Summary Microsoft is recommending that organizations install Windows cumulative update KB5101684 Preview to complete remediation for the issue previously described in IT1431577. The Intune service-side mitigation is already in place, but a Windows client-side fix is still needed for impacted Windows devices to fully resolve the underlying problem. This update applies to Windows devices in …
Update
Summary Microsoft Whiteboard is retiring legacy whiteboards and moving fully to OneDrive-backed whiteboards. Enterprise tenants must migrate any remaining legacy whiteboards before the migration tool is removed. After the cutoff, unmigrated legacy whiteboards will be permanently deleted with no recovery option. The standalone Whiteboard desktop and mobile app will be deprecated, and users will access …
Summary Windows updates released in October 2026 will enforce AD FS Distributed Key Manager (DKM) container ACL hardening to remediate a security vulnerability (CVE-2026-56155). Organizations running Active Directory Federation Services should review current DKM container permissions and test compatibility during the current Audit mode period. Supported Windows Server versions will automatically remediate insecure DKM ACL …
Summary Microsoft Entra is changing Conditional Access enforcement for policies that target All resources when resource exclusions are configured. Certain sign-ins that request only baseline OIDC or limited directory scopes will now be evaluated by those Conditional Access policies even if exclusions exist. Users may start receiving MFA or device compliance prompts in scenarios that …
Summary Microsoft Entra SSO plug-ins for Atlassian Jira Server/Data Center and Confluence Server/Data Center are being retired and will no longer be supported. Organizations still using these plug-ins should plan and complete migration to a supported replacement before support ends. Affected customers should move to Atlassian Cloud or switch to Atlassian Data Center’s native SAML …
Summary Microsoft is retiring the legacy Entra agent registry API and requires migration to the new Agent 365 registry API. Organizations using applications, agents, or services that register or manage agents through the legacy API are affected. Microsoft 365 admins and development teams should inventory dependencies, validate agent workflows, and update any automation that calls …
Summary Microsoft has paused rollout of Microsoft Defender for Endpoint on Linux build 101.26052.0009 due to an issue affecting a subset of FIPS-enabled Red Hat Enterprise Linux 8 and 9 devices. On affected devices, installation or upgrade of the platform package may fail, preventing the update from completing successfully. Admins should not deploy or upgrade …
Summary Customer Intent Agent in Voice for Dynamics 365 Contact Center has reached end of support. Voice scenarios that depended on AI-driven customer intent detection from this feature will no longer receive that functionality or new data. Microsoft recommends moving voice self-service scenarios to Realtime Voice in Customer Assist Agent. If you still use Customer …
Summary Microsoft Entra ID is retiring support for custom CSS positioning properties used in company branding for branded sign-in experiences. The change affects tenants that currently use custom CSS positioning in Entra ID company branding; tenants not using these properties are not affected and cannot add new dependencies on them. Affected CSS positioning-related properties include …
Summary Microsoft Purview is retiring the **Instances** policy location for DLP and auto-labeling policies. Organizations using Instances for non-Microsoft apps such as Google Workspace, Box, Dropbox, Salesforce, ServiceNow, AWS, or Cisco Webex must migrate to the new dedicated application locations. Existing policies based on Instances should be reviewed and recreated in Microsoft Purview using the …
Summary Microsoft Graph Security API v1 is being retired, so organizations that read security alerts through v1 must move to the newer v2 alerts/incidents model. Affected integrations include SIEM connectors, dashboards, automation scripts, SOAR playbooks, and third-party security tools that call the legacy alerts endpoint. Microsoft Sentinel customers have an additional requirement: onboard Sentinel to …
Summary Windows 11, version 24H2 Home and Pro editions and Windows 10 Enterprise LTSB 2016 will no longer receive updates after the specified end date. Devices should be updated to Windows 11, version 25H2 or the latest LTSC release for continued security and quality updates. Extended Security Updates (ESU) are available for organizations needing more …
Summary Windows July 2026 security update begins enforcing Kerberos RC4 protections and removes Audit mode for RC4-based Kerberos ticket usage on domain controllers. Environments that still rely on RC4 Kerberos service tickets may see authentication failures after the update, especially applications, services, or devices using legacy encryption settings. AES-based Kerberos encryption is now expected for …
Summary Microsoft Entra will make passkeys the default authentication experience and automatically enable them for eligible users currently using SMS or voice. Microsoft is retiring its own SMS and voice multifactor authentication methods; organizations that still need telephony-based authentication must move to a customer-configured telecom provider. A passkey registration campaign will be enabled in managed …
Summary Microsoft is updating backend Exchange support for the Microsoft Teams mobile calendar experience. Organizations using Exchange Web Services (EWS) application access policies may need to adjust allow/block lists so Teams mobile can continue accessing calendar data. Admins managing Exchange Online and Teams calendar access should review tenant-level and mailbox-level EWS configuration before the change …
Summary Microsoft Entra ID is retiring Custom Controls in Conditional Access and moving organizations to External MFA, a standards-based way to use third-party MFA providers. Organizations that use Custom Controls will need to migrate affected Conditional Access policies to External MFA before the retirement deadline. Administrators should review Conditional Access policies, configure the third-party MFA …
Summary Microsoft 365 Copilot will support OpenAI-operated models as a new subprocessor option, including GPT-5.6, giving tenants access to newer AI model capabilities. A new admin setting in the Microsoft 365 admin center lets eligible tenants enable or disable access to these OpenAI-operated models. The setting is initially disabled for tenants, but if admins take …
Summary The static Dynamics 365 ERP Model Context Protocol (MCP) server (Preview) will be retired and replaced by the new Dynamics 365 ERP MCP server. This change affects Dynamics 365 finance and operations app integrations that use MCP-based agents, Copilot experiences, or other connected workflows. The new dynamic MCP server is available in Dynamics 365 …
Summary Microsoft Defender for Cloud Apps file policies are being retired, and DLP file policies configured there will no longer be supported or enforced after the retirement date. Organizations using these policies should migrate any policies they want to keep into Microsoft Purview to preserve DLP coverage and administration. SharePoint and OneDrive file DLP capabilities …
Summary Windows 365 User settings are being retired in favor of a unified Cloud PC Settings experience in Microsoft Intune. Admins managing Windows 365 Cloud PCs must move configurations for BCDR and local administrator controls into Cloud PC Settings. Existing User settings policies will not migrate automatically, so current assignments and settings need to be …
Summary: Microsoft is retiring the EWS-based controls used to enable or disable Personal Bookings (Bookings with me) in Microsoft Bookings. After the change, Personal Bookings access will be controlled only through the OWA Mailbox Policy assigned to each user. Organizations that currently manage this setting with Exchange Online organization-wide EWS settings or per-user CAS mailbox …
Summary Microsoft Purview is enforcing the existing one-capturing-group limit for regular expressions used in custom Sensitive Information Types (SITs). Admins who create or update custom SITs in Purview may see creation or validation failures if a regex contains more than one capturing group. The enforcement applies in both the Purview portal and the related PowerShell …
Summary Microsoft Defender will remove the standalone AIR investigation experience and stop allowing manual triggering of automated investigation and response. AIR capabilities remain built into always-on Microsoft Defender antivirus protection, so detection and response continue automatically by default. Security admins and teams using Microsoft Defender for Endpoint or Microsoft Defender XDR should update any playbooks, …
Summary SharePoint Online Remote Event Receivers (RERs) are being retired as part of Microsoft’s modernization of SharePoint extensibility and the Azure ACS retirement. Solutions using RERs registered with Microsoft Entra applications will continue to work only until the retirement cutoff, after which all RER-based event handling stops. Organizations using SharePoint customizations, workflows, or third-party products …
Summary Exchange Online moderation approvals are moving away from legacy Outlook voting buttons to Actionable Messages adaptive cards. This affects organizations that use Exchange Online message moderation, especially moderators and tenants still using the legacy approval experience. Moderators will need supported Microsoft 365 mailboxes and clients that can receive Actionable Messages; shared mailboxes are not …
Summary Excel Power Query is changing its authentication flow for connections to enterprise data sources that use Organizational Accounts (Microsoft Entra ID). The change affects users running Excel 2021 version 21.08 or older unsupported Excel/Office versions. Affected Power Query connectors include common sources such as SharePoint, SQL Server, Exchange, Power BI, Dataverse, and Azure data …
Summary Microsoft is retiring the Calendar widget in Student Hub; existing widgets will stop working after the end-of-support date and new ones cannot be added. This affects organizations using Student Hub, especially admins who manage Student Hub configurations and the educators, students, and support teams who rely on the widget. There is no direct replacement …
Summary Microsoft is retiring the legacy Turnitin Similarity integration in Microsoft Teams Assignments and steering customers to Turnitin Feedback Studio for Microsoft Teams. The change affects institutions that currently use Turnitin inside Teams Assignments, especially educators and admins who manage assignment workflows. Teams Assignments workflows that depend on the legacy Similarity integration will stop working …
Summary Microsoft is retiring the WebRTC-based Teams VDI optimization on Windows endpoints and replacing it with a new VDI optimization aligned to the native Teams desktop media engine. The change affects Windows-based VDI users on Azure Virtual Desktop, Windows 365, and Citrix CVAD/DaaS, including both published desktops and published apps. Admins should verify the new …
Summary Microsoft is retiring Restricted SharePoint Search (RSS) in SharePoint Online and recommends moving to Restricted Content Discovery (RCD) or other governance controls. The change affects organizations currently using RSS in Worldwide, GCC, GCC High, and DoD tenants, especially SharePoint and Microsoft 365 admins responsible for search visibility and content governance. Microsoft will not automatically …
Summary Microsoft 365 Copilot Cowork is moving to general availability worldwide, while Frontier remains the early-access channel for new capabilities. Frontier Cowork is changing to usage-based billing, with a grace period for existing users and required billing setup to keep access after the grace period ends. Admins need to configure pay-as-you-go billing and review spending …
Summary Copilot Cowork is now generally available worldwide for eligible users, with a new experience that adds multi-model capabilities, plugins, updated skill management/navigation, Microsoft Purview integration, and branded templates/image creation. Access is limited to users with a Microsoft 365 Copilot license and requires usage-based billing through Copilot Credits; without billing enabled, users cannot use Cowork. …
Summary Microsoft Teams is adding new admin controls for governing how applications and agents access meeting transcripts through the Microsoft Graph API. The controls apply to transcripts with and without speaker attribution, giving admins more granular control over transcript data access. Tenant administrators managing Teams and Graph API permissions are affected, especially where apps or …
Summary Microsoft is retiring support for Microsoft Defender for Endpoint on Amazon Linux 2 (ARM64); devices running AL2 on AMD64/x86_64 are not affected. The last supported MDE agent for AL2 (ARM64) is version 101.25122.0004; later Defender releases will not install on that architecture. Admins must identify devices running Amazon Linux 2 (ARM64), prevent upgrades beyond …
Summary The OneDrive (Consumer) connector used in Power Platform (flows, apps, and agents) is being deprecated and will be removed; OneDrive for Business connector is not affected. After the deprecation starts, new flows/apps/agents will no longer be able to use the consumer connector; existing items must be reviewed and migrated before retirement. IT must inventory …
Summary File-level archiving for Microsoft 365 Archive will be turned on by default for tenants that already have Microsoft 365 Archive configured. A new “Archive” action will appear in SharePoint on the web for users with edit permissions; archived files are moved to a cold storage tier and must be reactivated to access. Admins can …
Summary Microsoft Defender for Endpoint on Linux now retrieves internal configuration updates from new service URLs; these must be allowlisted per your tenant type. Affected: organizations using Defender for Endpoint on Linux endpoints (agents require outbound access to the listed URLs). Admin action: review firewall/proxy rules and allowlist the single URL that matches your tenant …
Summary Windows security updates will enforce Kerberos RC4 hardening on domain controllers, removing Audit mode as a rollback option after the final phase. Systems, service accounts, applications, appliances, and non‑Windows Kerberos implementations that still rely on RC4 may experience authentication failures unless remediated. Admins must detect RC4 dependencies (check System event log for Kerberos-related events) …
Summary Outgoing screensharing in Microsoft Teams VDI with the new SlimCore optimization will capture and process shared content on the virtual machine (VM) instead of the endpoint device; enabled by default in supported client versions. Affected: organizations using Teams in VDI environments (Azure Virtual Desktop, Windows 365, Citrix, Amazon WorkSpaces, Omnissa) and users who share …
Summary Microsoft Purview Endpoint DLP Just-in-time protection audit logging is changing from automatic logging to an explicitly scoped setting: admins must configure which users or groups have activities audited. Affected: Purview/Endpoint DLP administrators who manage Just-in-time protection and Activity explorer visibility; audited vs blocked scopes determine whether activities are logged or enforcement occurs. Admin action …
Summary Update network/firewall to allow outbound ports 50118 and 50119 and the domain *.rtmpingest.mcr.teams.cloud.microsoft for RTMP-In streaming into Teams meetings, webinars, and town halls. Affected: admins who manage Teams meetings/webinars/town halls and event organizers using external hardware or software encoders; existing RTMP-In events will continue to function through end of 2026 but new events may …
Summary Storage capacity entitlement report in Power Platform admin center was incorrectly displaying data for certain Dynamics 365 applications. A misconfiguration caused incorrect storage capacity from base licenses to be reported with attach and premium licenses. A fix will ensure reporting aligns with standard licensing policy regarding storage entitlements. Attach licenses will no longer show …