MDM restrictions payload. To manage these settings, use the DDM configurations released in March 2026 instead. In the settings catalog, the following Restrictions are now deprecated: Allow Apple Intelligence Report…
With the release of 26.4, Apple deprecated several intelligence-related settings in the MDM restrictions payload. To manage these settings, use the DDM configurations released in March 2026 instead.
In the settings catalog, the following Restrictions are now deprecated:
This feature is rolling out to tenants gradually and may take several weeks to become available in your environment. The Vulnerability Remediation Agent is now available to all customers in preview. Previously, the agent was available only to a select group of…
This feature is rolling out to tenants gradually and may take several weeks to become available in your environment.
The Vulnerability Remediation Agent is now available to all customers in preview. Previously, the agent was available only to a select group of customers in a limited preview.
The Vulnerability Remediation Agent now uses Microsoft Entra agentic identity instead of a human user identity. When you set up a new agent instance, the setup process automatically provisions an agentic identity in your tenant's Entra directory. The agent runs under the permissions delegated to this agentic user, providing a more secure and scalable identity model.
What this means for existing agents: If you already have a Vulnerability Remediation Agent instance that uses a human user identity, your agent continues to work as-is for now. Human user identity support expires 90 days after this release, after which you must transition to an agentic identity. A banner on the agent page notifies you when agentic identity is available for your agent. For transition steps and details, see Transition existing agents to agentic identity.
What's new for agentic identity:
New agent instances are provisioned with an agentic identity during setup.
After setup, you must delegate the required permissions to the agentic user in the Microsoft Entra and Microsoft Defender admin centers.
Use the Run Readiness Check button to verify that all required permissions are in place before running the agent.
Makers can now add expected responses to agent evaluation test cases manually or through file import. Details: What changed: Test cases now support expected responses and multiple grading methods, including Exact, Partial, Similarity, and Compare Meaning. Why: This helps makers evaluate agent…
Makers can now add expected responses to agent evaluation test cases manually or through file import.
Details:
What changed: Test cases now support expected responses and multiple grading methods, including Exact, Partial, Similarity, and Compare Meaning.
Why: This helps makers evaluate agent quality more accurately and consistently.
Try this:
Add expected responses to an existing test case.
Import a file containing multiple test cases.
Run an evaluation using different grading methods.
Why this matters:
Business impact: Improves agent reliability and testing accuracy.
Personal impact: Makes it easier to validate agent behavior.
Admins can now leverage rules to take large-scale agent management scenarios such as bulk installing first-party (1P) agents and reassigning ownerless agents to appropriate managers, enabling consistent governance and reducing operational overhead in enterprise environments. Roadmap ID: 481518 Details: What changed: Admins…
Admins can now leverage rules to take large-scale agent management scenarios such as bulk installing first-party (1P) agents and reassigning ownerless agents to appropriate managers, enabling consistent governance and reducing operational overhead in enterprise environments.
What changed: Admins can now use rules to manage two key scenarios: (1) bulk installation of first-party (1P) agents across all users in the organization, and (2) automatic reassignment of ownerless agents to the appropriate manager. Previously, these actions required manual intervention or scripting, making it difficult to manage at scale. With rules, these workflows can now be executed consistently and based on defined conditions.
Why this matters:
Business impact: Accelerates enterprise-wide agent adoption while ensuring every agent remains governed with a clear owner, reducing risk and operational gaps at scale.
Personal impact: Eliminates manual effort for admins to deploy agents or track down ownership gaps, enabling more efficient and reliable management of agent environments.
The default chat experience with Copilot in Word now allows Copilot to directly edit your document. All changes made by Copilot are fully reviewable and reversible, and users can turn this experience off if needed Roadmap ID: 557673 Details: What changed: Copilot…
The default chat experience with Copilot in Word now allows Copilot to directly edit your document. All changes made by Copilot are fully reviewable and reversible, and users can turn this experience off if needed
What changed: Copilot is now able to edit documents by default in Word. This means Copilot can make direct edits to the document without requiring users to toggle editing on. Users can still turn this experience off if they prefer. All Copilot‑made changes remain trackable and reversible.
Why: This update streamlines the editing workflow, reducing friction, and helping users complete writing tasks more efficiently.
Try this:
Ask Copilot to rewrite a paragraph and watch the edits appear directly in the document.
Request formatting changes, such as adjusting headings or reorganizing sections.
Use Copilot to insert new content, then review the tracked changes.
Why this matters:
Business impact: Speeds up document creation and editing across teams.
Personal impact: Makes writing and revising content more intuitive.
101838 Federated Copilot connectors are now generally available, enabling users to securely connect Microsoft 365 Copilot to supported third-party data sources and retrieve information in real time using the Model Context Protocol (MCP). Details: What changed: Federated Copilot connectors are now available…
101838 Federated Copilot connectors are now generally available, enabling users to securely connect Microsoft 365 Copilot to supported third-party data sources and retrieve information in real time using the Model Context Protocol (MCP).
Details:
What changed: Federated Copilot connectors are now available across Microsoft 365 Chat, Researcher, and Agent Mode in Excel. Admins can discover, review, enable, disable, and manage Microsoft-published federated connectors from Microsoft Admin Center > Copilot > Connectors.
Why: Organizations can extend Copilot with real-time access to external business data while maintaining centralized governance and administrative control.
Try this:
Review available federated connectors in Microsoft Admin Center.
Use staged rollout to enable connectors for a subset of users or groups.
Evaluate connectors during the 7-day admin review period before end-user availability.
Disable connectors that do not align with organizational policies or compliance requirements.
Why this matters:
Business impact: Provides secure, governed access to external business data without requiring data ingestion, storage, or indexing in Microsoft 365.
Personal impact: Users can connect approved third-party applications and access up-to-date information directly within Copilot experiences, helping them complete tasks more efficiently.
The Grader Framework provides flexible evaluation options for agent responses using exact match, similarity, intent, and AI‑based metrics. Details: What changed: Makers can now use multiple grading approaches to evaluate agent performance with more transparency. Why: Different scenarios require different evaluation methods,…
The Grader Framework provides flexible evaluation options for agent responses using exact match, similarity, intent, and AI‑based metrics.
Details:
What changed: Makers can now use multiple grading approaches to evaluate agent performance with more transparency.
Why: Different scenarios require different evaluation methods, and flexibility improves testing accuracy.
Try this:
Evaluate an agent using similarity scoring.
Compare intent‑based grading with exact match.
Review detailed grading results to identify improvement areas.
Why this matters:
Business impact: Enhances quality assurance for AI agents.
Personal impact: Helps makers understand how agents perform in real scenarios.
Organizational Messages now supports usage‑based targeting in addition to existing group‑based targeting capabilities. This enables admins to deliver Organizational Messages based on real user behavior and engagement patterns rather than static group membership. Roadmap ID: 503563 Details: What changed: Admins can now…
Organizational Messages now supports usage‑based targeting in addition to existing group‑based targeting capabilities. This enables admins to deliver Organizational Messages based on real user behavior and engagement patterns rather than static group membership.
What changed: Admins can now target Organizational Messages using dynamic usage behaviors through Usage‑based targeting. This allows IT admins to drive Microsoft 365 Copilot adoption by reaching users based on actual product usage instead of relying only on pre‑configured groups or distribution lists. By leveraging dynamic, pre‑defined usage segments, admins can deliver timely and relevant guidance to the right users to improve awareness, engagement, and value realization from Copilot investments.
The initial release includes two Action Segments focused on Copilot adoption:
Inactive Copilot Users for the past 28 days
Inactive Copilot Users in Teams for the past 30 days
Why this matters:
Business impact: Enables more precise and effective Copilot adoption campaigns by targeting users based on actual behavior, helping organizations improve engagement and maximize value from Copilot investments.
Personal impact: Users receive more relevant and timely communications tailored to their usage patterns, helping them better discover and adopt Microsoft 365 Copilot capabilities.
Organizational Messages in the Microsoft 365 Admin Center now supports email delivery in addition to other surfaces like the Windows Taskbar, Windows Spotlight, Windows Notification Center, and Teams Popovers. This gives admins another familiar communication channel while keeping messaging within one centralized…
Organizational Messages in the Microsoft 365 Admin Center now supports email delivery in addition to other surfaces like the Windows Taskbar, Windows Spotlight, Windows Notification Center, and Teams Popovers. This gives admins another familiar communication channel while keeping messaging within one centralized workflow.
What changed: Admins can now deliver Organizational Messages through email alongside existing OM surfaces including Windows Taskbar, Windows Spotlight, Windows Notification Center, and Teams Popovers. Adding email expands communication reach and simplifies change management workflows by reducing dependency on separate communication tools.
The initial release includes 9 premade email templates available in 15 languages to help accelerate Microsoft 365 Copilot onboarding, awareness, and adoption:
3 welcome email templates: Welcome to M365 Copilot, Welcome to Copilot Chat, and Welcome to Copilot Trial with onboarding guidance and helpful resources.
6 weekly email templates for The Great M365 Copilot Journey, designed to increase awareness of Copilot features and capabilities and help users maximize the value of Copilot.
A new insights tab dedicated to the Email surface is now available to help admins track and measure campaign engagement.
Why: Adding email as a delivery surface helps organizations reach users through a familiar and widely used communication channel while enabling centralized campaign management within Organizational Messages.
Try this:
Create an Organizational Message and select Email as the delivery method.
Use premade onboarding and adoption templates to accelerate Copilot rollout campaigns.
Leverage the weekly Great M365 Copilot Journey emails to drive continued Copilot engagement and feature awareness.
Monitor campaign effectiveness using the new Email insights tab.
Why this matters:
Business impact: Expands organizational communication reach, simplifies change communication workflows, and accelerates Microsoft 365 Copilot awareness, onboarding, and adoption through centralized campaign management.
Personal impact: Helps users stay informed and adopt Microsoft 365 Copilot capabilities through timely onboarding guidance and engaging email experiences delivered in a familiar communication channel.
Users can now access Microsoft 365 Copilot directly inside model‑driven apps to get answers and take action without switching tools. Details: What changed: Copilot is now embedded in model‑driven apps, enabling users to ask questions, complete tasks, and access context‑aware insights. Why:…
Users can now access Microsoft 365 Copilot directly inside model‑driven apps to get answers and take action without switching tools.
Details:
What changed: Copilot is now embedded in model‑driven apps, enabling users to ask questions, complete tasks, and access context‑aware insights.
Why: Users lose time switching between apps and searching for information. Integrating Copilot reduces delays and improves task completion.
Try this:
Ask Copilot to summarize a record or workflow.
Request help completing a task inside the app.
Use Copilot to find missing context before making a decision.
Why this matters:
Business impact: Improves app adoption and reduces operational friction.
Personal impact: Helps users work faster with fewer interruptions.
When enabled, cloud-native file formats such as .loop and .page files are converted to HTML, making the content indexed and keyword searchable in the review set and easier to process in post-export workflows.
A new Convert supported file formats to HTML option is available when adding search results to a review set and when exporting items from a review set in eDiscovery. When enabled, cloud-native file formats such as .loop and .page files are converted to HTML, making the content indexed and keyword searchable in the review set and easier to process in post-export workflows.
Query Endpoint DLP device configuration and policy sync attributes at scale through the DeviceInfo table's DlpInfo column in Advanced hunting in the Microsoft Defender portal, instead of relying on point-in-time exports from the Microsoft Purview portal.
Access Endpoint DLP device attribute data using Advanced Hunting. Query Endpoint DLP device configuration and policy sync attributes at scale through the DeviceInfo table's DlpInfo column in Advanced hunting in the Microsoft Defender portal, instead of relying on point-in-time exports from the Microsoft Purview portal.
Added definitions for the following sensitive information types: China physical addresses Colombia national ID Colombia tax identification number Greenland physical addresses Russia physical addresses Russia taxpayer identification number Singapore physical addresses South Africa physical addresses Ukraine physical addresses
Added definitions for the following sensitive information types:
We are excited to announce Bring Your Own Device (BYOD) support for Windows client using Entra-registered devices is now generally available. You can now enable users and partners to access corporate resources from their own devices. Administrators can assign the Private Application…
We are excited to announce Bring Your Own Device (BYOD) support for Windows client using Entra-registered devices is now generally available. You can now enable users and partners to access corporate resources from their own devices. Administrators can assign the Private Application traffic profile to users with internal accounts, including internal guest users. This removes the previous requirement for Windows devices to be domain-joined. For more information, see: Bring Your Own Device.
Muted chats and meeting chats are now grouped together in separate sections to help you keep track of conversations and reduce distractions. To learn more, see Chat in Microsoft Teams meetings.
Muted chats and meeting chats are now grouped together in separate sections to help you keep track of conversations and reduce distractions. To learn more, see Chat in Microsoft Teams meetings.
Express yourself with organization-branded reactions during meetings. Companies can create custom reaction experiences that align with their brand. To learn more, see Use meeting themes in Microsoft Teams.
Express yourself with organization-branded reactions during meetings. Companies can create custom reaction experiences that align with their brand. To learn more, see Use meeting themes in Microsoft Teams.
Scope an Endpoint DLP policy to specific device groups — for example, enforce policy only when Finance users access data from Windows devices, and not when the same users work from macOS — using dynamic device groups defined in Microsoft Entra ID.
Create a DLP policy that uses device scoping. Scope an Endpoint DLP policy to specific device groups — for example, enforce policy only when Finance users access data from Windows devices, and not when the same users work from macOS — using dynamic device groups defined in Microsoft Entra ID.
You no longer need to manually initiate vectorization before using AI features.
Data preparation in Data Security Investigations now runs automatically in the background as items are added to scope. You no longer need to manually initiate vectorization before using AI features.
Domainless SAML federation with a SAML Identity Provider allows external users to authenticate into your apps or workforce resources using their IdP-managed credentials, regardless of their email domain. Domainless federation removes the need for domain matching between the user's email and preconfigured…
Domainless SAML federation with a SAML Identity Provider allows external users to authenticate into your apps or workforce resources using their IdP-managed credentials, regardless of their email domain. Domainless federation removes the need for domain matching between the user's email and preconfigured IdP domains during sign-in or invitation redemption. Learn more at Add a SAML/WS-Fed identity provider - Microsoft Entra External ID.
Investigators receive notifications through the Microsoft Purview Notification Center and email when setup completes and investigations are ready to use.
Email and portal notifications for Data Security Investigations. Investigators receive notifications through the Microsoft Purview Notification Center and email when setup completes and investigations are ready to use.
Investigators can query data captured by endpoint Data Loss Prevention (DLP) policies on onboarded devices and add the associated content to an investigation scope for AI-powered analysis. This integration enables aggregate analysis of endpoint exfiltration events instead of per-alert triage.
Endpoint DLP evidence collection is now available as a data source in Data Security Investigations. Investigators can query data captured by endpoint Data Loss Prevention (DLP) policies on onboarded devices and add the associated content to an investigation scope for AI-powered analysis. This integration enables aggregate analysis of endpoint exfiltration events instead of per-alert triage. For more information, see Search, review, and refine results in Data Security Investigations.
The new version of the tool streamlines onboarding and enhances security by:- Bundling the onboarding package directly into the tool's executable.- Generating a key during deployment package creation that is required for running the tool.- Enabling users to configure an expiry date…
The new version of the tool streamlines onboarding and enhances security by:- Bundling the onboarding package directly into the tool's executable.- Generating a key during deployment package creation that is required for running the tool.- Enabling users to configure an expiry date for the package to reduce the risk of unauthorized use.In addition:- You have the option of downloading the package as either an .exe or a .zip file, whichever best suits your organization's needs.- A new Deployment packages page in the Defender portal facilitates management of downloaded packages by providing centralized visibility into all the packages and their current status.
The new exposure score model in Defender Vulnerability Management is now generally available. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors such as internet-facing status and criticality. For more information, see…
The new exposure score model in Defender Vulnerability Management is now generally available. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors such as internet-facing status and criticality. For more information, see Exposure score in Defender Vulnerability Management and Security recommendations.
Each matched condition includes the condition name, matched value, and source.
Enhanced matched conditions for Exchange DLP events surfaces detailed non-sensitive information type (SIT) condition matches in DLP alerts and Activity Explorer for Exchange Online. Each matched condition includes the condition name, matched value, and source.
Entity enrichments with threat intelligence: Entity pages for IP addresses, domains, URLs, and files now include a Threat Intelligence Insights tab that surfaces enrichment data from Microsoft Threat Intelligence directly in the investigation workflow. Enrichments include reputation scores, attributed threat reports, infrastructure…
Entity enrichments with threat intelligence: Entity pages for IP addresses, domains, URLs, and files now include a Threat Intelligence Insights tab that surfaces enrichment data from Microsoft Threat Intelligence directly in the investigation workflow. Enrichments include reputation scores, attributed threat reports, infrastructure relationships, and sandbox analysis, eliminating the need to switch between separate tools during investigations. For more information, see View threat intelligence in entity pages.
Conditional Access now provides broader controls to secure AI agents that have a user account. Administrators can: Target agent's user accounts with greater precision by including or excluding individual agents or dynamically grouping agents using Custom Security Attributes. Protect against risky agent…
Conditional Access now provides broader controls to secure AI agents that have a user account. Administrators can:
Target agent's user accounts with greater precision by including or excluding individual agents or dynamically grouping agents using Custom Security Attributes.
Protect against risky agent activity by applying Conditional Access policies based on Agent Risk.
Require compliant devices for agents running on managed endpoints, including Windows 365 for Agents, ensuring agents can only operate from devices that meet your organization's compliance requirements.
Apply device platforms, filter for devices and compliant network conditions to agents running on endpoints, enabling policies based on device state and trusted network locations.
These capabilities extend Zero Trust protections to agent's user accounts while leveraging the familiar Conditional Access policy experience. For more information see: Target agent identities in Conditional Access policies.
This feature allows Entitlement Management admins to directly assign external users who are not in the directory to an access package using the user's email. Users are invited into the tenant as Guest users and are governed (as long as Entra ID…
This feature allows Entitlement Management admins to directly assign external users who are not in the directory to an access package using the user's email. Users are invited into the tenant as Guest users and are governed (as long as Entra ID Governance is configured).
Preview PowerPoint and Excel files more quickly in Teams on your mobile device. Open and review content without waiting as long for files to load. To learn more, see Share files in Microsoft Teams.
Preview PowerPoint and Excel files more quickly in Teams on your mobile device. Open and review content without waiting as long for files to load. To learn more, see Share files in Microsoft Teams.
Discover files in chats and channels with improved search and filtering options. Narrow results by file type, sender, and date to quickly locate content. Press Ctrl+F (Windows), Cmd+F (Mac), or select Find in chat to start. To learn more, see Search for…
Discover files in chats and channels with improved search and filtering options. Narrow results by file type, sender, and date to quickly locate content. Press Ctrl+F (Windows), Cmd+F (Mac), or select Find in chat to start. To learn more, see Search for messages and more in Microsoft Teams.
When a Teams Room on Android joins a webinar or structured meeting as a presenter, the front-of-room display will default to attendee view and presenters keep full control from the console. To learn more, see Microsoft Teams Rooms (Android).
When a Teams Room on Android joins a webinar or structured meeting as a presenter, the front-of-room display will default to attendee view and presenters keep full control from the console. To learn more, see Microsoft Teams Rooms (Android).
Your download manager now appears in the Teams title bar or with a keyboard shortcut to let you monitor downloads without blocking you from other actions in Teams.
Your download manager now appears in the Teams title bar or with a keyboard shortcut to let you monitor downloads without blocking you from other actions in Teams.
No action is required. What is changing? Starting August 2026, users will see an improved restore experience for device-bound Authenticator app passkeys for iOS users. No admin or user action is required. With this update: Users who already have iCloud and iCloud…
No action is required.
What is changing? Starting August 2026, users will see an improved restore experience for device-bound Authenticator app passkeys for iOS users. No admin or user action is required.
With this update:
Users who already have iCloud and iCloud Keychain backup enabled for the Authenticator app—and have device-bound Authenticator passkeys on their old device—will automatically benefit from this improved experience.
Users restoring their Authenticator app on a new iOS device will experience an updated restore flow.
This change streamlines the restore experience by directing users to the right recovery path based on access to their old device and helping them understand cross-device passkey authentication, resulting in a smoother transition to a new phone.
This update applies to iOS devices only. Android support will follow.
Learn more about the changes to backup and restore in Authenticator app.
Microsoft Authenticator introduced jailbreak/root detection for Microsoft work or school accounts in the Authenticator app. Users with rooted/jailbroken devices will be blocked from adding/using work or school accounts in Authenticator app. Users must move to compliant devices to continue using work or…
Microsoft Authenticator introduced jailbreak/root detection for Microsoft work or school accounts in the Authenticator app. Users with rooted/jailbroken devices will be blocked from adding/using work or school accounts in Authenticator app. Users must move to compliant devices to continue using work or school accounts in Authenticator. This capability is secure by default and does not require any admin configuration or control.
Microsoft Defender for Endpoint now automatically discovers supported local AI agents running on onboarded Windows devices — including coding agents and IDE extensions, desktop AI assistants, local AI runtimes, and agent platforms. Discovered agents appear as assets in the AI agent inventory,…
Microsoft Defender for Endpoint now automatically discovers supported local AI agents running on onboarded Windows devices — including coding agents and IDE extensions, desktop AI assistants, local AI runtimes, and agent platforms. Discovered agents appear as assets in the AI agent inventory, exposure map, and advanced hunting, giving security teams visibility into local AI agent usage across the organization. For more information, see Discover local AI agents.
Discovered agents appear as assets in the AI agent inventory, exposure map, and advanced hunting, giving security teams visibility into local AI agent usage across the organization.
Local AI agent discovery on Windows endpoints: as part of the Defender AI agents experience, Microsoft Defender now automatically discovers supported local AI agents running on onboarded Windows devices - including coding agents and IDE extensions, desktop AI assistants, local AI runtimes, and agent platforms. Discovered agents appear as assets in the AI agent inventory, exposure map, and advanced hunting, giving security teams visibility into local AI agent usage across the organization. For more information, see Discover local AI agents.
Local AI agent discovery now supports macOS endpoints in addition to Windows. This update also adds discovery support for new agents including Junie CLI, Kiro CLI, Warp, Hermes Agent, Goose Desktop, Perplexity Desktop, Kiro IDE, Devin Desktop (formerly Windsurf), and QClaw. For…
Local AI agent discovery now supports macOS endpoints in addition to Windows. This update also adds discovery support for new agents including Junie CLI, Kiro CLI, Warp, Hermes Agent, Goose Desktop, Perplexity Desktop, Kiro IDE, Devin Desktop (formerly Windsurf), and QClaw. For more information, see Local AI agent discovery.
Runtime protection for supported local AI agents on Windows endpoints is now available in public preview. Microsoft Defender inspects the agent loop (user prompts, tool calls, and tool responses) and can block risky activity before it executes, helping stop prompt injection and…
Runtime protection for supported local AI agents on Windows endpoints is now available in public preview. Microsoft Defender inspects the agent loop (user prompts, tool calls, and tool responses) and can block risky activity before it executes, helping stop prompt injection and unsafe agent actions at the device level. Blocked and audited events appear as alerts in Microsoft Defender to support incident correlation and investigation workflows. For more information, see Set up AI agent runtime protection.
Microsoft Defender inspects the agent loop (user prompts, tool calls, and tool responses) and can block risky activity before it executes, helping stop prompt injection and unsafe agent actions at the device level. Blocked and audited events appear as alerts in Microsoft…
Local AI agent runtime protection on Windows endpoints: as part of the Defender AI agents experience, runtime protection for supported local AI agents on Windows endpoints is now available in public preview. Microsoft Defender inspects the agent loop (user prompts, tool calls, and tool responses) and can block risky activity before it executes, helping stop prompt injection and unsafe agent actions at the device level. Blocked and audited events appear as alerts in Microsoft Defender to support incident correlation and investigation workflows. For more information, see Set up AI agent runtime protection with Microsoft Defender for Endpoint.
Teams can now alert you when potential impersonation risks are detected during meetings on iOS and Android, helping you identify suspicious activity more easily.
Teams can now alert you when potential impersonation risks are detected during meetings on iOS and Android, helping you identify suspicious activity more easily.
Microsoft Entra Backup and Recovery is a built-in solution to help restore your tenant after accidental changes or malicious updates. Always on by default, it automatically backs up critical directory objects — including users, groups, applications, service principals, managed identities, Conditional Access…
Microsoft Entra Backup and Recovery is a built-in solution to help restore your tenant after accidental changes or malicious updates. Always on by default, it automatically backs up critical directory objects — including users, groups, applications, service principals, managed identities, Conditional Access policies, named locations, agent IDs, and authentication and authorization policy, so admins can quickly restore them to a previously known good state.
At preview, Entra Backup and Recovery automatically takes daily backup of a tenant's supported directory objects. If a tenant has Microsoft Entra ID P1 or P2 licenses, one backup is taken each day and retained for 7 days. Admins can view available snapshots, generate difference reports to understand what has changed, and run recovery jobs to restore objects to a prior state.
This gives your organization a reliable, built-in safety net helping you recover with confidence, minimize downtime, and protect your tenant from accidental changes, misconfigurations, or security compromises. For more information, see: Microsoft Entra Backup and Recovery overview (Preview).
General availability of Microsoft Entra Kerberos key rotation improved reliability particularly for environments using incoming trust referral flows. Previously, authentication failures could occur during Kerberos key rotation if referral tickets were encrypted with a secondary key. The update enhances validation logic to…
General availability of Microsoft Entra Kerberos key rotation improved reliability particularly for environments using incoming trust referral flows. Previously, authentication failures could occur during Kerberos key rotation if referral tickets were encrypted with a secondary key. The update enhances validation logic to attempt decryption with both primary and secondary Kerberos keys, improving resiliency during key rollover operations and reducing authentication disruption during rotation events. For more information, see: Rotate the Kerberos server key for Microsoft Entra Kerberos.
New Email is received from > External users condition for the Microsoft 365 Copilot and Copilot Chat policy location lets DLP policies prevent Copilot from using external email as grounding data, helping reduce prompt injection risk from untrusted senders. See Block external…
New Email is received from > External users condition for the Microsoft 365 Copilot and Copilot Chat policy location lets DLP policies prevent Copilot from using external email as grounding data, helping reduce prompt injection risk from untrusted senders. See Block external email from being processed (preview).
Microsoft Secure Score now includes the Reduce unnecessary inbound internet exposure on internet-facing devices recommendation, which helps identify devices that are accessible from the public internet and may represent unnecessary attack surface.Internet-facing devices are primary entry points for attackers and automated scanners,…
Microsoft Secure Score now includes the Reduce unnecessary inbound internet exposure on internet-facing devices recommendation, which helps identify devices that are accessible from the public internet and may represent unnecessary attack surface.Internet-facing devices are primary entry points for attackers and automated scanners, making them prime targets for credential brute-forcing, exploitation of unpatched vulnerabilities, and initial access for ransomware and hands-on-keyboard intrusions.This recommendation provides centralized visibility into internet-facing devices across the environment, enabling organizations to validate whether exposure is expected, prioritize remediation for unintended exposure, and reduce external attack surface at scale.
Starting June 8 we're introducing a new built-in role in Microsoft Entra—SOC Identity Responder—to further improve how security teams execute identity containment actions initiated from Microsoft Defender using a least-privilege access model. Previously, performing these actions required SOC analysts to hold multiple…
Starting June 8 we're introducing a new built-in role in Microsoft Entra—SOC Identity Responder—to further improve how security teams execute identity containment actions initiated from Microsoft Defender using a least-privilege access model.
Previously, performing these actions required SOC analysts to hold multiple high-privilege Entra roles or depend on identity administrators, creating delays during active investigations.
With this update, SOC analysts can be assigned a dedicated role purpose-built for identity response actions, allowing them to perform key actions—such as disabling users, revoking sessions, and forcing password resets—without being granted broad directory administrative privileges.
Access to this role supports flexible assignment models, including role-assignable groups for managing permissions through group membership and delegated ownership. Optional integration with Privileged Identity Management (PIM) enables just-in-time activation and enhanced governance controls.
These actions continue to be enforced and audited by Microsoft Entra, ensuring consistency with existing RBAC and compliance controls.
By default, the panel shows only SaaS applications detected in your environment. Turn off the toggle to see other supported SaaS applications you can onboard to expand your identity coverage.
On the Coverage and maturity page, the Review and improve coverage side panel for SaaS Identities now includes an Observed column and a Show Only Observed Applications toggle. By default, the panel shows only SaaS applications detected in your environment. Turn off the toggle to see other supported SaaS applications you can onboard to expand your identity coverage. For more information, see Coverage and maturity.
For customers leveraging group provisioning to AD, this capability ensures that changes to AD groups remain consistent with those managed in Microsoft Entra. With this preview, you can designate specific AD groups so that modifications to those groups can only be made…
For customers leveraging group provisioning to AD, this capability ensures that changes to AD groups remain consistent with those managed in Microsoft Entra. With this preview, you can designate specific AD groups so that modifications to those groups can only be made through the Entra provisioning service. Changes made outside of Entra are blocked, helping prevent drift before it occurs and maintaining alignment between Entra ID and AD groups.
Access image sharing options from hover, right-click, overflow menus, and shared tabs. Permissions are preserved for images stored in OneDrive or SharePoint, so the right people maintain access. Images pasted directly in chat don’t support permission-based sharing. To learn more, see Send…
Access image sharing options from hover, right-click, overflow menus, and shared tabs. Permissions are preserved for images stored in OneDrive or SharePoint, so the right people maintain access. Images pasted directly in chat don’t support permission-based sharing. To learn more, see Send a file, picture, or link in Microsoft Teams.
Flag suspicious calls directly from Teams and optionally block the caller. Your reports help strengthen protections against fraud and impersonation threats. To learn more, see Reporting for Teams calling.
Flag suspicious calls directly from Teams and optionally block the caller. Your reports help strengthen protections against fraud and impersonation threats. To learn more, see Reporting for Teams calling.
Rolling out, the sensitivity label setting to prevent connected experiences that analyze content extends to Word, Excel, and PowerPoint across MacOS, iOS, and Android.
Rolling out, the sensitivity label setting to prevent connected experiences that analyze content now prevents all connected experiences in Word, Excel, and PowerPoint for Windows, rather than a subset of these experiences.
Rolling out, the sensitivity label setting to prevent connected experiences that analyze content now prevents all connected experiences in Word, Excel, and PowerPoint for Windows, rather than a subset of these experiences.
See whether a meeting room is available before confirming it when scheduling a Teams event. To learn more, see Host or attend an event from a Microsoft Teams Room (MTR).
SCIM 2.0 APIs are now generally available in the US Gov cloud, giving customers, developers, and partners a standards-based option for managing users and groups in Microsoft Entra using the System for Cross-domain Identity Management (SCIM) 2.0 specification. For more information, see:…
SCIM 2.0 APIs are now generally available in the US Gov cloud, giving customers, developers, and partners a standards-based option for managing users and groups in Microsoft Entra using the System for Cross-domain Identity Management (SCIM) 2.0 specification. For more information, see: Enable the SCIM Provisioning API in Microsoft Entra ID.
Find chats, files, and other content by asking questions in natural language instead of searching exact keywords. Copilot helps surface information you're looking for across Teams. To learn more, see .
Find chats, files, and other content by asking questions in natural language instead of searching exact keywords. Copilot helps surface information you're looking for across Teams. To learn more, see .
For Microsoft Copilot experiences and Enterprise AI apps, you can now select or deselect generative AI apps for monitoring, reducing alert noise, and avoiding unnecessary pay-as-you-go billing charges.
Select which generative AI apps to monitor in Insider Risk Management policy indicators. For Microsoft Copilot experiences and Enterprise AI apps, you can now select or deselect generative AI apps for monitoring, reducing alert noise, and avoiding unnecessary pay-as-you-go billing charges.
It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering strong protection. Documentation: Selective Response Actions
Selective Response Actions enables organizations to tailor high-impact security operations on devices during onboarding. It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering strong protection.
Browse your apps in a new list view designed to make finding and launching apps easier. To learn more, see Find teams and personal apps in Microsoft Teams.
The AIAgentsInfo table is transitioning to this new table, which provides a unified schema that supports agent inventory and governance for all agent types, including Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, third-party, and endpoint-discovered agents. Microsoft Agent 365 customers should use…
The AgentsInfo table in advanced hunting is now available in preview. The AIAgentsInfo table is transitioning to this new table, which provides a unified schema that supports agent inventory and governance for all agent types, including Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, third-party, and endpoint-discovered agents. Microsoft Agent 365 customers should use the AgentsInfo table today. The AIAgentsInfo table remains accessible until July 1, 2026. Update your queries to use AgentsInfo before this date. For more information, see Advanced hunting schema - Naming changes.
The Identity Security dashboard now includes a new Human identities card that shows your human identities by source (Entra ID, SaaS, and on-premises), giving you a single view of where your human identities live.
The Identity Security dashboard now includes a new Human identities card that shows your human identities by source (Entra ID, SaaS, and on-premises), giving you a single view of where your human identities live. For more information, see Identity Security dashboard.
The Phishing Triage Agent and Security Alert Triage Agent now use the more limited Email & collaboration content: Emails associated with alerts (read) permission instead of the broader Email & Collaboration content: All Emails (read) permission. This least-privilege permission restricts agent access…
The Phishing Triage Agent and Security Alert Triage Agent now use the more limited Email & collaboration content: Emails associated with alerts (read) permission instead of the broader Email & Collaboration content: All Emails (read) permission. This least-privilege permission restricts agent access to only email content associated with alerts, improving the security posture of your agent configuration.
The CloudAuditEvents table contains information about cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud. The CloudDnsEvents table contains information about DNS activity events from cloud infrastructure environments. The CloudProcessEvents table contains information about process events…
The following advanced hunting schema tables are now generally available:
The DisruptionAndResponseEvents table contains information about automatic attack disruption events in Microsoft Defender XDR.
The CloudAuditEvents table contains information about cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud.
The CloudDnsEvents table contains information about DNS activity events from cloud infrastructure environments.
The CloudProcessEvents table contains information about process events in multicloud hosted environments.
When Microsoft Intune is enabled as a data source in Security Copilot, by default: The Microsoft Entra ID Intune Administrator role automatically inherits Security Copilot owner access to Copilot in Intune. All the other built-in and custom Intune role-based access (RBAC) roles…
When Microsoft Intune is enabled as a data source in Security Copilot, by default:
The Microsoft Entra ID Intune Administrator role automatically inherits Security Copilot owner access to Copilot in Intune.
All the other built-in and custom Intune role-based access (RBAC) roles automatically inherit Security Copilot contributor access to Copilot in Intune.
Intune admins can use Security Copilot capabilities in Intune without requiring more role assignments.
Previously, access to Copilot in Intune required a separate role assignment in Security Copilot or a Microsoft Entra ID role, like the Intune Administrator role.
This update reduces access friction and simplifies Copilot onboarding for organizations.
Users can now see ready‑to‑use Copilot actions directly when previewing files in OneDrive. Details: What changed: When previewing a file, users now see suggested Copilot prompts—such as summarizing documents or generating FAQs—next to the Copilot button. Why: Many users are unsure what…
Users can now see ready‑to‑use Copilot actions directly when previewing files in OneDrive.
Details:
What changed: When previewing a file, users now see suggested Copilot prompts—such as summarizing documents or generating FAQs—next to the Copilot button.
Why: Many users are unsure what to ask Copilot. Suggested prompts help them get started without writing their own.
Try this:
Preview a document and select a suggested summary prompt.
Generate FAQs from a policy or procedure file.
Use a suggested prompt to extract key points from a PDF.
Why this matters:
Business impact: Increases Copilot adoption by reducing friction.
Personal impact: Helps users get value from Copilot immediately.
Graph API for custom connectors now supports richer configuration options—including icons, visibility controls, metadata, property descriptions, and semantic labels—to improve relevance and user experience. Details: What changed: Developers can now configure icons, visibility settings, connection metadata, property descriptions, and semantic labels for…
Graph API for custom connectors now supports richer configuration options—including icons, visibility controls, metadata, property descriptions, and semantic labels—to improve relevance and user experience.
Details:
What changed: Developers can now configure icons, visibility settings, connection metadata, property descriptions, and semantic labels for custom connectors. Previously, these elements were limited or unavailable, which reduced clarity and consistency across Copilot experiences.
Why: These enhancements were introduced to help developers create more meaningful and recognizable connector experiences, improving how Copilot interprets and presents data.
Try this:
Add custom icons to your connector to improve recognition in Copilot experiences.
Update property descriptions to help Copilot interpret your data more accurately.
Why this matters:
Business impact: Improves the quality and clarity of custom connectors, helping organizations deliver more accurate and trustworthy Copilot outputs.
Personal impact: Makes Copilot interactions more intuitive and easier to understand.
Roadmap ID: 557371 Admins can now manage access to Anthropic and xAI models for specific users and groups. Details: What changed: New admin controls allow organizations to enable Anthropic as a model provider or xAI model provider settings in the admin center.…
Admins can now manage access to Anthropic and xAI models for specific users and groups.
Details:
What changed: New admin controls allow organizations to enable Anthropic as a model provider or xAI model provider settings in the admin center. Note: xAI models are currently available in Microsoft Copilot Studio for US customers via admin opt-in.
Why: Organizations need granular control over which AI models are available to different users and groups in the organization.
Try this:
Review Anthropic and xAI (US only) model provider settings in the admin center.
Assign model access to specific users or groups.
Update internal documentation to reflect new model options.
Why this matters:
Business impact: Improves governance and model management.
Personal impact: Ensures users get access to the right AI tools.
Users will be able to add emails and text from email threads directly into their prompt context in Microsoft 365 Copilot Chat through simple interactions in Outlook. Details: What changed: Developers can now configure icons, visibility settings, connection metadata, property descriptions, and…
Users will be able to add emails and text from email threads directly into their prompt context in Microsoft 365 Copilot Chat through simple interactions in Outlook.
Details:
What changed: Developers can now configure icons, visibility settings, connection metadata, property descriptions, and semantic labels for custom connectors. Previously, these elements were limited or unavailable, which reduced clarity and consistency across Copilot experiences.
Why: This change helps users work more efficiently by reducing the steps needed to reference email content in Copilot Chat. It supports smoother workflows and helps users get more accurate, context aware responses.
Try this:
Select an email in Outlook and add it to your Copilot Chat prompt.
Highlight a section of text in an email and insert it into your Copilot Chat conversation.
Use Copilot Chat to summarize or analyze the added email content.
Why this matters:
Business impact: Improves workflow efficiency by reducing manual steps and enabling more seamless use of email content in Copilot Chat.
Personal impact: Helps users get faster, more relevant answers by grounding Copilot Chat with the right email context.
SharePoint Admin Agent helps admins manage their tenant with natural language guidance and actionable insights. Details: What changed: Copilot in the SharePoint admin center now surfaces insights, recommendations, and contextual guidance based on your organization's SharePoint and OneDrive data. Why: Admins need…
SharePoint Admin Agent helps admins manage their tenant with natural language guidance and actionable insights.
Details:
What changed: Copilot in the SharePoint admin center now surfaces insights, recommendations, and contextual guidance based on your organization's SharePoint and OneDrive data.
Why: Admins need faster ways to understand issues, take action, and reduce time spent navigating complex settings.
Try this:
Ask Copilot to identify inactive sites or sites with no recent activity.
Request guidance on optimizing storage
Identify sites with permissions causing large exposure of sensitive data
Use natural language to locate admin settings.
Why this matters:
Business impact: Reduces operational overhead and improves governance.
Personal impact: Helps admins complete tasks faster with less manual effort.
You can now open PDFs directly inside Microsoft 365 Copilot Chat to improve your viewing and analysis experience. Details: What changed: When you click a PDF while using Microsoft 365 Copilot Chat, the file now opens directly within the Copilot experience. Previously,…
You can now open PDFs directly inside Microsoft 365 Copilot Chat to improve your viewing and analysis experience.
Details:
What changed: When you click a PDF while using Microsoft 365 Copilot Chat, the file now opens directly within the Copilot experience. Previously, PDFs opened in a separate viewer or browser tab. This update keeps your workflow in one place and makes it easier to ask Microsoft 365 Copilot Chat questions about the document.
Why: Users wanted a smoother way to view and reference PDFs while working with Copilot, reducing context switching and improving productivity.
Try this:
Click a PDF link or attachment while using Microsoft 365 Copilot Chat.
Ask Copilot to summarize the document or highlight key points.
Use Microsoft 365 Copilot Chat to extract action items or compare sections of the PDF.
Why this matters:
Business impact: Reduces workflow interruptions and improves document review efficiency.
Personal impact: Makes it easier to read and analyze PDFs without switching apps.
GPT 5.5 Thinking expands what Copilot Chat can do by enabling deeper reasoning and more complex problem solving. Details: What changed: Copilot Chat now includes GPT 5.5 Thinking, a model designed for multistep reasoning, structured analysis, and more thoughtful responses. Why: Users…
GPT 5.5 Thinking expands what Copilot Chat can do by enabling deeper reasoning and more complex problem solving.
Details:
What changed: Copilot Chat now includes GPT 5.5 Thinking, a model designed for multistep reasoning, structured analysis, and more thoughtful responses.
Why: Users need AI that can handle complex tasks such as planning, troubleshooting, and evaluating multiple options.
Try this:
Ask Copilot to break down a complex project into actionable steps.
Use GPT 5.5 Thinking to compare multiple strategies or solutions.
Request a detailed explanation of a technical or business process.
Why this matters:
Business impact: Supports more advanced decision making and planning.
Personal impact: Helps users think through complex tasks with greater clarity.
GPT 5.5 Thinking expands what Copilot Chat can do by enabling deeper reasoning and more complex problem solving. Details: What changed: Copilot Chat now includes GPT 5.5 Thinking, a model designed for multistep reasoning, structured analysis, and more thoughtful responses. Why: Users…
GPT 5.5 Thinking expands what Copilot Chat can do by enabling deeper reasoning and more complex problem solving.
Details:
What changed: Copilot Chat now includes GPT 5.5 Thinking, a model designed for multistep reasoning, structured analysis, and more thoughtful responses.
Why: Users need AI that can handle complex tasks such as planning, troubleshooting, and evaluating multiple options.
Try this:
Ask Copilot to break down a complex project into actionable steps.
Use GPT 5.5 Thinking to compare multiple strategies or solutions.
Request a detailed explanation of a technical or business process.
Why this matters:
Business impact: Supports more advanced decision making and planning.
Personal impact: Helps users think through complex tasks with greater clarity.
OpenAI's GPT‑5.5 Instant improves everyday work in Copilot Chat by delivering more accurate, concise responses with better performance on image analysis and STEM‑related tasks. Details: What changed: GPT-5.5 Instant in Copilot Chat helps provide improved quality of answers for quick responses. Try…
OpenAI's GPT‑5.5 Instant improves everyday work in Copilot Chat by delivering more accurate, concise responses with better performance on image analysis and STEM‑related tasks.
Details:
What changed: GPT-5.5 Instant in Copilot Chat helps provide improved quality of answers for quick responses.
Try this:
Summarize a long email thread using GPT‑5.5 Instant.
Use GPT‑5.5 Instant to check formulas or explain a STEM concept.
Why this matters:
Business impact: Improves response quality and reliability across daily workflows.
Personal impact: Helps users get clearer, more accurate answers with less effort
OpenAI's GPT‑5.5 Instant improves everyday work in Copilot Chat by delivering more accurate, concise responses with better performance on image analysis and STEM‑related tasks. Details: What changed: GPT-5.5 Instant in Copilot Chat helps provide improved quality of answers for quick responses. Try…
OpenAI's GPT‑5.5 Instant improves everyday work in Copilot Chat by delivering more accurate, concise responses with better performance on image analysis and STEM‑related tasks.
Details:
What changed: GPT-5.5 Instant in Copilot Chat helps provide improved quality of answers for quick responses.
Try this:
Summarize a long email thread using GPT‑5.5 Instant.
Use GPT‑5.5 Instant to check formulas or explain a STEM concept.
Why this matters:
Business impact: Improves response quality and reliability across daily workflows.
Personal impact: Helps users get clearer, more accurate answers with less effort
Copilot in Viva Glint now uses Microsoft 365 Copilot access controls, simplifying how organizations manage AI-powered insights from employee feedback. Roadmap ID: 551197 What changed: Copilot in Viva Glint now aligns with Microsoft's enterprise AI governance platform. Existing Copilot toggles in the…
Copilot in Viva Glint now uses Microsoft 365 Copilot access controls, simplifying how organizations manage AI-powered insights from employee feedback.
What changed: Copilot in Viva Glint now aligns with Microsoft's enterprise AI governance platform. Existing Copilot toggles in the Viva Glint admin UI are removed, and Viva Feature Access Management becomes the single control plane for Copilot enablement.
Why: Organizations requested centralized governance to reduce setup effort and audit complexity when managing AI features.
Try this:
Review Copilot access settings in Viva Feature Access Management.
Confirm which managers and leaders should have access to Copilot in Glint.
Use centralized monitoring and reporting to review Copilot usage.
Why this matters:
Business impact: Reduces governance complexity by using a single Microsoft 365 control plane for AI features.
Personal impact: Helps leaders access Copilot insights more easily in their existing workflow.
We updated documentation to clarify how to interpret device-reported values in compliance reports. Some compliance reports include a Setting column with values reported directly by the device, providing additional context for noncompliance in scenarios such as custom compliance and Android app configuration…
We updated documentation to clarify how to interpret device-reported values in compliance reports. Some compliance reports include a Setting column with values reported directly by the device, providing additional context for noncompliance in scenarios such as custom compliance and Android app configuration reporting. This update adds guidance on treating these values as informational only and highlights security considerations for reviewing device-reported data. For more information, see Device-reported values in compliance reports.
On macOS devices enrolled with Automated Device Enrollment (ADE), you can run Platform SSO during device registration. Before you enroll, you: Create an Intune settings catalog policy and configure the Enable Registration During Setup setting. Deploy the Company Portal (5.2604.0 and newer)…
On macOS devices enrolled with Automated Device Enrollment (ADE), you can run Platform SSO during device registration. Before you enroll, you:
Create an Intune settings catalog policy and configure the Enable Registration During Setup setting.
Deploy the Company Portal (5.2604.0 and newer) as a line-of-business app.
Configure the Automated Device Enrollment policy to use Setup Assistant with modern authentication and enable await final configuration.
When this feature is enabled, users have access to Microsoft Entra ID resources immediately when they arrive at desktop.
Copilot in Viva Glint now generates AI-powered summaries of employee survey results directly within Team Summary and Executive Summary reports, helping leaders quickly understand strengths, opportunities, and trends across their teams. Copilot Highlights surfaces key insights-such as notable score changes, benchmark comparisons,…
Copilot in Viva Glint now generates AI-powered summaries of employee survey results directly within Team Summary and Executive Summary reports, helping leaders quickly understand strengths, opportunities, and trends across their teams. Copilot Highlights surfaces key insights-such as notable score changes, benchmark comparisons, and response rate confidence-so leaders can move from data to action faster. With general availability, Copilot Highlights expands to support multilingual summaries, enabling global organizations to deliver AI-generated survey insights in their preferred language.
What changed: Copilot in Viva Glint now automatically generates AI-powered summaries within Team Summary and Executive Summary reports. These summaries highlight key insights like score changes, benchmark comparisons, and response rate confidence. The feature now supports multilingual summaries, allowing organizations to view insights in their preferred language.
Why: This change helps leaders quickly interpret survey data and identify actionable trends without manual analysis. Multilingual support ensures accessibility for global teams.
Try this:
Open a Team Summary or Executive Summary report in Viva Glint.
Review the Copilot Highlights section to see AI-generated insights.
Switch the summary language to match your organization's preferred language.
Use the insights to identify areas for improvement or celebrate team strengths.
Why this matters:
Business impact: Enables faster, data-driven decision-making and improves accessibility for global organizations.
Personal impact: Helps leaders quickly understand team sentiment and take informed action.
Use Microsoft Edge for Business adds contextual nudges that make it easier to ask Microsoft 365 Copilot Chat to summarize your open webpage. Roadmap ID: 515167 Details: What changed: Edge for Business introduces contextual nudges attached to the Copilot entry point that…
Use Microsoft Edge for Business adds contextual nudges that make it easier to ask Microsoft 365 Copilot Chat to summarize your open webpage.
What changed: Edge for Business introduces contextual nudges attached to the Copilot entry point that prompt users to take actions-such as summarizing an open page-through Microsoft 365 Copilot Chat.
Why: This change helps users discover page summarization faster and save time when scanning long webpages.
Try this:
Open a webpage in Microsoft Edge.
Use Copilot Chat in Edge and ask "Summarize this page."
Ask a follow-up question about the page content to get more targeted details.
Why this matters:
Business impact: Helps teams consume and share web information faster, improving research and decision-making workflows.
Personal impact: Saves time by surfacing a quick summary when you need it.
The updated Readiness page in the Copilot Dashboard offers personalized configuration insights to help organizations prepare for successful Copilot adoption. Roadmap ID: 551196 Details: What changed The Readiness page now includes tailored recommendations for Copilot configuration settings. Previously, IT leaders had to…
The updated Readiness page in the Copilot Dashboard offers personalized configuration insights to help organizations prepare for successful Copilot adoption.
What changed The Readiness page now includes tailored recommendations for Copilot configuration settings. Previously, IT leaders had to manually review and interpret multiple configuration areas. The new experience centralizes guidance to streamline deployment and improve readiness.
Why: Organizations requested clearer, more actionable guidance to help them configure Microsoft 365 Copilot, Copilot Chat, and agents effectively. These insights help IT teams accelerate adoption and improve user outcomes.
Try this:
Review the updated Readiness page to see recommended configuration changes.
Share the recommendations with your deployment or governance team.
Why this matters:
Business impact: Helps organizations deploy Copilot more efficiently with clearer guidance and improved governance readiness.
Personal impact: Makes it easier for IT professionals to understand what actions to take and why they matter.
Analysts can now publish Viva Insights Power BI reports to anyone in their organization, expanding access beyond users with Copilot Dashboard permissions. Roadmap ID: 558257 What changed: Previously, analysts could publish Viva Insights Power BI reports only to people who had access…
Analysts can now publish Viva Insights Power BI reports to anyone in their organization, expanding access beyond users with Copilot Dashboard permissions.
What changed: Previously, analysts could publish Viva Insights Power BI reports only to people who had access to the Copilot Dashboard. With this update, analysts can publish these reports to anyone in their organization. This broadens visibility and removes the dependency on global Copilot Dashboard access to receive reports.
Why: Organizations asked for more flexibility in sharing insights across teams. Expanding publishing permissions helps analysts distribute insights more widely, supporting better decision making.
Try this:
Publish a Viva Insights Power BI report and enter the name of any user in your organization.
Review your existing reports and update sharing settings to reach more stakeholders.
Why this matters:
Business impact: Expands access to insights across the organization, enabling broader collaboration and more informed decisions.
Personal impact: Makes it easier for individuals to receive and use insights without requiring Copilot Dashboard access.
Intune enhanced app inventory brings faster, more detailed visibility into the apps in your environment to support identification of outdated or risky software. Improved data freshness and richer app metadata provide clearer insight into installed applications, while new controls let you specify…
Intune enhanced app inventory brings faster, more detailed visibility into the apps in your environment to support identification of outdated or risky software. Improved data freshness and richer app metadata provide clearer insight into installed applications, while new controls let you specify which devices are included in inventory collection.
This feature is initially available for Windows, with additional platforms to follow.
Account discovery for connected applications is now generally available in Microsoft Entra ID Governance. This capability provides administrators with visibility into all accounts that exist within connected applications, including orphan accounts. By generating discovery reports directly from the provisioning experience, organizations can…
Account discovery for connected applications is now generally available in Microsoft Entra ID Governance. This capability provides administrators with visibility into all accounts that exist within connected applications, including orphan accounts.
By generating discovery reports directly from the provisioning experience, organizations can identify accounts in connected applications that aren't assigned to the enterprise application in Microsoft Entra and simplify onboarding the application.
Added the admin permissions (Directory Reader, Microsoft Edge administration, and Microsoft Intune administration) required to activate DLP policies for unmanaged cloud apps in Microsoft Edge for Business.
We're excited to introduce the User Attribute Updates task in Lifecycle Workflows, extending existing attribute change trigger capabilities with a built-in, customer-ready way to automate attribute updates (set or clear values) directly within a workflow. With a secure, consistent, and auditable experience,…
We're excited to introduce the User Attribute Updates task in Lifecycle Workflows, extending existing attribute change trigger capabilities with a built-in, customer-ready way to automate attribute updates (set or clear values) directly within a workflow. With a secure, consistent, and auditable experience, organizations can reduce manual effort, improve governance, and scale identity automation with greater confidence.
Isolation blocks attacker communication and lateral movement while keeping the device connected to security services. The action is time-limited, scoped to devices involved in the incident, and can be released by security operators at any time.
Automatic attack disruption can now isolate compromised devices from the network when high-confidence incident analysis indicates the device is being used as an active foothold. Isolation blocks attacker communication and lateral movement while keeping the device connected to security services. The action is time-limited, scoped to devices involved in the incident, and can be released by security operators at any time. Learn more
Microsoft Defender for Endpoint can now automatically isolate compromised devices as part of automatic attack disruption. Isolation blocks most network traffic while keeping the device connected to security services. The action is time-limited, scoped to the incident, and security operators can release…
Microsoft Defender for Endpoint can now automatically isolate compromised devices as part of automatic attack disruption. Isolation blocks most network traffic while keeping the device connected to security services. The action is time-limited, scoped to the incident, and security operators can release isolation at any time.
You can now govern eligible and active assignments to Azure roles at the Management Group, Subscription, and Resource Group levels directly through access packages. This brings role assignment into the same request, approval, and lifecycle governance model as apps, groups, and more…
You can now govern eligible and active assignments to Azure roles at the Management Group, Subscription, and Resource Group levels directly through access packages. This brings role assignment into the same request, approval, and lifecycle governance model as apps, groups, and more - making it easier to manage access to Azure resources at scale while aligning to least privilege and just-in-time access.
Tap Catch up at the top of your Teams chat list to swipe through the latest activity in conversations. Reply, react, save, and mark read or unread. To learn more, see Catch up on all your conversations in one place.
Tap Catch up at the top of your Teams chat list to swipe through the latest activity in conversations. Reply, react, save, and mark read or unread. To learn more, see Catch up on all your conversations in one place.
Policies for unmanaged cloud apps on managed devices apply across all Edge profiles (work, personal, and InPrivate); policies for managed apps apply only in the Edge work profile.
Now, when you share code in Teams chat, Teams automatically formats it to display line numbers, making it easier to reference specific lines in conversation.
Now, when you share code in Teams chat, Teams automatically formats it to display line numbers, making it easier to reference specific lines in conversation.
You can now configure offline security intelligence update settings for Linux directly from the Defender and Intune portals. Documentation: Configure offline security intelligence update settings for Linux from the Defender and Intune portals
You can now configure offline security intelligence update settings for Linux directly from the Defender and Intune portals.
Meeting organizers can now consult and merge PSTN callers into active Teams meetings, even when navigating a Dual-Tone Multi-Frequency (DTMF) menu is required. To learn more, see Merge calls in Microsoft Teams.
Meeting organizers can now consult and merge PSTN callers into active Teams meetings, even when navigating a Dual-Tone Multi-Frequency (DTMF) menu is required. To learn more, see Merge calls in Microsoft Teams.
This feature enables centralized management of group membership in a source tenant while making those groups available in one or more target tenants, simplifying cross-tenant collaboration and reducing administrative overhead associated with managing duplicate groups. With cross tenant group synchronization, organizations can…
Cross tenant group synchronization allows organizations to synchronize security groups across Microsoft Entra tenants. This feature enables centralized management of group membership in a source tenant while making those groups available in one or more target tenants, simplifying cross-tenant collaboration and reducing administrative overhead associated with managing duplicate groups.
With cross tenant group synchronization, organizations can extend their existing cross tenant synchronization configurations to include groups, supporting scenarios such as shared application access, resource authorization, and consistent group-based access control across tenants. Admins can opt in to this functionality and configure attribute mappings and cross tenant access policies to enable group synchronization into target tenants. Use of cross-tenant group synchronization requires Microsoft Entra ID Governance licenses. Existing licensing requirements for cross tenant user synchronization features remains unchanged. https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview.
Custom Reporting populates additional columns and tables in the scanner cluster database so administrators can build their own reports directly against scan results in Power BI or any SQL-based reporting tool, without stitching together per-scan CSV reports.
Custom Reporting populates additional columns and tables in the scanner cluster database so administrators can build their own reports directly against scan results in Power BI or any SQL-based reporting tool, without stitching together per-scan CSV reports.
This feature enables organizations to expand and customize telemetry collection beyond default configurations with rule-based filtering for specific events from endpoint devices. The maximum event limit per rule has been updated from 25,000 to 75,000 events per device within a 24-hour rolling…
Custom data collection is now generally available. This feature enables organizations to expand and customize telemetry collection beyond default configurations with rule-based filtering for specific events from endpoint devices. The maximum event limit per rule has been updated from 25,000 to 75,000 events per device within a 24-hour rolling window.
Define your own examination focus with custom prompts to analyze investigation content beyond the built-in examination areas.
Custom examinations in Data Security Investigations. Define your own examination focus with custom prompts to analyze investigation content beyond the built-in examination areas.
Assemble metric and chart cards in sections to answer organization-specific questions that complement the built-in posture reports.
Custom posture reports let admins build tailored views of information protection and DLP activity. Assemble metric and chart cards in sections to answer organization-specific questions that complement the built-in posture reports.
It helps SOC analysts investigate threats, explore incidents, and answer security questions in plain language, without needing to navigate multiple screens or write complex queries.
Defender Chat experience (Preview) is an open prompt chat assistant built into Microsoft Defender. It helps SOC analysts investigate threats, explore incidents, and answer security questions in plain language, without needing to navigate multiple screens or write complex queries.
The Defender for endpoint security solution for legacy Windows 7 SP1 and Windows Server 2008 R2 SP1 devices is now generally available. The solution provides advanced protection capabilities and improved functionality for these devices compared to other solutions. The solution is available…
The Defender for endpoint security solution for legacy Windows 7 SP1 and Windows Server 2008 R2 SP1 devices is now generally available. The solution provides advanced protection capabilities and improved functionality for these devices compared to other solutions. The solution is available using the Defender deployment tool.
Delete a meeting recording, summary, and notes in one place. On the recap page, select More options > Delete recap content . Shared files stay in their original locations. To learn more, see Recap in Microsoft Teams.
Delete a meeting recording, summary, and notes in one place. On the recap page, select More options > Delete recap content . Shared files stay in their original locations. To learn more, see Recap in Microsoft Teams.
Device Soft Delete, now available in preview, enables administrators to safely remove device objects by moving them to a recoverable state instead of permanently deleting them. This feature allows organizations to restore devices within a defined retention period while preserving critical data…
Device Soft Delete, now available in preview, enables administrators to safely remove device objects by moving them to a recoverable state instead of permanently deleting them. This feature allows organizations to restore devices within a defined retention period while preserving critical data such as device identity and associated security artifacts. The feature supports Microsoft Entra joined, registered, and hybrid joined devices and helps reduce risk from accidental deletions while improving device lifecycle management.
We're enhancing the security posture of Microsoft Entra Connect Sync by introducing interactive admin authorization for configuration changes. With this update, an authorized administrator will need to sign in and explicitly approve changes to sync settings, ensuring that configuration updates are intentional…
We're enhancing the security posture of Microsoft Entra Connect Sync by introducing interactive admin authorization for configuration changes. With this update, an authorized administrator will need to sign in and explicitly approve changes to sync settings, ensuring that configuration updates are intentional and made by the right person.
What’s changing
Interactive admin authorization for sync configuration changes: Going forward, changes to sync configuration settings – such as enabling or disabling features – will require interactive authentication from an authorized cloud administrator. Whether you're using the Entra Connect wizard or PowerShell, a verified admin sign-in will be required to complete the action. This strengthens the authorization model for all sync-related configuration changes.
Greater consistency in admin-driven configuration: We are aligning sync behavior so that configuration decisions made by cloud administrators are consistently respected. The cloud will serve as the source of truth for sync feature state, giving administrators greater confidence that their intended configuration is maintained.
Updated management paths: All management interfaces for Entra Connect will incorporate delegated admin authentication where needed. Specifically:
Entra Connect wizard flows: The installation and configuration wizard will use delegated admin tokens for sync configuration changes, providing a more secure authorization flow.
PowerShell cmdlets: PowerShell-based management of sync settings will now prompt for an interactive admin sign-in to complete configuration changes. Ensure you run these commands in a session where you can provide admin credentials.
Uninstall behavior: If you uninstall Entra Connect Sync and choose to make cloud-side changes such as converting the tenant to cloud-only synchronization, the uninstall process will require admin authentication before modifying settings in the cloud tenant.
What’s not changing
Sync functionality and the end-user experience remain unchanged. Everything continues to work as expected when features are enabled or disabled.
There is no change to how administrators choose to enable or disable sync features; only that these actions now require interactive authentication.
The Microsoft Entra Connect Sync .msi installation file for this change is exclusively available on Microsoft Entra admin center under Microsoft Entra Connect.
The new exposure score model in Defender Vulnerability Management is now available in preview. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors such as internet-facing status and criticality. For more information,…
The new exposure score model in Defender Vulnerability Management is now available in preview. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors such as internet-facing status and criticality. For more information, see Exposure score in Defender Vulnerability Management and Security recommendations.
We increased the passkey (FIDO2) policy size limit in the authentication methods policy to a dedicated 20-KB allocation. Previously, all authentication methods shared a single 20-KB policy size limit. With this update, a dedicated 20-KB limit is now allocated specifically to the…
We increased the passkey (FIDO2) policy size limit in the authentication methods policy to a dedicated 20-KB allocation.
Previously, all authentication methods shared a single 20-KB policy size limit. With this update, a dedicated 20-KB limit is now allocated specifically to the passkey (FIDO2) policy, while the remaining authentication methods continue to use their existing limit.
This change helps address scenarios where tenants approach the overall policy size limit, which can block configuration of passkey profiles. By separating passkey policy storage, organizations can more easily adopt passkeys and configure advanced targeting scenarios.
In addition, the maximum number of passkey profiles per tenant has been increased from 3 to 10.
For auto-labeling policies that are turned on and target SharePoint and OneDrive, per-policy review pages let you monitor daily labeling activity, spot-check labeled and failed files, and investigate labeling failures.
For auto-labeling policies that are turned on and target SharePoint and OneDrive, per-policy review pages let you monitor daily labeling activity, spot-check labeled and failed files, and investigate labeling failures. For more information, see Policy-level labeling activity for SharePoint and OneDrive.
High Scale Compatibility (HSC) mode enables organizations to migrate to Microsoft Entra External ID while preserving their existing user directory. It's designed for large, established customer identity platforms transitioning from Azure AD B2C. With HSC mode, customers can rebuild applications on External…
High Scale Compatibility (HSC) mode enables organizations to migrate to Microsoft Entra External ID while preserving their existing user directory. It's designed for large, established customer identity platforms transitioning from Azure AD B2C.
With HSC mode, customers can rebuild applications on External ID while maintaining continuity for existing users, supporting a seamless, phased migration at scale. Some advanced customization capabilities are limited in this mode and will continue to evolve. For more information, see: Enable External ID High Scale Compatibility (HSC) mode.
In advanced hunting, the Take action wizard now lets customers allow or block top-level domains and files attachment hashes in emails based on query results.
In advanced hunting, the Take action wizard now lets customers allow or block top-level domains and files attachment hashes in emails based on query results. Learn more.
One of the most important parts of governing agent identities is making sure that a delegated human user is always assigned to make sure the agent identity's access to resources are current. If the sponsor is leaving the organization, sponsorship of the…
One of the most important parts of governing agent identities is making sure that a delegated human user is always assigned to make sure the agent identity's access to resources are current. If the sponsor is leaving the organization, sponsorship of the agent identities is automatically transferred to their manager. With sponsorship transferred, there's always a human user accountable for managing the access and lifecycle of the agent identities. Microsoft Entra ID Governance features can help streamline this process within your organization. Lifecycle workflows include multiple tasks around notifying cosponsors, and managers of sponsors, of impending sponsorship changes. For a guide on setting up a workflow for agent identities sponsors, see: Agent identity sponsor tasks in Lifecycle Workflows.
and Microsoft Defender Experts Hunting - Servers are now offered as standalone offerings for customers who wish to avail managed extended detection and response and threat hunting services for their on-premises and multicloud servers protected by Microsoft Defender for Cloud. These services…
and Microsoft Defender Experts Hunting - Servers are now offered as standalone offerings for customers who wish to avail managed extended detection and response and threat hunting services for their on-premises and multicloud servers protected by Microsoft Defender for Cloud. These services were previously offered as add-ons to Microsoft Defender Experts MDR and Microsoft Defender Experts Hunting, respectively. Learn more.
We're excited to announce the upcoming general availability of three redesigned pages in the My Account portal (myaccount.microsoft.com), bringing a modernized experience to help end users manage their account with greater ease and clarity. The redesigned Devices page features a modernized layout…
We're excited to announce the upcoming general availability of three redesigned pages in the My Account portal (myaccount.microsoft.com), bringing a modernized experience to help end users manage their account with greater ease and clarity.
The redesigned Devices page features a modernized layout that makes it easier for users to view and manage their registered devices. BitLocker recovery keys are now more prominently surfaced, reducing the need to contact IT helpdesk for key retrieval.
The new Personal Info page gives users a centralized view of their profile information alongside language and region settings - making it simple to review and update personal details in one place.
The redesigned Organizations page delivers a modernized experience and resolves a longstanding issue where users were unable to successfully leave an organization.
Availability: These pages will be generally available to all Microsoft Entra ID customers by end of June 2026. No admin action is required - users will see the updated experience automatically.
The “NetBIOS Name Sysvol Connectivity resolution” test in the AD DS health monitoring agent has been _reclassified_ from an alerting test to an informational test. Going forward, if this test fails, it will no longer generate an alert or require remediation action…
The “NetBIOS Name Sysvol Connectivity resolution” test in the AD DS health monitoring agent has been _reclassified_ from an alerting test to an informational test. Going forward, if this test fails, it will no longer generate an alert or require remediation action on your part. Instead, the test runs in the background and logs results for your information only.
What Changed
The NetBIOS Name Sysvol Connectivity test is now _informational-only_. Previously, when this test failed (e.g. if a domain controller couldn’t resolve the NetBIOS name to access its SYSVOL share), an alert was triggered in Connect Health, prompting you for action. Now, failures in this test will not raise an alert in Microsoft Entra Connect Health.
Why We Made This Change
NetBIOS is a legacy networking protocol that is not critical in modern Active Directory environments. Many organizations no longer rely on NetBIOS name resolution in day-to-day operations. Reclassifying this test as informational reduces noise in your alert feed and allows you to focus on issues that are genuinely critical to your identity infrastructure. In short, we want to ensure that Connect Health alerts highlight _meaningful issues_ and help you prioritize real problems, rather than flagging non-essential conditions.
New Block access for specific external domains or users sub-option for the Restrict access or encrypt the content in Microsoft 365 locations action lets DLP policies for SharePoint and OneDrive block access to sensitive files for specific external domains or user SMTPs.
New Block access for specific external domains or users sub-option for the Restrict access or encrypt the content in Microsoft 365 locations action lets DLP policies for SharePoint and OneDrive block access to sensitive files for specific external domains or user SMTPs. See Actions and Help prevent sharing sensitive items via SharePoint and OneDrive with external users.
When audit searches exceed the approximately 3,000-item limit, use the Audit solution to analyze the full result volume, then split searches into smaller time-based slices for ingestion into an investigation.
New guidance for working with large audit search results in Data Security Investigations. When audit searches exceed the approximately 3,000-item limit, use the Audit solution to analyze the full result volume, then split searches into smaller time-based slices for ingestion into an investigation.
Image files are automatically processed with optical character recognition (OCR), and the extracted text is merged and vectorized for AI analysis.
OCR support in Data Security Investigations. Image files are automatically processed with optical character recognition (OCR), and the extracted text is merged and vectorized for AI analysis.
Manage collaborative calling on the Teams Queues app, now available on Teams for mobile devices. To learn more, see Use the Queues app for Microsoft Teams.
Manage collaborative calling on the Teams Queues app, now available on Teams for mobile devices. To learn more, see Use the Queues app for Microsoft Teams.
Rolling out, a new label policy setting for meetings, Apply meeting label to artifacts, automatically applies the meeting's sensitivity label to recordings and their transcripts (.mp4 files), and to meeting notes (.loop files).
Rolling out, a new label policy setting for meetings, Apply meeting label to artifacts, automatically applies the meeting's sensitivity label to recordings and their transcripts (.mp4 files), and to meeting notes (.loop files).
You can now configure scheduled antivirus scans on Microsoft Defender for Endpoint on Linux. Scheduled scans support hourly quick scans, interval-based quick scans, and weekly full scans, with options for low-priority execution, idle-time scheduling, and randomized start times. Configure scans using managed…
You can now configure scheduled antivirus scans on Microsoft Defender for Endpoint on Linux. Scheduled scans support hourly quick scans, interval-based quick scans, and weekly full scans, with options for low-priority execution, idle-time scheduling, and randomized start times. Configure scans using managed JSON, the Microsoft Defender portal, or the mdatp CLI.
When you search in a chat or channel, choose a filter to see results from specific dates and people, or with mentions and attachments. To learn more, see Search for messages and more in Microsoft Teams.
When you search in a chat or channel, choose a filter to see results from specific dates and people, or with mentions and attachments. To learn more, see Search for messages and more in Microsoft Teams.
You can now see the sync status of your sensitivity label publishing policies on the Label policies page, giving you visibility into when label policy updates are fully synced across Microsoft 365.
You can now see the sync status of your sensitivity label publishing policies on the Label policies page, giving you visibility into when label policy updates are fully synced across Microsoft 365.
It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering strong protection. Documentation: Selective Response Actions
Selective Response Actions enables organizations to tailor high-impact security operations on devices during onboarding. It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering strong protection.
Microsoft Entra ID now supports applying Microsoft Purview sensitivity labels to Entra cloud security groups in public preview. Administrators can use labels to govern security group settings such as guest access using the same labels and policies that apply to Microsoft 365…
Microsoft Entra ID now supports applying Microsoft Purview sensitivity labels to Entra cloud security groups in public preview.
Administrators can use labels to govern security group settings such as guest access using the same labels and policies that apply to Microsoft 365 groups today.
New purple indicators in Teams chat show which conversations are active and need your attention. They appear for mentions, tags, and activity in followed threads.
New purple indicators in Teams chat show which conversations are active and need your attention. They appear for mentions, tags, and activity in followed threads.
Teams now detects when callers might be impersonating your bank, IT admin, or other trusted brands, and warns you. Decline, leave, or report the call instantly.
Teams now detects when callers might be impersonating your bank, IT admin, or other trusted brands, and warns you. Decline, leave, or report the call instantly.
Claude then displays as another AI application alongside Copilot, Copilot Studio, ChatGPT Enterprise, and other AI apps. Use activity explorer to see individual Claude interactions, such as who used Claude, when they used it, and what kinds of content were involved, just…
Support for Anthropic Claude (Enterprise) when you add and configure the Anthropic Claude data connector, now in preview. Claude then displays as another AI application alongside Copilot, Copilot Studio, ChatGPT Enterprise, and other AI apps. Use activity explorer to see individual Claude interactions, such as who used Claude, when they used it, and what kinds of content were involved, just as you do for other AI apps. For more information about Purview support for Claude, see Use Microsoft Purview to manage data security & compliance for Anthropic Claude (Enterprise).
Microsoft Registration Campaigns now supports Passkeys (FIDO2) as an authentication method. Administrators can configure registration campaigns to nudge users to register passkeys during sign-in, helping organizations drive passkey adoption at scale. This first rollout experience is optimized for users who are in…
Microsoft Registration Campaigns now supports Passkeys (FIDO2) as an authentication method. Administrators can configure registration campaigns to nudge users to register passkeys during sign-in, helping organizations drive passkey adoption at scale. This first rollout experience is optimized for users who are in a passkey profile that doesn't have any restrictions.
We're extending system-preferred authentication to apply to the first factor in Microsoft-managed configurations (in addition to second factor). With this change, the system evaluates the credentials registered for a user and selects the highest-ranked authentication method for each step of the sign-in…
We're extending system-preferred authentication to apply to the first factor in Microsoft-managed configurations (in addition to second factor). With this change, the system evaluates the credentials registered for a user and selects the highest-ranked authentication method for each step of the sign-in flow.
As a result, users with strong, phishing-resistant credentials (such as passkeys) might be signed in without needing to use a password, improving both security and user experience.
This behavior applies only to the Microsoft-managed state, where system-preferred authentication now covers both first- and second-factor authentication. The rollout is currently in progress and will be fully deployed to all Microsoft-managed tenants by the end of June.
The "Responsible AI FAQ for Data Security Posture Management" is replaced with the more detailed Application card for Data Security Posture Management to better help you understand this solution's AI capabilities, intended uses, limitations, evaluations, safety components, and best practices.
The "Responsible AI FAQ for Data Security Posture Management" is replaced with the more detailed Application card for Data Security Posture Management to better help you understand this solution's AI capabilities, intended uses, limitations, evaluations, safety components, and best practices.
The documentation section How to disable sensitivity labels for SharePoint and OneDrive (opt-out) now includes labeling behavior if you disable sensitivity labels for SharePoint and Onedrive after they've been enabled.
These scenarios help you discover attack paths, privilege escalation routes, and credential access risks across on-premises and cloud environments, including Kerberoast and AS-REP roast paths, domain compromise routes, OAuth application risks, and guest user access to cloud resources.
The hunting graph in advanced hunting now includes new identity-focused predefined scenarios. These scenarios help you discover attack paths, privilege escalation routes, and credential access risks across on-premises and cloud environments, including Kerberoast and AS-REP roast paths, domain compromise routes, OAuth application risks, and guest user access to cloud resources.
Partner solutions for non-Microsoft data sources remain in preview, as does the Data Security Posture Agent. This current version provides guided workflows for proactive risk management and streamlines data security operations so you can more confidently adopt AI across your digital estate.
The new version of Data Security Posture Management is now generally available. Partner solutions for non-Microsoft data sources remain in preview, as does the Data Security Posture Agent. This current version provides guided workflows for proactive risk management and streamlines data security operations so you can more confidently adopt AI across your digital estate.
To optimize resources, processing is paused for Microsoft 365 data when tenants are inactive for more than 60 days, and automatically resume when you return to the solution.
To optimize resources, processing is paused for Microsoft 365 data when tenants are inactive for more than 60 days, and automatically resume when you return to the solution. For more information, see Data updates paused for inactive tenants.
Video recap is a new, engaging way to catch up on past meetings. Recorded meetings are clipped into short, narrated highlights that show key conversations, presented content, and more. To learn more, see Video recap in Microsoft Teams.
Video recap is a new, engaging way to catch up on past meetings. Recorded meetings are clipped into short, narrated highlights that show key conversations, presented content, and more. To learn more, see Video recap in Microsoft Teams.
When you set your Windows device to “Do not disturb,” your Teams notifications will be silenced. Notifications will resume after “Do not disturb” is turned off on your device.
When you set your Windows device to “Do not disturb,” your Teams notifications will be silenced. Notifications will resume after “Do not disturb” is turned off on your device.
Microsoft Entra is introducing workload identity–based authentication for SAP SuccessFactors provisioning. This new capability allows the Microsoft Entra provisioning service to authenticate to SAP SuccessFactors using Entra workload identity and short‑lived tokens instead of static credentials (username and password). This change helps…
Microsoft Entra is introducing workload identity–based authentication for SAP SuccessFactors provisioning. This new capability allows the Microsoft Entra provisioning service to authenticate to SAP SuccessFactors using Entra workload identity and short‑lived tokens instead of static credentials (username and password).
Customers can switch existing provisioning configurations from basic authentication to workload identity–based authentication directly through updated connectivity settings in the provisioning experience, without needing to recreate or restart their configuration.
This method removes the need to store long-lived credentials and uses a standards-based authentication method between Entra and SAP SuccessFactors through SAP Cloud Identity Services.
This capability applies to the following provisioning scenarios:
If you are currently using basic authentication for any of the above SAP SuccessFactors provisioning integrations, you must upgrade to workload identity-based authentication before November 2026 to ensure uninterrupted operation of the integrations.
No immediate action is required, but we recommend planning your migration early to avoid last-minute disruption.
The new method improves security by:
Eliminating stored passwords
Using short-lived, verifiable tokens
Aligning with SAP’s supported authentication model
Recommended action
Evaluate the new authentication option once available in your tenant
Plan and test migration of existing provisioning jobs to workload identity-based authentication
Update any internal documentation or operational processes that reference basic authentication
Additional information
For detailed configuration guidance and step-by-step instructions visit https://aka.ms/EntraSAPSFConnectivityGuide.
You can now use Apple access management settings in Apple Business Manager and Apple School Manager to configure service access for Apple accounts on organization-owned devices. These controls let you choose what devices users can sign in to and which apps and…
You can now use Apple access management settings in Apple Business Manager and Apple School Manager to configure service access for Apple accounts on organization-owned devices. These controls let you choose what devices users can sign in to and which apps and services are available to them. For more information, see Configure service access for Apple accounts.
The Autopatch update risk visibility report extends the security update status dashboard with granular insight into patch compliance and risk across your managed devices. It classifies devices as Current, Exposed, or Critical and highlights policies contributing to risk, so you can identify…
The Autopatch update risk visibility report extends the security update status dashboard with granular insight into patch compliance and risk across your managed devices. It classifies devices as Current, Exposed, or Critical and highlights policies contributing to risk, so you can identify and remediate issues faster.
On Android Enterprise devices, you can use the General > Block location in the settings catalog to disable the location services on the device and prevent users from turning it on. This setting is now called Location and has three options you…
On Android Enterprise devices, you can use the General > Block location in the settings catalog to disable the location services on the device and prevent users from turning it on.
This setting is now called Location and has three options you can configure:
Device default - Intune doesn't change or update this setting. By default, the OS allows end users to turn location services on or off.
Location enabled - Requires location services to be on and prevents end users from turning them off.
Location disabled - Requires location services to be off and prevents end users from turning them on.
The Change Review Agent now provides risk-based recommendations directly in the Multi Admin Approval experience for Windows PowerShell scripts. On the My requests and All requests tabs, a new Agent Response column displays when a suggestion is available. You can then select…
The Change Review Agent now provides risk-based recommendations directly in the Multi Admin Approval experience for Windows PowerShell scripts. On the My requests and All requests tabs, a new Agent Response column displays when a suggestion is available. You can then select the suggestion to open and complete the Change Review Agent's approval workflow for that request without leaving the Multi Admin Approval node.
Change Review Agent suggestions continue to be available in the agent's primary experience as well.
You can now control which applications act as system-level credential providers on managed Android Enterprise devices running Android 14 and higher. Credential providers are responsible for password autofill and passkey storage. To configure credential manager permissions, go to Apps > Android >…
You can now control which applications act as system-level credential providers on managed Android Enterprise devices running Android 14 and higher. Credential providers are responsible for password autofill and passkey storage.
To configure credential manager permissions, go to Apps > Android > Configuration > Managed Devices and choose Android Enterprise as the platform type.
By default, Android blocks third-party credential providers on managed devices. This configuration setting lets you:
Allow specific apps (such as Microsoft Authenticator or a third-party password manager) to act as credential providers
Enable passkey-based sign-in across managed Android Enterprise devices
Maintain control over which credential sources are trusted on corporate devices
A known limitation is that Google Password Manager can't act as a credential provider on corporate-owned work profile or personally owned work profile devices. It is blocked on the end user's device. Use a different credential app as a workaround.
You can now manage Android line-of-business (LOB) apps directly in Microsoft Intune without publishing them to Managed Google Play on Android Enterprise corporate-owned fully managed (COBO) and dedicated (COSU) devices. With direct LOB app management, admins can upload APK files directly to…
You can now manage Android line-of-business (LOB) apps directly in Microsoft Intune without publishing them to Managed Google Play on Android Enterprise corporate-owned fully managed (COBO) and dedicated (COSU) devices.
With direct LOB app management, admins can upload APK files directly to Intune and deploy required apps to supported Android Enterprise enrollment types using a native Intune workflow.
Direct LOB app management enables you to:
Deploy in-house LOB APKs to fully managed and dedicated devices without publishing them to Managed Google Play
Manage the app lifecycle directly from Intune
Create app configuration policies for directly deployed LOB apps, giving you the same configuration flexibility you have for Managed Google Play apps
Intune's Endpoint Privilege Management (EPM) now supports support approved elevation requests from all users of a device. This update expands the utility of support approved file elevations and helps to improve scenarios that involve shared devices. Previously, file elevation requests that require…
Intune's Endpoint Privilege Management (EPM) now supports support approved elevation requests from all users of a device. This update expands the utility of support approved file elevations and helps to improve scenarios that involve shared devices.
Previously, file elevation requests that require support approval were supported from only a device's primary user or the user who enrolled the device.
Microsoft Intune has added support for userless Apple automated device enrollment (ADE) for visionOS and tvOS devices, enabling you to enroll and manage Apple Vision Pro and Apple TV through Apple Business Manager or Apple School Manager. This capability supports ADE without…
Microsoft Intune has added support for userless Apple automated device enrollment (ADE) for visionOS and tvOS devices, enabling you to enroll and manage Apple Vision Pro and Apple TV through Apple Business Manager or Apple School Manager. This capability supports ADE without user affinity and includes custom configuration uploads for settings, default enrollment restrictions, and device actions. The feature is available with Microsoft Intune Plan 2 as part of the Microsoft 365 Suite.
Enrolled visionOS and tvOS devices appear alongside iOS and iPadOS devices in the Intune admin center within Apple mobile and can be filtered. Support requires tvOS 26 and later or visionOS 26 and later. We recommend that you keep these devices up to date to receive the latest security fixes.
Intune has two new remote actions that allow admins to temporarily suspend and restore Managed Home Screen (MHS) on Android devices. These actions let users exit MHS and access the device's default launcher for a defined period, without removing policies or requiring…
Intune has two new remote actions that allow admins to temporarily suspend and restore Managed Home Screen (MHS) on Android devices. These actions let users exit MHS and access the device's default launcher for a defined period, without removing policies or requiring a PIN.
When the specified duration expires, or when the restore managed home screen action is triggered, MHS automatically re-locks the device into the kiosk experience. This helps maintain security while reducing disruption during troubleshooting or short-term use outside of MHS.
The following protected apps are now available for Microsoft Intune: Harvey AI by Harvey AI Corporation (iOS) Continia Expense App by Continia Software A/S For more information about protected apps, see Microsoft Intune protected apps.
The following protected apps are now available for Microsoft Intune:
In the Intune admin center, when you go to Devices > All Devices and select a device, you can see device-specific info, like device properties. This page is redesigned and is available for you to preview. To enable the new experience: In…
In the Intune admin center, when you go to Devices > All Devices and select a device, you can see device-specific info, like device properties.
This page is redesigned and is available for you to preview. To enable the new experience:
In the [Microsoft Intune admin center], go to Devices > All Devices.
Move the Preview new device view toggle to On.
The new experience is only available when you go to Devices > All Devices and select a device. If you open a device page from a different part of the Intune admin center, like from a report, the original page view is shown, even with the toggle enabled.
When turned on, you see the new full page layout that gives you a single view of the device. Use this view to:
Track device activity
Access tools and reports
Manage device information
The single device page has the following tabs:
Device action status: Shows requested, in‑progress, and recently completed device actions. You can search, sort, and filter this list. You can quickly see what actions are running or have completed without leaving the device view.
Tools and reports: This tab was previously called Overview. It shows monitoring reports, like compliance and device configuration status, tools, like remediations. These features were previously accessed in other parts of the Intune admin center.
Properties: Contains admin‑modifiable device properties with visible scope tags and a dedicated editing view.
Device details: This tab was previously called Hardware. It provides physical device information and key Intune and Microsoft Entra management details.
Other features:
Device actions are grouped, ordered, and labeled consistently across platforms and device types, and only shows relevant and permitted actions. Destructive actions are separated and require confirmation, reducing unintentional actions.
The updated layout uses a standard structure across device types and platforms, while adapting to platform‑specific capabilities.
Improved labeling, hierarchy, and formatting make device information easier to scan and understand. The Essentials section elevates important device information and is accessible from any tab.
All existing device management capabilities remain available. This update focuses on making them easier to find and use.
Microsoft Intune now supports Ubuntu 26.04 LTS. Support for Ubuntu 22.04 LTS ends in August 2026. Devices already enrolled on Ubuntu 22.04 remain enrolled, but you should notify users to upgrade to a supported Ubuntu version. You can identify devices running Ubuntu…
Microsoft Intune now supports Ubuntu 26.04 LTS. Support for Ubuntu 22.04 LTS ends in August 2026. Devices already enrolled on Ubuntu 22.04 remain enrolled, but you should notify users to upgrade to a supported Ubuntu version. You can identify devices running Ubuntu 22.04 in the Intune admin center by going to Devices > All devices, filtering by Linux, and adding the OS version column. For more information, see Enroll Linux desktop devices in Microsoft Intune.
Windows devices managed by Intune need to run Intune Management Extension version 1.58.103.0 or later. Devices on earlier versions no longer receive configurations or updates that depend on the Intune Management Extension, including Win32 app deployments, PowerShell scripts, remediations, and platform scripts.…
Windows devices managed by Intune need to run Intune Management Extension version 1.58.103.0 or later. Devices on earlier versions no longer receive configurations or updates that depend on the Intune Management Extension, including Win32 app deployments, PowerShell scripts, remediations, and platform scripts.
The Intune Management Extension updates automatically, so most managed devices should already have a compatible version. Verify that your devices can sync with Intune to receive updates.
Microsoft Edge version 139 security baseline is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations for the Microsoft Edge browser and is the latest available Edge security baseline in Intune. The Edge v139 security baseline includes new settings,…
Microsoft Edge version 139 security baseline is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations for the Microsoft Edge browser and is the latest available Edge security baseline in Intune.
The Edge v139 security baseline includes new settings, updated default values, and retired settings.
We recommend carefully reviewing the settings in the new baseline before moving from a previous baseline version, especially if existing profiles include customizations.
A new setting in the Microsoft 365 admin center allows admins to control access to AI video generation features in Microsoft 365 Copilot and supported apps. Details: What changed: Admins can now use a dedicated setting in the Microsoft 365 admin center…
A new setting in the Microsoft 365 admin center allows admins to control access to AI video generation features in Microsoft 365 Copilot and supported apps.
Details:
What changed: Admins can now use a dedicated setting in the Microsoft 365 admin center to control whether users can access AI video generation features available in Microsoft 365 Copilot and Microsoft 365 apps.
Why: Organizations need clearer administrative controls to manage who can create AI-generated videos and align usage with internal policies.
Try this:
Review the new Copilot video generation setting in the Microsoft 365 admin center.
Decide whether video generation should be allowed for your organization.
Communicate policy changes to users if access is modified.
Update internal guidance or documentation if needed.
Why this matters:
Business impact: Provides centralized control over AI video generation to support governance and compliance needs.
Personal impact: Clarifies when and where users can access video generation features.
This update introduces an optional, customizable landing page for the Employee Self-Service agent that lets organizations highlight key HR and IT resources and align the experience with their branding. Details: What changed: Organizations can now optionally customize the Employee Self-Service agent landing…
This update introduces an optional, customizable landing page for the Employee Self-Service agent that lets organizations highlight key HR and IT resources and align the experience with their branding.
Details:
What changed: Organizations can now optionally customize the Employee Self-Service agent landing page with branding and commonly used resources. If no customization is applied, there is no change to the existing experience, and the agent continues to use Copilot's default appearance and starter prompts.
Why: Organizations want more control over how employees first interact with the Employee Self-Service agent while keeping the default experience unchanged when customization is not needed.
Try this:
Review the new landing page customization options for the Employee Self-Service agent.
Decide whether to align the landing page with your organization's branding.
Highlight commonly used HR or IT resources on the landing page.
Keep the default experience if customization is not required.
Why this matters:
Business impact: Helps organizations surface key resources while maintaining a consistent employee support experience.
Personal impact: Makes it easier for employees to find relevant help and information in one place.
Microsoft 365 Copilot now displays rich, interactive Bing web answer cards-such as Weather and Stocks-directly in chat responses to help users quickly access relevant, real-time information. Roadmap ID: 500865 Details: What changed: Copilot Chat will now show Bing's rich and interactive answer…
Microsoft 365 Copilot now displays rich, interactive Bing web answer cards-such as Weather and Stocks-directly in chat responses to help users quickly access relevant, real-time information.
What changed: Copilot Chat will now show Bing's rich and interactive answer cards-such as Weather, Stocks, and other structured information-when users ask related questions. Previously, Copilot provided only text-based responses without these enhanced visual cards.
Why: This change helps users get clearer, more actionable information at a glance, reducing the need to leave Copilot Chat to check external sources.
Try this:
Ask Copilot for the current weather in your city.
Request stock information for a company your team follows.
Check sunrise and sunset times by asking Copilot directly.
Why this matters:
Business impact: Provides faster access to real-time data, improving decision-making and reducing context switching.
Personal impact: Helps individuals quickly get the information they need without opening additional tabs or apps.
[Web} This feature allows users to share their agent directly with a Microsoft Teams team, making it easier for teams to discover, install, and start using agents together. Roadmap ID: 557947 Details: What changed Users can now share an agent with a…
[Web}
This feature allows users to share their agent directly with a Microsoft Teams team, making it easier for teams to discover, install, and start using agents together.
What changed Users can now share an agent with a Microsoft Teams team by selecting a team in the sharing dialog. Users can also notify the team's main channel so team members are aware of the agent and can install it.
Why: This change helps teams collaborate more easily by making shared agents discoverable and accessible within the Teams environment they already use.
Try this:
Open the agent sharing dialog and search for a Microsoft Teams team.
Select a team to share your agent with.
Send a notification to the team's main channel.
Encourage team members to install and start using the agent.
Why this matters:
Business impact: Improves team collaboration by making agents easier to deploy within existing Teams workflows.
Personal impact: Simplifies access to shared agents without needing individual setup steps.
The Intune Data Warehouse (beta) connector v1 in Power BI is retired. If you use Power BI reports that rely on this connector, you need to transition to Intune connector v2 or the OData Feed connector before the transition completes. Power BI…
The Intune Data Warehouse (beta) connector v1 in Power BI is retired. If you use Power BI reports that rely on this connector, you need to transition to Intune connector v2 or the OData Feed connector before the transition completes. Power BI reports created after November 2025 already use connector v2, while reports created before that date may still use the beta connector and need updating. This change improves the long-term reliability and supportability of Intune data access.
Customer impact: This change does not introduce new user interface experiences. Customers who still rely on the Intune Data Warehouse (beta) connector in Power BI may be affected if they have not transitioned to supported alternatives. Customers already using supported and documented data access options do not experience disruption.
Required customer action: Review the published guidance and transition away from the Intune Data Warehouse (beta) connector in Power BI before the transition completes. Customers who do not take action lose access to data through the beta connector after it is retired.
Timing and rollout: Customer communications begin in late April 2026. The transition occurs gradually over two weeks starting April 20, 2026.
New guidance has been added to the Microsoft Intune compliance policy reporting documentation to help explain how device compliance results appear in Intune reports. This update clarifies expected reporting behavior related to device check-in timing and user association, helping you better interpret…
New guidance has been added to the Microsoft Intune compliance policy reporting documentation to help explain how device compliance results appear in Intune reports. This update clarifies expected reporting behavior related to device check-in timing and user association, helping you better interpret compliance policy reports. For more information, see Known reporting behaviors.
Analyze enterprise search results with code interpreter Copilot's code interpreter can now analyze files found via enterprise search in Chat, even if they weren't manually uploaded or linked. Roadmap ID: 519570 Details: What changed: Previously, code interpreter only worked on files explicitly…
Analyze enterprise search results with code interpreter Copilot's code interpreter can now analyze files found via enterprise search in Chat, even if they weren't manually uploaded or linked.
Previously, code interpreter only worked on files explicitly uploaded or attached. Now, it can also analyze files surfaced through enterprise search in Copilot Chat.
Why: This change reduces friction and improves usability by allowing users to analyze relevant files without needing to manually attach them.
Try this:
Search for a spreadsheet in Copilot Chat and ask the code interpreter to summarize trends.
Locate a CSV file via enterprise search and request a data visualization.
Find a document using Chat and ask Copilot to run calculations or extract metrics.
Why this matters:
Business impact: Streamlines workflows by enabling analysis of discovered files without manual uploads.
Personal impact: Saves time and effort when working with files found through search.
The updated Copilot adoption Power BI report introduces a cleaner experience and new insights that help organizations understand how power users engage with Copilot. Roadmap ID: 557674 Details: What changed: The Copilot adoption Power BI report now includes a simplified, more intuitive…
The updated Copilot adoption Power BI report introduces a cleaner experience and new insights that help organizations understand how power users engage with Copilot.
What changed: The Copilot adoption Power BI report now includes a simplified, more intuitive layout and new insights that highlight how power users interact with Copilot. These updates make it easier to identify Copilot adoption and habit formation compared to the previous version.
Why: These improvements were made to help organizations better track Copilot engagement and identify opportunities to increase value and usage.
Try this:
Open the updated Copilot adoption Power BI report in Advanced insights.
Review the new power user insights to identify high-impact usage patterns.
Share findings with team leads to support targeted Copilot enablement.
Why this matters:
Business impact: Helps organizations better understand Copilot usage and identify opportunities to improve adoption.
Users can now edit the schedule of their Copilot prompts, giving them more flexibility and control. Roadmap ID: 531912 Details: What changed: You can now adjust the timing of scheduled prompts instead of deleting and recreating them. This update improves usability and…
Users can now edit the schedule of their Copilot prompts, giving them more flexibility and control.
What changed: You can now adjust the timing of scheduled prompts instead of deleting and recreating them. This update improves usability and reduces repetitive setup.
Why: This change was made to give users more control over their workflows and reduce friction when managing recurring prompts.
Try this:
Open your list of scheduled prompts.
Select a prompt and adjust the schedule to match your needs.
Save your changes to update the prompt timing.
Why this matters:
Business impact: Reduces time spent managing recurring workflows.
Personal impact: Makes it easier to keep prompts aligned with changing schedules.
Action confirmations have been streamlined, so users experience fewer interruptions while still maintaining safety controls. Details: What changed: Copilot now reduces the number of confirmation prompts shown during read actions which don't make changes to external systems. Safety checks remain in place…
Action confirmations have been streamlined, so users experience fewer interruptions while still maintaining safety controls.
Details:
What changed: Copilot now reduces the number of confirmation prompts shown during read actions which don't make changes to external systems. Safety checks remain in place while enhancing the user experience.
Why: This update helps users stay focused and reduces friction during task execution.
Try this:
Use an agent to fetch data from an external system.
Notice fewer confirmation steps during the process.
Continue your workflow without additional interruptions.
Why this matters:
Business impact: Improves workflow efficiency by reducing delays.
Personal impact: Creates a smoother, more natural Copilot experience.
Code interpreter now works on files found via Chat search
Analyze enterprise search results with code interpreter Copilot's code interpreter can now analyze files found via enterprise search in Chat, even if they weren't manually uploaded or linked.
What changed: Previously, code interpreter only worked on files explicitly uploaded or attached. Now, it can also analyze files surfaced through enterprise search in Copilot Chat.
Why: This change reduces friction and improves usability by allowing users to analyze relevant files without needing to manually attach them.
Try this:
Search for a spreadsheet in Copilot Chat and ask the code interpreter to summarize trends.
Locate a CSV file via enterprise search and request a data visualization.
Find a document using Chat and ask Copilot to run calculations or extract metrics.
Why this matters:
Business impact: Streamlines workflows by enabling analysis of discovered files without manual uploads.
Personal impact: Saves time and effort when working with files found through search.
Microsoft 365 Copilot Chat integration is expanding to Teams chats, channels, and meetings, with mobile support coming soon. Roadmap ID: 501107 Details: What changed: Microsoft 365 Copilot Chat is now accessible across Teams chats, channels, calling, and meetings. This expands availability beyond…
Microsoft 365 Copilot Chat integration is expanding to Teams chats, channels, and meetings, with mobile support coming soon.
What changed: Microsoft 365 Copilot Chat is now accessible across Teams chats, channels, calling, and meetings. This expands availability beyond its previous limited scope.
Why: The goal is to make Microsoft 365 Copilot Chat available wherever users collaborate, improving consistency and access.
Try this:
Open a Teams chat or channel and launch Copilot.
Use Microsoft 365 Copilot Chat to ask questions or generate insights.
Try Microsoft 365 Copilot Chat during a meeting to support real time collaboration.
Why this matters:
Business impact: Enhances collaboration by bringing Microsoft 365 Copilot Chat into more communication surfaces.
Personal impact: Makes it easier to access Microsoft 365 Copilot Chat wherever you work in Teams.
You can now generate a file summary with Copilot and include it directly when sharing OneDrive files in Windows. Roadmap ID: 527840 Details: What changed: A new option in File Explorer and the OneDrive Activity Center lets you summarize a file with…
You can now generate a file summary with Copilot and include it directly when sharing OneDrive files in Windows.
What changed: A new option in File Explorer and the OneDrive Activity Center lets you summarize a file with Copilot and send that summary within the share dialog. Previously, users needed to create summaries separately before sharing.
Why: Sharing a file often means the recipient has to open it just to understand what it's about. Now, Copilot generates a summary for you so the people you share with get the key points upfront, right in the share notification.
Try this:
Open File Explorer and select a file stored in OneDrive.
Choose Share, then select the option to generate a Copilot summary.
Send the file along with the summary to your recipient.
Open OneDrive activity center and select a file.
Choose Share, then select the option to generate a Copilot summary.
Send the file along with the summary to your recipient.
Why this matters:
Business impact: Your recipients can quickly decide if a file needs their attention without opening it first. Whether you're sharing a proposal, report, or meeting notes, the summary gives everyone the context they need to act faster.
Personal impact: Makes it easier to communicate key points without extra steps.
Declarative Agents can now interpret and ground responses using embedded images in Word, PowerPoint, and PDF files. This enhancement enables Copilot to extract insights from charts, diagrams, and screenshots, improving the accuracy and completeness of answers. Roadmap ID: 531758 Details: What changed:…
Declarative Agents can now interpret and ground responses using embedded images in Word, PowerPoint, and PDF files. This enhancement enables Copilot to extract insights from charts, diagrams, and screenshots, improving the accuracy and completeness of answers.
What changed: Declarative Agents now analyze embedded images in supported file types (.docx, .pptx, .pdf). Visual elements such as charts and diagrams are used to inform responses, resulting in more contextually accurate answers.
Why: Users often include critical information in visuals. This change ensures Copilot can interpret both text and graphics for more complete responses.
Try this:
Upload a Word document with embedded charts and ask Copilot to summarize key insights.
Attach a PowerPoint file with diagrams and request an explanation of the visual flow.
Use a PDF with screenshots and ask Copilot to describe the process shown.
Why this matters:
Business impact: Improves Copilot's ability to deliver comprehensive answers grounded in both text and visuals.
Personal impact: Helps users get more accurate and complete responses from files with embedded images.
There is a new TeamViewer integration in Microsoft Intune that simplifies onboarding and improves reliability for remote assistance workflows. The new connector replaces the existing TeamViewer connector experience and provides a more streamlined experience in the Intune admin center. If you're using…
There is a new TeamViewer integration in Microsoft Intune that simplifies onboarding and improves reliability for remote assistance workflows. The new connector replaces the existing TeamViewer connector experience and provides a more streamlined experience in the Intune admin center. If you're using the previous TeamViewer connector, you must migrate to the new connector within 12 months to maintain functionality. For more information about the new connector, see Use the TeamViewer integration in Microsoft Intune.
Microsoft Intune now supports management of Android XR devices using Android Enterprise dedicated and fully managed enrollment modes. You can enroll Android XR devices, deploy apps through managed Google Play, and apply core security and compliance policies. Android XR devices appear and…
Microsoft Intune now supports management of Android XR devices using Android Enterprise dedicated and fully managed enrollment modes. You can enroll Android XR devices, deploy apps through managed Google Play, and apply core security and compliance policies. Android XR devices appear and are managed alongside other Android devices in the Intune admin center. For more information about supported scenarios and current limitations, see Microsoft Intune announces Android Enterprise management support for Android XR.
The ability to use $count in sign-ins API requests is now here, allowing customers to perform count computations directly in API requests. For more information, see: Customize Microsoft Graph responses with query parameters.
Members of the Compliance Administrator and Organization Management role groups have administrative and contributor access, while members of the Data Security Management and Insider Risk Management role groups have contributor access without needing explicit role assignment.
A new Data Security Investigation Contributor role automatically provides Data Security Investigations access to members of several Microsoft Purview role groups. Members of the Compliance Administrator and Organization Management role groups have administrative and contributor access, while members of the Data Security Management and Insider Risk Management role groups have contributor access without needing explicit role assignment.
A new conceptual article, Learn about just-in-time protection, now covers JIT concepts, terms, supported activities, device compatibility, and includes a detailed JIT workflow diagram.
A new conceptual article, Learn about just-in-time protection, now covers JIT concepts, terms, supported activities, device compatibility, and includes a detailed JIT workflow diagram.
A new granular Unified RBAC permission Email & collaboration content: Emails associated with alerts (read) allows analysts to preview or download email messages associated with specific security alerts. For more information, see Email entity page actions.
A new granular Unified RBAC permission Email & collaboration content: Emails associated with alerts (read) allows analysts to preview or download email messages associated with specific security alerts. For more information, see Email entity page actions.
Microsoft Entra ID Governance now supports account discovery for connected applications in public preview. This capability provides administrators with visibility into all accounts that exist within connected applications, including orphan accounts. By generating discovery reports directly from the provisioning experience, organizations can…
Microsoft Entra ID Governance now supports account discovery for connected applications in public preview. This capability provides administrators with visibility into all accounts that exist within connected applications, including orphan accounts.
By generating discovery reports directly from the provisioning experience, organizations can identify accounts in connected applications that aren't assigned to the enterprise application in Microsoft Entra and simplify onboarding the application.
Identify existing provisioning jobs that use the OAuth 2.0 Authorization Code grant. Watch for announcements about affected applications and availability of updated authentication methods. Update and test provisioning job configuration when your application supports a modern authentication method. If an application is…
Identify existing provisioning jobs that use the OAuth 2.0 Authorization Code grant.
Watch for announcements about affected applications and availability of updated authentication methods.
Update and test provisioning job configuration when your application supports a modern authentication method.
If an application is retired, plan to migrate to a supported alternative.
In Microsoft Entra tenants, customers can create a single, tenant-wide, customized branding experience that applies to all apps. We are introducing a concept of Branding "themes" to allow customers to create different branding experiences for specific applications.
In Microsoft Entra tenants, customers can create a single, tenant-wide, customized branding experience that applies to all apps. We are introducing a concept of Branding "themes" to allow customers to create different branding experiences for specific applications.
In May, requestors will be able to see the name and email address of approvers for their pending access package requests directly in the My Access portal will be in General Availability. This feature improves transparency and helps streamline communication between requestors…
In May, requestors will be able to see the name and email address of approvers for their pending access package requests directly in the My Access portal will be in General Availability. This feature improves transparency and helps streamline communication between requestors and approvers. At the tenant level, approver visibility is enabled by default for all members (non-guests) and can be controlled through the Entitlement Management settings in the Microsoft Entra Admin Center. At the access package level, admins and access package owners can configure the approver visibility and choose to override the tenant level setting under the advanced request settings in the access package policy. For more information, see: View approver information for pending requests.
When you chose to automatically apply a sensitivity label, you can now optionally choose to always overriding an existing label that has a lower priority label, even if it was manually applied. This option was previously available for emails only and now…
Auto-labeling policies introduce a new flow where you must decide whether to automatically apply a sensitivity label, or remove a label when the configured conditions apply for files in SharePoint and OneDrive. When you chose to automatically apply a sensitivity label, you can now optionally choose to always overriding an existing label that has a lower priority label, even if it was manually applied. This option was previously available for emails only and now extends to files in SharePoint and OneDrive.
Teams will automatically detect each speaker's spoken language and update it in real time as the conversation evolves. Manual spoken language selection will no longer be available. To learn more, see Multilingual speech recognition in Microsoft Teams.
Teams will automatically detect each speaker's spoken language and update it in real time as the conversation evolves. Manual spoken language selection will no longer be available. To learn more, see Multilingual speech recognition in Microsoft Teams.
Request expert status to contribute trusted answers in Viva Engage. Approved experts are highlighted with a special label next to their names and can endorse accurate and credible responses. To learn more, see Answers in Viva: Answer questions and earn badges.
Request expert status to contribute trusted answers in Viva Engage. Approved experts are highlighted with a special label next to their names and can endorse accurate and credible responses. To learn more, see Answers in Viva: Answer questions and earn badges.
Built-in alert tuning rules suppress alerts from common benign activity in Defender for Endpoint and Defender for Office 365 without affecting Automated Investigation and Response (AIR) investigations and email notifications.
Built-in alert tuning rules are now generally available. Built-in alert tuning rules suppress alerts from common benign activity in Defender for Endpoint and Defender for Office 365 without affecting Automated Investigation and Response (AIR) investigations and email notifications.
This condition is supported with browser and network cloud apps detection.
Collection policies support sensitivity labels as a condition for scoping detection to items with specific sensitivity labels applied. This condition is supported with browser and network cloud apps detection.
Configurable token lifetime policies are now generally available in Microsoft Entra ID. This feature allows administrators to customize the lifetimes of access tokens, ID tokens, and SAML tokens issued by the Microsoft identity platform by creating and assigning token lifetime policies to…
Configurable token lifetime policies are now generally available in Microsoft Entra ID. This feature allows administrators to customize the lifetimes of access tokens, ID tokens, and SAML tokens issued by the Microsoft identity platform by creating and assigning token lifetime policies to applications and service principals.
With configurable token lifetime policies, organizations can adjust token durations to meet their security and usability requirements -- for example, shortening access token lifetimes for sensitive applications or extending them for long-running automation scenarios. For more information, see: Configurable token lifetimes in the Microsoft identity platform.
You can use it as a condition to scope DLP rules to specific URLs, or as an exception to exclude specific URLs from policy enforcement.
DLP policies for unmanaged cloud apps support a new URL contains text condition that detects when the URL of the cloud app contains specified text strings. You can use it as a condition to scope DLP rules to specific URLs, or as an exception to exclude specific URLs from policy enforcement.
A new reference article covering DLP policy tips, supported conditions, oversharing dialogs, and override capabilities for Outlook on Android, iOS, and macOS.
On-premises databases are scanned in on-premises infrastructure to ensure that data doesn't move beyond organizations' premises. You need to set up a Kubernetes cluster to host the runtime that scans these databases.
You can configure alerts for a rule level threshold and a data asset level threshold.
Data quality thresholds help stakeholders and data consumers know when data quality scores fall below standards. You can configure alerts for a rule level threshold and a data asset level threshold.
Microsoft Copilot can help you answer incoming Teams calls and schedule follow-up appointments, ensuring you stay focused without missing important connections. To learn more, see Use Copilot Call Delegation in Microsoft Teams.
Microsoft Copilot can help you answer incoming Teams calls and schedule follow-up appointments, ensuring you stay focused without missing important connections. To learn more, see Use Copilot Call Delegation in Microsoft Teams.
Added Scenarios and API overview section. This new section helps developers identify which APIs to use for specific scenarios. For more information, see Scenarios and API overview.
Added Scenarios and API overview section. This new section helps developers identify which APIs to use for specific scenarios. For more information, see Scenarios and API overview.
Based on your licensing, you can download the installer packages here: Microsoft Identity Manager licensing and downloads | Microsoft Learn SP3 introduces a new upgrade process. Please follow the documented steps carefully: Upgrade Microsoft Identity Manager 2016 from SP2 to SP3 |…
Notifications use a rolling 10-minute batching window to prevent excessive emails.
Email notifications for browser and network DLP rules notify end users via email when their activity is blocked. Notifications use a rolling 10-minute batching window to prevent excessive emails.
Build secure sign‑in and sign‑up experiences for applications in Entra External ID using Native Authentication, with Social Identity Provider support such as Google, Facebook, and Apple available through browser‑delegated (web‑view) authentication using developer‑friendly SDKs. For more information, see: Native authentication in Microsoft…
Build secure sign‑in and sign‑up experiences for applications in Entra External ID using Native Authentication, with Social Identity Provider support such as Google, Facebook, and Apple available through browser‑delegated (web‑view) authentication using developer‑friendly SDKs. For more information, see: Native authentication in Microsoft Entra External ID.
Generally available feature for configuring reauthentication with Conditional Access for Microsoft Entra Privileged Identity Management role activation. For more information see: On activation, require Microsoft Entra Conditional Access authentication context
This feature enhances the security and manageability of certificate-based authentication (CBA) by ensuring that only authorized users can authenticate using certificates issued by specific CAs. More information at Certificate Authority (CA) scoping
Entra CBA Certificate Authority (CA) scoping in Microsoft Entra allows tenant administrators to restrict the use of specific certificate authorities (CAs) to defined user groups. This feature enhances the security and manageability of certificate-based authentication (CBA) by ensuring that only authorized users can authenticate using certificates issued by specific CAs. More information at Certificate Authority (CA) scoping
General Availability - Due to known issues on iOS platform, the Entra certificate-based authentication (CBA) method was not allowed as a second factor on iOS and CBA was moved to the last place in the system-preferred MFA list as documented at FAQ.…
General Availability - Due to known issues on iOS platform, the Entra certificate-based authentication (CBA) method was not allowed as a second factor on iOS and CBA was moved to the last place in the system-preferred MFA list as documented at FAQ.
We've enhanced the user experience during sign-in with certificate in native iOS apps by removing unnecessary passwords and MFA prompts with all the known issues addressed. The feature enhancement enables us to support CBA as a second factor on iOS, and to move CBA to the third place in system preferred MFA methods.
Use the export for support requests, configuration reference, and local analysis by using PowerShell or Microsoft 365 Copilot.
Export policy configuration as a ZIP file containing a point-in-time snapshot of all policy configurations in XML format for DLP and sensitivity label publishing policies. Use the export for support requests, configuration reference, and local analysis by using PowerShell or Microsoft 365 Copilot.
Customer can use GSA cloud firewall to apply admin configurable, 5-tuple (source IP, destination IP, protocol, source port, destination port) based filtering for all internet traffic acquired from branch offices through GSA remote networks capability. For more information, see: Configure Global Secure…
Customer can use GSA cloud firewall to apply admin configurable, 5-tuple (source IP, destination IP, protocol, source port, destination port) based filtering for all internet traffic acquired from branch offices through GSA remote networks capability. For more information, see: Configure Global Secure Access cloud firewall.
We are excited to announce the general availability of the iOS Global Secure Access (GSA) client. The Global Secure Access client on iOS and iPadOS requires no new agent installation. It leverages the existing Microsoft Defender for Endpoint (MDE) to route traffic…
We are excited to announce the general availability of the iOS Global Secure Access (GSA) client. The Global Secure Access client on iOS and iPadOS requires no new agent installation. It leverages the existing Microsoft Defender for Endpoint (MDE) to route traffic through Microsoft SSE for Microsoft 365, internet access, and private access.
Issuer Hints is generally available now and helps improve the sign‑in experience for Entra Certificate‑Based Authentication (CBA) by ensuring users are prompted to select only certificates that are trusted and valid for their organization. This reduces confusion, minimizes sign‑in errors, and streamlines…
Issuer Hints is generally available now and helps improve the sign‑in experience for Entra Certificate‑Based Authentication (CBA) by ensuring users are prompted to select only certificates that are trusted and valid for their organization. This reduces confusion, minimizes sign‑in errors, and streamlines certificate selection especially on devices with multiple certificates installed. Issuers hints are designed to enhance both security and usability without changing how certificates are issued or managed. For more information, see: Issuer hints.
In the new simplified app bar in Teams, labels are now hidden by default, so you can focus on what matters. To learn more, see Change settings in Microsoft Teams.
In the new simplified app bar in Teams, labels are now hidden by default, so you can focus on what matters. To learn more, see Change settings in Microsoft Teams.
The License Usage page in the Microsoft Entra admin center helps customers optimize their Entra licenses by providing visibility into feature usage across their tenant. It shows how many Entra ID P1, P2, and Suite licenses you own, along with usage of…
The License Usage page in the Microsoft Entra admin center helps customers optimize their Entra licenses by providing visibility into feature usage across their tenant. It shows how many Entra ID P1, P2, and Suite licenses you own, along with usage of key features such as Conditional Access and risk‑based Conditional Access mapped to each license type. You can also review usage trends over the past six months. This view gives you a clearer understanding of your license footprint, the value you’re deriving from Entra, and potential over‑usage risks within your tenant. For more information, see: Microsoft Entra license usage insights.
SQL Server 2022 and Exchange Server Subscription Edition (SE) Support: Updated integration and database compatibility with the latest SQL and Exchange releases. SharePoint Subscription Edition (SE) Support: The MIM Portal can now be deployed on SharePoint SE. System Center Service Manager Data…
SQL Server 2022 and Exchange Server Subscription Edition (SE) Support: Updated integration and database compatibility with the latest SQL and Exchange releases.
SharePoint Subscription Edition (SE) Support: The MIM Portal can now be deployed on SharePoint SE.
System Center Service Manager Data Warehouse (DW) 2022 Support: Enables reporting and audit integration with the latest SCSM DW.
Active Directory Federation Services (AD FS) Single Sign-On (SSO): Introduces support for claims-based authentication, allowing end-users to sign in via AD FS instead of Windows Integrated Authentication
SQL Server 2022 Support: Full support for installation with and connection to SQL Server 2022. Azure SQL Support: MIM Sync can now use Azure SQL Database, with authentication supported via both System Assigned and User Assigned Managed Identities.
SQL Server 2022 Support: Full support for installation with and connection to SQL Server 2022.
Azure SQL Support: MIM Sync can now use Azure SQL Database, with authentication supported via both System Assigned and User Assigned Managed Identities.
This feature adds to the existing home page status card as in-portal experiences that provide consistent and predictable access to the service.
Microsoft Defender Experts MDR customers can now see Defender Experts as a distinct entry in the Microsoft Defender portal navigation menu. This feature adds to the existing home page status card as in-portal experiences that provide consistent and predictable access to the service. Learn more.
The Microsoft Entra Agent ID platform is now generally available. The Agent ID platform provides an identity and authorization framework built specifically for AI agents operating in enterprise environments. It enables developers to create and manage agent identities with enterprise-grade authentication, authorization,…
The Microsoft Entra Agent ID platform is now generally available. The Agent ID platform provides an identity and authorization framework built specifically for AI agents operating in enterprise environments. It enables developers to create and manage agent identities with enterprise-grade authentication, authorization, and governance, using standard protocols such as OAuth 2.0, MCP, and A2A.
Microsoft Entra Certificate-Based Authentication (CBA) is now generally available on iOS. Native iOS sign-ins now avoid unnecessary password and MFA prompts, enabling CBA as a supported second factor and allowing it to be prioritized as a system‑preferred MFA method. Users can choose…
Microsoft Entra Certificate-Based Authentication (CBA) is now generally available on iOS. Native iOS sign-ins now avoid unnecessary password and MFA prompts, enabling CBA as a supported second factor and allowing it to be prioritized as a system‑preferred MFA method. Users can choose another allowed MFA method if needed, based on tenant policy. More information at Microsoft Entra certificate-based authentication on Apple devices
By leveraging standards‑based federation, users authenticate with their home tenant while applications hosted in an External ID tenant rely on trusted identity assertions from Entra ID. This approach reduces the need for duplicate accounts, streamlines sign‑in experiences, and allows organizations to extend…
Microsoft Entra ID federation with External ID (EEID) enables organizations to let users sign in to customer‑facing applications using their existing workforce Entra ID identities. By leveraging standards‑based federation, users authenticate with their home tenant while applications hosted in an External ID tenant rely on trusted identity assertions from Entra ID. This approach reduces the need for duplicate accounts, streamlines sign‑in experiences, and allows organizations to extend consistent security controls across workforce and customer scenarios. For more information, see: Add a Microsoft Entra ID tenant as an OpenID Connect identity provider (Preview).
SP3 focuses on stability and supportability, modernizes compatibility with current platform components (SQL Server, SharePoint, and Exchange), and adds an additional deployment option for the Synchronization Service by enabling Azure SQL Database with managed identity authentication—helping reduce operational risk for hybrid identity…
Microsoft Identity Manager (MIM) 2016 Service Pack 3 (SP3) is now available. SP3 focuses on stability and supportability, modernizes compatibility with current platform components (SQL Server, SharePoint, and Exchange), and adds an additional deployment option for the Synchronization Service by enabling Azure SQL Database with managed identity authentication—helping reduce operational risk for hybrid identity environments.
Issues fixed and improvements added in this update include
Omnissa deployments have been brought onto Microsoft Teams' VDI optimization architecture. This will deliver improved performance, greater feature parity with the native desktop client, and more reliability across meeting experiences, all while continuing to benefit from the centralized management, security, and scalability…
Omnissa deployments have been brought onto Microsoft Teams' VDI optimization architecture. This will deliver improved performance, greater feature parity with the native desktop client, and more reliability across meeting experiences, all while continuing to benefit from the centralized management, security, and scalability of VDI.
If you're an IT admin or simply looking for feature updates on Teams desk phones, displays, and panels, you'll find all the updates at What's new in Microsoft Teams devices.
To view feature updates for Microsoft Teams Rooms, go to:
As organizations look to strengthen identity security and advance their Zero Trust strategies, many are looking for simpler, more reliable ways to manage hybrid identity. To support these needs, we’re beginning the transition from Microsoft Entra Connect Sync to the cloud‑native Microsoft…
As organizations look to strengthen identity security and advance their Zero Trust strategies, many are looking for simpler, more reliable ways to manage hybrid identity. To support these needs, we’re beginning the transition from Microsoft Entra Connect Sync to the cloud‑native Microsoft Entra Cloud Sync - helping reduce on‑premises complexity while improving security, reliability, and day‑to‑day manageability.
This shift is a key step toward a cloud-managed identity future that will provide a more secure, resilient, and easier-to-operate synchronization experience. As part of ongoing modernization efforts, Microsoft’s strategy remains to deliver stronger security, improved reliability, and simpler identity operations.
Global Secure Access supports network-based content filtering based on file types. This allows you to monitor and control file transfers across the network to GenAI and SaaS apps to prevent unauthorized exfiltration of content. For more information, see: Create a content policy…
Global Secure Access supports network-based content filtering based on file types. This allows you to monitor and control file transfers across the network to GenAI and SaaS apps to prevent unauthorized exfiltration of content. For more information, see: Create a content policy to filter network file content.
Microsoft Secure Score now includes the Ensure devices are updated to Secure Boot 2023 certificates and boot manager, which helps identify devices that haven't yet transitioned to the new Secure Boot 2023 certificates required ahead of the June 2026 expiration.Devices that remain…
Microsoft Secure Score now includes the Ensure devices are updated to Secure Boot 2023 certificates and boot manager, which helps identify devices that haven't yet transitioned to the new Secure Boot 2023 certificates required ahead of the June 2026 expiration.Devices that remain on older Secure Boot certificates may become unable to receive new security protections for the early boot process as the certificates approach expiration in June 2026.This recommendation provides centralized visibility into deployment status across the environment, which enables organizations to identify exposure, prioritize remediation, and track rollout progress at scale. To learn more about the recommendation, see Assess Secure Boot status with Microsoft Defender (blog).
New bulk import, editing, and moving capabilities can help you quickly scale operations in Unified Catalog: Create data products in bulk Create critical data elements in bulk Create glossary terms in bulk and bulk edit glossary terms Move multiple glossary terms between…
New bulk import, editing, and moving capabilities can help you quickly scale operations in Unified Catalog:
Instead, they are included in the new support for Teams call logs retention policies that you create by using PowerShell. These newly supported retention policies let you manage the deletion of calling-related data when this is required for compliance and regulatory requirements.…
Newly created Teams call data records (often abbreviated to CDRs, and sometimes also called call detail records or just call records) are no longer included with Teams chat retention policies. Instead, they are included in the new support for Teams call logs retention policies that you create by using PowerShell. These newly supported retention policies let you manage the deletion of calling-related data when this is required for compliance and regulatory requirements. Call data records previously included in Teams chat retention policies continue to be managed by those same policies.
This Workday connector update resolves termination processing delays observed for workers in APAC and ANZ regions. Admins can now enable termination lookahead setting to prefetch data and tailor deprovisioning logic for accounts in Microsoft Entra ID and on-premises Active Directory. For more…
This Workday connector update resolves termination processing delays observed for workers in APAC and ANZ regions. Admins can now enable termination lookahead setting to prefetch data and tailor deprovisioning logic for accounts in Microsoft Entra ID and on-premises Active Directory. For more details, refer to: https://aka.ms/WorkdayTerminationLookaheadDoc
Screen capture prevention is now supported on Teams for iOS devices. Turn this setting on to protect sensitive information shared during Teams meetings. To learn more, see Prevent screen captures in Microsoft Teams meetings.
Screen capture prevention is now supported on Teams for iOS devices. Turn this setting on to protect sensitive information shared during Teams meetings. To learn more, see Prevent screen captures in Microsoft Teams meetings.
Preview content while triaging alerts to quickly identify false positives, confirm the presence of sensitive data, and decide whether the alert warrants escalation.
Preview content while triaging alerts to quickly identify false positives, confirm the presence of sensitive data, and decide whether the alert warrants escalation.
The DSPM exfiltration objective card displays risk counts across five fixed categories, giving security teams continuous visibility into recently exfiltrated sensitive data without manual investigation creation.
Proactive AI insights from Data Security Posture Management (DSPM) automatically create and refresh a single investigation for your tenant every 24 hours. The DSPM exfiltration objective card displays risk counts across five fixed categories, giving security teams continuous visibility into recently exfiltrated sensitive data without manual investigation creation.
You can configure anti-spam policies to deliver bulk mail below the BCL threshold to the Promotions folder in supported versions of Outlook. For more information, see Deliver bulk mail below the BCL threshold to the Promotions folder.
Filter your Teams chats by @mentions, followed threads, and more by selecting Quick views at the top of your chat list. To customize, hover over a category and select More quick view options . To learn more, see Manage notifications in Microsoft Teams.
Filter your Teams chats by @mentions, followed threads, and more by selecting Quick views at the top of your chat list. To customize, hover over a category and select More quick view options . To learn more, see Manage notifications in Microsoft Teams.
Evaluate the new authentication option once available in your tenant Plan and test migration of existing provisioning jobs to workload identity-based authentication Update any internal documentation or operational processes that reference basic authentication
Evaluate the new authentication option once available in your tenant
Plan and test migration of existing provisioning jobs to workload identity-based authentication
Update any internal documentation or operational processes that reference basic authentication
A prerequisite for this functionality is that co-authoring is enabled for the tenant. If this prerequisite isn't in place, users still see the message that they must use a desktop app to apply the label.
If you have a Microsoft Security Copilot subscription, you can generate an AI summary of email entity data directly from the Email entity page by selecting the Copilot action.
If you have a Microsoft Security Copilot subscription, you can generate an AI summary of email entity data directly from the Email entity page by selecting the Copilot action.
Please monitor monthly What’s new articles and the Microsoft 365 Message Center for future announcements, migration guidance, deadlines, and documentation.
Please monitor monthly What’s new articles and the Microsoft 365 Message Center for future announcements, migration guidance, deadlines, and documentation.
Microsoft Entra is introducing workload identity–based authentication for SAP SuccessFactors provisioning. This new capability allows the Microsoft Entra provisioning service to authenticate to SAP SuccessFactors using Entra workload identity and short‑lived tokens instead of static credentials (username and password). This change helps…
Microsoft Entra is introducing workload identity–based authentication for SAP SuccessFactors provisioning. This new capability allows the Microsoft Entra provisioning service to authenticate to SAP SuccessFactors using Entra workload identity and short‑lived tokens instead of static credentials (username and password).
Meeting notes are now available for instant meetings that started via Meet now in the calendar. To learn more, see Take meeting notes in Microsoft Teams.
Meeting notes are now available for instant meetings that started via Meet now in the calendar. To learn more, see Take meeting notes in Microsoft Teams.
These fields expand coverage beyond Copilot Studio to all agent types, including Microsoft Foundry, third-party marketplace, and custom line-of-business agents.
The AIAgentsInfo table in advanced hunting now includes additional columns that provide deeper visibility into AI agents operating in your Microsoft 365 environment. These fields expand coverage beyond Copilot Studio to all agent types, including Microsoft Foundry, third-party marketplace, and custom line-of-business agents.
The Advanced review set explorer (preview) includes a new left navigation pane to browse the review set schema, insert KQL operators, and run sample queries, and a new Getting started tab with basic and advanced query templates to help you build queries…
The Export to Zip selection includes more detailed information about the policies and all sensitivity labels in your tenant.
The Label policies page for label publishing policies has a new Export policies option, where the Export to CSV selection acts similarly to Export on the Sensitivity labels page. The Export to Zip selection includes more detailed information about the policies and all sensitivity labels in your tenant. For more information, see Export policy configuration in Microsoft Purview.
Enable common automation scenarios, like approvals, notifications, or follow-up actions, by triggering Teams workflows directly from a chat message. To learn more, see Add or run a workflow in chats, chat messages, channels, and channel posts in Microsoft Teams.
This process allows you to centralize the management of glossary terms by migrating glossary terms created in the classic governance experience into Unified Catalog. When you complete the process, you can curate data assets and columns.
Use a one-time glossary migration and asset enablement process to curate data assets and columns with glossary terms. This process allows you to centralize the management of glossary terms by migrating glossary terms created in the classic governance experience into Unified Catalog. When you complete the process, you can curate data assets and columns.
You can now view the current status of automatic attack disruption and predictive shielding actions related to a specific incident. You view this data in the Activities tab of the incident page. The data applies to the Contain user, GPO hardening, Safeboot…
You can now view the current status of automatic attack disruption and predictive shielding actions related to a specific incident. You view this data in the Activities tab of the incident page. The data applies to the Contain user, GPO hardening, Safeboot hardening response actions.
You view this data in the Activities tab of the incident page.
You can now view the current status of automatic attack disruption and predictive shielding actions related to a specific incident. You view this data in the Activities tab of the incident page. Learn more
SCIM provisioning applications that use the OAuth 2.0 Authorization Code grant will be updated to support modern authentication methods, such as OAuth 2.0 Client Credentials and workload identity federation. Existing provisioning jobs will not switch automatically. Customers will need to update job…
SCIM provisioning applications that use the OAuth 2.0 Authorization Code grant will be updated to support modern authentication methods, such as OAuth 2.0 Client Credentials and workload identity federation.
Existing provisioning jobs will not switch automatically. Customers will need to update job configuration after the new method is available.
A small number of applications that cannot support a modern method may be retired from the Microsoft Entra app gallery.
If you are currently using basic authentication for any of the above SAP SuccessFactors provisioning integrations, you must upgrade to workload identity-based authentication before November 2026 to ensure uninterrupted operation of the integrations. No immediate action is required, but we recommend planning…
If you are currently using basic authentication for any of the above SAP SuccessFactors provisioning integrations, you must upgrade to workload identity-based authentication before November 2026 to ensure uninterrupted operation of the integrations.
No immediate action is required, but we recommend planning your migration early to avoid last-minute disruption.
The new method improves security by:
Eliminating stored passwords
Using short-lived, verifiable tokens
Aligning with SAP’s supported authentication model
A new authentication option will be available starting May 2026 in the SAP SuccessFactors provisioning apps to use Entra workload identity-based authentication instead of basic authentication. Customers can switch existing provisioning configurations from basic authentication to workload identity–based authentication directly through updated…
A new authentication option will be available starting May 2026 in the SAP SuccessFactors provisioning apps to use Entra workload identity-based authentication instead of basic authentication.
Customers can switch existing provisioning configurations from basic authentication to workload identity–based authentication directly through updated connectivity settings in the provisioning experience, without needing to recreate or restart their configuration.
This method removes the need to store long-lived credentials and uses a standards-based authentication method between Entra and SAP SuccessFactors through SAP Cloud Identity Services.
This capability applies to the following provisioning scenarios:
Beginning in July 2026, we will begin notifying customers through the M365 Message Center, Entra Connect Health, and targeted emails about their individual transition timelines. The transition will be rolled out in phases, and we will reach out directly to each organization…
Beginning in July 2026, we will begin notifying customers through the M365 Message Center, Entra Connect Health, and targeted emails about their individual transition timelines. The transition will be rolled out in phases, and we will reach out directly to each organization when their assigned transition window begins. This phased approach ensures that we can provide tailored guidance and support to all our customers.
Initial phases: In the first waves, we will focus on tenants for whom Entra Cloud Sync already meets all their identity synchronization needs. If your organization relies on advanced features or has a large directory, you will _not_ be among the initial targeted groups. We will prioritize early transitions for customers with straightforward configurations that are fully supported by Entra Cloud Sync’s current capabilities.
Subsequent phases: As Entra Cloud Sync’s capabilities expand, we will progressively notify the later groups and ensure they can transition successfully once equivalent support is available in Entra Cloud Sync
We are committed to supporting you by providing tooling and documentation for the transition to Entra Cloud Sync.
Once you migrate to Cloud Sync, your hybrid authentication features that enable on‑premises credentials to be used for accessing cloud resources will continue to be available after migration on the Connect Sync config wizard. Start preparing today We recommend that you take…
Once you migrate to Cloud Sync, your hybrid authentication features that enable on‑premises credentials to be used for accessing cloud resources will continue to be available after migration on the Connect Sync config wizard.
Start preparing today
We recommend that you take steps to begin your migration. You can begin familiarizing yourself with Entra Cloud Sync and review our dedicated resources to ensure a smooth transition:
Microsoft Entra supports Source of Authority (SOA) capabilities that allow you to shift user and group management to the cloud while continuing to operate existing Connect Sync deployments. These capabilities can help simplify environments, reduce long‑term dependency on on‑prem infrastructure, and improve readiness for future transitions. If this aligns with your identity strategy, the following resources may be helpful:
This change will roll out over the coming months, and timing will vary by application. We will share impacted applications, customer deadlines, and supporting documentation through monthly What’s new articles and the Microsoft 365 Message Center.
This change will roll out over the coming months, and timing will vary by application. We will share impacted applications, customer deadlines, and supporting documentation through monthly What’s new articles and the Microsoft 365 Message Center.
This update strengthens the security of Microsoft Entra provisioning integrations by moving away from older authentication patterns. Modern methods are better suited for service-to-service scenarios and can reduce credential management overhead, including the need to rotate shared secrets.
This update strengthens the security of Microsoft Entra provisioning integrations by moving away from older authentication patterns. Modern methods are better suited for service-to-service scenarios and can reduce credential management overhead, including the need to rotate shared secrets.
Microsoft Intune now supports Apple Declarative Device Management (DDM) for required line-of-business apps on devices running iOS/iPadOS 18 and later. By changing the management type to DDM in App information, you can deploy and configure apps using Apple's policy-based model, which improves…
Microsoft Intune now supports Apple Declarative Device Management (DDM) for required line-of-business apps on devices running iOS/iPadOS 18 and later. By changing the management type to DDM in App information, you can deploy and configure apps using Apple's policy-based model, which improves delivery efficiency, provides real-time app status, and expands per-app options such as associated domains.
Starting with the May 2026 Windows security update, hotpatch updates are enabled by default for all eligible devices managed through Windows Autopatch. Hotpatch updates install faster and require fewer restarts, helping devices get secure sooner. If your organization isn't ready for this…
Starting with the May 2026 Windows security update, hotpatch updates are enabled by default for all eligible devices managed through Windows Autopatch. Hotpatch updates install faster and require fewer restarts, helping devices get secure sooner.
If your organization isn't ready for this change, you can opt out using either of the following options:
Tenant-level setting: Opt out of hotpatch updates across all eligible devices in your tenant. This option becomes available April 1, 2026 in the Intune admin center.
Quality update policy: Control hotpatch behavior for a specific group of devices. Hotpatch settings configured in a quality update policy override the tenant-level setting for devices assigned to that policy.
Key dates:
April 1, 2026: Tenant-level opt-out setting available in the Intune admin center.
May 2026 security update: Hotpatch updates enabled by default.
For more information, see the Windows IT Pro Blog (https://aka.ms/HotpatchByDefault).
Device query for multiple devices now includes new capabilities to help you work with query results more efficiently. You can use a search text box to search across all resulting rows of a query, use column headers to add filters for specific…
Device query for multiple devices now includes new capabilities to help you work with query results more efficiently.
You can use a search text box to search across all resulting rows of a query, use column headers to add filters for specific values, and create Microsoft Entra security groups directly from a query's device results.
The Windows security baseline for Windows 11, version 25H2 is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations for supported Windows devices and is the latest available Windows security baseline in Intune. The Windows 11, version 25H2 security…
The Windows security baseline for Windows 11, version 25H2 is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations for supported Windows devices and is the latest available Windows security baseline in Intune.
The Windows 11, version 25H2 security baseline includes new settings, updated default values, retired settings, and revised security guidance. Existing security baseline profiles don't automatically update to the new version.
The following two settings aren't included in this baseline release and will be added in a future baseline update. Each change will be communicated to customers when available:
Disable Internet Explorer 11 launch via COM automation - This setting isn't included at release due to a known issue. The Windows client team is addressing the issue, and the setting will be added in a future baseline update.
Configure NetBIOS settings - This setting is pending availability in the Settings Catalog and will be added to the baseline in a future update.
We recommend carefully reviewing the settings in the new baseline before moving from a previous baseline version, especially if existing profiles include customizations.
The Microsoft Intune app for Linux now uses the Microsoft Identity Broker on supported Ubuntu and Red Hat Enterprise Linux (RHEL) distributions. Broker version 2.0.2 and later introduces a major architectural change from the previous Java-based broker. This update enables new single…
The Microsoft Intune app for Linux now uses the Microsoft Identity Broker on supported Ubuntu and Red Hat Enterprise Linux (RHEL) distributions. Broker version 2.0.2 and later introduces a major architectural change from the previous Java-based broker. This update enables new single sign-on (SSO) experiences using phish-resistant MFA, smart card authentication, and certificate-based authentication with Microsoft Entra ID. For more information, see Enabling Phish-Resistant MFA (PRMFA) on Linux devices.
There are new settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Configuration profiles > Create profile > Windows 10 and later > Settings catalog). The new policies include:…
There are new settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Configuration profiles > Create profile > Windows 10 and later > Settings catalog).
The new policies include:
Connectivity > Disable Cross Device Resume: This feature lets Windows suggest continuing an activity users start on a device, like a phone, to a PC. IT admins can use this policy to turn off this feature and prevent users from continuing tasks, like browsing files or continuing to use supported apps that require linking between a phone and PC.
When set to CrossDeviceResume is Disabled, the Windows device doesn't receive any CrossDeviceResume notification. Users won't see any "resume from your phone" prompts. When you select CrossDeviceResume is Enabled, the Windows device does receive notification to resume activity from linked devices. If you don't configure this policy setting, the default behavior is that the CrossDeviceResume feature is turned on, which means users see the notification. Changes to this policy take effect on reboot.
Windows AI > Remove Microsoft Copilot App: This policy setting allows you to uninstall the Microsoft Copilot app from devices. It applies to devices and users that meet the following conditions:
The Microsoft 365 Copilot and Microsoft Copilot apps are both installed.
The Microsoft Copilot app was not installed by the user.
The Microsoft Copilot app was not opened in the last 14 days.
If this policy is enabled, the Microsoft Copilot app is uninstalled. Users can still re-install if they choose to.
The following OEMConfig app is available in Intune for Android Enterprise: Inventus | com.inventus.oemconfig.gen For more information about OEMConfig, see Use and manage Android Enterprise devices with OEMConfig in Microsoft Intune.
The following OEMConfig app is available in Intune for Android Enterprise:
The Settings Catalog lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog. There are new settings in the…
The Settings Catalog lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog.
There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center], go to Devices > Manage devices > Configuration > Create > New policy > iOS/iPadOS or macOS for platform > Settings catalog for profile type.
The following protected apps are now available for Microsoft Intune: PerfectServe Clinical Collab by PerfectServe Synigo Pulse by Synigo B.V. DeepL for Intune by DeepL SE Foxit PDF Editor by Foxit Software Inc. EasyPlant QC Inspections by Technip Energies (Android) For more…
The following protected apps are now available for Microsoft Intune:
PerfectServe Clinical Collab by PerfectServe
Synigo Pulse by Synigo B.V.
DeepL for Intune by DeepL SE
Foxit PDF Editor by Foxit Software Inc.
EasyPlant QC Inspections by Technip Energies (Android)
On macOS devices, you can configure a recovery OS password that prevents users from booting company-owned devices into recovery mode, reinstalling macOS, and bypassing remote management. Admins can also rotate this password. There are two ways to use this feature: Settings catalog…
On macOS devices, you can configure a recovery OS password that prevents users from booting company-owned devices into recovery mode, reinstalling macOS, and bypassing remote management. Admins can also rotate this password.
There are two ways to use this feature:
Settings catalog policy - In a settings catalog policy, you can use the Recovery Lock settings to:
Turn on the recovery lock feature
Configure a password rotation schedule
Remote device action - Use the Recovery Lock device action to manually rotate the recovery lock password for a specific device.
The Recovery Lock password can be viewed in the per-setting status report > Passwords and keys. To view the Recovery Lock password, the signed-in administrator needs the Remote tasks/View macOS recovery lock password permission.
We've improved connectivity when using the Launch Remote Help capability in the Intune admin center for Windows devices. For the best experience, we recommend updating firewall rules to include this new endpoint: *.trouter.communications.svc.cloud.microsoft For the current list of required network endpoints, see…
We've improved connectivity when using the Launch Remote Help capability in the Intune admin center for Windows devices. For the best experience, we recommend updating firewall rules to include this new endpoint:
With this endpoint addition, we've also added a new Intune Management Extension log, NotificationInfra.log, which tracks notifications sent through the Microsoft real-time communication channel.
Intune now includes an opt-in preview to enable Scoped permissions, making your role-based access control (RBAC) configuration more precise. Enabling Scoped permissions is a one-time choice that can't be undone. In the future, this will become the default behavior for all tenants.…
Intune now includes an opt-in preview to enable Scoped permissions, making your role-based access control (RBAC) configuration more precise. Enabling Scoped permissions is a one-time choice that can't be undone. In the future, this will become the default behavior for all tenants.
Previously, when an admin had multiple role assignments using different scope tags for the same permission category, Intune merged permissions across those assignments, which could unintentionally grant broader access than intended. With Scoped permissions enabled, each role assignment's permissions apply only within its own scope tag context, so admins receive exactly the access you intended.
To help you prepare before enabling this change, Intune includes a new Permissions Assessment Report. The report details your tenant's current permissions and shows how they will change after enabling Scoped permissions. You can rerun the report as often as needed, adjust role assignments, and communicate any changes to affected admins before opting in.
All authenticated users can now access Support Assistant in the Intune admin center to find solutions and troubleshooting guidance. Creating and managing support tickets still requires a Microsoft Entra role that includes the microsoft.office365.supportTickets permission. For more information, see How to get…
All authenticated users can now access Support Assistant in the Intune admin center to find solutions and troubleshooting guidance. Creating and managing support tickets still requires a Microsoft Entra role that includes the microsoft.office365.supportTickets permission. For more information, see How to get support in the Microsoft Intune admin center.
Microsoft Intune supports Red Hat Enterprise Linux (RHEL) 9 LTS and RHEL 10 LTS. Support for RHEL 8 LTS will end in July 2026. Devices already enrolled on RHEL 8 will remain enrolled. You can identify devices running RHEL 8 in the…
Microsoft Intune supports Red Hat Enterprise Linux (RHEL) 9 LTS and RHEL 10 LTS. Support for RHEL 8 LTS will end in July 2026. Devices already enrolled on RHEL 8 will remain enrolled. You can identify devices running RHEL 8 in the Intune admin center by going to Devices > All devices, filtering OS by Linux, and adding OS version columns. Notify users to upgrade their devices to a supported RHEL version. For more information about enrolling Linux devices, see Enrollment guide: Enroll Linux desktop devices in Microsoft Intune.
Devices configured with system-level (WinHTTP) proxy settings can now send telemetry to endpoint analytics and Advanced Analytics, enabling more comprehensive reporting. Endpoint Privilege Management (EPM) will also include elevation usage data from these devices. No admin action is required. If endpoint analytics…
Devices configured with system-level (WinHTTP) proxy settings can now send telemetry to endpoint analytics and Advanced Analytics, enabling more comprehensive reporting. Endpoint Privilege Management (EPM) will also include elevation usage data from these devices.
No admin action is required. If endpoint analytics or EPM is enabled for a device, telemetry and events will automatically appear in the User Experience (Device blade), endpoint Analytics reports, and EPM.
For more details about displaying advanced proxy settings, see Netsh.exe commands.
Connect Microsoft 365 Copilot to Asana with a Copilot connector so you can query projects and tasks from within Microsoft 365. Roadmap ID: 515175 Details: What changed: Microsoft 365 Copilot now supports an Asana Copilot connector that can index Asana tasks for…
Connect Microsoft 365 Copilot to Asana with a Copilot connector so you can query projects and tasks from within Microsoft 365.
What changed: Microsoft 365 Copilot now supports an Asana Copilot connector that can index Asana tasks for use in Microsoft 365 Copilot and Microsoft Search.
Why: This change helps people access project and task information in the flow of work.
Try this:
Connect Microsoft 365 Copilot to Asana with a Copilot connector.
Ask Copilot to summarize tasks and deadlines across projects.
Ask Copilot to list overdue tasks in a project.
Why this matters:
Business impact: Improves project tracking by bringing Asana task data into Microsoft 365 Copilot and search experiences.
Personal impact: Helps you stay on top of tasks without switching tools.
Microsoft Copilot (Microsoft 365) can now connect to Smartsheet so users can work with collaborative projects and tasks through a Copilot connector. Details: What changed: A new Copilot connector allows Microsoft 365 Copilot to access project and task information stored in Smartsheet.…
Microsoft Copilot (Microsoft 365) can now connect to Smartsheet so users can work with collaborative projects and tasks through a Copilot connector.
Details:
What changed: A new Copilot connector allows Microsoft 365 Copilot to access project and task information stored in Smartsheet.
Why: Many teams manage collaborative projects in Smartsheet and want Copilot to reference that information without switching tools.
Try this:
Configure the Smartsheet Copilot connector for your organization.
Ask Copilot to find, summarize, or reference projects and tasks stored in Smartsheet.
Why this matters:
Business impact: Enables teams to work with Smartsheet project data directly in Copilot workflows, improving visibility and coordination.
Personal impact: Helps individuals understand project status and tasks more quickly using Copilot.
Users can connect Microsoft 365 Copilot with Egnyte to collaborate on secure file storage using the Copilot Connector. Roadmap ID: 513283 Details: What changed: Copilot can now access files stored in Egnyte, allowing users to retrieve, summarize, and interact with content without…
Users can connect Microsoft 365 Copilot with Egnyte to collaborate on secure file storage using the Copilot Connector.
What changed: Copilot can now access files stored in Egnyte, allowing users to retrieve, summarize, and interact with content without manually opening those files.
Why: This integration supports organizations that rely on Egnyte for secure file storage and governance.
Try this:
Ask Copilot to summarize a document stored in Egnyte.
Retrieve key insights from Egnyte folders.
Request a list of recent Egnyte updates relevant to your team.
Why this matters:
Business impact: Supports secure and compliant integration with existing file storage systems.
Personal impact: Helps users quickly access and understand stored content.
Users can connect Microsoft 365 Copilot with Zendesk Help Center to retrieve support articles and FAQs using the Copilot Connector. Roadmap ID: 513279 Details: What changed: Copilot can now search and summarize content from Zendesk Help Center, including help articles, troubleshooting steps,…
Users can connect Microsoft 365 Copilot with Zendesk Help Center to retrieve support articles and FAQs using the Copilot Connector.
Copilot Chat now recommends relevant installed agents when it detects a match with the user's intent. Details: What changed: When a user's prompt aligns with the capabilities of an installed agent, Copilot Chat will suggest that agent directly in the conversation. Previously,…
Copilot Chat now recommends relevant installed agents when it detects a match with the user's intent.
Details:
What changed: When a user's prompt aligns with the capabilities of an installed agent, Copilot Chat will suggest that agent directly in the conversation. Previously, users had to know which agent to invoke.
Why: This helps users discover and use the right agent at the right time, improving task completion and reducing friction.
Try this:
Ask Copilot Chat to perform a task that aligns with one of your installed agents.
Select the recommended agent when it appears in the chat.
Continue the conversation using the agent's specialized capabilities.
Why this matters:
Business impact: Increases utilization of installed agents and improves workflow efficiency.
Personal impact: Makes it easier to find the right tool without remembering agent names.
Roadmap ID: 413718 Delegates with calendar access can now search for another user's meetings directly in Copilot Chat. Details: What changed: Delegates can use Copilot Chat to search for meetings on behalf of the person whose calendar they manage. Previously, this required…
Delegates with calendar access can now search for another user's meetings directly in Copilot Chat.
Details:
What changed: Delegates can use Copilot Chat to search for meetings on behalf of the person whose calendar they manage. Previously, this required manual navigation in Outlook.
Why: This update streamlines workflows and reduces time spent searching across calendars.
Try this:
In Copilot Chat, ask for upcoming calendar planning meetings for the person whose calendar you manage.
Search for specific meeting details, such as attendees or topics
Why this matters:
Business impact: Improves efficiency for executive assistants and teams with shared calendar planning responsibilities.
Personal impact: Saves time by making calendar searches faster and more intuitive.
Admins can now set up authentication for Gong, GitHub, and Monday connectors using a simplified, faster OAuth experience. Details: What changed: The connector setup flow now uses a streamlined OAuth process that replaces lengthy manual steps. Admins can complete authentication in minutes…
Admins can now set up authentication for Gong, GitHub, and Monday connectors using a simplified, faster OAuth experience.
Details:
What changed: The connector setup flow now uses a streamlined OAuth process that replaces lengthy manual steps. Admins can complete authentication in minutes instead of hours.
Why: This update reduces friction for IT teams and aligns connector setup with modern authentication standards.
Try this:
Open the Microsoft 365 admin center and start configuring one of the supported connectors.
Follow the guided OAuth prompts to complete authentication.
Review your connector list to confirm the setup is complete.
Why this matters:
Business impact: Reduces setup time and administrative overhead for connector deployment.
Personal impact: Makes it easier for admins to configure connectors confidently and quickly.
All guided scenarios except Windows 365 Boot are removed from the Microsoft Intune admin center. You can no longer access the guided scenario wizards, but any Intune objects previously created by these wizards remain available and manageable. The Windows 365 Boot guided…
All guided scenarios except Windows 365 Boot are removed from the Microsoft Intune admin center. You can no longer access the guided scenario wizards, but any Intune objects previously created by these wizards remain available and manageable. The Windows 365 Boot guided scenario remains available from the Windows 365 overview page in the Intune admin center. No action is required.
For alternative step-by-step guidance, see the following resources:
Connect Microsoft 365 Copilot to Bitbucket with Copilot connectors so you can query pull requests and related engineering context. Roadmap ID: 515163 Details: What changed: Microsoft 365 Copilot now supports a Bitbucket Pull Request Copilot connector that brings pull request information into…
Connect Microsoft 365 Copilot to Bitbucket with Copilot connectors so you can query pull requests and related engineering context.
What changed: Microsoft 365 Copilot now supports a Bitbucket Pull Request Copilot connector that brings pull request information into Microsoft 365 Copilot and Microsoft Search.
Why: This change helps teams find pull request details through Microsoft 365 tools they already use.
Try this:
Connect Microsoft 365 Copilot to Bitbucket with a Copilot connector.
Ask Copilot to find pull requests related to a repository or feature.
Ask Copilot to summarize the discussion and status of a pull request.
Why this matters:
Business impact: Surfaces pull request context in Microsoft 365 Copilot to speed up collaboration and reviews.
Personal impact: Makes it easier to understand a pull request without switching apps.
Connect Microsoft 365 Copilot to Coda with Copilot connectors so you can query collaborative documents and wikis from Copilot. Roadmap ID: 515165 Details: What changed: Microsoft 365 Copilot now supports a Coda Enterprise Copilot connector that can index Coda documents and pages…
Connect Microsoft 365 Copilot to Coda with Copilot connectors so you can query collaborative documents and wikis from Copilot.
What changed: Microsoft 365 Copilot now supports a Coda Enterprise Copilot connector that can index Coda documents and pages for use in Microsoft 365 Copilot and Microsoft Search.
Why: This change helps people find knowledge stored in Coda without leaving Microsoft 365.
Try this:
Connect Microsoft 365 Copilot to Coda with a Copilot connector.
Ask Copilot to summarize content in a Coda workspace.
Ask Copilot to retrieve the URL for a specific Coda document.
Why this matters:
Business impact: Improves knowledge discovery by making Coda content available in Microsoft 365 Copilot and Microsoft Search.
Personal impact: Makes it easier to get answers from Coda docs and wikis using natural language.
Connect Microsoft 365 Copilot to GitLab with Copilot connectors so you can query merge requests and related repository activity. Roadmap ID: 515162 Details: What changed: Microsoft 365 Copilot now supports GitLab merge request connectors, making merge request information discoverable and retrievable in…
Connect Microsoft 365 Copilot to GitLab with Copilot connectors so you can query merge requests and related repository activity.
What changed: Microsoft 365 Copilot now supports GitLab merge request connectors, making merge request information discoverable and retrievable in Microsoft 365 Copilot and Microsoft Search.
Why: This change reduces context switching by bringing merge request information into Microsoft 365 workflows.
Try this:
Connect Microsoft 365 Copilot to GitLab with a Copilot connector.
Ask Copilot to list open merge requests waiting for review.
Ask Copilot to summarize merge requests targeting a release branch.
Why this matters:
Business impact: Improves visibility into engineering work by bringing merge request context into Microsoft 365 experiences.
Personal impact: Helps you find and summarize merge requests faster using natural language.
We're introducing a new Scatter image effect that helps users quickly apply a modern, stylized look to AI-generated or uploaded images. Roadmap ID: 537288 Details: What changed: The image editor in Copilot Chat and the Create module now includes a Scatter effect.…
We're introducing a new Scatter image effect that helps users quickly apply a modern, stylized look to AI-generated or uploaded images.
What changed: The image editor in Copilot Chat and the Create module now includes a Scatter effect. This effect adds a dynamic, dispersed visual style to images, giving users more creative options than before.
Why: Users asked for more built-in creative effects to help them produce unique visuals without needing external editing tools.
Try this:
Generate an image in Chat, click the image to open Editor and apply the Scatter effect to give it a more artistic look.
Use the Scatter effect in the Create module to enhance visuals for presentations or social posts.
Why this matters:
Business impact: Expands creative capabilities directly within Microsoft 365 workflows, reducing the need for third-party tools.
Personal impact: Makes it easier to create visually distinctive images with minimal effort.
Connect Microsoft 365 Copilot to Aha! with Copilot connectors so you can query product features and customer ideas in Copilot. Roadmap ID: 515159 Details: What changed: Microsoft 365 Copilot now supports an Aha! Copilot connector that can index Aha! features and ideas…
Connect Microsoft 365 Copilot to Aha! with Copilot connectors so you can query product features and customer ideas in Copilot.
What changed: Microsoft 365 Copilot now supports an Aha! Copilot connector that can index Aha! features and ideas and make them discoverable through Microsoft 365 Copilot and Microsoft Search.
Why: This change helps product and engineering teams find roadmap and feedback context in Microsoft 365 workflows.
Try this:
Connect Microsoft 365 Copilot to Aha! with a Copilot connector.
Ask Copilot to list features assigned to you in Aha!.
Ask Copilot to show ideas with the highest number of votes.
Why this matters:
Business impact: Improves cross-team alignment by making Aha! roadmap and feedback content easier to find in Microsoft 365.
Personal impact: Helps you answer product questions faster without leaving Microsoft 365.
You can now generate a file summary with Copilot and include it directly when sharing OneDrive files in Windows. Roadmap ID: 527840 Details: What changed: A new option in File Explorer and the OneDrive Activity Center lets you summarize a file with…
You can now generate a file summary with Copilot and include it directly when sharing OneDrive files in Windows.
What changed: A new option in File Explorer and the OneDrive Activity Center lets you summarize a file with Copilot and send that summary within the share dialog. Previously, users needed to create summaries separately before sharing.
Why: Sharing a file often means the recipient has to open it just to understand what it's about. Now, Copilot generates a summary for you so the people you share with get the key points upfront, right in the share notification.
Try this:
Open File Explorer and select a file stored in OneDrive.
Choose Share, then select the option to generate a Copilot summary.
Send the file along with the summary to your recipient.
Open OneDrive activity center and select a file.
Choose Share, then select the option to generate a Copilot summary.
Send the file along with the summary to your recipient.
Why this matters:
Business impact: Your recipients can quickly decide if a file needs their attention without opening it first. Whether you're sharing a proposal, report, or meeting notes, the summary gives everyone the context they need to act faster.
Personal impact: Makes it easier to communicate key points without extra steps.
Two new Copilot actions-Summarize and Explain-are now available in the Microsoft Edge PDF reader to help users understand content faster. Roadmap ID: 498641 Details: What changed: The built in PDF reader now includes Summarize and Explain options alongside the existing Ask Copilot…
Two new Copilot actions-Summarize and Explain-are now available in the Microsoft Edge PDF reader to help users understand content faster.
What changed: The built in PDF reader now includes Summarize and Explain options alongside the existing Ask Copilot integration. Users can generate overviews or simplify complex text directly within the PDF experience.
Why: These additions help users quickly interpret long or complex documents without leaving the PDF reader.
Try this:
Open a PDF in Microsoft Edge and select Summarize to get a concise overview.
Highlight a section of text and choose Explain to simplify technical or dense content.
Use these actions to prepare for meetings or review documents more efficiently.
Why this matters:
Business impact: Improves document review workflows and reduces time spent interpreting complex PDFs.
Personal impact: Helps users understand information more quickly and with less effort.
Connect Microsoft 365 Copilot to GitLab Issues with Copilot connectors so you can query engineering tasks and bugs from Copilot. Roadmap ID: 515158 Details: What changed: Microsoft 365 Copilot now supports GitLab Issues connectors that can index issue data and make it…
Connect Microsoft 365 Copilot to GitLab Issues with Copilot connectors so you can query engineering tasks and bugs from Copilot.
What changed: Microsoft 365 Copilot now supports GitLab Issues connectors that can index issue data and make it available in Microsoft 365 Copilot and Microsoft Search.
Why: This change helps teams retrieve issue details, assignments, and context without leaving Microsoft 365 workflows.
Try this:
Connect Microsoft 365 Copilot to GitLab Issues with a Copilot connector.
Ask Copilot to summarize high-priority issues for a release milestone.
Ask Copilot to list blocked issues and their owners.
Why this matters:
Business impact: Improves visibility into work tracking by surfacing GitLab issues in Microsoft 365 Copilot.
Personal impact: Makes it easier to find issue context and stay on top of tasks using natural language.
We've improved the update and reporting experience for Remote Help on macOS to make version management more reliable and transparent for IT admins. After you deploy the latest Remote Help client (version 1.0.26012221) through Microsoft Intune, you can now view the full…
We've improved the update and reporting experience for Remote Help on macOS to make version management more reliable and transparent for IT admins.
After you deploy the latest Remote Help client (version 1.0.26012221) through Microsoft Intune, you can now view the full client version in your device inventory and during app upgrades. This improvement makes it easier to verify deployments. Remote Help installations deployed through Intune are also registered with Microsoft AutoUpdate (MAU), allowing Intune-managed macOS devices to automatically receive future Remote Help updates. For more information, see Deploy Remote Help with Microsoft Intune.
Microsoft Edge lets users send a search query from the address bar directly to Copilot to receive a synthesized, more targeted answer. Roadmap ID: 493287 Details: What changed: When users type a search query in the Microsoft Edge address bar, they can…
Microsoft Edge lets users send a search query from the address bar directly to Copilot to receive a synthesized, more targeted answer.
What changed: When users type a search query in the Microsoft Edge address bar, they can choose to ask Copilot instead of running a standard search, enabling Copilot to generate a focused response based on web content and, for eligible users, work content.
Why: Switching between search results and separate AI tools can interrupt workflow. This update allows users to move from intent to answer in one step, directly from the address bar.
Try this:
Type a question or topic in the Edge address bar and select Ask Copilot.
Use Copilot's response to quickly understand a topic before refining or acting on the result.
Why this matters:
Business impact: Helps teams find relevant information faster by combining search and AI responses in a single, policy-governed experience within Microsoft Edge.
Personal impact: Reduces time spent scanning search results by delivering clearer, synthesized answers directly from the address bar.
Users can connect Microsoft 365 Copilot to Amazon S3 so Copilot can access structured document repositories through a Copilot connector. Roadmap ID: 513285 Details: What changed: Microsoft 365 Copilot can now connect to Amazon S3 using a Copilot connector, which makes structured…
Users can connect Microsoft 365 Copilot to Amazon S3 so Copilot can access structured document repositories through a Copilot connector.
What changed: Microsoft 365 Copilot can now connect to Amazon S3 using a Copilot connector, which makes structured documents stored in S3 available in Copilot experiences.
Why: Many organizations store important documents in Amazon S3 and want Copilot to reference that content without moving or duplicating data.
Try this:
Configure the Amazon S3 Copilot connector for your organization.
Ask Copilot to find or summarize documents stored in connected Amazon S3 repositories.
Why this matters:
Business impact: Enables teams to access Amazon S3 content directly in Copilot workflows, reducing context switching and manual searches.
Personal impact: Helps individuals find and reference documents stored in Amazon S3 more quickly using natural language.
Users can connect Microsoft 365 Copilot with Shortcut to manage agile development workflows using the Copilot Connector. Roadmap ID: 515178 Details: What changed: Users can now integrate Shortcut as a data source for Microsoft 365 Copilot. This enables Copilot to retrieve, summarize,…
Users can connect Microsoft 365 Copilot with Shortcut to manage agile development workflows using the Copilot Connector.
What changed: Users can now integrate Shortcut as a data source for Microsoft 365 Copilot. This enables Copilot to retrieve, summarize, and assist with agile development tasks directly from Shortcut project data.
Why: Teams using Shortcut for product and engineering work can now bring their workflow data into Copilot to streamline task updates and planning. -- incorrect. find new.
Try this:
Open Copilot and ask for a summary of active Shortcut stories.
Request an overview of recent team progress pulled from Shortcut.
Use Copilot to identify blockers based on Shortcut task data.
Why this matters:
Business impact: Helps teams maintain visibility into engineering work without switching tools.
Personal impact: Makes daily task reviews faster and easier.
PowerPoint now includes the Designer Editor for image editing, giving you a modern, intuitive way to refine images directly on your slides without leaving PowerPoint. Details: What changed: You can now use PowerPoint's new AI-powered image editing capabilities to perform tasks such…
PowerPoint now includes the Designer Editor for image editing, giving you a modern, intuitive way to refine images directly on your slides without leaving PowerPoint.
Details:
What changed: You can now use PowerPoint's new AI-powered image editing capabilities to perform tasks such as improving image resolution, removing backgrounds, and moving image elements with generative AI-all directly within your presentation.
Why: Creating polished slides often requires quick image adjustments, and switching tools slows down the workflow. This change keeps image editing within PowerPoint so you can stay focused on your presentation.
Try this:
Select an image on a slide and open the Designer Editor to refine visuals directly in PowerPoint.
Remove distracting backgrounds from photos before placing them into layouts.
Add text annotations with cool text effects.
Why this matters:
Business impact: Helps teams create more polished presentations faster by reducing the need to switch tools for image editing.
Personal impact: Makes it easier to enhance slide visuals quickly, helping your presentations look more professional with less effort.
Edit with Copilot in Excel to build and change workbooks, using Excel tools like tables, charts, PivotTables, and formulas to complete complex data tasks faster. Roadmap IDs: 542182, 527835 Details: What changed: A new option is available in Copilot in Excel that…
Edit with Copilot in Excel to build and change workbooks, using Excel tools like tables, charts, PivotTables, and formulas to complete complex data tasks faster.
What changed: A new option is available in Copilot in Excel that enables you to edit your workbook through chat. You can use Copilot as an assistant to create and make changes by describing what you want to do through chat. Why: This change reduces the need to switch between manual steps and back-and-forth requests, which can help you move through data modeling and analysis with less effort.
Try this:
Open Copilot chat in Excel and see "Let's edit together" welcome message.
If you don't see the message, then go to the tools menu and select "Edit with Copilot".
Describe what you'd like to do in the chat. For example, "Build an expense tracking template, then add formulas for variance calculations."
Business impact: Helps teams complete complex models and reports faster by reducing manual steps in Excel workflows.
Personal impact: Saves you time by letting Copilot perform multi-step workbook updates while you stay focused on insights.
This update expands AI-powered skill inferencing to Microsoft 365 E3 and E5 users, helping organizations keep user profiles more accurate and up to date. Roadmap ID: 548643 Details: What changed: AI-powered skill inferencing, previously available only to Microsoft 365 Copilot and Microsoft…
This update expands AI-powered skill inferencing to Microsoft 365 E3 and E5 users, helping organizations keep user profiles more accurate and up to date.
What changed: AI-powered skill inferencing, previously available only to Microsoft 365 Copilot and Microsoft Viva licensed users, can now be enabled for Microsoft 365 E3 and E5 users. Admins can turn this capability on directly in the Microsoft 365 admin center. When enabled, AI automatically identifies and updates skills on users' Microsoft 365 profiles based on work activity from the Microsoft Graph. This control is available to tenants with Copilot licenses.
Why: Organizations asked for broader access to AI-powered skill updates so they could maintain more complete and accurate user profiles across their workforce. Expanding this capability helps teams surface expertise more easily and improves profile data quality.
Try this:
Open the Microsoft 365 admin center and review the People Skills settings.
Turn on AI-powered skill inferencing for Microsoft 365 E3 or E5 users.
Inform users that their profiles may begin updating automatically based on their work activity.
Why this matters:
Business impact: Improves organizational visibility into employee skills, making it easier to identify expertise and support workforce planning.
Personal impact: Helps users keep their profiles current without manual updates, making their expertise easier for colleagues to discover.
You can now search for and select Microsoft Teams channels in Context IQ to ground Copilot Chat prompts in the conversations and content that matter most. Roadmap ID: 429645 Details: What changed: Context IQ now allows you to search for and select…
You can now search for and select Microsoft Teams channels in Context IQ to ground Copilot Chat prompts in the conversations and content that matter most.
What changed: Context IQ now allows you to search for and select Microsoft Teams channels when creating prompts in Copilot Chat, so responses are grounded in a specific channel instead of across all Teams content.
Why: Users asked for more precise ways to focus Copilot Chat on relevant team conversations and reduce noise from unrelated channels.
Try this:
Open Copilot Chat and start a new prompt.
Use the Context IQ menu to search for and select a Teams channel.
Ask a question to get responses grounded in that channel's conversations.
Why this matters:
Business impact: Improves response relevance and reduces time spent searching across multiple Teams channels.
Personal impact: Makes it easier to get accurate, channel-specific answers without manual filtering.
Microsoft Edge expands its built-in PDF reader with new Copilot actions that help you quickly summarize or explain PDF content directly in the browser. Roadmap ID: 498641 Details: What changed: The existing Ask Copilot experience in the Microsoft Edge PDF reader now…
Microsoft Edge expands its built-in PDF reader with new Copilot actions that help you quickly summarize or explain PDF content directly in the browser.
What changed: The existing Ask Copilot experience in the Microsoft Edge PDF reader now includes two additional actions-Summarize and Explain-that let you generate a concise overview or simplify complex sections of a PDF or selected content. These actions follow the same enterprise controls and policies already applied to Copilot in Edge.
Why: Reviewing long or complex PDFs often requires extra time and context switching. This update makes it easier to understand key points or technical language without leaving the PDF reader or copying content into another tool.
Try this:
Open a PDF in Microsoft Edge and select Summarize to get a quick overview of the document.
Select a paragraph or section and choose Explain to simplify complex language or concepts.
Why this matters:
Business impact: Helps teams review documents faster and stay within existing enterprise controls while using Copilot in Edge.
Personal impact: Makes it easier to understand lengthy or technical PDFs without interrupting your workflow.
You can use assignment filters in policy assignments for DDM-based configurations, like software updates. This feature is rolling out slowly and should be available for all customers by late March 2026. To learn more about filters, see Use assignment filters to assign…
You can use assignment filters in policy assignments for DDM-based configurations, like software updates.
This feature is rolling out slowly and should be available for all customers by late March 2026.
Autopatch update readiness provides a unified experience for tracking and remediating Windows update issues across Intune-enrolled devices and Windows Autopatch group-enrolled devices. With a single dashboard, admins can view all managed devices, including enrollment status and policy assignments, to better understand update…
Autopatch update readiness provides a unified experience for tracking and remediating Windows update issues across Intune-enrolled devices and Windows Autopatch group-enrolled devices. With a single dashboard, admins can view all managed devices, including enrollment status and policy assignments, to better understand update readiness across their environment.
Key capabilities include:
Device update journey: View granular update states for each device to quickly identify where updates are blocked and why.
Centralized alerting: See actionable alerts for update failures, policy conflicts, and readiness gaps in one place, with integrated remediation guidance.
Update readiness checker: Proactively evaluate devices for deployment risks and flag devices as At Risk based on signals such as disk space, appraiser data, and setup conditions.
Repair devices with OS reinstall: Remediate upgrade‑blocked devices by triggering an OS reinstall for common issues like insufficient disk space or app compatibility problems, with supporting alerts and reporting.
With the release of iOS 26, iPadOS 26, and macOS 26, Apple has deprecated legacy mobile device management (MDM) software update commands and payloads. As a result, Microsoft Intune will soon end support for creating legacy iOS/iPadOS and macOS software update policies.…
With the release of iOS 26, iPadOS 26, and macOS 26, Apple has deprecated legacy mobile device management (MDM) software update commands and payloads. As a result, Microsoft Intune will soon end support for creating legacy iOS/iPadOS and macOS software update policies. To continue managing Apple software updates in Intune, configure update policies using Apple's declarative device management (DDM) model. DDM provides a more modern and reliable approach to managing software updates, with improved device autonomy and reporting.
Multi-administrator approval now supports device configuration policies created through the settings catalog and device compliance policies. When you turn on this feature, any changes you make, including creating, editing, or deleting a policy, must be approved by a second administrator before they…
Multi-administrator approval now supports device configuration policies created through the settings catalog and device compliance policies. When you turn on this feature, any changes you make, including creating, editing, or deleting a policy, must be approved by a second administrator before they take effect. This dual-authorization process helps protect your organization from unauthorized or accidental changes to role-based access control.
A new setting that affects the Microsoft Entra account registration experience on Windows is available in the Microsoft Intune admin center. The setting, Disable MDM enrollment when adding work or school account on Windows, controls whether devices enroll in MDM during the…
A new setting that affects the Microsoft Entra account registration experience on Windows is available in the Microsoft Intune admin center. The setting, Disable MDM enrollment when adding work or school account on Windows, controls whether devices enroll in MDM during the account registration flow. The default setting is set to No, which allows MDM enrollment. No action is required unless you want to change the default enrollment behavior. This Microsoft Entra setting is in preview. For more information, see Enable MDM automatic enrollment for Windows.
There are new settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Configuration profiles > Create profile > Windows 10 and later > Settings catalog). The new policies include:…
There are new settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Configuration profiles > Create profile > Windows 10 and later > Settings catalog).
The new policies include:
Microsoft Edge:
Control whether an informational webpage for Edge for Business is shown in the new tab after major browser updates: When Enabled or not configured, users with Microsoft Entra ID profiles see an informational page about new Edge for Business features after major browser updates. When Disabled, the informational page isn't shown to users.
This policy:
Applies only to Microsoft Entra ID profiles. It doesn't apply to Microsoft account (MSA) profiles.
Is available starting in Microsoft Edge version 144, which allows you to configure the setting before any version 145 changes.
Enable Silent Printing: When Enabled, Microsoft Edge automatically closes the print preview window and prints to the default printer using its default settings. If the default printer is Save as PDF, the file is saved to the user's Downloads folder. When Disabled or not configured, silent printing is disabled. The print preview window stays open, and the user must choose the print settings as usual.
Microsoft Edge > Content settings:
Allow precise geolocation on these sites: When Enabled, enter a list of URL patterns for sites that are allowed to access the user's high-accuracy geolocation without prompting for permission. When Disabled or not configured, the default geolocation setting applies to all sites (if configured) or the user's personal setting is used.
Block geolocation on these sites: When Enabled, enter a list of URL patterns for sites that are blocked from requesting or accessing the user's geolocation. These sites can't prompt the user for location permissions. When Disabled or not configured, the default geolocation setting applies to all sites (if configured) or the user's personal browser setting is used.
Enable Windows Restore: Choose to enable Windows Restore. When enabled, the restore process for a device can be initiated:
At the time of device enrollment during the out-of-box experience (OOBE), or
The first time a user signs in with their Microsoft Entra ID account after the device finishes enrolling.
It allows a user to restore their backed‑up Windows settings and Microsoft Store apps from the cloud to a new or reset device. It restores the user experience settings and configuration preferences. It's not a full system image. To learn more, see Windows Backup for Organizations overview.
Your options:
Windows Restore Not Configured
Windows Restore Enabled
This policy:
Was previously for Windows Insiders and is now generally available (GA).
The Settings Catalog lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog. There are new settings in the…
The Settings Catalog lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog.
There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center], go to Devices > Manage devices > Configuration > Create > New policy > iOS/iPadOS or macOS for platform > Settings catalog for profile type.
iOS/iPadOS
AirPlay:
Device Name
macOS
AirPlay:
Device Name
Microsoft Defender:
The Microsoft Defender category is updated with new settings. Learn more about available macOS Defender settings at Microsoft Defender - Policies.
The following protected apps are now available for Microsoft Intune: Jump by Accio Inc. Mijn InPlanning by Intus Workforce Solutions (Android) For more information about protected apps, see Microsoft Intune protected apps.
The following protected apps are now available for Microsoft Intune:
Jump by Accio Inc.
Mijn InPlanning by Intus Workforce Solutions (Android)
Device query for multiple devices now includes expanded operator support, clearer query validation, and improved results to make building and interpreting queries easier. New join types supported\ You can now use the following join types when querying across entities: leftsemi rightsemi leftanti…
Device query for multiple devices now includes expanded operator support, clearer query validation, and improved results to make building and interpreting queries easier.
New join types supported\ You can now use the following join types when querying across entities:
leftsemi
rightsemi
leftanti
rightanti
Updated join behavior\ Joins that use on Device.DeviceId are no longer supported. Queries should instead:
Use on Device, or
Omit the on clause entirely when joining on the device entity.
Updated device references in operators\ Using Device by itself is no longer supported in operators such as distinct, summarize, or order by. Queries must reference a specific device property.
Improved query results\ Queries that involve a device—either by querying a device directly or by joining a device with another entity—now return the device as a clickable link in the results, allowing you to quickly navigate to device details.
Clearer error messages\ Some query error messages have been updated to provide clearer, more descriptive guidance when queries are invalid.
When Users report Microsoft Teams messages from chats, channels (standard, shared, and private), and meeting conversations to Microsoft as malicious (security risk), up to fifteen messages before and after the reported message are shared for analysis.
When Users report Microsoft Teams messages from chats, channels (standard, shared, and private), and meeting conversations to Microsoft as malicious (security risk), up to fifteen messages before and after the reported message are shared for analysis.
We’re consolidating agent management experiences to make it easier to observe, govern, and secure all agents in your tenant. Agent 365 will be the single source of truth, offering a unified catalog, consistent visibility, and simplified management. What’s changing The Agent registry…
We’re consolidating agent management experiences to make it easier to observe, govern, and secure all agents in your tenant. Agent 365 will be the single source of truth, offering a unified catalog, consistent visibility, and simplified management.
What’s changing
The Agent registry and Agent collections blades in the Entra admin center will be retired on May 1, 2026.
Agent 365 becomes the unified registry and control plane for agents.
Microsoft Entra continues to provide the identity foundation through Agent ID.
The existing registry Graph API will be deprecated and replaced by a new API powered by Agent 365. Agents registered via the current API will need to be re-registered. We’ll follow up soon with details on the deprecation date and the availability of the new registry Graph API.
All agent access and governance capabilities remain fully available through Agent ID and Agent 365.
When you share a specific application window in a meeting, you and others can now directly annotate on that shared content without you sharing the entire desktop. To learn more, see Use annotation while sharing your screen in Microsoft Teams.
When you share a specific application window in a meeting, you and others can now directly annotate on that shared content without you sharing the entire desktop. To learn more, see Use annotation while sharing your screen in Microsoft Teams.
Use audit search to identify and collect content based on user activities recorded in the Microsoft Purview unified audit log, such as accessing, copying, or downloading files, and pull the associated content into your investigation.
Audit search in Data Security Investigations is now generally available. Use audit search to identify and collect content based on user activities recorded in the Microsoft Purview unified audit log, such as accessing, copying, or downloading files, and pull the associated content into your investigation.
When you chose to automatically apply a sensitivity label, you can now optionally choose to always overriding an existing label that has a lower priority label, even if it was manually applied. This option was previously available for emails only and now…
Auto-labeling policies introduce a new flow where you must decide whether to automatically apply a sensitivity label, or remove a label when the configured conditions apply for files in SharePoint and OneDrive. When you chose to automatically apply a sensitivity label, you can now optionally choose to always overriding an existing label that has a lower priority label, even if it was manually applied. This option was previously available for emails only and now extends to files in SharePoint and OneDrive.
Standard categorization can significantly reduce the time it takes to complete processing and the amount of Data Security Investigation Compute Units (compute unit) needed for categorization.
Categorization now includes a Standard and Advanced option. Standard categorization can significantly reduce the time it takes to complete processing and the amount of Data Security Investigation Compute Units (compute unit) needed for categorization.
Configurable Data Quality thresholds allows users to define minimum acceptable quality scores at the data quality rule and data asset levels to align quality evaluation with business criticality.
Configurable Data Quality thresholds allows users to define minimum acceptable quality scores at the data quality rule and data asset levels to align quality evaluation with business criticality.
Choose confidence-based or percentage-based sampling to add a statistically representative subset of search results instead of all items. Completing the Generate statistics process is required to enable sampling.
Configure sampling options when adding search results to a review set in eDiscovery. Choose confidence-based or percentage-based sampling to add a statistically representative subset of search results instead of all items. Completing the Generate statistics process is required to enable sampling.
We’re introducing cross-tenant group synchronization, a new capability that allows organizations to synchronize security groups across Microsoft Entra tenants. This feature enables centralized management of group membership in a source tenant while making those groups available in one or more target tenants,…
We’re introducing cross-tenant group synchronization, a new capability that allows organizations to synchronize security groups across Microsoft Entra tenants. This feature enables centralized management of group membership in a source tenant while making those groups available in one or more target tenants, simplifying cross-tenant collaboration and reducing administrative overhead associated with managing duplicate groups.
With cross-tenant group synchronization, organizations can extend their existing cross-tenant synchronization configurations to include groups, supporting scenarios such as shared application access, resource authorization, and consistent group-based access control across tenants. Admins can opt in to this functionality and configure attribute mappings and cross-tenant access policies to enable group synchronization into target tenants. Use of cross-tenant group synchronization requires Microsoft Entra ID Governance licenses. Existing licensing requirements for cross-tenant user synchronization features remains unchanged. For more information, see: What is cross-tenant synchronization?.
Choose what the Enter key does in a Teams chat by selecting Settings and more > Settings > Chats and Channels in Teams and choosing an option in When writing a message, press Enter to.
Choose what the Enter key does in a Teams chat by selecting Settings and more > Settings > Chats and Channels in Teams and choosing an option in When writing a message, press Enter to.
Soft purge moves items to the recoverable items folder, preserving the ability to restore items based on retention settings. Updated documentation includes guidance for choosing between soft purge and hard purge methods.
Data Security Investigations now supports soft purge for Exchange mailbox items. Soft purge moves items to the recoverable items folder, preserving the ability to restore items based on retention settings. Updated documentation includes guidance for choosing between soft purge and hard purge methods.
Investigators whose accounts are scoped by a compliance boundary only see search results for content locations within their permitted boundary.
Data Security Investigations searches now respect compliance boundaries configured with search permissions filters. Investigators whose accounts are scoped by a compliance boundary only see search results for content locations within their permitted boundary.
Now that container-level support for sensitivity labels include new collaborative workspaces such as Viva Engage communities and Loop workspaces, the previously titled article "Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 groups, and SharePoint sites" is now renamed Use…
Now that container-level support for sensitivity labels include new collaborative workspaces such as Viva Engage communities and Loop workspaces, the previously titled article "Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 groups, and SharePoint sites" is now renamed Use sensitivity labels to protect collaborative workspaces (groups and sites).
Build secure sign‑in and sign‑up experiences for applications in Entra External ID using Native Authentication, with Email and SMS OTP MFA available through developer‑friendly SDKs and APIs..
Build secure sign‑in and sign‑up experiences for applications in Entra External ID using Native Authentication, with Email and SMS OTP MFA available through developer‑friendly SDKs and APIs..
Scroll through images shared in a chat without distractions. The new Lightbox experience highlights the image you're viewing. Select Show message in the header to go right to the message the image was shared in.
Scroll through images shared in a chat without distractions. The new Lightbox experience highlights the image you're viewing. Select Show message in the header to go right to the message the image was shared in.
This new capability enables a Windows device to become Hybrid Entra joined immediately at provisioning time, without waiting for Entra Connect sync or requiring AD FS. By leveraging Entra Kerberos, customers can modernize their hybrid identity architecture while reducing infrastructure complexity and…
This new capability enables a Windows device to become Hybrid Entra joined immediately at provisioning time, without waiting for Entra Connect sync or requiring AD FS. By leveraging Entra Kerberos, customers can modernize their hybrid identity architecture while reducing infrastructure complexity and dependency on legacy federation components. For more information, see: Microsoft Entra hybrid join using Microsoft Entra Kerberos (preview).
Users can reported completed or missed one-to-one Microsoft Teams calls from the call history as malicious (scam) or non malicious (non-scam) to the specified reporting mailbox, or Microsoft and the reporting mailbox via user reported settings.
Users can reported completed or missed one-to-one Microsoft Teams calls from the call history as malicious (scam) or non malicious (non-scam) to the specified reporting mailbox, or Microsoft and the reporting mailbox via user reported settings.
Extend coverage of data insights to third-party SaaS and IaaS platforms by using Microsoft Sentinel with partner solutions to provide holistic data insights across Google Cloud Platform, Snowflake, and Databricks.
Extend coverage of data insights to third-party SaaS and IaaS platforms by using Microsoft Sentinel with partner solutions to provide holistic data insights across Google Cloud Platform, Snowflake, and Databricks.
New identity security capabilities help you monitor and manage identity security for human and non-human identities: (Preview) Identity Security dashboard: The Identity Security dashboard provides summary cards for identity providers, on-premises identities, SaaS identities, PAM and IGA integrations, and non-human identities. For…
New identity security capabilities help you monitor and manage identity security for human and non-human identities:
(Preview) Identity Security dashboard: The Identity Security dashboard provides summary cards for identity providers, on-premises identities, SaaS identities, PAM and IGA integrations, and non-human identities. For more information, see The Identity Security dashboard. The Identity Security dashboard is being rolled out gradually to customers, and might not yet be available in your organization.
(Preview) Coverage and maturity page: The Coverage and maturity page shows your organization's identity security coverage with maturity levels, including Connected, Protected, Fortified, and Resilient, and prioritized setup tasks. For more information, see Coverage and maturity. The Coverage and maturity page is being rolled out gradually to customers, and might not yet be available in your organization. If you don't see this feature in your environment yet, check back soon.
Identity inventory: The Identity inventory page now shows human and non-human identities in separate tabs. Insight cards help you classify critical assets, view highly privileged identities, identify critical Active Directory service accounts, and view cloud application accounts. For more information, see View the Identity inventory.
(Preview) Non-human identities: The Non-human identities tab shows non-human identities, including Microsoft Entra ID apps, Active Directory service accounts, Google Workspace apps, and Salesforce apps. For more information, see Identity inventory and Investigate non-human identities.
(Preview) Identity risk score: A new risk score for identities, ranging from 0 to 100, that indicates the likelihood of compromise and the potential impact based on criticality and privileged roles. The risk score is available in Microsoft Entra ID, where it can be used to inform conditional access policies and identity protection workflows. A new Risk score tab on the Identity page provides a detailed breakdown of the risk factors, including percentile comparison and risk trends. For more information, see Investigate an identity.
(Preview) Domain investigation page: The Domain investigation page shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more information, see Investigate a domain.
(Preview) Identity security recommendations: View recommendations from Active Directory, Microsoft Entra ID, SaaS applications, and supported non-Microsoft identity providers. For more information, see Identity security recommendations.
Starting in April 2026, the Authentication Methods Policy Update and Authentication Methods Policy Reset audit log activities has been updated to improve readability and clarity. Previously, audit logs included the full authentication methods policy payload in both the old and new values,…
Starting in April 2026, the Authentication Methods Policy Update and Authentication Methods Policy Reset audit log activities has been updated to improve readability and clarity. Previously, audit logs included the full authentication methods policy payload in both the old and new values, even when only a small number of settings were changed. With this update, audit log entries now surface only the specific properties that were modified, along with their corresponding old and new values.
Policy-wide updates—such as Registration Campaigns and System‑preferred authentication—may continue to include the full policy payload. The activity name and triggering events remain unchanged. This update affects formatting only and does not change policy behavior. For more information, see: Core Directory.
Just‑in‑Time Password Migration is now generally available in Microsoft Entra External ID. Customers can migrate user passwords securely at first sign‑in, allowing users to continue using their existing credentials without forced password resets. This enables a smoother transition from Azure AD B2C…
Just‑in‑Time Password Migration is now generally available in Microsoft Entra External ID.
Customers can migrate user passwords securely at first sign‑in, allowing users to continue using their existing credentials without forced password resets. This enables a smoother transition from Azure AD B2C or other identity providers while reducing migration risk and operational overhead.
This feature provides a centralized view for managing files and scripts used during live response sessions. Documentation: Library management for live response
Library management for live response is now generally available. This feature provides a centralized view for managing files and scripts used during live response sessions.
Because retention labels also support labeling at the section level, you might find it helpful to review the architecture diagram for retention policies and retention labels. To enable the support for sensitivity labels, SharePoint and OneDrive must already be enabled for sensitivity…
Microsoft Entra Backup and Recovery is a built-in solution to help restore your tenant after accidental changes or malicious updates. Always on by default, it automatically backs up critical directory objects — including users, groups, applications, service principals, managed identities, conditional Access…
Microsoft Entra Backup and Recovery is a built-in solution to help restore your tenant after accidental changes or malicious updates. Always on by default, it automatically backs up critical directory objects — including users, groups, applications, service principals, managed identities, conditional Access policies, named locations, agent IDs, and authentication and authorization policy, so admins can quickly restore them to a previously known good state.
At preview, Entra Backup and Recovery automatically takes daily backup of a tenant’s supported directory objects. If a tenant has Microsoft Entra ID P1 or P2 licenses, one backup is taken each day and retained for five days. Admins can view available snapshots, generate difference reports to understand what has changed, and run recovery jobs to restore objects to a prior state.
This gives your organization a reliable, built in safety net helping you recover with confidence, minimize downtime, and protect your tenant from accidental changes, misconfigurations, or security compromises. For more information, see: Microsoft Entra Backup and Recovery overview (Preview).
We’ve completed a full migration to TLS 1.2 for Entra Connect Health and removed legacy TLS 1.1 references as part of security hardening. Ensure your Health agents are up to date and your servers are configured to use TLS 1.2 for outbound…
We’ve completed a full migration to TLS 1.2 for Entra Connect Health and removed legacy TLS 1.1 references as part of security hardening. Ensure your Health agents are up to date and your servers are configured to use TLS 1.2 for outbound connections.
Why this matters TLS 1.1 is deprecated due to security vulnerabilities. This change helps protect agent-to-service communication and aligns with modern compliance expectations.
What you need to do Ensure your Entra Connect Health agents are up to date and that your servers are configured to use TLS 1.2 for outbound connections.
This feature allows users to register device‑bound passkeys directly in the local Windows Hello container and use them to sign in to Microsoft Entra ID with Windows Hello biometrics or PIN. Entra passkeys on Windows behave as standard FIDO2 credentials and can…
Microsoft Entra passkeys on Windows are now available in public preview. This feature allows users to register device‑bound passkeys directly in the local Windows Hello container and use them to sign in to Microsoft Entra ID with Windows Hello biometrics or PIN.
Entra passkeys on Windows behave as standard FIDO2 credentials and can be used for Entra authentication flows without requiring the device to be Microsoft Entra joined or registered. During public preview, the feature is opt‑in and requires explicit configuration through passkey profiles to allow Windows Hello as a passkey provider. For more information, see: How to enable passkeys (FIDO2) in Microsoft Entra ID
The major improvements that this release provides includes: Enables authentication using CBA/YubiKey with certificate (PRMFA) Removes dependency on Java runtime as part of the Intune install Improved performance and reliability when authenticating to EntraId Provides device trust using Entra Join instead of…
The major improvements that this release provides includes:
Enables authentication using CBA/YubiKey with certificate (PRMFA)
Removes dependency on Java runtime as part of the Intune install
Improved performance and reliability when authenticating to EntraId
Provides device trust using Entra Join instead of Entra Registration
Increased stability and performance for authentication requests
Audio recap for Teams meetings now generates summaries in Chinese, English (multiple variations), French, German, Italian, Japanese, Portuguese, and Spanish. To learn more, see Listen to audio recaps of your meetings.
Audio recap for Teams meetings now generates summaries in Chinese, English (multiple variations), French, German, Italian, Japanese, Portuguese, and Spanish. To learn more, see Listen to audio recaps of your meetings.
We’re improving the Microsoft 365 group creation experience in My Groups to give group owners more control and clarity from the start. The updated experience lets you configure key group, email, and security settings during creation—so your group works the way you…
We’re improving the Microsoft 365 group creation experience in My Groups to give group owners more control and clarity from the start. The updated experience lets you configure key group, email, and security settings during creation—so your group works the way you expect without extra admin help later.
With this update, you can:
Set group usage guidelines, email alias, and sensitivity labels
Configure Exchange settings such as sending welcome emails, subscribing members to conversations, and showing the group mailbox and calendar in Outlook
Control who can send email to the group, hide the group from the global address list, and allow or block external senders
Enable security group functionality when needed
This streamlined, self‑service experience helps ensure your group is created with the right defaults and policies from day one. We are rolling out to all tenants by end of March.
Microsoft Secure Score now includes new recommendations to help organizations reduce exposure to common attack techniques involving remote access and authentication relay attacks: - Block file transfer over RDP: Restricts file transfer capabilities in Remote Desktop Protocol (RDP) sessions. This helps prevent…
Microsoft Secure Score now includes new recommendations to help organizations reduce exposure to common attack techniques involving remote access and authentication relay attacks: - Block file transfer over RDP: Restricts file transfer capabilities in Remote Desktop Protocol (RDP) sessions. This helps prevent attackers from using RDP sessions to transfer malicious files into the environment or exfiltrate sensitive data. - SMB server security hardening against authentication relay attacks: Helps protect servers from credential relay attacks by strengthening Server Message Block (SMB) authentication protections, including enforcing Extended Protection for Authentication (EPA), SMB signing, and SMB encryption to ensure authentication integrity and protect SMB traffic from tampering or interception.
Categorization uses relevance scoring to prioritize the most relevant content for each selected category. Updated documentation includes considerations for results, content volume effects, and recommendations for using examination tools for comprehensive analysis.
New guidance for how categorization processes data in Data Security Investigations. Categorization uses relevance scoring to prioritize the most relevant content for each selected category. Updated documentation includes considerations for results, content volume effects, and recommendations for using examination tools for comprehensive analysis.
The Data Security Posture agent (preview) in Data Security Investigations helps your organization proactively surface credentials buried in data across your organization at scale.
New support for the Data Security Posture Agent in Microsoft Purview. The Data Security Posture agent (preview) in Data Security Investigations helps your organization proactively surface credentials buried in data across your organization at scale.
Our newly designed org chart in profile cards streamlines navigation through reporting relationships, recently viewed profiles, and more. Select Navigate to org chart in someone's profile card to get started.
Our newly designed org chart in profile cards streamlines navigation through reporting relationships, recently viewed profiles, and more. Select Navigate to org chart in someone's profile card to get started.
The Conditional Access Optimization Agent now supports passkey adoption campaigns in public preview, helping organizations roll out phishing‑resistant authentication in a structured and automated way. With this capability, the agent can assess user and device readiness, generate a recommended deployment plan, guide…
The Conditional Access Optimization Agent now supports passkey adoption campaigns in public preview, helping organizations roll out phishing‑resistant authentication in a structured and automated way.
With this capability, the agent can assess user and device readiness, generate a recommended deployment plan, guide users through required steps, and automatically enforce Conditional Access policies once users are ready. Campaigns progress continuously as prerequisites are met, reducing manual effort for large‑scale passkey rollouts.
Passkey adoption campaigns are managed directly from the Microsoft Entra admin center and are currently targeted at privileged administrator roles. The agent creates Conditional Access policies in report‑only mode first, allowing administrators to monitor impact before enforcement. For more information, see: Deploy passkey adoption campaigns with the Conditional Access Optimization Agent (Preview)
Passkey profiles provide a structured way to manage passkey (FIDO2) authentication by allowing administrators to define multiple profiles with different requirements and target them to specific user groups. Each profile can specify allowed passkey types, attestation requirements, and authenticator restrictions, enabling differentiated…
Passkey profiles in Microsoft Entra ID are now generally available. Passkey profiles provide a structured way to manage passkey (FIDO2) authentication by allowing administrators to define multiple profiles with different requirements and target them to specific user groups.
Each profile can specify allowed passkey types, attestation requirements, and authenticator restrictions, enabling differentiated policies for scenarios such as administrators versus standard users. For tenants that previously configured passkeys, existing settings are migrated into a default passkey profile. For more information, see: How to enable passkeys (FIDO2) in Microsoft Entra ID.
Quickly assess which personal data types were exposed after a data security incident, including names, email addresses, financial account numbers, and Social Security numbers, with severity classification and AI-generated reasoning to support regulatory compliance reporting.
Personal data examinations in Data Security Investigations identify and extract personally identifiable information from selected data items in an investigation scope. Quickly assess which personal data types were exposed after a data security incident, including names, email addresses, financial account numbers, and Social Security numbers, with severity classification and AI-generated reasoning to support regulatory compliance reporting.
You can now use the Conditional Access Optimization Agent to safely roll out _any_ report‑only Conditional Access policy in phases. When you initiate the process, the agent analyzes sign‑in data to recommend a low‑risk, staged deployment plan, starting with smaller user groups…
You can now use the Conditional Access Optimization Agent to safely roll out _any_ report‑only Conditional Access policy in phases. When you initiate the process, the agent analyzes sign‑in data to recommend a low‑risk, staged deployment plan, starting with smaller user groups and gradually expanding, so you can turn policies on with confidence and minimize user impact. For more information, see: Conditional Access Optimization Agent phased rollout.
The proactive user containment (contain user) action as part of the predictive shielding feature is now generally available. This action infuses activity data with exposure data to identify exposed credentials at risk of being compromised and reused to conduct malicious activity. Documentation:…
The proactive user containment (contain user) action as part of the predictive shielding feature is now generally available. This action infuses activity data with exposure data to identify exposed credentials at risk of being compromised and reused to conduct malicious activity.
This feature allows admins to discover related tenants connected to their own by B2B activity or shared billing information. Admins can use this information to request and establish tenant governance relationships, or to quarantine potential risks. For more information, see: Microsoft Entra…
This feature allows admins to discover related tenants connected to their own by B2B activity or shared billing information. Admins can use this information to request and establish tenant governance relationships, or to quarantine potential risks. For more information, see: Microsoft Entra tenant governance documentation (preview).
SCIM 2.0 APIs give customers, developers, and partners a standards-based option for managing users and groups in Microsoft Entra using the System for Cross-domain Identity Management (SCIM) 2.0 specification. For more information, see: Enable Microsoft Entra SCIM 2.0 APIs.
SCIM 2.0 APIs give customers, developers, and partners a standards-based option for managing users and groups in Microsoft Entra using the System for Cross-domain Identity Management (SCIM) 2.0 specification. For more information, see: Enable Microsoft Entra SCIM 2.0 APIs.
Permissioned users can now create add-on tenants that are owned and governed by their home tenant. Governance is established through tenant governing relationships, granting admins access and control via GDAP. For more information, see: Microsoft Entra tenant governance documentation (preview).
Permissioned users can now create add-on tenants that are owned and governed by their home tenant. Governance is established through tenant governing relationships, granting admins access and control via GDAP. For more information, see: Microsoft Entra tenant governance documentation (preview).
Now, Teams automatically manages permissions so you can collaborate in shared files and Loop components with people outside your org. To learn more, see Collaborate on files in Microsoft Teams.
Now, Teams automatically manages permissions so you can collaborate in shared files and Loop components with people outside your org. To learn more, see Collaborate on files in Microsoft Teams.
Microsoft Entra ID now supports synced passkeys as a generally available authentication method. Synced passkeys are FIDO2-based credentials that can be stored in built-in or third-party passkey providers and made available across a user’s devices. Administrators can manage the use of synced…
Microsoft Entra ID now supports synced passkeys as a generally available authentication method. Synced passkeys are FIDO2-based credentials that can be stored in built-in or third-party passkey providers and made available across a user’s devices. Administrators can manage the use of synced passkeys alongside device-bound passkeys through passkey profiles in the authentication methods policy. Existing passkey configurations can be managed using the same Entra ID authentication policies and reporting surfaces. For more information, see: How to enable passkeys (FIDO2) in Microsoft Entra ID.
Tenant Configuration Management APIs allow organizations to take snapshots of their tenants' current configuration settings in a JSON format and to enforce configuration settings by offering continuous monitoring of drifts. For more information see Overview of the Tenant Configuration Management APIs.
Tenant Configuration Management APIs allow organizations to take snapshots of their tenants' current configuration settings in a JSON format and to enforce configuration settings by offering continuous monitoring of drifts.
Now you can use the Entra admin center to administer tenant configuration management capabilities of Entra tenant governance. You can use this experience to: Create and update monitors that enable you to define the desired state of resources in your tenant across…
Now you can use the Entra admin center to administer tenant configuration management capabilities of Entra tenant governance. You can use this experience to:
Create and update monitors that enable you to define the desired state of resources in your tenant across a range of Microsoft services, and monitor the actual state of those resources relative to the desired state on an ongoing basis
See reports of monitor results, and details of any configuration drifts identified by the configuration management service when it runs a monitor that you defined.
Manage permission for the configuration management service to monitor resources in your tenant, by assigning app permissions or Entra roles.
This feature allows admins to request and accept tenant governance relationships, which grant admins of the governing tenant access and administrative control over the governed tenant. For more information, see: Microsoft Entra tenant governance documentation (preview).
This feature allows admins to request and accept tenant governance relationships, which grant admins of the governing tenant access and administrative control over the governed tenant. For more information, see: Microsoft Entra tenant governance documentation (preview).
The agent summary tab in the Triage Agent in Insider Risk Management has been enhanced to intelligently distill user activity risk into meaningful risk pattern narratives, contextual filtering options, granular activity signals, and provide specific files within alerts.
The agent summary tab in the Triage Agent in Insider Risk Management has been enhanced to intelligently distill user activity risk into meaningful risk pattern narratives, contextual filtering options, granular activity signals, and provide specific files within alerts.
The CloudPolicyEnforcementEvents table contains policy enforcement evaluation decisions and metadata of security gating events for various cloud platforms protected by the organization's Microsoft Defender for Cloud.
The following advanced hunting schema tables are now available for preview:
The CloudDnsEvents table contains information about DNS activity events from cloud infrastructure environments.
The CloudPolicyEnforcementEvents table contains policy enforcement evaluation decisions and metadata of security gating events for various cloud platforms protected by the organization's Microsoft Defender for Cloud.
This action infuses activity data with exposure data to identify exposed credentials at risk of being compromised and reused to conduct malicious activity.
The proactive user containment (contain user) action as part of the predictive shielding feature is now generally available. This action infuses activity data with exposure data to identify exposed credentials at risk of being compromised and reused to conduct malicious activity.
To improve accuracy and better protect organizational identities, we've made updates to the Secure Score category calculations. Some security recommendations categorized as Cloud apps recommendations are now considered identity‑related and grouped under the Identity category. While the total Secure Score remains unchanged,…
To improve accuracy and better protect organizational identities, we've made updates to the Secure Score category calculations. Some security recommendations categorized as Cloud apps recommendations are now considered identity‑related and grouped under the Identity category. While the total Secure Score remains unchanged, individual identity and app scores may change.
This change is also available for data risk assessments in Data Security Posture Management for AI (classic).
You can now use federated credentials as a more secure method of authentication to run Fabric data risk assessments. This change is also available for data risk assessments in Data Security Posture Management for AI (classic). For more information, see Prerequisites for Fabric data risk assessments.
By simplifying the graphs, security teams can focus their investigations on what matters most.
Customers can now use filters on very large incidents with many alerts and entities or hide specific entities to simplify complex incident graphs. By simplifying the graphs, security teams can focus their investigations on what matters most. Learn more
Build advanced queries with complex filtering, pattern-based text extraction, and data visualization to analyze and find key information in your review sets.
Use the new Advanced review set explorer to query review set data with Kusto Query Language (KQL). Build advanced queries with complex filtering, pattern-based text extraction, and data visualization to analyze and find key information in your review sets.
The container label settings supported are privacy and guest access controls, to help you manage consistent protection with other groups and sites that support sensitivity labels. You can manually apply the label in Engage communities, and configure it in label policies as…
Users can connect Copilot with Azure File Share to manage and work with their files using the Copilot Connector. Details: What changed: Copilot can now retrieve and summarize files stored in Azure File Share, providing insights without requiring users to open each…
Users can connect Copilot with Azure File Share to manage and work with their files using the Copilot Connector.
Details:
What changed: Copilot can now retrieve and summarize files stored in Azure File Share, providing insights without requiring users to open each file individually.
Why: This integration helps organizations using Azure File Share bring their structured content into Copilot for easier processing.
Try this:
Ask Copilot to list recent files added to Azure File Share.
Request summaries of documents stored there.
Retrieve key updates from a specific folder.
Why this matters:
Business impact: Helps teams better use their Azure-hosted content.
Personal impact: Makes finding and understanding files faster.
Users can connect Microsoft 365 Copilot with Jira Data Center to track and manage engineering tasks using the Copilot Connector. Details: What changed: Copilot can now retrieve issues, tasks, and updates from Jira Data Center. Users can analyze engineering progress and blockers…
Users can connect Microsoft 365 Copilot with Jira Data Center to track and manage engineering tasks using the Copilot Connector.
Details:
What changed: Copilot can now retrieve issues, tasks, and updates from Jira Data Center. Users can analyze engineering progress and blockers directly in Copilot.
Why: This helps engineering teams streamline updates and reduce the need to navigate multiple tools.
Try this:
Ask Copilot for a summary of Jira engineering issues.
Request insights on current blockers.
Generate a high-level project update.
Why this matters:
Business impact: Provides clearer visibility into engineering workflows.
Personal impact: Helps users stay organized and informed.
Users can connect Microsoft 365 Copilot with Monday.com to track work and team progress using the Copilot Connector. Roadmap ID: 515177 Details: What changed: Copilot can now pull data from Monday.com boards, tasks, and workflows. This allows users to review team progress…
Users can connect Microsoft 365 Copilot with Monday.com to track work and team progress using the Copilot Connector.
What changed: Copilot can now pull data from Monday.com boards, tasks, and workflows. This allows users to review team progress and updates directly through Copilot.
Why: This integration supports teams that rely on Monday.com by bringing their work data into Copilot for easier updates and insights.
Try this:
Ask Copilot to summarize key Monday.com tasks for your team.
Request a list of items that are overdue or blocked.
Generate a status update based on Monday.com board activity.
Why this
Business impact: Reduces context switching and improves clarity of work tracking.
Personal impact: Makes task reviews and updates more efficient.
Users can connect Copilot with Veeva to access promotional materials, quality documents, and regulatory information using the Copilot Connector. Details: What changed: Copilot can now retrieve and summarize approved content stored in Veeva Vault, including compliance and regulatory documents. Why: This supports…
Users can connect Copilot with Veeva to access promotional materials, quality documents, and regulatory information using the Copilot Connector.
Details:
What changed: Copilot can now retrieve and summarize approved content stored in Veeva Vault, including compliance and regulatory documents.
Why: This supports life sciences teams that depend on Veeva for controlled content, helping them access accurate information quickly.
Try this:
Ask Copilot to summarize a regulatory document stored in Veeva.
Retrieve approved promotional content for a product.
Request key updates across quality documentation.
Why this matters:
Business impact: Improves access to validated documents for regulated workflows.
Personal impact: Helps users stay compliant and informed.
Users can connect Copilot with WordPress.com and WordPress.org to retrieve, summarize, and analyze site content using the Copilot Connector. Details: What changed: Copilot can now pull posts, pages, and site content from WordPress installations, making it easier to analyze or repurpose web…
Users can connect Copilot with WordPress.com and WordPress.org to retrieve, summarize, and analyze site content using the Copilot Connector.
Details:
What changed: Copilot can now pull posts, pages, and site content from WordPress installations, making it easier to analyze or repurpose web content.
Why: The integration helps teams working with large content libraries stay informed and reuse content efficiently.
Try this:
Ask Copilot for a summary of recent posts from your WordPress site.
Retrieve key themes across published articles.
Request an analysis of content performance patterns.
Why this matters:
Business impact: Supports content teams by improving visibility into site content.
Personal impact: Simplifies reviewing and reusing website
The Copilot Studio agent report includes autonomous agents and provides insights on adoption, impact, time savings, and cost savings. Roadmap ID: 499422 Details: What changed: The agent report now includes autonomous agents with generative orchestration. It also offers new metrics related to…
The Copilot Studio agent report includes autonomous agents and provides insights on adoption, impact, time savings, and cost savings.
What changed: The agent report now includes autonomous agents with generative orchestration. It also offers new metrics related to adoption, time saved, and cost benefits.
Why: These enhancements help organizations understand how Copilot Studio agents are used and the value they deliver.
Try this:
Open the Copilot Studio agent report to review autonomous agent usage.
Compare generative and non-generative agent activity.
Review time-saving and cost-saving insights.
Why this matters:
Business impact: Supports better decision-making about automation and ROI.
Personal impact: Helps creators understand how their agents are being used.
PowerPoint now includes the Designer Editor for image editing, giving you a modern, intuitive way to refine images directly on your slides without leaving PowerPoint. Details: What changed: You can now use PowerPoint's new AI-powered image editing capabilities to perform tasks such…
PowerPoint now includes the Designer Editor for image editing, giving you a modern, intuitive way to refine images directly on your slides without leaving PowerPoint.
Details:
What changed: You can now use PowerPoint's new AI-powered image editing capabilities to perform tasks such as improving image resolution, removing backgrounds, and moving image elements with generative AI-all directly within your presentation.
Why: Creating polished slides often requires quick image adjustments, and switching tools slows down the workflow. This change keeps image editing within PowerPoint so you can stay focused on your presentation.
Try this:
Select an image on a slide and open the Designer Editor to refine visuals directly in PowerPoint.
Remove distracting backgrounds from photos before placing them into layouts.
Add text annotations with cool text effects.
Why this matters:
Business impact: Helps teams create more polished presentations faster by reducing the need to switch tools for image editing.
Personal impact: Makes it easier to enhance slide visuals quickly, helping your presentations look more professional with less effort.
Developers can embed knowledge such as PDFs, Word documents, and PowerPoint files for declarative agents. Roadmap ID: 474448 Details: What changed: Declarative agents now support embedded knowledge, allowing developers to include up to 10 local files as grounding resources. Why: This makes…
Developers can embed knowledge such as PDFs, Word documents, and PowerPoint files for declarative agents.
IT admins can customize filters for data sources in Copilot Search without additional development work. Roadmap ID: 502534 Details: What changed: Microsoft 365 Copilot search now includes a dynamic filtering experience that surfaces data source-specific filters. When users select a source (such…
IT admins can customize filters for data sources in Copilot Search without additional development work.
What changed: Microsoft 365 Copilot search now includes a dynamic filtering experience that surfaces data source-specific filters. When users select a source (such as Outlook, SharePoint, Teams, Azure DevOps, Google Drive, Jira, or Confluence), relevant filters automatically appear in the right rail.
Why: This gives users more precise control over search results by tailoring filters to the selected data source-without requiring any admin setup or changes to existing policies.
Try this:
Select a specific data source in Copilot search (e.g., Outlook or SharePoint).
Use the dynamically populated filters in the right rail to refine results.
Switch data sources to see filters update automatically based on context.
Why this matters:
Business impact: Improves search accuracy while reducing administrative overhead-no configuration or policy updates required.
Personal impact: Helps users find relevant information faster with less manual refinement.
Users can scope grounding for declarative agents to specific data sources. Details: What changed: Users can now define which data sources a declarative agent draws from. This ensures more precise responses and reduces unnecessary information. Why: This gives users more control over…
Users can scope grounding for declarative agents to specific data sources.
Details:
What changed: Users can now define which data sources a declarative agent draws from. This ensures more precise responses and reduces unnecessary information.
Why: This gives users more control over how declarative agents use organizational data.
Try this:
Select a declarative agent where sources have been exposed or define sources in the manifest for your agent.
Limit grounding to a single repository for more focused results.
Test the agent's output to confirm improved relevance.
Why this matters:
Business impact: Improves control over data usage and response accuracy.
Personal impact: Helps users get answers that match their needs.
Users can scope grounding for declarative agents to specific data sources. Details: What changed: Users can now define which data sources a declarative agent draws from. This ensures more precise responses and reduces unnecessary information. Why: This gives users more control over…
Users can scope grounding for declarative agents to specific data sources.
Details:
What changed: Users can now define which data sources a declarative agent draws from. This ensures more precise responses and reduces unnecessary information.
Why: This gives users more control over how declarative agents use organizational data.
Try this:
Select a declarative agent where sources have been exposed or define sources in the manifest for your agent.
Limit grounding to a single repository for more focused results.
Test the agent's output to confirm improved relevance.
Why this matters:
Business impact: Improves control over data usage and response accuracy.
Personal impact: Helps users get answers that match their needs.
Users can adjust presentation length, narrative tone, slide style, and AI-generated images when creating presentations with Copilot. Roadmap ID: 513422 Details: What changed: Copilot now supports more granular controls for customization. Users can specify slide count, tone of messaging, stylistic preferences, and…
Users can adjust presentation length, narrative tone, slide style, and AI-generated images when creating presentations with Copilot.
What changed: Copilot now supports more granular controls for customization. Users can specify slide count, tone of messaging, stylistic preferences, and visual elements to better tailor their presentations.
Why: This gives users more creative control and ensures presentations match the intended audience and purpose.
Try this:
Ask Copilot to shorten your presentation to five slides.
Set the tone to "professional" or "informal" as needed.
Request new AI-generated images that match your theme.
Why this matters:
Business impact: Helps teams build polished presentations more efficiently.
Personal impact: Gives individuals more flexibility and creative options.
Users can select the "explain" option from the contextual menu that appears by right clicking on objects or content in PowerPoint to receive a detailed and contextual explanation. Roadmap ID: 516565 Details: What changed: Copilot can now provide an explanation of any…
Users can select the "explain" option from the contextual menu that appears by right clicking on objects or content in PowerPoint to receive a detailed and contextual explanation.
What changed: Copilot can now provide an explanation of any selected object in a presentation. This includes acronyms, individual text boxes, tables images, & entire slide. Previously, users needed to rely on external references or manual research to understand unclear content.
Why: This feature helps users understand unfamiliar or complex information without leaving their presentation
Try this:
Select any text, table or slide, right click and choose "Explain".
Review the explanation without leaving PowerPoint
Why this matters:
Business impact: Helps teams quickly understand unfamiliar content, reducing time spent researching and improving clarity in presentations.
Personal impact: Makes it easier to grasp the meaning of slide objects without switching apps.
Admins can now set up connector authentication faster through a simplified and guided OAuth experience. Details: What changed: Previously, connector authentication required manual steps and extensive documentation. The new experience introduces a streamlined, guided OAuth flow that significantly reduces setup time. Why:…
Admins can now set up connector authentication faster through a simplified and guided OAuth experience.
Details:
What changed: Previously, connector authentication required manual steps and extensive documentation. The new experience introduces a streamlined, guided OAuth flow that significantly reduces setup time.
Why: This change modernizes the authentication framework and reduces friction for admins configuring connectors.
Try this:
Open connector setup and follow the guided OAuth flow.
Complete authentication for supported connectors such as Gong, GitHub, or Monday.
Why this matters:
Business impact: Reduces configuration time and operational overhead for IT teams.
Personal impact: Makes connector setup faster and easier for admins.
Developer Portal now supports management and configuration of Agent Blueprints allowing developers to extend Agent 365 capabilities to their agents including enterprise-grade identity, observability, notifications, security, and governed access to Microsoft 365 data. Details: What changed: Developer Portal now supports full lifecycle…
Developer Portal now supports management and configuration of Agent Blueprints allowing developers to extend Agent 365 capabilities to their agents including enterprise-grade identity, observability, notifications, security, and governed access to Microsoft 365 data.
Details:
What changed: Developer Portal now supports full lifecycle actions for agent manifests. Developers can create, edit, and manage manifest configuration in a single place to streamline setup.
Why: Centralizing manifest management reduces friction, improves consistency, and shortens setup time for agent-based solutions.
Try this:
Create a new agent manifest and define its required settings.
Update an existing manifest to refine configuration details.
Review manifest properties to ensure consistent deployment.
Why this matters:
Business impact: Standardizes agent configuration and reduces setup errors across projects.
Personal impact: Makes it easier for individuals to manage agent settings without switching tools.
Connect Copilot to your GitHub Server to retrieve and collaborate on issues, pull requests, and knowledge base content. Details: What changed: The Copilot Connector enables a direct connection to GitHub Server. Users can bring issues, pull requests, and knowledge base content into…
Connect Copilot to your GitHub Server to retrieve and collaborate on issues, pull requests, and knowledge base content.
Details:
What changed: The Copilot Connector enables a direct connection to GitHub Server. Users can bring issues, pull requests, and knowledge base content into Copilot to view and collaborate.
Why: Centralizing software work items and documentation in Copilot saves time and reduces context switching during development and review activities.
Try this:
Connect your GitHub Server and ask Copilot to list open issues for a repository.
Use Copilot to summarize a pull request and highlight reviewers' comments.
Retrieve knowledge base articles to prepare a project briefing.
Why this matters:
Business impact: Speeds up review cycles and keeps development work aligned by consolidating information in one place.
Personal impact: Makes it easier for individuals to find and act on relevant GitHub items.
URL-based dialogs in Declarative Agents allow users to open linked experiences without leaving Copilot, helping them stay focused. Details: What changed: Developers can now enable URL-based dialogs in Declarative Agents. This lets users open external pages or forms directly within Copilot. Previously,…
URL-based dialogs in Declarative Agents allow users to open linked experiences without leaving Copilot, helping them stay focused.
Details:
What changed: Developers can now enable URL-based dialogs in Declarative Agents. This lets users open external pages or forms directly within Copilot. Previously, these workflows required switching apps or breaking context.
Why: This feature helps users complete tasks without interruption, supporting smoother and more connected workflows.
Try this:
Open a Declarative Agent that includes a URL-based dialog.
Follow the dialog link to continue your workflow inside Copilot.
Use the dialog to complete tasks that require external pages or forms.
Why this matters:
Business impact: Reduces context switching and improves workflow continuity.
Personal impact: Helps individuals complete tasks more efficiently without leaving Copilot.
Field teams can use getting started guides of champion connectors to guide customers through Copilot adoption with clear, consistent resources. Details: What changed: Field teams can now use getting started guides champion connectors to guide Copilot adoption in top accounts. This adds…
Field teams can use getting started guides of champion connectors to guide customers through Copilot adoption with clear, consistent resources.
Details:
What changed: Field teams can now use getting started guides champion connectors to guide Copilot adoption in top accounts. This adds structured resources and best practices that were not available in earlier workflows.
Why: This change gives field teams consistent tools that help customers adopt Copilot more quickly and confidently.
Try this:
Review champion connector resources available to your field team.
Share the connector with top accounts beginning their Copilot journey.
Use the resources to guide conversations about adoption planning.
Why this matters:
Business impact: Supports faster and more consistent Copilot adoption across key customer accounts.
Personal impact: Makes it easier for individuals to provide clear, ready-to-use guidance.
The ServiceNow Tickets Copilot connector updates ticket status more frequently by ingesting both active and inactive tickets. Roadmap ID: 505437 Details: What changed: The ServiceNow Tickets Copilot connector now ingests both active and inactive tickets by default, improving how often ticket status…
The ServiceNow Tickets Copilot connector updates ticket status more frequently by ingesting both active and inactive tickets.
What changed: The ServiceNow Tickets Copilot connector now ingests both active and inactive tickets by default, improving how often ticket status changes appear in Copilot responses. Admins can also edit the data query filter to include inactive tickets for existing connections.
Why: Inactive tickets were not previously ingested, which could lead to outdated ticket status information in Copilot responses.
Try this:
Review the query filter for existing ServiceNow Tickets connections.
Update the filter to include both active and inactive tickets if needed.
Communicate the change to your ServiceNow stakeholders and Copilot users.
Why this matters:
Business impact: Improves the quality of Copilot responses that reference ServiceNow tickets by keeping ticket status information current.
Personal impact: Reduces confusion by showing more up-to-date ticket statuses in Copilot answers.
Connect Microsoft 365 Copilot to Miro with Copilot connectors so you can query visual boards and diagrams in Copilot. Roadmap ID: 515166 Details: What changed: Microsoft 365 Copilot now supports a Miro Copilot connector, which makes Miro boards discoverable and usable in…
Connect Microsoft 365 Copilot to Miro with Copilot connectors so you can query visual boards and diagrams in Copilot.
What changed: Microsoft 365 Copilot now supports a Miro Copilot connector, which makes Miro boards discoverable and usable in Microsoft 365 Copilot and Microsoft Search.
Why: This change helps people access Miro boards and visual planning work without leaving Microsoft 365.
Try this:
Connect Microsoft 365 Copilot to Miro with a Copilot connector.
Ask Copilot to summarize the content of a Miro board for a project.
Ask Copilot to list action items on a Miro board.
Why this matters:
Business impact: Brings Miro board knowledge into Microsoft 365 Copilot so teams can find and use visual artifacts in the flow of work.
Personal impact: Reduces time spent switching tools when you need context from a Miro board.
Users can refresh Adaptive Cards in agents to ensure they always see the most current information in their workflows. Details: What changed: Users can now refresh Adaptive Cards inside their agents to view updated information. Previously, cards remained static unless the agent…
Users can refresh Adaptive Cards in agents to ensure they always see the most current information in their workflows.
Details:
What changed: Users can now refresh Adaptive Cards inside their agents to view updated information. Previously, cards remained static unless the agent was recreated or reloaded.
Why: This improvement helps users stay aligned with the latest data, reducing confusion and improving workflow accuracy.
Try this:
Select the refresh option on an Adaptive Card inside your agent.
Use the updated card to continue your workflow with the latest information.
Check refreshed cards when reviewing time-sensitive or changing data.
Why this matters:
Business impact: Ensures teams work with accurate, up-to-date information.
Personal impact: Reduces manual steps and helps individuals stay current with ongoing changes.
You can now measure, understand, and improve the quality of your data in your SQL MI. Both public network and private endpoint configurations are supported. To get started, create a connection similar to Azure SQL database with supported port number, and assess…
Azure SQL Managed Instance support (SQL MI) is now generally available. You can now measure, understand, and improve the quality of your data in your SQL MI. Both public network and private endpoint configurations are supported. To get started, create a connection similar to Azure SQL database with supported port number, and assess the quality of your data using the Microsoft Purview Data Quality scanner.
Bring Your Own Device (BYOD) support for Windows using Microsoft Entra‑registered devices is now available in public preview. Users and partners can access corporate resources from their own devices. Admins can assign the Private Application traffic profile to internal accounts, including internal…
Bring Your Own Device (BYOD) support for Windows using Microsoft Entra‑registered devices is now available in public preview. Users and partners can access corporate resources from their own devices. Admins can assign the Private Application traffic profile to internal accounts, including internal guest users. For more information, see: Bring Your Own Device (Preview).
Copilot in Teams can analyze chat history, meeting transcripts, and calendar content to generate smart recaps, rewrite messages, and surface relevant insights. To learn more, see Use Copilot in Microsoft Teams meetings.
Copilot in Teams can analyze chat history, meeting transcripts, and calendar content to generate smart recaps, rewrite messages, and surface relevant insights. To learn more, see Use Copilot in Microsoft Teams meetings.
When you configure policies blocking your users from accessing a risky, NSFW, or unsanctioned sites or apps in GSA, they receive a clear HTML error message with Microsoft Entra Internet Access branding. We’ve heard from many admins that they’d like to start…
When you configure policies blocking your users from accessing a risky, NSFW, or unsanctioned sites or apps in GSA, they receive a clear HTML error message with Microsoft Entra Internet Access branding. We’ve heard from many admins that they’d like to start customizing that experience with text aligned to a company style guide, callouts to company Terms of Use documentation, hyperlinks to IT workflows, and more.
Global Secure Access now offers customized block pages for Internet Access. In the Microsoft Graph API, Admins can now:
Configure the tenant-wide body text of the GSA block page.
Add hyperlinks via limited markdown to reference Terms of Use, ServiceNow/IT ticketing services, or even MyAccess for ID Governance workflow integration.
In addition to the global banned password lists already supported, EEID admins can now add specific strings to block during password creation and reset. For more information, see Password Protection - Custom banned password lists.
Generate custom meeting recaps that include the details most important to you, in your preferred tone and format. To learn more, see Customize recap summaries in Microsoft Teams.
Generate custom meeting recaps that include the details most important to you, in your preferred tone and format. To learn more, see Customize recap summaries in Microsoft Teams.
By running scans on assets, organizations can decide whether to associate a data asset to a data product if the data asset is in poor quality.
Data quality scans for standalone data assets enable organizations to measure and improve data quality immediately without associating a data asset to a data product, significantly speeding up governance adoption. By running scans on assets, organizations can decide whether to associate a data asset to a data product if the data asset is in poor quality.
Lifecycle workflows can now be managed with Administrative Units (AUs), enabling organizations to segment workflows and delegate administration to specific admins. This enhancement ensures that only authorized admins can view, configure, and execute workflows relevant to their scope. Customers are able to…
Lifecycle workflows can now be managed with Administrative Units (AUs), enabling organizations to segment workflows and delegate administration to specific admins. This enhancement ensures that only authorized admins can view, configure, and execute workflows relevant to their scope. Customers are able to associate workflows with AUs, assign scoped permissions to delegated admins, and ensure that workflows only impact users within their defined scope. For more information, see: Delegated workflow management.
Similar to Microsoft Entra ID (workforce tenants), Microsoft Entra External ID (external tenants) now supports device authorization grant flow, which allows users to sign in to input-constrained devices such as a smart TV, IoT device, or a printer. For more information, see…
Similar to Microsoft Entra ID (workforce tenants), Microsoft Entra External ID (external tenants) now supports device authorization grant flow, which allows users to sign in to input-constrained devices such as a smart TV, IoT device, or a printer. For more information, see OAuth 2.0 device authorization grant.
The Effective settings tab under the device inventory Configuration management tab is now generally available. In this tab, you can view the actual value and configuration source of each security setting on a device. This helps identify configuration attempts that didn't take…
The Effective settings tab under the device inventory Configuration management tab is now generally available. In this tab, you can view the actual value and configuration source of each security setting on a device. This helps identify configuration attempts that didn't take effect and eliminates gaps where intended protections aren't enforced.
The new version of the tool streamlines onboarding and enhances security by:- Bundling the onboarding package directly into the tool's executable.- Generating a key during deployment package creation that is required for running the tool.- Enabling users to configure an expiry date…
The new version of the tool streamlines onboarding and enhances security by:- Bundling the onboarding package directly into the tool's executable.- Generating a key during deployment package creation that is required for running the tool.- Enabling users to configure an expiry date for the package to reduce the risk of unauthorized use.In addition, a new Deployment packages page in the Defender portal facilitates management of downloaded packages by providing centralized visibility into all the packages and their current status.
The Attribute Changes trigger in Lifecycle Workflows now supports additional attribute types, enabling broader detection of organizational changes. Previously, this trigger was limited to a set of core attributes. With this update, you can configure workflows to respond when any of the…
The Attribute Changes trigger in Lifecycle Workflows now supports additional attribute types, enabling broader detection of organizational changes. Previously, this trigger was limited to a set of core attributes. With this update, you can configure workflows to respond when any of the following attributes change:
Custom security attributes
Directory extension attributes
EmployeeOrgData attributes
On-premises attributes 1–15
This enhancement gives administrators greater flexibility to automate lifecycle processes for mover events based on custom or extended attributes, improving governance for complex organizational structures and hybrid environments. For more information, see: Use Custom attribute triggers in lifecycle workflows.
Users can report external and intra-org Microsoft Teams messages from chats, standard, shared, and private channels, meeting conversations to Microsoft as malicious (security risk) the specified reporting mailbox, or both via user reported settings.
Users can report external and intra-org Microsoft Teams messages from chats, standard, shared, and private channels, meeting conversations to Microsoft as malicious (security risk) the specified reporting mailbox, or both via user reported settings.
We're excited to announce that external authentication methods in Microsoft Entra ID is now generally available under a new name: External Multifactor Authentication (External MFA). This capability enables organizations to meet multifactor authentication requirements while continuing to use their preferred MFA provider.…
We're excited to announce that external authentication methods in Microsoft Entra ID is now generally available under a new name: External Multifactor Authentication (External MFA). This capability enables organizations to meet multifactor authentication requirements while continuing to use their preferred MFA provider. Microsoft Entra ID remains the identity control plane, performing full policy evaluation and access decisions on every sign in, including real time Conditional Access enforcement and sign in risk assessment. For more information, see How to enable external MFA.
Forward up to five messages at a time from a Teams chat or channel. Hover over a message and select More options . Select Forward > Multiple messages and choose the messages you want to send. Select Next, add recipients, and select Forward.
Forward up to five messages at a time from a Teams chat or channel. Hover over a message and select More options . Select Forward > Multiple messages and choose the messages you want to send. Select Next, add recipients, and select Forward.
To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes the following changes and enhancements:- The Vulnerable devices by Windows 10/11 version over time section is now removed.- The report's filters only include the Device group filter.-…
To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes the following changes and enhancements:- The Vulnerable devices by Windows 10/11 version over time section is now removed.- The report's filters only include the Device group filter.- The report's history is now limited to the last 30 days.- The report's history is now limited to the last 30 days.Note: These changes are now visible to government cloud customers, but aren't yet visible in air-gapped environments. This visibility will be added in the coming months.
Assess who you're working with by checking Trust Indicators, visual badges that appear next to external people in Teams. Labels are automatically assigned based on the person's relationship with your org.
Assess who you're working with by checking Trust Indicators, visual badges that appear next to external people in Teams. Labels are automatically assigned based on the person's relationship with your org.
You can now view and manage files and scripts used during live response sessions in the Microsoft Defender portal. With this enhancement, you get a centralized view of all uploaded files and their properties, and can upload, view and delete files outside…
You can now view and manage files and scripts used during live response sessions in the Microsoft Defender portal. With this enhancement, you get a centralized view of all uploaded files and their properties, and can upload, view and delete files outside the live response session.
These contacts are the individuals or groups that Microsoft needs to notify if there are critical incidents or service updates.
Microsoft Defender Experts Hunting customers can now set up Notification contacts. These contacts are the individuals or groups that Microsoft needs to notify if there are critical incidents or service updates.
Microsoft Entra Connect Sync now officially supports Windows Server 2025. This means you can confidently install and run Microsoft Entra Connect Sync on servers running Windows Server 2025, enabling your hybrid identity environment to take full advantage of the latest Windows Server…
Microsoft Entra Connect Sync now officially supports Windows Server 2025. This means you can confidently install and run Microsoft Entra Connect Sync on servers running Windows Server 2025, enabling your hybrid identity environment to take full advantage of the latest Windows Server enhancements.
What this means for you: With this update, organizations can upgrade their identity synchronization servers to Windows Server 2025 without hesitation. Windows Server 2025 brings advanced features that improve security, performance, and flexibility, and our engineering team has thoroughly validated Microsoft Entra Connect Sync on this platform. Many customers have been eager to adopt Windows Server 2025 to leverage its enhanced security, better performance, and improved management capabilities. Now, with official support in place, you can benefit from these improvements while maintaining a reliable, fully supported hybrid identity solution.
The Microsoft Entra Connect Sync .msi installation file is exclusively available on Microsoft Entra admin center under Microsoft Entra Connect. Check our version history page for more details on available versions.
Consider moving to Cloud Sync: Microsoft Entra Cloud Sync is a sync client that works from the cloud and allows customers to set up and manage their sync preferences online. We recommend that you use Cloud Sync because we're introducing new features that improve the sync experiences through Cloud Sync. You can avoid future migrations by choosing Cloud Sync if that's the right option for you. Use the supported sync scenarios comparison to see if Cloud Sync is the right sync client for you.
What is Hard-matching in Microsoft Entra Connect Sync and Cloud Sync? When Microsoft Entra Connect or Cloud Sync adds new objects from Active Directory, the Microsoft Entra ID service tries to match the incoming object with an Entra object by looking up…
What is Hard-matching in Microsoft Entra Connect Sync and Cloud Sync?
When Microsoft Entra Connect or Cloud Sync adds new objects from Active Directory, the Microsoft Entra ID service tries to match the incoming object with an Entra object by looking up the incoming object’s sourceAnchor value against the OnPremisesImmutableId attribute of existing cloud managed objects in Microsoft Entra ID. If there's a match, Microsoft Entra Connect or Cloud Sync takes over the source or authority (SoA) of that object and updates it with the properties of the incoming Active Directory object in what is known as "hard-match."
To strengthen the security posture of your Microsoft Entra ID environment, we are introducing a change that will restrict certain types of hard-match operations by default.
What’s changing
Beginning June 1, 2026, Microsoft Entra ID will block any attempt by Entra Connect Sync or Cloud Sync from hard-matching a new user object from Active Directory to an existing cloud-managed Entra ID user object that holds Microsoft Entra roles.
This means:
If a cloud managed user already has onPremisesImmutableId (sourceAnchor) set and is assigned a Microsoft Entra role, Microsoft Entra Connect Sync or Cloud Sync will no longer be able to take over the Source of Authority of that user by hard-matching with an incoming user object from Active Directory.
This safeguard prevents attackers from taking over privileged cloud managed users in Entra by manipulating attributes of user objects in Active Directory.
What’s not changing
Hard match operations for cloud users without Microsoft Entra roles are not affected.
The Microsoft Entra provisioning service can be used in the 21Vianet / China cloud for the following scenarios: API-driven provisioning, Cloud Sync, Cross-tenant sync between China tenants, SCIM provisioning for the non-gallery / custom application, and on-premises app provisioning (ECMA). Specific gallery…
The Microsoft Entra provisioning service can be used in the 21Vianet / China cloud for the following scenarios: API-driven provisioning, Cloud Sync, Cross-tenant sync between China tenants, SCIM provisioning for the non-gallery / custom application, and on-premises app provisioning (ECMA). Specific gallery connectors such as Workday, SuccessFactors, and AWS aren't onboarded to the environment. For more information, see: Gallery application doesn't support provisioning in US Government or 21Vianet (China) clouds.
By using incremental scans, you can choose between full scans, incremental scans, or both when you run data quality rules on data assets.
Microsoft Purview Data Quality supports incremental data quality scans by using time-based filtering. By using incremental scans, you can choose between full scans, incremental scans, or both when you run data quality rules on data assets.
A new list of partner integrations is now available, with links to partner documentation.
Microsoft Purview enables software development companies to integrate governance, protection, and compliance capabilities into their applications using SDKs and APIs. A new list of partner integrations is now available, with links to partner documentation. For more information, see Software Developer Partner Integrations.
If your connectivity drops in a meeting, you'll see a notification alerting you that your network connection is weak. You'll also receive suggestions for strengthening and restabilizing it, like turning your video off.
If your connectivity drops in a meeting, you'll see a notification alerting you that your network connection is weak. You'll also receive suggestions for strengthening and restabilizing it, like turning your video off.
The homepage at https://myaccount.microsoft.com has been updated to provide a more task-focused experience. Users will see pending actions like renewing expiring groups, approving access package requests, and setting up MFA directly on the homepage. Quick links to apps, groups, access packages, and…
The homepage at https://myaccount.microsoft.com has been updated to provide a more task-focused experience. Users will see pending actions like renewing expiring groups, approving access package requests, and setting up MFA directly on the homepage. Quick links to apps, groups, access packages, and sign-in details will be easier to find and use. This change is designed to streamline account management and help users stay on top of access and security tasks.
Teams meeting recaps now include key on-screen moments, like screen shares, directly next to the relevant sections of the summary, so you can see exactly what was being discussed. To learn more, see Recap in Microsoft Teams.
Teams meeting recaps now include key on-screen moments, like screen shares, directly next to the relevant sections of the summary, so you can see exactly what was being discussed. To learn more, see Recap in Microsoft Teams.
By end of March Microsoft Entra ID Governance approvers can now revoke access to an access package after an approval has already been granted. This gives approvers greater control to respond to changes, mistakes, or updated business needs. With this update, an…
By end of March Microsoft Entra ID Governance approvers can now revoke access to an access package after an approval has already been granted. This gives approvers greater control to respond to changes, mistakes, or updated business needs. With this update, an approver can undo a prior approval decision, immediately removing the requestor’s access to the access package. Only the approver who originally approved the request can revoke it, even if multiple approvers belong to the same approver group. For more information, see: Revoke a request.
In Microsoft Entra External ID (EEID), users who authenticate with a local email and password now can also sign in using a username (alias) as an alternate sign-in identifier. This alias can represent a customer or member ID, insurance number, frequent flyer…
In Microsoft Entra External ID (EEID), users who authenticate with a local email and password now can also sign in using a username (alias) as an alternate sign-in identifier. This alias can represent a customer or member ID, insurance number, frequent flyer number, or a self-chosen username. The alias can be collected from user or assigned during self-service sign-up, or assigned during user creation or user update via the Microsoft Graph API or Microsoft Entra admin center. For details, see Sign in with alias.
To provide comprehensive vulnerability management capabilities across all supported Windows versions, Microsoft Defender Vulnerability Management now gathers software product vulnerability data on Windows 7 devices.
To provide comprehensive vulnerability management capabilities across all supported Windows versions, Microsoft Defender Vulnerability Management now gathers software product vulnerability data on Windows 7 devices.
The client-side improvements for sensitivity labels that extend SharePoint permissions to downloaded documents that started to roll out to Windows version 2601+ in January for the Current Channel is complete, and now also available with the Monthly Enterprise Channel.
It also includes information and link to the identity that owns the account. The EntraIdSignInEvents table contains information about Microsoft Entra interactive and non-interactive sign-ins. The EntraIdSpnSignInEvents table contains information about Microsoft Entra service principal and managed identity sign-ins. The GraphApiAuditEvents table…
The following advanced hunting schema tables are now generally available:
The IdentityAccountInfo table contains information about account information from various sources, including Microsoft Entra ID. It also includes information and link to the identity that owns the account.
The EntraIdSignInEvents table contains information about Microsoft Entra interactive and non-interactive sign-ins.
The EntraIdSpnSignInEvents table contains information about Microsoft Entra service principal and managed identity sign-ins.
The GraphApiAuditEvents table provides information about Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant.
The following content types are now generally available for distribution across multiple tenants in the Microsoft Defender multitenant portal: analytics rules, automation rules, and workbooks.
The following content types are now generally available for distribution across multiple tenants in the Microsoft Defender multitenant portal: analytics rules, automation rules, and workbooks.
Starting February 2026, Microsoft Authenticator will introduce jailbreak/root detection for Microsoft Entra credentials in the Authenticator app. The rollout progresses from warning mode → blocking mode. Users must move to compliant devices to continue using Microsoft Entra accounts in Authenticator.
Starting February 2026, Microsoft Authenticator will introduce jailbreak/root detection for Microsoft Entra credentials in the Authenticator app. The rollout progresses from warning mode → blocking mode. Users must move to compliant devices to continue using Microsoft Entra accounts in Authenticator.
To reflect Defender Vulnerability Management's visibility into all software components identified in your organization, the Vulnerable components page is now named Software components. Documentation: Software components
To reflect Defender Vulnerability Management's visibility into all software components identified in your organization, the Vulnerable components page is now named Software components.
The what's new and OS-specific release notes pages are now updated to provide better visibility and access to new features, improvements, and fixes:- The what's new page (this page) is now named New features in Microsoft Defender for Endpoint and includes both…
The what's new and OS-specific release notes pages are now updated to provide better visibility and access to new features, improvements, and fixes:- The what's new page (this page) is now named New features in Microsoft Defender for Endpoint and includes both features and links to latest release notes.- The Release notes page now consolidates release details for all supported operating systems, including Windows Antivirus. The new page groups updates by platform and date, making it easier to find specific information.- All previous release notes pages redirect to the consolidated release notes page.
Copilot now understands content within comments and attachments for ServiceNow KB and Azure DevOps work item connectors. Details: What changed: Previously, Copilot focused on primary content only. Comments and attachments are now included in content understanding. Why: This ensures important context is…
Copilot now understands content within comments and attachments for ServiceNow KB and Azure DevOps work item connectors.
Details:
What changed: Previously, Copilot focused on primary content only. Comments and attachments are now included in content understanding.
Why: This ensures important context is not missed during searches or summaries.
Try this:
Ask Copilot about an Azure DevOps work item.
Review insights that include comment and attachment context.
Why this matters:
Business impact: Improves decision making with more complete information.
Personal impact: Reduces the need to manually review supporting content.
Bring intelligent agents built and hosted in Microsoft Foundry into to Microsoft 365 Copilot and Microsoft Teams-tailored to your organization's workflows, rules, and compliance needs. What Changed: You can now connect an existing Foundry agent to Microsoft 365 Copilot and Microsoft Teams…
Bring intelligent agents built and hosted in Microsoft Foundry into to Microsoft 365 Copilot and Microsoft Teams-tailored to your organization's workflows, rules, and compliance needs.
What Changed: You can now connect an existing Foundry agent to Microsoft 365 Copilot and Microsoft Teams via a proxy app built with the Microsoft 365 Agents Toolkit.
Why: Many specialized or regulated industries require custom logic beyond standard Copilot features. This update empowers teams to create agents that are tightly aligned with enterprise policies, domain needs, and governance expectations, and bring them into Microsoft 365 Copilot.
Try This:
Integrate your Microsoft Foundry agent with Microsoft 365 using Agents Toolkit sample.
Why This Matters:
Business Impact: Enables organizations to build tailored solutions, ensuring Copilot adapts to unique operational needs.
Personal Impact: Gives developers freedom to innovate while maintaining the required levels of security, compliance, and governance.
Choose GPT-5.2 in Copilot Chat for faster responses or deeper reasoning, improving accuracy and clarity. Details: What changed: The model selector in Copilot Chat now includes GPT-5.2. Users can pick Quick Response for immediate answers or Think Deeper for more thorough reasoning.…
Choose GPT-5.2 in Copilot Chat for faster responses or deeper reasoning, improving accuracy and clarity.
Details:
What changed: The model selector in Copilot Chat now includes GPT-5.2. Users can pick Quick Response for immediate answers or Think Deeper for more thorough reasoning. GPT-5.2 delivers better instruction following, improved math and coding performance, and clearer explanations compared to previous models.
Why: This update provides more flexibility and precision, helping users handle both simple and complex tasks with adaptive reasoning.
Try this:
Select More in the model selector and choose Quick Response for quick answers.
Choose Think Deeper when you need detailed reasoning for complex queries.
Why this matters:
Business impact: Enhances productivity by offering tailored response modes for different workflows.
Personal impact: Gives individuals control over response depth, improving efficiency and clarity.
A new Power BI report in Viva Insights shows how Copilot usage relates to employee experience sentiment in Viva Glint. Roadmap ID: 496654 Details: What changed: Previously, Understanding the impact of copilot usage on employee experience outcomes required customers to take the…
A new Power BI report in Viva Insights shows how Copilot usage relates to employee experience sentiment in Viva Glint.
What changed: Previously, Understanding the impact of copilot usage on employee experience outcomes required customers to take the data out and do their own custom analysis. The new report that comes with copilot analytics in Viva Insights provides built-in segmented cohort analysis and heatmap visualizations.
Why: This helps organizations better understand how Copilot influences employee experience.
Try this:
Open Viva Insights and access the Copilot Outcomes report.
Analyze sentiment by Copilot usage patterns.
Why this matters:
Business impact: Enables data-driven insights into Microsoft 365 copilot adoption and sentiment.
Personal impact: Supports improvements to daily work experiences.
Users can now manage the visibility of the Copilot icon in the Microsoft Edge toolbar, while admins can control icon access through policy settings. Roadmap ID: 536579 Details: What changed: Previously, the Copilot icon always appeared in the toolbar. Users can now…
Users can now manage the visibility of the Copilot icon in the Microsoft Edge toolbar, while admins can control icon access through policy settings.
What changed: Previously, the Copilot icon always appeared in the toolbar. Users can now hide or show the icon, and admins can manage visibility using the ""Microsoft365CopilotChatIconEnabled policy.""
Why: This change gives users and IT admins more flexibility in managing the Edge interface and Copilot availability.
Try this:
Right-click the Copilot icon and select Hide Copilot.
Use Edge settings to toggle the icon visibility.
Configure the Microsoft365CopilotChatIconEnabled policy as an admin.
Why this matters:
Business impact: Supports customized user experiences and centralized policy control.
Personal impact: Lets users reduce toolbar clutter or restore the icon when needed.
Users can now open agents created in Agent Builder in the Copilot Studio authoring experience. Details: What changed: Previously, agents created in Agent Builder experience were limited in capability. Authors can now move agents into Copilot Studio to access advanced features and…
Users can now open agents created in Agent Builder in the Copilot Studio authoring experience.
Details:
What changed: Previously, agents created in Agent Builder experience were limited in capability. Authors can now move agents into Copilot Studio to access advanced features and publishing options.
Why: This change enables more powerful agents and supports stronger governance and lifecycle management.
Try this:
Open an agent created in Agent Builder.
Continue editing the agent in Copilot Studio.
Why this matters:
Business impact: Enables more capable agents with governance controls such as Data Loss Prevention.
Personal impact: Gives creators greater flexibility to enhance their agents.
Create a PowerPoint deck grounded on a Copilot page to present page content quickly. Roadmap ID: 499425 Details: What changed: You can generate a PowerPoint presentation grounded on the content of a Copilot page, enabling rapid presentation creation based on existing information.…
Create a PowerPoint deck grounded on a Copilot page to present page content quickly.
What changed: You can generate a PowerPoint presentation grounded on the content of a Copilot page, enabling rapid presentation creation based on existing information.
Why: Teams often needs to transform the content on a Page to slide format. Grounded generation speeds up this process and keeps slides aligned with the source.
Try this:
Create a launch plan for a new electric scooter brand, including key messaging, target audience, launch channels, and success metrics. Organize it as an outline I can turn into a presentation.
Draft a competitive analysis comparing Nike and Adidas across brand positioning, digital strategy, and customer engagement. Present it as an outline ready to convert into a PowerPoint deck.
Develop an employee onboarding overview that covers company culture, core values, and 30-day goals. Structure it as a presentation outline I can generate into slides.
Why this matters:
Business impact: Saves time turning working pages into presentations for reviews and updates.
Personal impact: Helps individuals present page content without manual slide creation.
Users can generate custom icons using AI Agent Builder using custom prompts, manually upload their own icon, or select from a set of pre-created icons. Roadmap ID: 502864 Details: What changed: Previously, users relied on default icons or manual uploads. AI-generated icons…
Users can generate custom icons using AI Agent Builder using custom prompts, manually upload their own icon, or select from a set of pre-created icons.
What changed: Previously, users relied on default icons or manual uploads. AI-generated icons are now available in Agent Builder, with size limits of 1 MB (192px).
Why: This feature simplifies icon creation and improves how agents visually represent their purpose.
Try this:
Enter a prompt to generate an icon with AI.
Use the agent description to generate an icon automatically.
Upload a custom icon or select a pre-created option.
Why this matters:
Business impact: Improves clarity and usability of custom agents.
Personal impact: Makes agent creation faster and more creative.
Copilot improves relevance and personalization by connecting user identities across multiple data sources. Details: What changed: Previously, identities from third party systems were not linked to the corresponding Microsoft identity, leading to poor response quality esp with people related queries. Copilot now…
Copilot improves relevance and personalization by connecting user identities across multiple data sources.
Details:
What changed: Previously, identities from third party systems were not linked to the corresponding Microsoft identity, leading to poor response quality esp with people related queries. Copilot now correlates identities across supported connectors, leading to more relevant and personalized responses.
Why: This ensures responses better reflect user context across systems.
Try this:
Ask Copilot about work spanning multiple connected tools.
Why this matters:
Business impact: Improves cross-system relevance and response quality in Copilot.
Personal impact: Delivers more accurate, personalized answers.
Developers can launch AI agents to the Copilot Agent Store effortlessly with no coding required. Roadmap ID: 501112 What Changed: Users have a one-click publishing flow from Azure AI Foundry to the Microsoft 365 Copilot Agent Store. No development experience is required…
Developers can launch AI agents to the Copilot Agent Store effortlessly with no coding required.
What Changed: Users have a one-click publishing flow from Azure AI Foundry to the Microsoft 365 Copilot Agent Store. No development experience is required and agents become instantly accessible.
Why: This enhancement accelerates the delivery of AI-powered solutions to frontline teams and improves deployment efficiency.
Try this:
In Azure AI Foundry, open your agent and click Publish to Copilot.
Confirm availability in Word, Teams, and other supported Microsoft 365 apps.
Why This Matters:
Business Impact: Accelerates delivery of tailored AI capabilities across the enterprise.
Personal Impact: Developers spend less time on integration work and more time innovating.
Agents in Copilot can now use other agents to accomplish work if configured. Users can see the interaction between agents. Details: What changed: Researcher and other agents could call simple APIs but not other AI agents. Now multiple agents will coordinate to…
Agents in Copilot can now use other agents to accomplish work if configured. Users can see the interaction between agents.
Details:
What changed: Researcher and other agents could call simple APIs but not other AI agents. Now multiple agents will coordinate to respond to the user's task.
Why: Multi-agent systems support more difficult work that requires multiple special AI systems.
Try this:
Administrators: Add some of your most-used agents to Researcher.
Users: Use Researcher on topics that require expertise from the agents available in Researcher's Sources menu.
Developers: Connect other Declarative Agents to your agent.
Why this matters:
Business impact: Streamlines complex, multi system workflows.
Personal impact: Makes interactions with multiple agents feel smoother.
A new report in Viva Glint highlights how employee sentiment relates to workplace patterns and drivers. Roadmap ID: 489229 Details: What changed: Previously, users relied on custom analysis. The Workplace Patterns report now provides out-of-the-box insights. Why: This accelerates access to actionable…
A new report in Viva Glint highlights how employee sentiment relates to workplace patterns and drivers.
Use the new Library in the Microsoft 365 Copilot app to easily find and manage your Copilot-created images and pages. Roadmap ID: 501783 What changed: A new centralized Library view in Copilot lets users access all their AI-generated assets in one place.…
Use the new Library in the Microsoft 365 Copilot app to easily find and manage your Copilot-created images and pages.
We updated the AI Disclaimer experience in Microsoft Copilot Chat based on customer feedback. To address this, we introduced an admin control that allows organizations to customize how the disclaimer appears, improving user awareness and flexibility. Details: What changed: The AI disclaimer…
We updated the AI Disclaimer experience in Microsoft Copilot Chat based on customer feedback. To address this, we introduced an admin control that allows organizations to customize how the disclaimer appears, improving user awareness and flexibility.
Details:
What changed: The AI disclaimer will remain visible in the user experience. Admins will gain the ability to heighten this message and to provide a link to their own documentation: The disclaimer will display bolded text for increased visibility. Admins can configure a custom URL pointing to their AI policy documentation.
Why: Organizations asked for more control over how the disclaimer appears to improve user awareness and flexibility.
Try this:
Review the new AI Disclaimer setting in the Admin Portal.
Decide whether you want to configure this setting for your organization.
If desired, prepare a custom URL to include in the UX.
Communicate this change to your helpdesk staff and Copilot users.
Update internal documentation if you reference the disclaimer experience.
Why this matters:
Business impact: Allows organizations to customize how the disclaimer appears.
Personal impact: Improves user awareness of the disclaimer.
Create more capable and context-aware Copilot agents powered by GPT-5, delivering richer responses and streamlined experiences for your users. Roadmap ID: 502552 Details: What changed: Declarative agents built in Microsoft 365 Copilot now use GPT-5 as the underlying chat model, enabling advanced…
Create more capable and context-aware Copilot agents powered by GPT-5, delivering richer responses and streamlined experiences for your users.
What changed: Declarative agents built in Microsoft 365 Copilot now use GPT-5 as the underlying chat model, enabling advanced reasoning, more natural language understanding, and improved multi-step processing.
Why: Organizations need AI-powered solutions that not only respond accurately but anticipate user needs. GPT-5 delivers higher precision and better handling of complex queries, resulting in agents that feel more responsive and intelligent, reducing repetitive follow-ups.
Try This:
Open Agent Builder in Microsoft 365 Copilot to create a new declarative agent that runs on GPT-5 as the foundation.
Configure your agent with domain-specific knowledge and test its ability to handle scenario-based queries.
Ask your new agent: "Help me draft a Q4 performance summary with recommendations based on last quarter's sales trends."
Why this matters:
Business Impact: Smarter agents mean streamlined workflows and faster completion of complex business processes, reducing time-to-value and improving ROI on AI initiatives.
Personal Impact: Users experience fewer frustrations when interacting with Copilot, getting precise answers and recommendations that fit their context-saving time and effort.
Integrate Dropbox with Copilot to access, retrieve, and manage files directly, regardless of where they are stored. Roadmap ID: 513282 What Changed: A new Copilot connector allows you to integrate Dropbox into the Microsoft 365 Copilot experience. Once connected, Copilot can retrieve…
Integrate Dropbox with Copilot to access, retrieve, and manage files directly, regardless of where they are stored.
What Changed: A new Copilot connector allows you to integrate Dropbox into the Microsoft 365 Copilot experience. Once connected, Copilot can retrieve and manage files stored in Dropbox and use them for context in responses.
Why: This update eliminates friction by letting Copilot work across locations, so users never waste time searching or switching services.
Try This:
In Copilot settings, enable the Dropbox connector and sign in with your account.
Ask Copilot, "Summarize the Q4 plan from my Dropbox folder."
Use Copilot in Word to insert insights from Dropbox files into a report.
Why it Matters:
Business Impact: Improve team efficiency by unifying data access across platforms, eliminating manual transfers.
Personal Impact: Create and edit content with ease by letting Copilot pull in what you need, including content from Dropbox.
Microsoft 365 Copilot can now connect with Guru to surface internal knowledge and team insights, enhancing team collaboration and decision-making. Roadmap ID: 513281 Details: What changed: Previously, Microsoft 365 Copilot operated with its standard integrations. With this update, users can connect Microsoft…
Microsoft 365 Copilot can now connect with Guru to surface internal knowledge and team insights, enhancing team collaboration and decision-making.
What changed: Previously, Microsoft 365 Copilot operated with its standard integrations. With this update, users can connect Microsoft 365 Copilot with Guru, allowing it to access and utilize internal knowledge bases and team insights directly within the workflow.
Why: This feature was added to leverage the wealth of internal knowledge and insights stored in Guru. By doing so, it enhances decision-making processes and streamlines access to valuable information for team members.
Try this:
Connect Microsoft 365 Copilot with Guru to start accessing your organization's internal knowledge base.
Use the Copilot Connector to query specific team insights and data stored in Guru.
Implement this connection in your workflow to improve collaboration and information retrieval during meetings or project planning.
Why this matters:
Business impact: Integrating Microsoft 365 Copilot with Guru enhances technological capabilities, optimizes workflow efficiency, and strengthens team collaboration by providing immediate access to critical insights.
Personal impact: Individual users benefit from quicker access to information and insights, aiding personal productivity and informed decision-making.
Copilot declarative agents can now integrate with richer M365 data: mail, people's data, Teams chats, and meeting transcripts. What Changed: Agents can now tap into richer Microsoft 365 data sources - email, Teams chats, meeting transcripts, and people data - to deliver…
Copilot declarative agents can now integrate with richer M365 data: mail, people's data, Teams chats, and meeting transcripts.
What Changed: Agents can now tap into richer Microsoft 365 data sources - email, Teams chats, meeting transcripts, and people data - to deliver more context-aware answers and automate tasks seamlessly.
Why: Modern work spans inboxes, chats, calendars, and documents. Constant switching slows teams down. By grounding declarative agents in organizational data, Copilot reduces context-switching, improves accuracy, and accelerates decision-making.
Try This:
Create a declarative agent that uses Meetings data to generate a project summary.
Sample query: "Summarize decisions and blockers from this week's meetings relating to Project X."
Create a declarative agent that uses Email data to draft emails.
Sample query: "Draft follow up emails for unresolved items from yesterday."
Why This Matters:
Business Impact: Teams works faster when Copilot agents bring context from across Microsoft 365 into one place. By reducing time spent searching through emails, chats and transcripts, organizations improve decision accuracy, accelerate workflows, and keep projects moving without delays.
Personal Impact: Users no longer need to juggle multiple tools to gather context. Copilot agents can consolidate multiple knowledge capabilities in one place, saving time and reducing cognitive load throughout the workday.
Agents built with Copilot Studio lite can generate PowerPoint decks, Excel spreadsheets, and Word documents via chat, with files saved to OneDrive. Roadmap ID: 506753 Details: What changed: Office skills are available in Copilot Studio lite. Users can chat with an agent…
Agents built with Copilot Studio lite can generate PowerPoint decks, Excel spreadsheets, and Word documents via chat, with files saved to OneDrive.
What changed: Office skills are available in Copilot Studio lite. Users can chat with an agent to generate PowerPoint, Excel, and Word files. Files are saved to OneDrive to streamline organization and support retention policies. These skills are part of the "Generate code, graphs, and documents" capability (formerly known as Code Interpreter).
Why: Automating common document tasks helps teams move faster and maintain consistency, while OneDrive storage supports governance needs.
Try this:
Ask your agent to create a Word document with a project outline.
Request an Excel spreadsheet with labeled columns for status tracking.
Generate a PowerPoint deck with section titles for an upcoming review.
Why this matters:
Business impact: Reduces manual document creation time and supports compliant storage.
Personal impact: Makes everyday document tasks quicker and easier.
Quickly find meetings scheduled by a specific person to review or prioritize your calendar. Roadmap ID: 503859 What changed: Copilot Chat now lets you search your calendar for meetings organized by a specific individual. Why: Helps users locate calendar items and prioritize…
Quickly find meetings scheduled by a specific person to review or prioritize your calendar.
Admins can now define ACL permission rules per table for ServiceNow ticket ingestion, reducing setup complexity. Details: What changed: Previously, permissions were selected for all tables combined. Now, admins define permission rules for each selected table, improving control and clarity. Why: Per-table…
Admins can now define ACL permission rules per table for ServiceNow ticket ingestion, reducing setup complexity.
Details:
What changed: Previously, permissions were selected for all tables combined. Now, admins define permission rules for each selected table, improving control and clarity.
Why: Per-table ACL rules simplify configuration and provide finer-grained access control aligned with data security practices.
Try this:
Set ACL permissions for a single table that requires restricted access.
Review and adjust table-level rules to match ingestion needs.
Validate table permissions to ensure correct access during ingestion.
Why this matters:
Business impact: Reduces configuration complexity and improves security alignment for ticket data.
Personal impact: Helps individuals manage permissions more clearly and confidently.
Connect Google Drive to Copilot for smooth collaboration in multiple clouds. What Changed: Copilot can access, reference, and combine insights from Google Drive files, allowing for richer, cross-platform collaboration. Why: This feature ensures Copilot brings content from different sources together, reducing complexity…
Connect Google Drive to Copilot for smooth collaboration in multiple clouds.
What Changed: Copilot can access, reference, and combine insights from Google Drive files, allowing for richer, cross-platform collaboration.
Why: This feature ensures Copilot brings content from different sources together, reducing complexity and improving workflow.
Try This:
Add Google Drive as a connector in Copilot settings.
Ask Copilot in Word, "Combine insights from my Google Drive marketing plan and recent reports."
Use Copilot in PowerPoint to create a slide pulling directly from Google Drive data.
Why it Matters:
Business Impact: Improves cross-platform workflows in hybrid environments
Personal Impact: Minimizes context switching and increases document creation efficiency
ServiceNow Knowledge Connector now ingests articles created using out-of-the-box and custom templates, expanding coverage and flexibility. Roadmap ID: 505436 Details: What changed: Previously, template-based knowledge articles were not ingested. The connector now supports out-of-the-box templates such as FAQ, How to, and What…
ServiceNow Knowledge Connector now ingests articles created using out-of-the-box and custom templates, expanding coverage and flexibility.
What changed: Previously, template-based knowledge articles were not ingested. The connector now supports out-of-the-box templates such as FAQ, How to, and What is, as well as custom templates used by customers.
Why: Supporting common and custom templates ensures more knowledge content is accessible, improving search and guidance quality.
Try this:
Ingest FAQ template articles to improve self-service answers.
Include How to articles to guide users through procedures.
Add custom template articles to reflect organizational standards.
Why this matters:
Business impact: Broadens access to structured knowledge and improves help coverage for teams.
Personal impact: Makes it easier for individuals to find accurate, template-based guidance.
We’re pleased to announce the general availability of object-level Source of Authority (SOA) switching for Microsoft Entra ID. With this feature, administrators can transition individual users from being synced with Active Directory (AD) to becoming cloud-managed accounts within Microsoft Entra ID. These…
We’re pleased to announce the general availability of object-level Source of Authority (SOA) switching for Microsoft Entra ID. With this feature, administrators can transition individual users from being synced with Active Directory (AD) to becoming cloud-managed accounts within Microsoft Entra ID. These users are no longer tied to AD sync and behave like native cloud users, giving you greater flexibility and control. This capability enables organizations to gradually reduce dependence on AD and simplify migration to the cloud, all while minimizing disruption for users and daily operations. Both Microsoft Entra Connect Sync and Cloud Sync fully support this SOA switch, ensuring a smooth transition process.
In Entra External ID (EEID), customers can create a single, tenant-wide, customized branding experience that applies to all apps. We're introducing a concept of Branding "themes" to allow customers to create different branding experiences for specific applications. A new Live Preview feature…
In Entra External ID (EEID), customers can create a single, tenant-wide, customized branding experience that applies to all apps. We're introducing a concept of Branding "themes" to allow customers to create different branding experiences for specific applications. A new Live Preview feature also helps quickly visualize the changes before saving. For more information, see: Customize the sign‑in experience for your application with branding themes.
Admins can directly block malicious domains and email addresses from within the Microsoft Defender portal, seamlessly adding targeted entries to the Teams Admin Center (TAC) blocked domains and users list. This capability enables near real-time protection. When suspicious or abusive external organizations…
Admins can directly block malicious domains and email addresses from within the Microsoft Defender portal, seamlessly adding targeted entries to the Teams Admin Center (TAC) blocked domains and users list. This capability enables near real-time protection. When suspicious or abusive external organizations are identified, SOC teams can immediately block them, effectively halting new external chat messages, invites, and channel communications from those domains and senders while deleting existing ones.
We are pleased to announce the general availability of client credentials in Entra External ID. The OAuth 2.0 client credentials grant flow permits a web service (confidential client) to use its own credentials, instead of impersonating a user, to authenticate when calling…
We are pleased to announce the general availability of client credentials in Entra External ID. The OAuth 2.0 client credentials grant flow permits a web service (confidential client) to use its own credentials, instead of impersonating a user, to authenticate when calling another web service. Permissions are granted directly to the application itself by an administrator.
Billing: When you configure machine-to-machine (M2M) authentication for Microsoft Entra External ID, you must use the M2M Premium add‑on. Review your organization’s premium add‑on usage policy to understand cost implications and ensure the implementation complies with internal governance and licensing guidelines. For more information, see: Microsoft identity platform and the OAuth 2.0 client credentials flow.
View meeting recaps in your desired format with customized recap summaries, available with a Microsoft Copilot license. Choose a ready-made summary template or create your own. To learn more, see Customize recap summaries in Microsoft Teams.
View meeting recaps in your desired format with customized recap summaries, available with a Microsoft Copilot license. Choose a ready-made summary template or create your own. To learn more, see Customize recap summaries in Microsoft Teams.
To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes several changes and enhancements (learn more).Note: These changes are not yet visible to government cloud customers. Documentation: Device vulnerabilities report
To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes several changes and enhancements (learn more).Note: These changes are not yet visible to government cloud customers.
Bring MFA to on‑premises applications when accessed from on‑premises, i.e., local‑to‑local access, while safeguarding domain controllers against identity threats. Enable secure access to private apps that use domain controllers for Kerberos authentication. For more information, see: Configure Microsoft Entra Private Access for…
Bring MFA to on‑premises applications when accessed from on‑premises, i.e., local‑to‑local access, while safeguarding domain controllers against identity threats. Enable secure access to private apps that use domain controllers for Kerberos authentication. For more information, see: Configure Microsoft Entra Private Access for Active Directory domain controllers.
Zero-hour-auto-purge (ZAP) and admin management of quarantined Teams messages is available to Microsoft Defender for Plan 1 by default, bringing a post-delivery protection layer.
The Files tab in channels is now the Shared tab. There, you can find files and links that were shared in the channel. To learn more, see Share files in Microsoft Teams.
The Files tab in channels is now the Shared tab. There, you can find files and links that were shared in the channel. To learn more, see Share files in Microsoft Teams.
Microsoft Entra Conditional Access is strengthening how policies that target All resources with resource exclusions are enforced in a narrow set of authentication flows. After this change, in user sign‑ins where a client application requests only OIDC or specific directory scopes, Conditional…
Microsoft Entra Conditional Access is strengthening how policies that target All resources with resource exclusions are enforced in a narrow set of authentication flows. After this change, in user sign‑ins where a client application requests only OIDC or specific directory scopes, Conditional Access policies that target All resources with one or more resource exclusions, or policies that explicitly target Azure AD Graph, will be enforced. This ensures that policies are consistently applied regardless of the scope set requested by the client application. For more information, see: New Conditional Access behavior when an ALL resources policy has a resource exclusion.
In advanced hunting, if the query result exceeds the 64-MB size limit, the portal now returns the maximum number of records it can within this limit and displays a message indicating that the displayed results are partial due to size constraints.
In advanced hunting, if the query result exceeds the 64-MB size limit, the portal now returns the maximum number of records it can within this limit and displays a message indicating that the displayed results are partial due to size constraints. Learn more
Help protect your org against phishing and other unwanted messages by flagging suspicious messages or confirming that messages flagged by Teams are safe.
Help protect your org against phishing and other unwanted messages by flagging suspicious messages or confirming that messages flagged by Teams are safe.
Pin your Teams window on top in your desktop to always keep it visible above other open windows. Just select Settings and more > Pin window on top in Teams.
Pin your Teams window on top in your desktop to always keep it visible above other open windows. Just select Settings and more > Pin window on top in Teams.
Enforcement for the Microsoft Entra ID Governance guest billing meter is now in effect for Entitlement Management and Lifecycle Workflows (Access Reviews will be enforced later in CY26 Q1). To keep using Entra ID Governance premium features for guest users in workforce…
Enforcement for the Microsoft Entra ID Governance guest billing meter is now in effect for Entitlement Management and Lifecycle Workflows (Access Reviews will be enforced later in CY26 Q1). To keep using Entra ID Governance premium features for guest users in workforce tenants, you must link a valid Azure subscription to activate the Microsoft Entra ID Governance for guests add-on. If a subscription isn’t linked, creation or updates of new guest-scoped governance configurations will be restricted (for example, certain access package policies, access reviews, and lifecycle workflows), and guest-specific governance actions may fail until billing is configured.
Schedule follow-up meetings from your emails. When you use the add-on to schedule a meeting from a specific email, the subject and participants are automatically prepopulated to make meeting scheduling easier.
Schedule follow-up meetings from your emails. When you use the add-on to schedule a meeting from a specific email, the subject and participants are automatically prepopulated to make meeting scheduling easier.
New audit log properties now make it easy for admins to understand why a service principal was created and who or what triggered it. The logs now surface the provisioning mechanism, the specific SKUs or service plans that enabled just‑in‑time creation, and…
New audit log properties now make it easy for admins to understand why a service principal was created and who or what triggered it. The logs now surface the provisioning mechanism, the specific SKUs or service plans that enabled just‑in‑time creation, and the home tenant of the app registration. This helps admins quickly distinguish Microsoft‑driven provisioning from tenant‑driven activity, streamlining alerting and investigations into newly created service principals. For more information, see:
EEID admins can configure persistent browser session and sign‑in frequency in Conditional Access. For more information, see Conditional Access: Manage Session Controls Effectively.
The BehaviorInfo and BehaviorEntities tables in advanced hunting now include additional columns and information about behavior data types and alerts from User and Entity Behavior Analytics (UEBA), providing more insights on the relationships between identified behaviors and entities.
The BehaviorInfo and BehaviorEntities tables in advanced hunting now include additional columns and information about behavior data types and alerts from User and Entity Behavior Analytics (UEBA), providing more insights on the relationships between identified behaviors and entities. Learn more about UEBA behaviors
Copilot Chat delivers faster, smarter results using GPT-5 as the default model. Details: What Changed: All Copilot Chat experiences run on GPT-5 by default. Copilot automatically routes prompts to the best-performing models for each task, using fast models for basic tasks and…
Copilot Chat delivers faster, smarter results using GPT-5 as the default model.
Details:
What Changed: All Copilot Chat experiences run on GPT-5 by default. Copilot automatically routes prompts to the best-performing models for each task, using fast models for basic tasks and specialized reasoning models for multi-step requests.
Why: Users want speed, accuracy, and minimal friction. This update helps to ensure consistent, high-quality AI interactions in Copilot Chat.
Try This:
"Get me up to speed on the latest plans related to [project/initiative]. Help me think through what to do next."
"Use the attached spreadsheet with customer feedback to create a polished executive report that helps upper management decide where to prioritize resources in our next cycle."
Why this matters:
Business Impact: Increases accuracy and productivity, helping teams make strong decisions and complete complex work faster.
Personal Impact: Removes friction by letting Copilot choose the best model--fast or reasoning--for the prompt.
Agent Builder now supports file uploads up to 512 MB when creating agents, ideal for larger files. Roadmap ID: 500375 Details: What Changed: This increases the upload size limit in Agent Builder to 512 MB, enabling use of larger files as grounding…
Agent Builder now supports file uploads up to 512 MB when creating agents, ideal for larger files.
See when Interpreter initializes so you can start speaking at the right time with Interpreter's new "Preparing" status. To learn more, see Interpreter in Microsoft Teams meetings.
See when Interpreter initializes so you can start speaking at the right time with Interpreter's new "Preparing" status. To learn more, see Interpreter in Microsoft Teams meetings.
By using tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries.
Advanced hunting now supports custom functions that use tabular parameters. By using tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries. Learn more
Your spoken language can now be detected across Interpreter, live captions, and live transcription when Interpreter is turned on. To learn more, see Interpreter in Microsoft Teams meetings.
Your spoken language can now be detected across Interpreter, live captions, and live transcription when Interpreter is turned on. To learn more, see Interpreter in Microsoft Teams meetings.
CVE exceptions are now generally available, and also support the False positive justification and the status field as part of the response for the GET /api/vulnerabilities request. Learn more.
Microsoft Security Copilot in Microsoft Defender now includes the Dynamic Threat Detection Agent, an always-on, adaptive backend service that uncovers hidden threats across Defender and Microsoft Sentinel environments.
Microsoft Security Copilot in Microsoft Defender now includes the Dynamic Threat Detection Agent, an always-on, adaptive backend service that uncovers hidden threats across Defender and Microsoft Sentinel environments. Learn more
This agent delivers a complete, conversational threat hunting experience by not only generating queries but also interpreting results, surfacing insights, and guiding you through full hunting sessions.
Microsoft Security Copilot in Microsoft Defender now lets you hunt for threats by using natural language with the Threat Hunting Assistant. This agent delivers a complete, conversational threat hunting experience by not only generating queries but also interpreting results, surfacing insights, and guiding you through full hunting sessions.
Now, joining a private group by code requires direct approval by one of the group owners, ensuring more security and the prevention of unauthorized access to private groups. To learn more, see Use a link or code to join a team in…
Now, joining a private group by code requires direct approval by one of the group owners, ensuring more security and the prevention of unauthorized access to private groups. To learn more, see Use a link or code to join a team in Microsoft Teams.
Open core Teams functions in their own windows to transition seamlessly between your Teams chat, calendar, activity, and more. Simply right-click an icon in Teams and select Open in new window .
Open core Teams functions in their own windows to transition seamlessly between your Teams chat, calendar, activity, and more. Simply right-click an icon in Teams and select Open in new window .
Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques: - Disable Remote Registry service on Windows: Prevents remote access to the Windows registry, reducing attack surface and blocking unauthorized configuration changes, privilege escalation, and lateral…
Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques: - Disable Remote Registry service on Windows: Prevents remote access to the Windows registry, reducing attack surface and blocking unauthorized configuration changes, privilege escalation, and lateral movement. - Disable NTLM authentication for Windows workstations: Helps prevent credential theft and lateral movement attacks by removing support for an outdated and insecure protocol.
It generates threat intelligence briefings based on the latest threat actor activity and both internal and external vulnerability information in a matter of minutes, helping security teams save time by creating customized, relevant reports.
The Microsoft Security Copilot Threat Intelligence Briefing Agent in Microsoft Defender is now generally available. It generates threat intelligence briefings based on the latest threat actor activity and both internal and external vulnerability information in a matter of minutes, helping security teams save time by creating customized, relevant reports.
The FileMaliciousContentInfo table contains information about files that Microsoft Defender for Office 365 processed in SharePoint Online, OneDrive, and Microsoft Teams.
The following advanced hunting schema tables are now available for preview:
The CampaignInfo table contains information about email campaigns identified by Microsoft Defender for Office 365.
The FileMaliciousContentInfo table contains information about files that Microsoft Defender for Office 365 processed in SharePoint Online, OneDrive, and Microsoft Teams.
It also now has two new predefined threat scenarios that you can use to render your hunts as interactive graphs.
The hunting graph in advanced hunting is now generally available. It also now has two new predefined threat scenarios that you can use to render your hunts as interactive graphs.
This response action blocks sensitive interfaces that allow lateral movement and privilege escalation.
A new Restrict pod access response action is now available when investigating container threats in the Defender portal. This response action blocks sensitive interfaces that allow lateral movement and privilege escalation.
When you join a Teams Room on Android, see either the attendee or presenter view on the front-of-room display. Presenters can bring people on and off screen, manage the green room, and switch the front-of-room display view. To learn more, see Host…
When you join a Teams Room on Android, see either the attendee or presenter view on the front-of-room display. Presenters can bring people on and off screen, manage the green room, and switch the front-of-room display view. To learn more, see Host an event from a Microsoft Teams Room (MTR).
Custom data collection enables organizations to expand and customize telemetry collection beyond default configurations to support specialized threat hunting and security monitoring needs.
Defender XDR now includes the predictive shielding capability, which uses predictive analytics and real-time insights to dynamically infer risk, anticipate attacker progression, and harden your environment before threats materialize.
Defender XDR now includes the predictive shielding capability, which uses predictive analytics and real-time insights to dynamically infer risk, anticipate attacker progression, and harden your environment before threats materialize. Learn more
The new Defender deployment tool is a lightweight, self-updating application that streamlines onboarding devices to the Defender endpoint security solution. The tool takes care of prerequisites, automates migrations from older solutions, and removes the need for complex onboarding scripts, separate downloads, and…
The new Defender deployment tool is a lightweight, self-updating application that streamlines onboarding devices to the Defender endpoint security solution. The tool takes care of prerequisites, automates migrations from older solutions, and removes the need for complex onboarding scripts, separate downloads, and manual installations. It supports Windows and Linux devices.
A Defender for endpoint security solution is now available for legacy Windows 7 SP1 and Windows Server 2008 R2 SP1 devices. The solution provides advanced protection capabilities and improved functionality for these devices compared to other solutions. The new solution is available…
A Defender for endpoint security solution is now available for legacy Windows 7 SP1 and Windows Server 2008 R2 SP1 devices. The solution provides advanced protection capabilities and improved functionality for these devices compared to other solutions. The new solution is available using the new Defender deployment tool.
Facilitator can recognize agendas shared in chat and create live progress trackers in meetings to keep everything on track. If someone invited to a meeting hasn't joined and their name comes up twice in conversation, Facilitator politely nudges them to join in…
Facilitator can recognize agendas shared in chat and create live progress trackers in meetings to keep everything on track.
If someone invited to a meeting hasn't joined and their name comes up twice in conversation, Facilitator politely nudges them to join in chat.
When someone forwards a message, it will now include a link that takes the recipient straight to the original chat or channel it came from. To learn more, see Forward a message in Microsoft Teams.
When someone forwards a message, it will now include a link that takes the recipient straight to the original chat or channel it came from. To learn more, see Forward a message in Microsoft Teams.
View data about a town hall's video quality, audio clarity, and connection stability to ensure smooth content delivery during events. Available with a Teams Premium license.
View data about a town hall's video quality, audio clarity, and connection stability to ensure smooth content delivery during events. Available with a Teams Premium license.
No need to switch apps to make Teams calls—set Teams as your default calling app to automatically route all your calls through Teams mobile. To learn more, see Getting started with Microsoft Teams Phone Mobile.
No need to switch apps to make Teams calls—set Teams as your default calling app to automatically route all your calls through Teams mobile. To learn more, see Getting started with Microsoft Teams Phone Mobile.
Our most immersive virtual event experience yet is here—join immersive events from a Meta Quest VR headset to feel like you're standing right there in the room. To learn more, see Attend an immersive event in Microsoft Teams.
Our most immersive virtual event experience yet is here—join immersive events from a Meta Quest VR headset to feel like you're standing right there in the room. To learn more, see Attend an immersive event in Microsoft Teams.
To view these alert types, you must have the Security Administrator or higher role. The Service Source, Detection Source, and Product Name values for these alerts are listed as Microsoft Threat Intelligence.
Microsoft Sentinel customers using the Defender portal, or the Azure portal with the Microsoft Sentinel Defender XDR data connector, now also benefit from Microsoft Threat Intelligence alerts that highlight activity from nation-state actors, major ransomware campaigns, and fraudulent operations. To view these alert types, you must have the Security Administrator or higher role. The Service Source, Detection Source, and Product Name values for these alerts are listed as Microsoft Threat Intelligence. For more information, see Incidents and alerts in the Microsoft Defender portal.
Use Copilot in Teams to generate messages, and insights from chat and channel history and calendar content. Available with a Microsoft Copilot license. To learn more, see Get started with Microsoft Copilot Chat in Teams.
Use Copilot in Teams to generate messages, and insights from chat and channel history and calendar content. Available with a Microsoft Copilot license. To learn more, see Get started with Microsoft Copilot Chat in Teams.
Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques:- Require LDAP client signing or Require LDAP server signing: Helps ensure integrity of directory requests so attackers cannot tamper with or manipulate group memberships or permissions…
Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques:- Require LDAP client signing or Require LDAP server signing: Helps ensure integrity of directory requests so attackers cannot tamper with or manipulate group memberships or permissions in transit. - Encrypt LDAP client traffic: Prevents exposure of credentials and sensitive user information by enforcing encrypted communication instead of clear-text LDAP.- Enforce LDAP channel binding: Stops adversaries from hijacking or relaying authentication sessions by binding NTLM authentication to a secure TLS channel.
Defender for Endpoint now includes the GPO hardening and Safeboot hardening response actions. These actions are part of the predictive shielding feature, which anticipates and mitigates potential threats before they materialize.
Defender for Endpoint now includes the GPO hardening and Safeboot hardening response actions. These actions are part of the predictive shielding feature, which anticipates and mitigates potential threats before they materialize.
Joining from a Mac? Share your screen and present content using the standard native picker experience when you opt in through settings. To learn more, see Present content in Microsoft Teams meetings.
Joining from a Mac? Share your screen and present content using the standard native picker experience when you opt in through settings. To learn more, see Present content in Microsoft Teams meetings.
Need to change a specific setting? Search for it in the settings search bar—no navigation necessary. Just type in a keyword, like "notifications" or "dark mode," to go straight to that option. Organize and collaborate in chat and channels Add existing Loop…
Need to change a specific setting? Search for it in the settings search bar—no navigation necessary. Just type in a keyword, like "notifications" or "dark mode," to go straight to that option.
Organize and collaborate in chat and channels
Add existing Loop components and pages to channels for more organized, contextual places to work.
Take notes in 1:1 and group chats that only chat members can see to centralize information. Add images, @mention members to get their attention, and more.
Give your chat and channel sections more personality and visibility by adding emoji to their names. Just select the section icon and choose Change icon .
Now, Teams actively protects against potentially harmful links by automatically detecting and warning against malicious URLs shared in Teams chats and channels.
Now, Teams actively protects against potentially harmful links by automatically detecting and warning against malicious URLs shared in Teams chats and channels.
Now, Teams actively protects against potentially harmful links by automatically detecting and warning against malicious files and URLS shared in Teams chats and channels. When a link is incorrectly identified as a potential threat, flag it to help improve Teams' detection accuracy.
Now, Teams actively protects against potentially harmful links by automatically detecting and warning against malicious files and URLS shared in Teams chats and channels.
When a link is incorrectly identified as a potential threat, flag it to help improve Teams' detection accuracy.
This table contains information about account information from various sources, including Microsoft Entra ID. It also includes information and link to the identity that owns the account.
The IdentityAccountInfo table in advanced hunting is now available for preview. This table contains information about account information from various sources, including Microsoft Entra ID. It also includes information and link to the identity that owns the account.
The overview section of threat analytics now includes additional details about a threat, such as alias, origin, and related intelligence, providing you with more insights on what the threat is and how it might impact your organization.
The overview section of threat analytics now includes additional details about a threat, such as alias, origin, and related intelligence, providing you with more insights on what the threat is and how it might impact your organization.
Microsoft researchers update these IOCs in real time as they find new evidence related to the threat. This information helps your security operations center (SOC) and threat intelligence analysts with remediation and proactive hunting.
Threat analytics now has an Indicators tab that provides a list of all indicators of compromise (IOCs) associated with a threat. Microsoft researchers update these IOCs in real time as they find new evidence related to the threat. This information helps your security operations center (SOC) and threat intelligence analysts with remediation and proactive hunting. Learn more
The Vulnerability Management section in the Microsoft Defender portal is now located under Exposure management. This change is part of the vulnerability management integration to Microsoft Security Exposure Management, which significantly expands the scope and capabilities of the platform. Learn more.
The Vulnerability Management section in the Microsoft Defender portal is now located under Exposure management. This change is part of the vulnerability management integration to Microsoft Security Exposure Management, which significantly expands the scope and capabilities of the platform. Learn more.
Quickly insert an emoji into your posts and messages using the updated emoji keyboard shortcut. Just type “:”, followed by the name of the emoji, then type “:” again.
Quickly insert an emoji into your posts and messages using the updated emoji keyboard shortcut. Just type “:”, followed by the name of the emoji, then type “:” again.
You can now use CVE exceptions to exclude specific Common Vulnerabilities and Exposures (CVEs) from analysis in your environment. CVE exceptions allow you to control what type of data is relevant to your organization and to selectively exclude certain data from your…
You can now use CVE exceptions to exclude specific Common Vulnerabilities and Exposures (CVEs) from analysis in your environment. CVE exceptions allow you to control what type of data is relevant to your organization and to selectively exclude certain data from your remediation efforts. For more information, see Exceptions in Microsoft Defender Vulnerability Management and Create, view, and manage exceptions.
Now available with a Copilot license, you can view concise summaries of shared files in chat to get context without opening them. To view a file's Copilot summary, select Summarize for me on the file thumbnail. To learn more, see Use Copilot in Microsoft Teams chat and channels.
Now available with a Copilot license, you can view concise summaries of shared files in chat to get context without opening them. To view a file's Copilot summary, select Summarize for me on the file thumbnail. To learn more, see Use Copilot in Microsoft Teams chat and channels.
When you enter a feedback rating from your certified Teams Phone device, Teams will suggest tailored text prompts to help you quickly share what’s working well or needs improvement.
When you enter a feedback rating from your certified Teams Phone device, Teams will suggest tailored text prompts to help you quickly share what’s working well or needs improvement.
Ensure smooth call transfers with your certified Teams Phone devices with our improved interface, including the option to Consult first (speak with the recipient before transferring the call to them) and live updates that indicate when a transfer is in-progress and when it’s complete. To learn more, see Transfer a call in…
Ensure smooth call transfers with your certified Teams Phone devices with our improved interface, including the option to Consult first (speak with the recipient before transferring the call to them) and live updates that indicate when a transfer is in-progress and when it’s complete. To learn more, see Transfer a call in Microsoft Teams.
The Isolation exclusions feature is now generally available. Isolation exclusions allow designated processes or endpoints to bypass the restrictions of network isolation. This ensures that essential functions can continue while broader network exposure is limited.
The Isolation exclusions feature is now generally available. Isolation exclusions allow designated processes or endpoints to bypass the restrictions of network isolation. This ensures that essential functions can continue while broader network exposure is limited.
Take a break from your screen and catch up on meetings with podcast-style audio recaps. This feature utilizes AI to transform meeting transcripts into engaging audio summaries. Available with Microsoft 365 and Microsoft Copilot licenses. To learn more, see Listen to audio recaps of your meetings.
Take a break from your screen and catch up on meetings with podcast-style audio recaps. This feature utilizes AI to transform meeting transcripts into engaging audio summaries. Available with Microsoft 365 and Microsoft Copilot licenses. To learn more, see Listen to audio recaps of your meetings.
Each report also now includes investigation summaries for nearly every hunt that Defender Experts conduct in your environment, regardless of whether they identified a confirmed threat.
Microsoft Defender Experts Hunting reports now include an Emerging threats section that details the proactive, hypothesis-based hunts Defender Experts conducted in your environment. Each report also now includes investigation summaries for nearly every hunt that Defender Experts conduct in your environment, regardless of whether they identified a confirmed threat.
The tab visualizes the data according to the incidents' severity, MITRE tactic, and threat type. This section gives you insight into how Defender Experts are tangibly improving your security operations by showing important operational metrics on a month-over-month basis.
Microsoft Defender Experts MDR reports now include a Trends tab that provides you with the monthly volume of investigated and resolved incidents for the last six months. The tab visualizes the data according to the incidents' severity, MITRE tactic, and threat type. This section gives you insight into how Defender Experts are tangibly improving your security operations by showing important operational metrics on a month-over-month basis.
Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques:- Block web shell creation on servers (reduces the risk of web-based persistence and remote code execution attacks)- Block use of copied or impersonated system tools (helps…
Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques:- Block web shell creation on servers (reduces the risk of web-based persistence and remote code execution attacks)- Block use of copied or impersonated system tools (helps prevent attacker misuse of legitimate administrative utilities for lateral movement or privilege escalation)- Block rebooting a machine in Safe Mode: Helps defend against attackers who attempt to disable endpoint protection or persist through reboots.
Access Intelligent recap for recorded or transcribed calls in Teams. Select Calls in Teams and find the call in your call history. Then, select View recap to open the call’s Intelligent recap and see AI summaries, notes, and more. To learn more, see Recap in Microsoft Teams.
Access Intelligent recap for recorded or transcribed calls in Teams. Select Calls in Teams and find the call in your call history. Then, select View recap to open the call’s Intelligent recap and see AI summaries, notes, and more. To learn more, see Recap in Microsoft Teams.
Defender for Endpoint now supports streamlined connectivity for US government cloud environments. This enhancement simplifies onboarding by reducing the number of required service endpoints and improves reliability across restricted networks. For more information, see the required connectivity settings. Documentation: Streamlined connectivity support…
Defender for Endpoint now supports streamlined connectivity for US government cloud environments. This enhancement simplifies onboarding by reducing the number of required service endpoints and improves reliability across restricted networks. For more information, see the required connectivity settings.
These actions, previously only available in Threat Explorer, are now accessible via custom queries in Advanced Hunting, enabling security teams to take investigative and response actions more efficiently and programmatically.
This update introduces the ability to perform Submit to Microsoft, Add to TABL and Initiate automated investigation actions directly from the Advanced Hunting interface in Microsoft Defender XDR. These actions, previously only available in Threat Explorer, are now accessible via custom queries in Advanced Hunting, enabling security teams to take investigative and response actions more efficiently and programmatically.
Quickly catch up on posts and threaded channels with thread summaries by Copilot. Thread summaries include key takeaways and a list organized by topic for easy scanning. Available with a Microsoft Copilot license.
Quickly catch up on posts and threaded channels with thread summaries by Copilot. Thread summaries include key takeaways and a list organized by topic for easy scanning. Available with a Microsoft Copilot license.
Private chat between organizers, co-organizers, and presenters is now available before, during, and after webinars, giving time and privacy for coordinating and preparing for the event.
Private chat between organizers, co-organizers, and presenters is now available before, during, and after webinars, giving time and privacy for coordinating and preparing for the event.
This feature generates an interactive graph showing possible propagation paths from the selected node to predefined critical targets scoped to the user’s permissions.
Investigate incidents by using Blast radius analysis, which is an advanced graph visualization built on the Microsoft Sentinel data lake and graph infrastructure. This feature generates an interactive graph showing possible propagation paths from the selected node to predefined critical targets scoped to the user’s permissions.
When meeting transcription is turned off, live captions and RTT will now only show the past five minutes of dialogue instead of the full meeting to protect information. Also, a previous issue that caused data loss when changing caption position has been resolved.
When meeting transcription is turned off, live captions and RTT will now only show the past five minutes of dialogue instead of the full meeting to protect information. Also, a previous issue that caused data loss when changing caption position has been resolved.
Known, malicious URLs in Teams messages are delivered with a warning. Messages found to contain malicious URLs up to 48 hours after delivery also receive a warning. The warning is added to messages in internal and external chats and channels for all…
Known, malicious URLs in Teams messages are delivered with a warning. Messages found to contain malicious URLs up to 48 hours after delivery also receive a warning. The warning is added to messages in internal and external chats and channels for all URL verdicts (not just malware or high confidence phishing).
Select Controls in your meeting controls for quicker access to key organizer meeting options, like lobby settings, attendee mic and camera access, and more. Select View more options for a complete list of customizations.
Select Controls in your meeting controls for quicker access to key organizer meeting options, like lobby settings, attendee mic and camera access, and more. Select View more options for a complete list of customizations.
Keep information confidential in Teams meetings with Prevent Screen Capture. When Prevent Screen Capture is turned on, the meeting window will turn black if someone attempts to capture the screen. Available in meetings organized with a Teams Premium license.
Keep information confidential in Teams meetings with Prevent Screen Capture. When Prevent Screen Capture is turned on, the meeting window will turn black if someone attempts to capture the screen. Available in meetings organized with a Teams Premium license.
Add Facilitator, a meeting AI agent, to your Teams meetings to keep them running smoothly and efficiently. Facilitator reminds participants about agenda items and time remaining, captures real-time notes, and much more. Available with a Microsoft Copilot license. To learn more, see Facilitator in Microsoft Teams meetings.
Add Facilitator, a meeting AI agent, to your Teams meetings to keep them running smoothly and efficiently. Facilitator reminds participants about agenda items and time remaining, captures real-time notes, and much more. Available with a Microsoft Copilot license. To learn more, see Facilitator in Microsoft Teams meetings.
Know your mic's audio levels with the real-time feedback indicator in Teams meetings. In your meeting controls, you’ll see the Mic icon fluctuate with your volume levels. You can also select Mic to see the feedback in more detail.
Know your mic's audio levels with the real-time feedback indicator in Teams meetings. In your meeting controls, you’ll see the Mic icon fluctuate with your volume levels. You can also select Mic to see the feedback in more detail.
Keep meetings on track with countdown timers. When someone starts a countdown timer, everyone will see in their meeting window and be able to start, stop, pause, or add more time.
Keep meetings on track with countdown timers. When someone starts a countdown timer, everyone will see in their meeting window and be able to start, stop, pause, or add more time.
View channel conversations as threads to easily reply to specific messages and keep related conversations grouped in one place. Follow threads to stay informed and view relevant updates in the Followed Threads view. To learn more, see Follow threads in Microsoft Teams.
View channel conversations as threads to easily reply to specific messages and keep related conversations grouped in one place. Follow threads to stay informed and view relevant updates in the Followed Threads view. To learn more, see Follow threads in Microsoft Teams.
Stay in sync when you attend town halls with ultra-low latency, available in events organized with a Teams Premium license. With ultra-low latency, you’ll see organizers, presenters, and shared content in near real-time.
Stay in sync when you attend town halls with ultra-low latency, available in events organized with a Teams Premium license. With ultra-low latency, you’ll see organizers, presenters, and shared content in near real-time.
Tasks are displayed alongside Security Copilot insights, guided responses, and reports - giving your team a unified view of progress and next steps. When you onboard Microsoft Sentinel to the Defender portal, tasks you create in Microsoft Sentinel through the Azure portal…
Use tasks in the Microsoft Defender portal to break down incident investigations into actionable steps and assign them across your operations teams. Tasks are displayed alongside Security Copilot insights, guided responses, and reports - giving your team a unified view of progress and next steps. When you onboard Microsoft Sentinel to the Defender portal, tasks you create in Microsoft Sentinel through the Azure portal are automatically synchronized to the Defender portal. For more information, see Streamline incident response using tasks in the Microsoft Defender portal (Preview)
Users can report external and intra-org Microsoft Teams messages as non-malicious (not a security risk) from the following locations: Chats Standard, shared, and private channels Meeting conversations
Users can report external and intra-org Microsoft Teams messages as non-malicious (not a security risk) from the following locations:
Enables organizations to update security intelligence (antivirus definitions/signatures) on macOS endpoints offline from a local mirror server. Documentation: Configure offline security intelligence updates for Microsoft Defender for Endpoint on macOS
Enables organizations to update security intelligence (antivirus definitions/signatures) on macOS endpoints offline from a local mirror server.
Make keyboard shortcuts your own by customizing commands or choosing a preset layout. In Teams, select Settings and more > Keyboard shortcuts to pick a layout and make any changes. To learn more, see Keyboard shortcuts for Microsoft Teams.
Make keyboard shortcuts your own by customizing commands or choosing a preset layout. In Teams, select Settings and more > Keyboard shortcuts to pick a layout and make any changes. To learn more, see Keyboard shortcuts for Microsoft Teams.
Elevate presentations you organized with Teams Premium by customizing your screen with select layouts, backgrounds, and name tags using the Manage what attendees see meeting option. To learn more, see Control town hall production tools in Microsoft Teams.
Elevate presentations you organized with Teams Premium by customizing your screen with select layouts, backgrounds, and name tags using the Manage what attendees see meeting option. To learn more, see Control town hall production tools in Microsoft Teams.
This feature allows our security analysts to gain a more comprehensive view of an attack's path that allows for faster and more thorough detection and response. It also provides customers with a more holistic view of the threat in their environments.
Defender Experts MDR customers can now incorporate third-party network signals for enrichment. This feature allows our security analysts to gain a more comprehensive view of an attack's path that allows for faster and more thorough detection and response. It also provides customers with a more holistic view of the threat in their environments.
Can't choose which emoji to react with? Respond to messages and posts with more than one! Just hover over a message or post and select multiple emoji reactions that resonate with you. To learn more, see Like or react to messages in…
Can't choose which emoji to react with? Respond to messages and posts with more than one! Just hover over a message or post and select multiple emoji reactions that resonate with you. To learn more, see Like or react to messages in Microsoft Teams.
Easily find files in your chats and channels by adding a search filter. In a chat or channel, select Find in chat or Find in channel and select the Has attachment filter to only see results with attachments. To learn more, see…
Easily find files in your chats and channels by adding a search filter. In a chat or channel, select Find in chat or Find in channel and select the Has attachment filter to only see results with attachments. To learn more, see Search for messages and more in Microsoft Teams.
Transform online events into impactful 3D experiences with Teams immersive events. Create, customize, and host interactive events that captivate attendees, strengthen connections, and boost engagement. Schedule immersive events from your calendar in Teams. Customize environments with objects and media that add interest…
Transform online events into impactful 3D experiences with Teams immersive events. Create, customize, and host interactive events that captivate attendees, strengthen connections, and boost engagement.
Microsoft Sentinel customers that are onboarded to Microsoft Defender also now have the option to customize the alert frequency when the rule is based only on data that is ingested to Sentinel.
In advanced hunting, you can now enrich your custom detection rules by creating dynamic alert titles and descriptions, select more impacted entities, and add custom details to display in the alert side panel. Microsoft Sentinel customers that are onboarded to Microsoft Defender also now have the option to customize the alert frequency when the rule is based only on data that is ingested to Sentinel.
This feature also brings the following improvements: You can now filter for every column (in addition to Frequency and Organizational scope). For multiworkspace organizations that onboard multiple workspaces to Microsoft Defender, you can now view the Workspace ID column and filter by…
In advanced hunting, you can now view all your user-defined rules—both custom detection rules and analytics rules—in the Detection rulespage. This feature also brings the following improvements:
You can now filter for every column (in addition to Frequency and Organizational scope).
For multiworkspace organizations that onboard multiple workspaces to Microsoft Defender, you can now view the Workspace ID column and filter by workspace.
You can now view the details pane even for analytics rules.
You can now perform the following actions on analytics rules: Turn on/off, Delete, Edit.
Microsoft Defender Experts MDR and Microsoft Defender Experts Hunting customers can now expand their service coverage to include server and cloud workloads protected by Microsoft Defender for Cloud through the respective add-ons, Microsoft Defender Experts for Servers and Microsoft Defender Experts Hunting…
Microsoft Defender Experts MDR and Microsoft Defender Experts Hunting customers can now expand their service coverage to include server and cloud workloads protected by Microsoft Defender for Cloud through the respective add-ons, Microsoft Defender Experts for Servers and Microsoft Defender Experts Hunting - Servers. Learn more.
Simplify your scheduling experience in Teams Premium by pre-saving meeting options as templates you can use to quickly organize meetings. To learn more, see Personal meeting templates in Microsoft Teams.
Simplify your scheduling experience in Teams Premium by pre-saving meeting options as templates you can use to quickly organize meetings. To learn more, see Personal meeting templates in Microsoft Teams.
Meeting organizers can send one-way messages to attendees waiting in the lobby via lobby chat. To learn more, see Using the lobby in Microsoft Teams meetings.
This filter lets you filter incidents and alerts based on the sensitivity label assigned to the affected resources.
The Sensitivity label filter is now available in the Incidents and Alerts queues in the Microsoft Defender portal. This filter lets you filter incidents and alerts based on the sensitivity label assigned to the affected resources. For more information, see Filters in the incident queue and Investigate alerts.
The following advanced hunting schema tables are now available for preview: The CloudStorageAggregatedEvents table contains information about storage activity and related events The IdentityEvents table contains information about identity events obtained from other cloud identity service providers
The following advanced hunting schema tables are now available for preview:
Open Chat in Teams and select Saved under Quick views to see all your saved messages. Select one to open the conversation it was in and review or reply directly.
Open Chat in Teams and select Saved under Quick views to see all your saved messages. Select one to open the conversation it was in and review or reply directly.
Now, unscheduled town hall participants using Android devices can access intelligent recap and catch up on parts they missed, see AI-generated notes and follow-up tasks, and more. To learn more, see Recap in Microsoft Teams.
Now, unscheduled town hall participants using Android devices can access intelligent recap and catch up on parts they missed, see AI-generated notes and follow-up tasks, and more. To learn more, see Recap in Microsoft Teams.
These events include both block and policy application events related to triggered attack disruption policies, and automatic actions that were taken across related workloads. Increase your visibility and awareness of active, complex attacks disrupted by attack disruption to understand the attacks' scope,…
The DisruptionAndResponseEvents table, now available in advanced hunting, contains information about automatic attack disruption events in Microsoft Defender XDR. These events include both block and policy application events related to triggered attack disruption policies, and automatic actions that were taken across related workloads. Increase your visibility and awareness of active, complex attacks disrupted by attack disruption to understand the attacks' scope, context, impact, and actions taken.
This table contains information about Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant.
The GraphApiAuditEvents table in advanced hunting is now available for preview. This table contains information about Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant.
Users can report external and intra-org Microsoft Teams messages from chats, standard, shared, and private channels, meeting conversations to Microsoft as malicious (security risk) the specified reporting mailbox, or both via user reported settings.
Users can report external and intra-org Microsoft Teams messages from chats, standard, shared, and private channels, meeting conversations to Microsoft as malicious (security risk) the specified reporting mailbox, or both via user reported settings.
AI-powered Submissions Response introduces generative AI explanations for admin email submissions to Microsoft. For more information, see Submission result definitions.
Mail bombing is a distributed denial of service (DDoS) attack that typically subscribes recipients to a large number of legitimate newsletters and services. The resulting volume of incoming email within minutes intends to overwhelm the recipient's mailbox and email security systems, and…
Defender for Office 365 is now able to detect and classify mail bombing attacks. Mail bombing is a distributed denial of service (DDoS) attack that typically subscribes recipients to a large number of legitimate newsletters and services. The resulting volume of incoming email within minutes intends to overwhelm the recipient's mailbox and email security systems, and acts as a precursor to malware, ransomware, or data exfiltration.
You no longer need to go to log analytics in Microsoft Sentinel to use this operator if you're already in Microsoft Defender.
In advanced hunting, Microsoft Defender portal users can now use the adx() operator to query tables stored in Azure Data Explorer. You no longer need to go to log analytics in Microsoft Sentinel to use this operator if you're already in Microsoft Defender.
Suggested prompts help you get more insights into the specific assets involved in an incident.
Microsoft Copilot now provides suggested prompts as part of incident summaries in the Microsoft Defender portal. Suggested prompts help you get more insights into the specific assets involved in an incident. For more information, see Summarize incidents with Microsoft Copilot in Microsoft Defender.
Choose from more ringtones to personalize call experiences and differentiate between call types. To change your ringtone, tap your profile picture and tap Settings > Calling .
Choose from more ringtones to personalize call experiences and differentiate between call types. To change your ringtone, tap your profile picture and tap Settings > Calling .
This latest version now includes the largest possible set of fields common to both Defender and Azure portals.
Defender portal users who onboard Microsoft Sentinel and enable the User and Entity Behavior Analytics (UEBA) can now take advantage of the new unified IdentityInfo table in advanced hunting. This latest version now includes the largest possible set of fields common to both Defender and Azure portals.
The unified security summary is available in the Microsoft Defender portal and streamlines the process for SOC teams to generate security reports, saving time usually spent on collecting data from various sources and creating reports.
You can now highlight your security operations achievements and the impact of Microsoft Defender by using the unified security summary. The unified security summary is available in the Microsoft Defender portal and streamlines the process for SOC teams to generate security reports, saving time usually spent on collecting data from various sources and creating reports. For more information, see Visualize security impact with the unified security summary.
This feature also brings the following improvements: You can now filter for every column (in addition to Frequency and Organizational scope). For multiworkspace organizations that onboard multiple workspaces to Microsoft Defender, you can now view the Workspace ID column and filter by…
In advanced hunting, you can now view all your user-defined rules—both custom detection rules and analytics rules—in the Detection rules page. This feature also brings the following improvements:
You can now filter for every column (in addition to Frequency and Organizational scope).
For multiworkspace organizations that onboard multiple workspaces to Microsoft Defender, you can now view the Workspace ID column and filter by workspace.
You can now view the details pane even for analytics rules.
You can now perform the following actions on analytics rules: Turn on/off, Delete, Edit.
For 100 or fewer messages selected in Threat Explorer, SecOps personnel can take multiple actions on the selected messages from the same page. For example: Purge email messages or propose email remediation. Submit messages to Microsoft. Trigger investigations. Create block entries in…
In government cloud environments, Take action replaces the Message actions drop down list on the Email tab (view) of the details area of the All email, Malware, or Phish views in Threat Explorer (Explorer):
SecOps personnel can now create organization block entries on URLs and files via the Tenant Allow/Block List directly from Threat Explorer.
For 100 or fewer messages selected in Threat Explorer, SecOps personnel can take multiple actions on the selected messages from the same page. For example:
Purge email messages or propose email remediation.
Submit messages to Microsoft.
Trigger investigations.
Create block entries in the Tenant Allow/Block List.
Actions are contextually based on the latest delivery location of the message, but SecOps personnel can use the Show all response actions toggle to allow all available actions.
For 101 or more messages selected, only email purge and propose remediation options are available.
Tip
A new panel allows SecOps personnel to look for indicators of compromise at the tenant level, and the block action is readily available.
The following advanced hunting schema tables are now available for preview to help you look through Microsoft Teams events and related information: The MessageEvents table contains details about messages sent and received within your organization at the time of delivery The MessagePostDeliveryEvents…
The following advanced hunting schema tables are now available for preview to help you look through Microsoft Teams events and related information:
The MessageEvents table contains details about messages sent and received within your organization at the time of delivery
The MessagePostDeliveryEvents table contains information about security events that occurred after the delivery of a Microsoft Teams message in your organization
The MessageUrlInfo table contains information about URLs sent through Microsoft Teams messages in your organization
You can now create allow entries for domains & addresses and URLs directly in the Tenant Allow/Block List. This capability is available in Microsoft 365 Worldwide, GCC, GCC High, DoD, and Office 365 operated by 21Vianet.
You can now create allow entries for domains & addresses and URLs directly in the Tenant Allow/Block List. This capability is available in Microsoft 365 Worldwide, GCC, GCC High, DoD, and Office 365 operated by 21Vianet.
In user reported settings, admins can select Monitor reported messages in Outlook > Use a non-Microsoft add-in button. In the Reported message destination section, select Microsoft and my reporting mailbox, and then provide the email address of the internal Exchange Online mailbox…
In user reported settings, admins can select Monitor reported messages in Outlook > Use a non-Microsoft add-in button. In the Reported message destination section, select Microsoft and my reporting mailbox, and then provide the email address of the internal Exchange Online mailbox where user-reported messages by the non-Microsoft add-in are routed to. Microsoft analyzes these reported messages and provides result on the User reported tab of Submissions page at https://security.microsoft.com/reportsubmission?viewid=user.
Use the built-in Report button in Outlook: The built-in Report button in Outlook for iOS version 4.2508 or, later and Android version 4.2446 or later now supports the user reported settings experience to report messages as Phishing, Junk, and Not Junk.
Use the built-in Report button in Outlook: The built-in Report button in Outlook for iOS version 4.2508 or, later and Android version 4.2446 or later now supports the user reported settings experience to report messages as Phishing, Junk, and Not Junk.
Considerations for integrating non-Microsoft security services with Microsoft 365: Considerations and recommendations for deploying a defense-in-depth email security strategy using non-Microsoft security services.
Microsoft Defender for Office 365 now detects BEC attacks using large language model (LLM)-based filters to analyze an email's language and infer intent. To learn more, see our blog post Microsoft Ignite: Redefining email security with LLMs to tackle a new era…
The Tenant Allow/Block List now supports allowing and blocking IPv6 addresses. It's available in Microsoft 365 Worldwide, GCC, GCC High, DoD, and Office 365 operated by 21Vianet environments.
This capability lets admins confidently tune their settings without anxiety about possible repercussions on users.
Admins can see policy what-if insights for the bulk complaint level (BCL) threshold, spoof, and impersonation settings, which let them understand the implication of a setting change based on historical data. This capability lets admins confidently tune their settings without anxiety about possible repercussions on users.
Use the built-in Report button in Outlook: The built-in Report button in Outlook for Mac v16.89 (24090815) or later now supports the user reported settings experience to report messages as Phishing, Junk, and Not Junk.
We're updating the end user experience for allowlist and blocklist management of their email messages. With one click, users can block email from unwanted senders and prevent those messages from appearing in their default quarantine view and in quarantine notifications. Users can…
We're updating the end user experience for allowlist and blocklist management of their email messages. With one click, users can block email from unwanted senders and prevent those messages from appearing in their default quarantine view and in quarantine notifications. Users can also allow email from trusted and prevent future messages from those senders from being quarantined (if there are no admin overrides). Users also have visibility into any admin overrides that led to a quarantined email message. For more information, see View quarantined email.
With one click, SecOps personnel can take a quarantine release action directly from Explorer (Threat Explorer) or the Email entity page (no need to go to the Quarantine page in the Defender portal).
With one click, SecOps personnel can take a quarantine release action directly from Explorer (Threat Explorer) or the Email entity page (no need to go to the Quarantine page in the Defender portal). For more information, see Remediate malicious email delivered in Office 365.
You can track user responses and assign training to end users.
(Preview) You can now run simulations with QR code payloads in Attack simulation training. You can track user responses and assign training to end users.
Use the built-in Report button in Outlook: The built-in Report button in Outlook for Microsoft 365 now supports the user reported settings experience to report messages as Phishing, Junk, and Not Junk.
We're rolling out new details into who or what was responsible for releasing a message from quarantine. These details are included in the email summary flyout that's accessible from the Quarantine page. For more information, see View quarantined email.
We're rolling out new details into who or what was responsible for releasing a message from quarantine. These details are included in the email summary flyout that's accessible from the Quarantine page. For more information, see View quarantined email.
Access Microsoft Defender XDR Ninja training, learning paths, training modules and more. Browse the list of learning paths, and filter by product, role, level, and subject.
(GA) Learning hub resources have moved from the Microsoft Defender portal to learn.microsoft.com. Access Microsoft Defender XDR Ninja training, learning paths, training modules and more. Browse the list of learning paths, and filter by product, role, level, and subject.
This capability allows security operators to manage false positives more efficiently and without losing context.
(GA) SecOps personnel can now release email messages from quarantine or move messages from quarantine back to user Inboxes directly from Take action in Threat Explorer, Advanced hunting, custom detection, the Email entity page, and the Email summary panel. This capability allows security operators to manage false positives more efficiently and without losing context. For more information, see Threat hunting: Email remediation.
The value Remove allow entry after > 45 days after last used date is now the default on new allow entries from submissions. The existing allow entries in the Tenant Allow/Block List can also be modified to include the value Remove allow…
The value Remove allow entry after > 45 days after last used date is now the default on new allow entries from submissions. The existing allow entries in the Tenant Allow/Block List can also be modified to include the value Remove allow entry after > 45 days after last used date. The allow entry is triggered and the LastUsedDate property is updated when the entity is encountered and identified as malicious during mail flow or at time of click. After the filtering system determines that the entity is clean, the allow entry is automatically removed after 45 days. By default, allow entries for spoofed senders never expire.
Access Microsoft Defender XDR Ninja training, learning paths, training modules and more. Browse the list of learning paths, and filter by product, role, level, and subject.
Learning hub resources have moved from the Microsoft Defender portal to learn.microsoft.com. Access Microsoft Defender XDR Ninja training, learning paths, training modules and more. Browse the list of learning paths, and filter by product, role, level, and subject.
This capability allows security operators to manage false positives more efficiently and without losing context.
SecOps personnel can now release email messages from quarantine or move messages from quarantine back to user Inboxes directly from Take action in Threat Explorer, Advanced hunting, custom detection, the Email entity page, and the Email summary panel. This capability allows security operators to manage false positives more efficiently and without losing context. For more information, see Threat hunting: Email remediation.
We're introducing intra-org protection data into three of our core customer facing reports: the Mailflow status report, Threat protection status report, and Top senders and recipient report. Admins and security operators now have insight into how the built-in security features for all…
The user submission automatic feedback response capability in Microsoft Defender for Office 365 enables organizations to automatically respond to end user submissions of phishing based on the verdict from the automated investigation. Learn more.
The user submission automatic feedback response capability in Microsoft Defender for Office 365 enables organizations to automatically respond to end user submissions of phishing based on the verdict from the automated investigation. Learn more.
Integration with Soft delete: Sender's copy clean-up is incorporated as part of the Soft delete action. Wide support: This action is supported across various Defender XDR platforms including Threat Explorer, Take Action wizard from the email entity, Summary Panel, Advanced hunting, and…
Integration with Soft delete: Sender's copy clean-up is incorporated as part of the Soft delete action.
Wide support: This action is supported across various Defender XDR platforms including Threat Explorer, Take Action wizard from the email entity, Summary Panel, Advanced hunting, and through Microsoft Graph API.
Undo capability: An undo action is available, allowing you to reverse the clean-up by moving items back to the Sent folder.
You can create block entries under domains & email addresses, using the format .TLD, where TLD can be any top-level domain or .SD1.TLD, .SD2.SD1.TLD, .SD3.SD2.SD1.TLD, and similar patterns for subdomain blocking. The entries block all email received from or sent to any…
You can create block entries under domains & email addresses, using the format .TLD, where TLD can be any top-level domain or .SD1.TLD, .SD2.SD1.TLD, .SD3.SD2.SD1.TLD, and similar patterns for subdomain blocking. The entries block all email received from or sent to any email addresses in the domain or subdomain during mail flow.
We're introducing Sender's copy clean-up features in Threat Explorer, email entity, Summary Panel, and Advanced hunting. These new features streamline the process of managing Sent items, particularly for admins who use the actions Move to mailbox folder > Soft delete and Move…
We're introducing Sender's copy clean-up features in Threat Explorer, email entity, Summary Panel, and Advanced hunting. These new features streamline the process of managing Sent items, particularly for admins who use the actions Move to mailbox folder > Soft delete and Move to mailbox folder > Inbox. For more information, see Threat hunting: The Take action wizard. Key highlights:
Admins and security operators now see enhanced results within submissions across email, Microsoft Teams messages, email attachments, URLs, and user-reported messages. These updates aim to eliminate any ambiguity associated with the current submission results. The results are refined to ensure clarity, consistency,…
Admins and security operators now see enhanced results within submissions across email, Microsoft Teams messages, email attachments, URLs, and user-reported messages. These updates aim to eliminate any ambiguity associated with the current submission results. The results are refined to ensure clarity, consistency, and conciseness, making the submission results more actionable for you. Learn more.
For 100 or fewer messages selected in Threat Explorer, SecOps personnel can take multiple actions on the selected messages from the same page. For example: Purge email messages or propose email remediation. Submit messages to Microsoft. Trigger investigations. Block entries in the…
Take action replaces the Message actions drop down list on the Email tab (view) of the details area of the All email, Malware, or Phish views in Threat Explorer (Explorer):
SecOps personnel can now create organization block entries on URLs and files via the Tenant Allow/Block List directly from Threat Explorer.
For 100 or fewer messages selected in Threat Explorer, SecOps personnel can take multiple actions on the selected messages from the same page. For example:
Purge email messages or propose email remediation.
Submit messages to Microsoft.
Trigger investigations.
Block entries in the Tenant Allow/Block List.
Actions are contextually based on the latest delivery location of the message, but SecOps personnel can use the Show all response actions toggle to allow all available actions.
For 101 or more messages selected, only email purge and propose remediation options are available.
Tip
A new panel allows SecOps personnel to look for indicators of compromise at the tenant level, and the block action is readily available.
Admins can now duplicate existing simulations and customize them to their specific requirements. This feature saves time and effort by using previously launched simulations as templates when creating new ones. Learn more.
Admins can now duplicate existing simulations and customize them to their specific requirements. This feature saves time and effort by using previously launched simulations as templates when creating new ones. Learn more.
Security teams are now able to see the URLs extracted from QR codes with QR code as URL source on the URL tab of the Email entity page, and QRCode in the UrlLocation column of EmailUrlInfo table in Advanced Hunting. You can…
Security teams are now able to see the URLs extracted from QR codes with QR code as URL source on the URL tab of the Email entity page, and QRCode in the UrlLocation column of EmailUrlInfo table in Advanced Hunting. You can also filter for email with URLs embedded within QR codes using the URL Source filter value QR code in the All email, Malware, and Phish views in Threat Explorer (Explorer).
Admins can identify if they're submitting an item to Microsoft for a second opinion or they're submitting the message because it's malicious and was missed by Microsoft. With this change, Microsoft analyses of admin submitted messages (email and Microsoft Teams), URLs, and…
Admins can identify if they're submitting an item to Microsoft for a second opinion or they're submitting the message because it's malicious and was missed by Microsoft. With this change, Microsoft analyses of admin submitted messages (email and Microsoft Teams), URLs, and email attachments are further streamlined and results in a more accurate analysis. Learn more.
Defender unified RBAC supports all Defender for Office 365 scenarios previously controlled by Email & collaboration permissions and Exchange Online permissions. To learn more about the supported workloads and data resources, see Microsoft Defender unified role-based access control (RBAC). Tip Defender unified…
New detection capabilities using image detection, threat signals, URL analysis now extracts QR codes from URLs and blocks QR code based phishing attacks from the body of an email. To learn more, see our blog.
New detection capabilities using image detection, threat signals, URL analysis now extracts QR codes from URLs and blocks QR code based phishing attacks from the body of an email. To learn more, see our blog.
The Tenant Allow/Block Listsupports more entries in each category (Domains & email addresses, Files, and URLs): Microsoft Defender for Office 365 Plan 2 supports 10,000 block entries and 5,000 allow entries (via admin submissions) in each category. Microsoft Defender for Office 365…
The Tenant Allow/Block Listsupports more entries in each category (Domains & email addresses, Files, and URLs):
Microsoft Defender for Office 365 Plan 2 supports 10,000 block entries and 5,000 allow entries (via admin submissions) in each category.
Microsoft Defender for Office 365 Plan 1 supports 1,000 block entries and 1,000 allow entries (via admin submissions) in each category.
Default protection in Microsoft 365 remains at 500 block entries and 500 allow entries (via admin submissions) in each category.
In addition to the existing support for Email & collaboration permissions, Defender unified RBAC now also supports protection-related Exchange Online permissions. To learn more about the supported Exchange Online permissions, see Exchange Online permissions mapping.
By default, messages sent between internal users that are identified as high confidence phishing are quarantined. Admins change this setting in the default anti-spam policy or in custom policies (opt-out of intra-org protection or include other spam filtering verdicts). For configuration information,…
By default, messages sent between internal users that are identified as high confidence phishing are quarantined. Admins change this setting in the default anti-spam policy or in custom policies (opt-out of intra-org protection or include other spam filtering verdicts). For configuration information, see Configure anti-spam policies.
If the User reported settings in the organization send user reported messages (email and Microsoft Teams) to Microsoft (exclusively or in addition to the reporting mailbox), we now do the same checks as when admins submit messages to Microsoft for analysis from…
If the User reported settings in the organization send user reported messages (email and Microsoft Teams) to Microsoft (exclusively or in addition to the reporting mailbox), we now do the same checks as when admins submit messages to Microsoft for analysis from the Submissions page.
Use anti-phishing policies to control what happens to messages where the sender fails explicit DMARC checks and the DMARC policy is set to p=quarantine or p=reject.
Use anti-phishing policies to control what happens to messages where the sender fails explicit DMARC checks and the DMARC policy is set to p=quarantine or p=reject. For more information, see Spoof protection and sender DMARC policies.
User tagsare now fully integrated with Defender for Office 365 reports, including: Threat protection status report Compromised users report Top senders and recipients report URL protection report
User tagsare now fully integrated with Defender for Office 365 reports, including:
Shared mailboxes require Send As or Send On Behalf permission for the user. Other mailboxes require Send As or Send On Behalf permission and Read and Manage permissions for the delegate.
Built-in reporting in Outlook on the web supports reporting messages from shared mailboxes or other mailboxes by a delegate.
Shared mailboxes require Send As or Send On Behalf permission for the user.
Other mailboxes require Send As or Send On Behalf permission and Read and Manage permissions for the delegate.
We also expanded our training module library to more than 70 different modules.
Training only campaigns available with an expanded library: You can now directly assign training content to your organization without needing to tie training to a phishing simulation campaign. We also expanded our training module library to more than 70 different modules.
Using machine learning to drive more effective simulations in Attack Simulation and Training: Make use of intelligent predicted compromise rate (PCR) and Microsoft Defender for Office 365 payload recommendations for utilizing high-quality payloads in your simulation.
By default, Microsoft now protects URLs in email messages at time of click as part of this update to Safe Links settings (EnableSafeLinksForEmail) within the Built-in protection preset security policy. To learn about the specific Safe Links protections in the Built-in protection…
By default, Microsoft now protects URLs in email messages at time of click as part of this update to Safe Links settings (EnableSafeLinksForEmail) within the Built-in protection preset security policy. To learn about the specific Safe Links protections in the Built-in protection preset security policy, see Safe Links policy settings.
With the increased use of collaboration tools like Microsoft Teams, the possibility of malicious attacks using URLs and messages has increased as well. Microsoft Defender for Office 365 is extending its Safe Links protection with increased capabilities for zero-hour auto purge (ZAP),…
With the increased use of collaboration tools like Microsoft Teams, the possibility of malicious attacks using URLs and messages has increased as well. Microsoft Defender for Office 365 is extending its Safe Links protection with increased capabilities for zero-hour auto purge (ZAP), quarantine, and end user reporting of potential malicious messages to their admins. For more information, see Microsoft Defender for Office 365 support for Microsoft Teams (Preview).
If your organization enabled or will enable the Standard or Strict preset security policies, the policies are automatically updated to use the new DefaultFullAccessWithNotificationPolicy quarantine policy (notifications enabled) wherever the DefaultFullAccessPolicy (notifications disabled) was used. To learn more about quarantine notifications, see…
If your organization enabled or will enable the Standard or Strict preset security policies, the policies are automatically updated to use the new DefaultFullAccessWithNotificationPolicy quarantine policy (notifications enabled) wherever the DefaultFullAccessPolicy (notifications disabled) was used. To learn more about quarantine notifications, see Quarantine notifications. For more information about specific settings in preset security policies, see Recommended email and collaboration threat policy settings for cloud organizations.
Microsoft now automatically removes allow entries from the Tenant Allow/Block List once the system has learned from it. Alternatively, Microsoft extends the expiration time of the allow entries if the system hasn't learned yet. This behavior prevents legitimate email from going to…
Microsoft now automatically removes allow entries from the Tenant Allow/Block List once the system has learned from it. Alternatively, Microsoft extends the expiration time of the allow entries if the system hasn't learned yet. This behavior prevents legitimate email from going to junk or quarantine.
We expanded "Simulation URLs to allow" limit to 30 URLs. To learn how to configure, see Configure the delivery of non-Microsoft phishing simulations to users and unfiltered messages to SecOps mailboxes
Enhanced user telemetry in the simulation reports in Attack Simulation Training: As part of our enhanced user telemetry, administrators can now view more details about how their targeted users are interacting with the phishing payload from phishing simulation campaigns.
The new Microsoft Defender XDR role-based access control (RBAC) model, with support for Microsoft Defender for Office, is now available in public preview.
The new Microsoft Defender XDR role-based access control (RBAC) model, with support for Microsoft Defender for Office, is now available in public preview. For more information, see Microsoft Defender XDR role-based access control (RBAC).
Use the built-in Report button on Outlook: Use the built-in Report button in Outlook on the web and new Outlook for Windows client to report messages as phish, junk, and not junk.
Use the built-in Report button on Outlook: Use the built-in Report button in Outlook on the web and new Outlook for Windows client to report messages as phish, junk, and not junk.
With the new lookback scenario, the "A potentially malicious URL click was detected" alert now includes any clicks during the past 48 hours (for email) from the time the malicious URL verdict is identified.
With the new lookback scenario, the "A potentially malicious URL click was detected" alert now includes any clicks during the past 48 hours (for email) from the time the malicious URL verdict is identified.
Customers in government cloud environments are now able to create allow and block entries for URLs and file attachments in the Tenant Allow/Block List using admin submissions for URLs and email attachments. The data submitted through the submissions experience doesn't leave the…
With allow expiry management (currently in Private Preview), if Microsoft hasn't learned from the allow, Microsoft automatically extends the expiry time of allows, which are going to expire soon, by 30 days to prevent legitimate email from going to junk or quarantine again.
Customers in government cloud environments are now able to create allow and block entries for URLs and file attachments in the Tenant Allow/Block List using admin submissions for URLs and email attachments. The data submitted through the submissions experience doesn't leave the customer organization, thus satisfying the data residency commitments for government cloud clients.
For spoofing protection, the allowed senders or domains defined in the anti-spam policy and within user allowlists must now pass email authentication for the allowed messages to be honored. The change only affects messages that are considered to be internal (the sender…
For spoofing protection, the allowed senders or domains defined in the anti-spam policy and within user allowlists must now pass email authentication for the allowed messages to be honored. The change only affects messages that are considered to be internal (the sender or sender's domain is in an accepted domain in the organization). All other messages continue to be handled as they are today.
Automatic redirection begins for users accessing the security solutions in Office 365 Security & Compliance center (protection.office.com) to the appropriate solutions in Microsoft Defender portal (security.microsoft.com). This change is for all security workflows like (for example, Alerts, Threat Management, and Reports). Redirection…
Automatic redirection begins for users accessing the security solutions in Office 365 Security & Compliance center (protection.office.com) to the appropriate solutions in Microsoft Defender portal (security.microsoft.com). This change is for all security workflows like (for example, Alerts, Threat Management, and Reports).
Redirection URLs:
GCC Environment:
From Office 365 Security & Compliance Center URL: protection.office.com
To Microsoft Defender XDR URL: security.microsoft.com
GCC-High Environment:
From Office 365 Security & Compliance Center URL: scc.office365.us
To Microsoft Defender XDR URL: security.microsoft.us
DoD Environment:
From Office 365 Security & Compliance Center URL: scc.protection.apps.mil
The action center in the Email & Collaboration section Email & collaboration > Review > Action centerhttps://security.microsoft.com/threatincidents is automatically redirected to Actions & Submissions > Action center > Historyhttps://security.microsoft.com/action-center/history.
The action center in the Email & Collaboration section Email & collaboration > Review > Action centerhttps://security.microsoft.com/threatincidents is automatically redirected to Actions & Submissions > Action center > Historyhttps://security.microsoft.com/action-center/history.
A profile that enables a base level of Safe Links and Safe Attachments protection that's on by default for all Defender for Office 365 customers. To learn more about this new policy and order of precedence, see Preset security policies. To learn…
A profile that enables a base level of Safe Links and Safe Attachments protection that's on by default for all Defender for Office 365 customers. To learn more about this new policy and order of precedence, see Preset security policies. To learn about the specific Safe Links and Safe Attachment controls that are set, see Safe Attachments settings and Safe Links policy settings.
is now available in the EmailEvents table in Advanced Hunting with numeric BCL values from 0 to 9. A higher BCL score indicates that bulk message is more likely to generate complaints and is more likely to be spam.
is now available in the EmailEvents table in Advanced Hunting with numeric BCL values from 0 to 9. A higher BCL score indicates that bulk message is more likely to generate complaints and is more likely to be spam.
Important ^\*^ Microsoft strongly advocates for the principle of least privilege. Assigning accounts only the minimum permissions necessary to perform their tasks helps reduce security risks and strengthens your organization's overall protection. Global Administrator is a highly privileged role that you should…
Global Administrators^\*^ and Security Administrators can turn on or off redirection in the Microsoft Defender portal by navigating to Settings > Email & collaboration > Portal redirection and switch the redirection toggle.
Important
^\*^ Microsoft strongly advocates for the principle of least privilege. Assigning accounts only the minimum permissions necessary to perform their tasks helps reduce security risks and strengthens your organization's overall protection. Global Administrator is a highly privileged role that you should limit to emergency scenarios or when you can't use a different role.
Items in the Office 365 Security & Compliance Center unrelated related to security aren't redirected to Microsoft Defender XDR. For compliance solutions redirection to Microsoft 365 Compliance Center, see Message Center post 244886.
Items in the Office 365 Security & Compliance Center unrelated related to security aren't redirected to Microsoft Defender XDR. For compliance solutions redirection to Microsoft 365 Compliance Center, see Message Center post 244886.
This change impacts all customers who use the Office 365 Security & Compliance Center (protection.office.com). For example: Microsoft Defender for Office (Plan 1 or Plan 2) Microsoft 365 E3 / E5 Office 365 E3 / E5 For the full list, see Microsoft…
This change impacts all customers who use the Office 365 Security & Compliance Center (protection.office.com). For example:
This change impacts all users who sign in to the Office 365 Security and Compliance portal (protection.office.com), including security teams and end-users who access the Email Quarantine experience, at the Microsoft Defender Portal > Review > Quarantine.
This change impacts all users who sign in to the Office 365 Security and Compliance portal (protection.office.com), including security teams and end-users who access the Email Quarantine experience, at the Microsoft Defender Portal > Review > Quarantine.
This change is a continuation of Public Sector Blog - Microsoft Defender XDR delivers unified XDR experience to GCC, GCC High, and DoD customers, announced in March 2022.
Configure impersonation protection settings for custom users and custom domains within Preset Strict/Standard policies and automatically protect your targeted users and targeted domain against impersonation attacks.
(Choose to) Apply Preset Strict/Standard policies to entire organization and avoid the hassle of selecting specific recipient users, groups, or domains, thereby securing all recipient users of your organization.
Configure impersonation protection settings for custom users and custom domains within Preset Strict/Standard policies and automatically protect your targeted users and targeted domain against impersonation attacks.
Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365: Introducing GCC, GCC-H, and DoD availability of differentiated protection for priority accounts.
Simplifying the quarantine experience (part two) in Microsoft Defender XDR for office 365: Highlights additional features to make the quarantine experience even easier to use.
Submit user reported messages to Microsoft for analysis: Configure a reporting mailbox to intercept user-reported messages without sending the messages to Microsoft for analysis.
View the associated alerts for user reported messages and admin submissions: View the corresponding alert for each user reported phishing message and admin email submission.
View the associated alerts for user reported messages and admin submissions: View the corresponding alert for each user reported phishing message and admin email submission.
Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365: Introducing the general availability of differentiated protection for priority accounts.
Introducing the URLClickEvents table in Microsoft Defender XDR Advanced Hunting: Introducing the UrlClickEvents table in advanced hunting with Microsoft Defender for Office 365.
Manual email remediation enhancements: Bringing manual email purge actions taken in Microsoft Defender for Office 365 to the Microsoft Defender XDR (M365D) unified Action Center using a new action-focused investigation.
Manual email remediation enhancements: Bringing manual email purge actions taken in Microsoft Defender for Office 365 to the Microsoft Defender XDR (M365D) unified Action Center using a new action-focused investigation.
Streamlined the submission experience in Microsoft Defender for Office 365: Introducing the new unified and streamlined submission process to make your experience simpler.
Updated Hunting and Investigation Experiences for Microsoft Defender for Office 365: Introducing the email summary panel for experiences in Defender for Office 365, along with experience updates for Threat Explorer and Real-time detections.
Portal redirection by default begins, redirecting users from the Security & Compliance Center to Microsoft Defender XDR https://security.microsoft.com.
Portal redirection by default begins, redirecting users from the Security & Compliance Center to Microsoft Defender XDR https://security.microsoft.com.
Video of admin experience Video of end-user experience Other new capabilities coming to the quarantine experience are described in this blog post: Simplifying the Quarantine experience.
Quarantine policies: Admins can configure granular control for recipient access to quarantined messages and customize end-user spam notifications.
Depending on the nature of the block, the submitted URL, file, and/or sender allow entries are added to the Tenant Allow/Block List. In most cases, the allows entries are added to give the system some time and allow it naturally, if warranted.…
You can now add allow entries to the Tenant Allow/Block List if the blocked message was submitted as part of the admin submission process. Depending on the nature of the block, the submitted URL, file, and/or sender allow entries are added to the Tenant Allow/Block List. In most cases, the allows entries are added to give the system some time and allow it naturally, if warranted. In some cases, Microsoft manages the allow entries for you. For more information, see:
The templates can be customized for your organization and based on your admin's verdict as well.
Admin review for reported messages: Admins can now send templated messages back to end users after they review reported messages. The templates can be customized for your organization and based on your admin's verdict as well.
Advanced Delivery: Introducing a new capability for configuring the delivery of non-Microsoft phishing simulations to users and unfiltered messages to security operation mailboxes.
Advanced Delivery: Introducing a new capability for configuring the delivery of non-Microsoft phishing simulations to users and unfiltered messages to security operation mailboxes.
Microsoft Defender for Office 365 alerts is now integrated into Microsoft Defender XDR - Microsoft Defender XDR Unified Alerts Queue and Unified Alerts Queue
New alert policies for the following scenarios: compromised mailboxes, Forms phishing, malicious mails delivered due to overrides and rounding out ZAP Suspicious email forwarding activity User restricted from sharing forms and collecting responses Form blocked due to potential phishing attempt Form flagged…
New alert policies for the following scenarios: compromised mailboxes, Forms phishing, malicious mails delivered due to overrides and rounding out ZAP
Suspicious email forwarding activity
User restricted from sharing forms and collecting responses
Tags are also available in the unified alerts queue in the Microsoft Defender portal (Microsoft Defender for Office 365 Plan 2)
User Tagsare now integrated into Microsoft Defender for Office 365 alerting experiences, including: the alerts queue and details in Office 365 Security & Compliance, and scoping custom alert policies to user tags to create targeted alert policies.
Tags are also available in the unified alerts queue in the Microsoft Defender portal (Microsoft Defender for Office 365 Plan 2)
This safety tip is shown when recipients first receive an email from a sender or don't often receive email from a sender.
New first contact safety tip setting within anti-phishing policies. This safety tip is shown when recipients first receive an email from a sender or don't often receive email from a sender. For more information on this setting and how to configure it, see the following articles:
Source: Microsoft's documentation (Microsoft Learn and the open-source docs on GitHub). Texts are Microsoft's, in English. "New" means: appeared in the last 14 days. Microsoft may change features and dates.
This site uses only functional storage to remember your language choice. With your consent, we also use Google Analytics to measure site usage.More in our privacy policy.