The Week at a Glance

  • 🔴 Exchange Web Services (EWS) deprecation is live and will break integrations if your IT team has not acted. Starting this month, any application using EWS in Exchange Online requires an explicit allowlist - and organizations running hybrid Exchange or on-premises mailboxes face additional exposure through April 2027.
  • 🟡 Russia-linked Star Blizzard is running a refined phishing campaign using a new malware delivery technique called RedFlick, targeting organizations through compromised websites; your security team should verify that email defenses and user awareness are current.
  • 🟡 Windows 11 version 26H2 is now generally available, bringing updated security baselines and device management policies that IT will need to evaluate and plan before broad rollout begins.
  • 🟢 Microsoft Teams is adding deepfake detection and impersonation protection for meetings (arriving November), giving organizations a new layer of defense against AI-generated fraud in video calls.

Sources: Exchange Team Blog - EWS Deprecation · Microsoft Security Blog - Star Blizzard RedFlick · Windows IT Pro Blog - 26H2 Guide

Why This Week Matters

Exchange Web Services deprecation crossing from warning to enforcement is the most operationally urgent event this week: integrations that have not been explicitly permitted will stop working, and the impact can cascade across email-connected business applications, hybrid mail environments, and third-party tools. At the same time, the 2026 Microsoft Digital Defense Report documents a threat landscape where government agencies and enterprises face attacks that are faster, more targeted, and increasingly automated. Leadership should understand that the combination of active state-sponsored phishing campaigns and the structural shift away from legacy email protocols creates a narrow window where inaction on either front carries measurable business and compliance risk.

Sources: Microsoft Security Blog - 2026 Digital Defense Report · Exchange Team Blog - EWS Deprecation

Risk & Compliance

  • 🔴 Exchange Web Services (EWS) Deprecation Now Active: Any application connecting to Exchange Online via EWS now requires an explicit app allowlist, or it will lose access; hybrid Exchange customers face additional disruption through April 2027 and must act immediately to avoid broken mail flow that could implicate SOC 2 availability controls.

  • 🔴 Exchange Online PowerShell Module - Mandatory Upgrade to v3.10.1: Older versions of the Exchange Online management module will not support new authentication requirements, meaning IT automation and administrative scripts will fail; teams should upgrade now to avoid losing administrative access.

  • 🔴 Star Blizzard RedFlick Phishing Campaign: A Russian state threat actor is using a novel malware delivery technique through compromised websites to evade detection, representing a direct threat to credential integrity and data confidentiality relevant to SOC 2, HIPAA, and CMMC environments; verify email filtering and endpoint protections are current now.

  • 🔴 Storm-3068 - Compromised Identity Leading to Cloud Takeover: Microsoft documented how attackers turned a single compromised developer identity into broad cloud infrastructure access, exposing a critical implicit-trust gap in CI/CD pipelines; organizations using Azure DevOps or GitHub-connected pipelines should verify that service account permissions follow least privilege.

  • 🟡 CVE-2026-96940 - Microsoft Exchange Server Privilege Escalation: An authenticated attacker on the network can elevate privileges on on-premises Exchange Server, a meaningful risk for any organization still running Exchange on-premises; patch as part of your next maintenance cycle and prioritize if Exchange is internet-facing.

  • 🟡 September 2026 V2 Exchange Server Security Updates: Microsoft has released security patches for Exchange Server SE, 2019, and 2016; organizations on older versions must also be enrolled in the Extended Security Update program to receive these patches, adding a licensing action item alongside the technical one.

  • 🟡 CVE-2026-73570 - Unauthenticated Command Injection in Zimbra Mail Servers: If your organization or any vendor in your supply chain runs Zimbra for internet-facing email, this actively exploited vulnerability enables remote code execution without credentials; relevant to HIPAA, CMMC, and cyber insurance requirements - confirm exposure with your IT team this week.

  • 🟡 Microsoft Purview DLP Extended to Network Layer via Entra Internet Access: Purview data loss prevention policies will soon intercept sensitive data at the network layer, covering browsers, APIs, and generative AI platforms; this closes a significant gap where data controls previously stopped at the application boundary, strengthening Zero Trust enforcement for organizations with GDPR, HIPAA, or state privacy obligations.

  • 🟡 Endpoint DLP - FTP and SFTP Data Exfiltration Protection: Purview will monitor and block sensitive data leaving managed devices via FTP and SFTP, a common blind spot in data loss prevention programs; organizations subject to HIPAA, SOC 2, or CMMC should plan to enable this when it reaches general availability in October.

  • 🟢 Inactive Files Policy in SharePoint Advanced Management: SharePoint administrators will be able to automatically archive files not accessed within a configured window, reducing data sprawl and supporting data minimization obligations under GDPR and state privacy laws.

  • 🟢 New Purview Classifiers Management Experience: A unified interface for managing sensitive data classifiers is entering preview, giving compliance teams better visibility into what is classified and which policies depend on each classifier before making changes; no immediate action required, but compliance officers should plan to evaluate this capability.

Sources: Exchange Team Blog - EWS Deprecation · Microsoft Security Blog - 2026 Digital Defense Report · Microsoft Security Response Center

What Your Employees Will Notice

  • Teams calling is getting smarter. Teams Phone Agent and Intelligent Call Delegation are now available, meaning incoming calls can be answered by an AI assistant that gathers context before routing or scheduling a callback. Employees in customer-facing or busy roles will notice calls being handled differently; brief communication ahead of rollout will reduce confusion.
  • Impersonation warnings in Teams meetings are coming in November. When Teams detects that a meeting participant may be misrepresenting their identity, it will surface a visible warning. Employees should understand this is a security feature, not a system error, so prepare a short explanation.
  • Deepfake detection in Teams will require a third-party tool. The platform integration arrives in November, but the detection capability itself comes from certified third-party providers your organization must procure separately. Employees in high-stakes meetings (executive, legal, financial) stand to benefit most.
  • Copilot in SharePoint is now generally available. Employees may already be seeing AI-assisted content creation inside SharePoint sites; if your organization has not communicated acceptable use policies for Copilot-generated content, now is the time.
  • New Outlook for GCC-H and DoD is in preview. Users in government-classified environments will soon be offered the updated Outlook experience; IT teams should coordinate rollout communications.

Sources: Microsoft Teams Blog - August/September 2026 Recap · M365 Roadmap - Teams Impersonation Protection · SharePoint Blog - Copilot in SharePoint October

What Your Help Desk Should Expect

  • EWS-related application failures. Any business application that connects to Exchange Online via EWS and has not been added to the allowlist will lose access starting now. Expect tickets from users whose calendar integrations, line-of-business tools, or third-party email connectors stop working. Help desk staff should be briefed on the allowlist requirement before this week’s tickets arrive.
  • Exchange hybrid customers reporting mail flow issues. Organizations with on-premises mailboxes coexisting with Exchange Online are at specific risk of calendar sharing and delegation failures; route these tickets directly to your Exchange administrator or managed service provider.
  • Teams Phone Agent and call routing questions. Employees unfamiliar with AI-assisted call answering may report that calls are being handled unexpectedly or that callers are being put through an automated system they did not configure.
  • Windows 11 26H2 readiness inquiries. As awareness of the new Windows version grows, IT and help desk teams can expect questions about upgrade timelines, compatibility, and whether devices will update automatically.
  • Passkey and sign-in questions on mobile. Passkey support has expanded for Microsoft apps on Android, iOS, and managed macOS when using external identity providers; expect some users to encounter new sign-in prompts or to ask for guidance on setting up or using a passkey.

Sources: Exchange Team Blog - EWS Deprecation · Exchange Team Blog - Hybrid EWS Impact · Entra ID Blog - Passkeys for External IdP

Cost & Licensing

  • Exchange Server Extended Security Updates are required to receive September patches. Organizations still running Exchange Server 2019 or 2016 must be enrolled in Microsoft’s Period 2 Extended Security Update program to access the September 2026 security updates. If your organization has not enrolled, this is both a security gap and an unbudgeted cost that needs immediate attention.
  • SharePoint Advanced Management licensing is required for the inactive files archiving policy. The new automatic archiving capability is part of the SharePoint Advanced Management add-on, not included in standard Microsoft 365 plans; organizations that want to use this for data minimization or storage cost reduction will need to confirm licensing.
  • Deepfake detection in Teams requires third-party procurement. The Teams platform integration is included, but the actual detection capability requires a certified third-party provider contract. Organizations planning to deploy this before November should begin vendor evaluation now.
  • AI token costs in Azure AI Foundry scale with conversation length. Microsoft has clarified that every chat turn in AI agents resends the full conversation history, meaning costs grow with each exchange. Organizations running custom AI agents or evaluating Copilot Studio automation should factor this into AI budget projections.

Sources: Exchange Team Blog - September 2026 V2 Security Updates · M365 Roadmap - Inactive Files Policy · M365 Roadmap - Deepfake Detection

Planning Horizon

Immediate (this week):

Within 30 days:

  • Within 30 days - Star Blizzard RedFlick Phishing Campaign: Security leadership should verify that email filtering, endpoint detection, and user phishing awareness programs are current and reflect this new evasion technique.

  • Within 30 days - Intune Security Baseline for Windows 11 26H2: IT must create new baseline profiles or update existing ones manually, as existing profiles do not auto-update; plan this before devices begin receiving the 26H2 feature update.

  • Within 30 days - Endpoint DLP for FTP and SFTP: Compliance and security teams should plan to enable this control when it reaches general availability in October, closing a data exfiltration path not covered by existing DLP policies.

  • Within 30 days - Exchange Server September 2026 Security Updates: Organizations on on-premises Exchange must apply the September patches promptly, and confirm Extended Security Update enrollment to remain eligible for future patches.

  • Within 30 days - Passkeys for External Identity Provider Users: Organizations using a third-party identity provider should evaluate this expanded passkey support as an opportunity to strengthen phishing-resistant authentication across mobile Microsoft apps, advancing Zero Trust identity posture.

Within 60-90 days:

  • Within 60-90 days - Teams Deepfake and Impersonation Protection: Begin vendor evaluation for certified third-party deepfake detection providers now so procurement can be completed before the November Teams platform integration arrives.

  • Within 60-90 days - Purview DLP Extended to Network Layer: Compliance and security leaders should evaluate the Entra Internet Access integration with Purview DLP, particularly for organizations where sensitive data may be leaving through unsanctioned cloud apps or generative AI platforms.

  • Within 60-90 days - New Purview Classifiers Experience: Compliance teams should pilot the unified classifier management interface in preview to prepare for a smoother transition when it reaches general availability.

Sources: Exchange Team Blog - EWS Deprecation · Intune - Security Baselines · M365 Roadmap - Teams Impersonation Protection

If You Take No Action

EWS Deprecation: Business applications that connect to Exchange Online via the legacy EWS protocol will begin losing access this month without an explicit allowlist configuration. For organizations running hybrid Exchange, calendar sharing, free/busy lookups, and delegation features can break progressively through April 2027. The operational impact ranges from individual productivity loss to broken workflows in line-of-business applications - and if those applications handle regulated data, interrupted access creates auditability and availability gaps relevant to SOC 2 Type II assessments.

Star Blizzard RedFlick Phishing: The RedFlick technique is specifically designed to bypass conventional detection by routing through compromised legitimate websites. Organizations that do not update their email filtering and endpoint detection rules leave employees exposed to a campaign that can deliver malware silently, with credential theft and subsequent data exfiltration as the likely outcomes. For organizations subject to HIPAA, CMMC, or cyber insurance requirements, a successful phishing compromise triggering a breach notification is both a regulatory and financial event.

Exchange Server Unpatched (CVE-2026-96940): An authenticated attacker on your network who reaches an unpatched Exchange Server can escalate privileges, potentially gaining administrative-level access to email data. For organizations where Exchange handles sensitive communications, legal correspondence, or regulated health or financial data, this represents a direct data breach risk with breach notification obligations under HIPAA and applicable state privacy laws.

Sources: Exchange Team Blog - EWS Deprecation · Microsoft Security Blog - Star Blizzard RedFlick · Microsoft Security Response Center - CVE-2026-96940