Top 5

  1. EWS Deprecation Is Live in Exchange Online: As of early October 2026, setting EWSEnabled to True alone no longer keeps EWS working. You must now populate EWSAllowedAppIDs with an explicit app allow list or EWS traffic breaks for unlisted apps. Hybrid customers with on-premises mailboxes and cross-org sharing arrangements have additional exposure; review the dedicated hybrid impact post now and plan for the full deprecation timeline running through April 2027.

  2. Upgrade ExchangeOnlineManagement PowerShell Module to v3.10.1 or newer: Microsoft has hardened the Exchange Online PowerShell authentication flow in v3.10.1, and older module versions will progressively fail to meet future authentication requirements. If your automation or admin scripts run anything below v3.10.1, update now before those sessions start breaking silently.

  3. CVE-2026-69712 Windows Key Distribution Center Remote Code Execution: Critical, CVSS 8.8 RCE in the Windows Key Distribution Center. An acknowledgment update surfaced this week, but the vulnerability class (KDC RCE) and severity mean any domain controller exposure warrants immediate patch verification. Confirm your September CU is deployed across all DCs.

  4. Windows 11 26H2 GA and Intune Security Baseline Available: Windows 11 version 26H2 is generally available and ships as an enablement package for devices already on 25H2 or 24H2, making adoption low-disruption. The matching Intune security baseline is live now, and the Settings Catalog has day-zero policy support. Existing baseline profiles do not auto-update; create or migrate profiles deliberately.

  5. Purview Unified Classifiers Experience in Public Preview: The new unified classifiers experience consolidates all Purview classification types into a single admin surface with classified-item counts and policy dependency visibility. This makes it materially safer to modify or retire classifiers without unintended DLP or retention policy gaps. Worth enabling in a test tenant now to map your current classifier sprawl.

Identity & Access

  • Every AI Agent Gets a Microsoft Entra ID [GA] - Every agent deployed to Microsoft Foundry receives a unique Entra identity with scoped permissions, enabling traceable, auditable agent actions either autonomously or on behalf of a signed-in user in an isolated microVM. This has direct implications for your PIM and Conditional Access policies: agent identities need to be accounted for in your identity governance model just like service principals. Start mapping agent identity patterns now before Foundry adoption scales in your environment.

  • Beyond Source Code: A Path to the Keys to the Kingdom [GA] - Microsoft Threat Intelligence details how Storm-3068 pivoted from a compromised developer identity to broad cloud access, including CI/CD pipelines and cloud infrastructure. If your organization stores credentials in source repositories or grants pipeline service principals broad cloud permissions, this attack chain is directly applicable. Review pipeline identity scopes and rotate any long-lived credentials exposed through code repositories.

  • Passkeys from External Identity Providers Now Work Across Microsoft Apps [GA] - Microsoft apps including Outlook, Teams, OneDrive, and Office apps on Android, iOS, and managed macOS now support FIDO2 passkeys and security keys issued by external IdPs. Previously, embedded web views blocked this flow for federated users. If your org federates to a third-party IdP and you’ve been blocked from rolling out phishing-resistant MFA to mobile users, this unblocks that deployment.

  • Dynamics 365 Commerce: Bulk Item Entry for Store Transactions [GA] - Store Commerce associates can now paste or enter multiple item-quantity pairs in a single bulk-entry dialog rather than scanning items one at a time. Supported delimiters include spaces, commas, tabs, and the x character. This is a retail workflow improvement with no admin configuration required.

Endpoint & Device Management

  • Intune Security Baseline for Windows 11, Version 26H2 [GA] - The Windows 11 26H2 security baseline is live in Intune with new settings, updated defaults, and revised guidance. Existing profiles do not auto-migrate; you need to explicitly create a new profile or upgrade an existing one. Schedule a baseline review cycle before 26H2 devices start appearing in your fleet.

  • Windows 11, Version 26H2 Generally Available [GA] - 26H2 delivers as an enablement package on top of 25H2 or 24H2, minimizing deployment complexity and avoiding a full OS image replacement. Review the support lifecycle and feature-on-by-default list before allowing broad rollout through Windows Update for Business or Autopatch rings.

  • Intune Settings Catalog Updated for Windows 11 26H2 [GA] - Day-zero Settings Catalog support for 26H2 policy settings is rolling out globally across all Intune tenants this week. New OS-level settings introduced in 26H2 are immediately configurable without waiting for a catalog update cycle. Check the blog for the specific new policy entries added in this release.

  • What’s New in Microsoft Intune - September 2026 [GA] - September’s Intune release expands advanced management capabilities to more government organizations and adds staged app and policy rollout controls to reduce deployment risk. Admins gain a consolidated device investigation view for faster troubleshooting. Review the full changelog for any features relevant to your GCC or commercial tenant configuration.

  • What’s New in Windows 365: September 2026 Recap [Preview] - This month’s combined Windows 365 and Azure Virtual Desktop roundup covers improvements to Cloud PC resilience, security and recovery, IT management, and deployment flexibility. Notable items include provisioning improvements and user experience enhancements. Check the post for preview features that may require opt-in in your tenant.

  • Windows News You Can Use: September 2026 [GA] - Microsoft’s September Windows roundup consolidates 26H2 readiness resources including the enablement package details, updated adoption tools, and management tooling updates. Bookmark this as your single source for the 26H2 rollout reference library rather than chasing individual announcements.

  • Ctrl + Manage: New Monthly Podcast for Windows IT Pros [GA] - Microsoft launched a monthly ~30-minute podcast translating Windows management updates into practical admin guidance, starting October 1. The format targets the gap between release notes (what changed) and operational context (what to do next). Worth subscribing if your team tracks Windows management closely.

Collaboration & Productivity

  • EWS Deprecation Is Here: What This Means to You [GA] - EWS deprecation in Exchange Online began early October 2026. EWSEnabled = True no longer suffices; you must explicitly configure EWSAllowedAppIDs to permit specific app access or those apps lose EWS connectivity. The full deprecation runs through April 2027 in multiple phases; track this post as Microsoft will update it with new phase details.

  • Impact of EWS Deprecation on Hybrid Coexistence and Cross-Org Sharing [GA] - On-premises Exchange customers in hybrid deployments and cross-org free/busy or calendar sharing scenarios face specific EWS deprecation impact between October 2026 and April 2027. Read this post alongside the main deprecation announcement; hybrid rich coexistence has different remediation steps than pure cloud tenants.

  • Action Required: Upgrade ExchangeOnlineManagement Module to v3.10.1+ [GA] - Security enhancements to the Exchange Online PowerShell authentication flow require module version 3.10.1 or newer. Older versions will increasingly fail as Exchange Online authentication evolves. Audit all automation runbooks, scheduled tasks, and admin workstations for the current module version and update them now.

  • Released: September 2026 V2 Exchange Server Security Updates [GA] - Security updates are available for Exchange Server SE RTM, 2019 CU14/CU15, and 2016 CU23. The 2019 and 2016 updates require Period 2 ESU enrollment. If you’re running on-premises Exchange, apply the September V2 SU promptly, especially given CVE-2026-96940 (EoP, CVSS 8.8) affecting Exchange Server this week.

  • What’s New in Copilot in SharePoint: October 2026 [GA] - Copilot in SharePoint reached GA on September 30, and October’s update focuses on post-generation workflows: reshaping documents and images, reviewing and publishing generated HTML, and distributing output without leaving the site. No additional admin action is required if you’ve already enabled Copilot in SharePoint; these capabilities roll out automatically.

  • What’s New in Microsoft Teams: August-September 2026 [GA] - Teams’ What’s New cadence is shifting from monthly to quarterly (next edition in December). This edition covers two major themes: AI agents integrated into teamwork flows and a simplified, more secure platform foundation. Teams Phone Agent and Queues app collaborative calling are highlighted as GA features. Review the full post for admin-relevant policy or configuration changes across the quarter.

  • Teams Phone Agent: AI-Powered Calling Receptionist [GA] - Teams Phone Agent answers incoming calls autonomously, handles routine customer requests, and scales to after-hours coverage without requiring human staff. This is a Teams Phone add-on capability, so licensing and provisioning requirements apply; review the blog for prerequisites before planning a rollout.

  • Queues App: Collaborative Calling for Microsoft Teams [GA] - The Queues app turns an existing Teams call queue into a shared workspace where agents and supervisors manage customer conversations together in Teams. It targets teams that handle customer calls alongside other responsibilities, such as branch banking or IT help desks. Check whether your existing call queue licenses include Queues app access before communicating availability to business units.

  • Microsoft Teams: Deepfake Detection Integration via Third-Party Providers [GA] - Teams will support certified third-party synthetic audio and video detection solutions that analyze meeting media and surface detection signals directly in the Teams meeting experience. Detection is performed by the provider; Teams provides the platform integration. GA is targeted for November 2026; identify which providers are certified before that date if this is a compliance requirement.

  • Microsoft Teams: Impersonation Protection for Meetings [GA] - When Teams detects a potential impersonation attempt in a meeting, it will surface warnings and risk indicators to participants and organizers. This is a platform-level control targeting social engineering in calls. GA is targeted for November 2026; no admin opt-in has been announced but watch for policy controls at rollout.

  • Microsoft Teams: Intelligent Call Delegation [GA] - Intelligent call delegation uses AI to screen incoming calls, gather context, and optionally schedule follow-up appointments via Microsoft Bookings integration. GA is targeted for November 2026. Assess whether your Teams Phone and Bookings licensing covers this capability before enabling it for executives or front-line staff.

  • Microsoft Teams: Alternate Text for Images Shared from OneDrive and SharePoint [GA] - Users will be able to add alt text to images shared into Teams from OneDrive and SharePoint, improving accessibility for screen reader users. GA is targeted for November 2026. No admin configuration is required; relevant if your organization has accessibility compliance obligations.

  • OneDrive: Presentation Mode for PDFs on iPad [GA] - The OneDrive iOS app for iPad will gain a presentation mode for PDFs that locks out free-scroll gestures during presenting, preventing accidental page changes. GA is targeted for December 2026. Not available on iPhone. No admin action required.

  • Outlook: New Outlook for Windows in GCC-H and DoD [Preview] - The new Outlook for Windows is now in preview for GCC-H and DoD sovereign environments, with GA targeted for September 2026 (now current). Government tenants on these clouds can begin piloting; verify that any Outlook add-ins or COM integrations are compatible with the new Outlook before broader rollout.

  • Outlook iOS: MIP-Label Protected PDFs Now Supported in PDF Previewer [Preview] - MIP-labeled protected PDFs can now be previewed natively in the Outlook iOS PDF viewer with a built-in navigation toolbar. GA is listed as July 2026, suggesting this may already be rolling out. Verify with your Purview/MIP-labeled document users on iOS whether preview is working as expected.

  • Phishing Campaigns Abusing RMM Tools for Persistent Access [GA] - Microsoft observed phishing campaigns deploying MSP360 RMM and ScreenConnect to establish redundant remote-access channels after initial compromise. If your environment permits RMM tools or allows ScreenConnect through your network perimeter, review your allowlist policies and look for unauthorized RMM installations as part of a compromise assessment.

  • Unauthenticated Command Injection on Internet-Facing Mail Servers: CVE-2026-73570 (Zimbra) [GA] - Microsoft Threat Intelligence analyzed active exploitation of CVE-2026-73570 in Zimbra, an unauthenticated command injection flaw in internet-facing mail servers. Primarily relevant to organizations that run or support Zimbra environments; if any are in scope, apply Zimbra’s patch immediately and review for signs of exploitation using the indicators in the blog.

  • Secure What’s Next: Microsoft Security at Ignite 2026 Preview [GA] - Microsoft previews its Ignite 2026 security announcements, centering on an AI-first end-to-end platform covering identities, devices, data, apps, clouds, infrastructure, and AI agents. Use this to set expectations with stakeholders about upcoming product direction changes before Ignite sessions begin.

AI & Copilot

  • Build Automated Agents, Workflows, and Apps in Copilot Studio [GA] - Copilot Studio now consolidates agent building, workflow automation, and app generation in one surface: describe the agent, generate instructions and skills, connect MCP tools and specialist agents, and test at scale with Evaluations. Workflow triggers from incoming email and human-review pause points are available. If your org is building production agents, the Evaluations feature directly addresses readiness validation before go-live.

  • Copilot Studio: Agent Evaluation at Scale [GA] - Copilot Studio’s Evaluations feature runs structured tests against agents using your own conversations, auto-generated test cases, or a CSV upload. This is the mechanism for validating agent behavior before production deployment. Build evaluation runs into your agent release process as a quality gate.

  • Copilot Studio: Bid Evaluation Agent Demo [GA] - A worked example of a Bid Evaluation Agent that checks supplier bids against tender requirements and flags missing certifications, cold-chain handling, and insurance minimums. Useful reference architecture for procurement automation use cases in your organization.

  • Dynamics 365 Contact Center: Recurring Quality Evaluations GA in October 2026 [GA] - Quality Evaluation in Dynamics 365 Contact Center now supports recurring bulk evaluation runs over previously closed conversations, not just event-triggered evaluations at conversation close. This enables retrospective quality analysis and ongoing sampling programs. GA is October 2026; review your contact center QA workflows to take advantage of scheduled evaluations.

  • Your AI Transformation Starts with What You’ve Already Built [GA] - Microsoft’s PPCC 2026 recap reinforces the Power Platform and Copilot Studio path for converting existing business processes into AI-powered solutions without starting from scratch. Useful framing for internal business cases when teams ask how to get started with agentic AI on existing data.

Security & Compliance

  • Meet the New Microsoft Purview Classifiers Experience (Public Preview) [Preview] - The unified classifiers experience consolidates trainable classifiers, sensitive information types, and other classification types into a single admin view with item counts and policy dependency mapping. Before modifying or retiring classifiers, this surface tells you which DLP or retention policies depend on each one. Enable the preview in a non-production tenant and audit your classifier inventory against active policies.

  • Scaling Classification and Labeling: Updated Interactive Architecture [Preview] - Microsoft published an updated interactive Purview reference architecture focused on classification and labeling at scale, incorporating the wave of current auto-labeling public previews. Download the interactive GitHub version for use in architecture reviews and workshop sessions; it’s self-contained and doesn’t require a Visio license.

  • Insights from the 2026 Microsoft Digital Defense Report [GA] - The 2026 MDDR reflects a more interconnected threat environment with government agencies accounting for 27% of observed cyber threat activity, up from 17% in 2025. Read the full report for threat actor patterns and sector-specific data relevant to your industry; use it to justify controls budget with leadership.

  • Preparing Governments for an Era of Interconnected Cyber Risk [GA] - Microsoft’s policy perspective on the 2026 MDDR findings, focused on government sector exposure. Relevant if you support public sector customers or operate in regulated environments where government threat intelligence informs your risk posture.

  • Why Every Chat Turn Costs More Tokens [GA] - A practical explainer on AI tokenomics: stateless language models resend the full conversation history and system prompt on every turn, meaning longer sessions accumulate prompt token costs faster than shorter questions suggest. Tool outputs and RAG document retrievals also bill as input tokens. Relevant for teams budgeting Azure AI Foundry agent costs or optimizing Copilot Studio agent designs.

Action Required

Documentation Updates

Identity & Access