Executive's Guide — Week of 2026-06-02

The Week at a Glance

• 🔴 High — Exchange Server OWA vulnerability (CVE-2026-42897) requires immediate patching. Any organization still running Exchange Server 2016, 2019, or Subscription Edition on-premises is exposed to a remote JavaScript execution attack delivered by email. Exchange Online customers are not affected, but hybrid environments must act now.
• 🔴 High — Secure Boot certificates begin expiring in June. Windows devices that have not been updated for the new certificate chain may fail to boot or be blocked from updates. Organizations should verify device readiness before June 30.
• 🟡 Medium — Teams Live Events retire June 30, 2026. Any scheduled town halls, all-hands, or external broadcasts using the legacy Teams Live Events platform must be migrated to the new Teams Events experience or rescheduled on a supported platform before the cutover date.
• 🟡 Medium — Exchange ActiveSync certificate-based authentication retires by end of 2026. Mobile devices using legacy certificate-based email authentication will lose access. IT and security teams need to inventory affected devices and plan re-enrollment through Microsoft Entra ID before the hard deadline.

Sources: Exchange Team Blog – CVE-2026-42897 · Windows IT Pro Blog – Secure Boot AMA · Teams Blog – Live Events Retirement

Why This Week Matters

Three converging deadlines — an active Exchange vulnerability, expiring Secure Boot certificates, and the Teams Live Events retirement — mean that organizations with any on-premises infrastructure or legacy authentication methods face real risk of service disruption or compliance exposure before the end of June. At the same time, Microsoft is accelerating its push to retire older protocols and authentication flows across Exchange and mobile email, creating a narrow window to avoid forced outages rather than planned migrations. The one thing leadership must understand: “we’ll get to it” is no longer a safe posture for on-premises Exchange or legacy authentication — the timelines are now measured in weeks, not quarters.

Sources: Exchange Team Blog – CVE-2026-42897 · Exchange Team Blog – EAS CBA Retirement · Windows IT Pro Blog – Secure Boot Status Report

Risk & Compliance

Sources: Exchange Team Blog – CVE-2026-42897 · Exchange Team Blog – EAS CBA Retirement · Exchange Team Blog – Legacy TLS Deprecation

What Your Employees Will Notice

• Teams Phone users assigned to multiple lines of business will now see up to 10 phone numbers within a single Teams interface — no more juggling accounts or devices for different roles or regions.
• Teams call management: Copilot can now answer incoming calls and schedule follow-up appointments on a user’s behalf when they are unavailable (available through the Frontier early access program — not broadly deployed yet).
• Meeting recaps and notes now include visual references (images shared during the meeting) and support custom format templates, making AI-generated summaries more useful and contextually complete.
• Viva Engage communities are rolling into Teams — employees who used Engage for company-wide discussions and leader communications will begin seeing those communities appear directly in the Teams sidebar.
• New Microsoft 365 Copilot design is rolling out — a cleaner, faster interface for Copilot across Microsoft 365 apps. Expect questions from users noticing a visual refresh.
• Frontline workers will see new smart scheduling (auto-fill open shifts) and a new Communicator app for official operational updates — relevant for retail, healthcare, manufacturing, and hospitality sectors.
• Windows 11 devices may have pre-installed apps removed via policy as IT teams use new dynamic app removal capabilities. Users may notice fewer pre-loaded Microsoft Store applications on provisioned devices.

Sources: Teams Blog – April 2026 What’s New · Teams Blog – Multi-Line Phone · Teams Blog – Frontline Innovations

What Your Help Desk Should Expect

• “My email stopped working on my phone” — Expect a spike in mobile email tickets as legacy Exchange ActiveSync certificate-based authentication is blocked for new tenants and communications about end-of-2026 retirement reach users. IT teams should proactively identify affected devices before users call in.
• “I can’t find Live Events” — Users who regularly scheduled or attended Teams Live Events will begin receiving communications about the June 30 retirement. Expect confusion about the difference between Live Events, Webinars, and the new Teams Events experience.
• Secure Boot / device won’t start or update — As June certificate expiration approaches, devices that have not received the certificate update may exhibit boot issues or failed Windows Update attempts. Admins should use the updated Secure Boot Status Report in Windows Autopatch to identify at-risk devices proactively.
• Copilot interface questions — The redesigned Microsoft 365 Copilot experience will prompt “where did X go?” questions from regular Copilot users. A short internal communication and updated quick-reference guide will reduce ticket volume.
• Teams community/Engage overlap confusion — As Viva Engage communities appear in Teams, users may be unsure whether to use Teams channels or communities for specific discussions. Guidance from internal communications teams will help.
• Multi-line Teams Phone configuration requests — Managers or executives with responsibility across multiple business lines may request the new multi-line phone feature; IT will need to configure assignments in the Teams Admin Center.

Sources: Teams Blog – Live Events Retirement · Exchange Team Blog – EAS CBA Retirement · Windows IT Pro Blog – Secure Boot Status Report

Cost & Licensing

• Microsoft 365 Business with Copilot launches July 1, 2026. Microsoft is introducing new small business SKUs with Copilot built in. Organizations currently purchasing separate Copilot add-on licenses for Business Basic, Standard, or Premium users should review the new bundled pricing before July 1 — there may be a cost optimization or simplification opportunity, and existing renewals may be affected.
• Advanced Intune capabilities added to Microsoft 365 at scale (CY26 Q3). Microsoft is bundling advanced endpoint management capabilities (previously part of the Intune Suite add-on) into broader Microsoft 365 plans. Organizations currently paying for the Intune Suite separately should watch for Message Center notifications — tenants will receive 30-day advance notice before capabilities appear. This may reduce add-on costs or change budget line items.
• High Volume Email (HVE) for Exchange Online is now generally available with its own pricing model. Organizations sending bulk operational email (notifications, alerts, reports) through shared mailboxes or SMTP relays should evaluate whether HVE is a better fit than current approaches — it may reduce abuse risk and improve deliverability at lower operational overhead.
• Exchange 2016/2019 ESU Period 2 is a paid extension program running through October 2026. Organizations enrolled are incurring ongoing licensing cost for a product on a hard end-of-life path. Budget owners should confirm migration timelines are funded to avoid a third extension cycle — which Microsoft has not indicated will be offered.

Sources: Microsoft 365 Blog – Business with Copilot · Intune Blog – Advanced Capabilities at Scale · Exchange Team Blog – High Volume Email GA

Planning Horizon

Next 30 Days (Act by July 2026)

Next 60 Days (Act by August 2026)

Next 90 Days (Act by September 2026)

Sources: Exchange Team Blog – CVE-2026-42897 · Teams Blog – Live Events Retirement · Entra Blog – Agent Sprawl Governance

If You Take No Action

CVE-2026-42897 (on-premises Exchange vulnerability): An attacker needs only to send a crafted email to a user on your Exchange system. If that user opens the message in Outlook Web Access, malicious code executes in their browser — potentially stealing credentials, session tokens, or enabling further lateral movement inside your network. This is a low-effort, high-impact attack vector. Leaving on-premises Exchange unpatched after a publicly disclosed vulnerability is a documented trigger for cyber insurance claim denials and will appear as a critical finding in any SOC 2, HIPAA, or CMMC audit conducted after the disclosure date.

Secure Boot Certificate Expiration: Devices that miss the certificate update window may be unable to start correctly or receive future Windows security updates, creating a growing gap in your patch compliance posture. In a fleet of hundreds or thousands of devices, even a fraction of non-booting machines creates significant help desk burden, lost employee productivity, and a compliance exposure that accumulates silently until audit time. Windows Autopatch customers have the tooling to identify at-risk devices today — the cost of running the report now is far lower than emergency remediation after devices begin failing.

Teams Live Events Retirement (June 30, 2026): Organizations that have not migrated scheduled large-scale broadcasts — investor briefings, all-employee town halls, partner events — will find those event types unavailable to schedule after June 30 with no fallback. Events already on the calendar will be honored through February 2027, but any new events must use the replacement platform. Communications, HR, and executive teams who own these events may not be aware that the scheduling window closes at the end of this month.

Sources: Exchange Team Blog – CVE-2026-42897 · Windows IT Pro Blog – Secure Boot Status Report · Teams Blog – Live Events Retirement