Top 5

  1. October 2026 Windows updates destabilizing on-prem Exchange Servers: If you applied October Patch Tuesday updates to Exchange Server SE, 2019, or 2016 hosts, check your OWA error logs and mail queue depths now. Reported symptoms include MapiExceptionMdbOffline failures, crawling email queues, and DAG quorum issues. Microsoft has published an incident post with mitigation steps; prioritize this over any other patching work this week.

  2. Microsoft 365 E7 agent insider risk controls GA: Microsoft is framing AI agents as the newest insider threat vector, and E7 plus Project Perception now give admins containment controls that adapt protection continuously as agent behavior evolves. If your org has deployed Copilot agents or third-party agents in M365, review the new E7 capabilities before your next security posture review.

  3. Intune CNAME auto-discovery end of support - January 15, 2027: MDM-only Windows enrollment via EnterpriseEnrollment DNS CNAME records stops working in Intune on January 15, 2027. Audit your enrollment flows now and update any user-facing documentation or deployment scripts that rely on CNAME-based discovery before the cutoff.

  4. New Defender for Identity alerts for Entra ID and Active Directory: The October update adds new alerts covering suspicious sign-in via Temporary Access Pass and additional Active Directory attack patterns. Review your alert tuning and incident response playbooks to account for the new signal coverage.

  5. Purview auto-labeling troubleshooting playbook published (500K files/day scale): Microsoft raised the tenant ceiling for service-side auto-labeling to 500,000 files per day and published a structured field-fix playbook for SharePoint and OneDrive policies. If you run auto-labeling at scale and have unexplained labeling gaps, this playbook replaces the usual trial-and-error troubleshooting cycle.

Identity & Access

  • New Defender for Identity security alerts [GA] - New October alerts cover suspicious sign-in via Temporary Access Pass in Entra ID and additional Active Directory attack patterns. Pull these into your incident response playbooks and validate that your alert tuning policies surface them at the right severity.

  • What’s new in Microsoft Entra: October 2026 [GA] - The October Entra roundup focuses on securing environments where people and AI agents both act on behalf of the business, with updates spanning identity, network access, and workload identity. Read the full post to catch any new defaults or feature GA announcements that affect your conditional access or PIM configuration.

  • Master Microsoft Entra with live webinars, AMAs, and on-demand videos [GA] - Microsoft has consolidated the Entra learning calendar, covering Zero Trust adoption, AI-driven automation, and hybrid security strategies. Worth bookmarking for team upskilling, especially if you have engineers newer to Entra Governance or Workload Identities.

  • Dynamics 365 Business Central: Shopify tax line matching (US preview) [Preview] - AI-assisted Shopify Tax Matching is in public preview for US tenants using the Shopify connector, suggesting tax jurisdiction mappings before sales documents are created. Low identity impact directly, but note that this uses Entra user context for connector authorization.

Endpoint & Device Management

  • Task Manager visibility into AI workloads (NPU/GPU neural engine) [GA] - On supported newer Windows devices, Task Manager now surfaces per-process NPU and GPU neural engine activity in the Processes tab, with overall utilization on the Performance tab. Useful for troubleshooting AI workload performance on Copilot+ PC fleets and reporting on resource consumption.

  • Intune CNAME auto-discovery end of support - January 15, 2027 [GA] - MDM-only Windows enrollment via EnterpriseEnrollment DNS CNAME records will stop working in Intune on January 15, 2027. Audit enrollment flows, update deployment scripts, and prepare user communications now so users aren’t prompted to manually enter the enrollment server URL post-cutoff.

  • Updated Windows 11 Photos experience rolling out to managed devices [GA] - The refreshed Photos app unifies local and OneDrive photo libraries and is rolling out first to Windows Insiders before broader release later this year. Review how existing management policies apply to the updated experience and assess any data governance implications of the deeper OneDrive integration on managed endpoints.

Collaboration & Productivity

  • Released: October 2026 Exchange Server Security Updates [GA] - October security updates are available for Exchange Server SE RTM, 2019 CU14/CU15, and 2016. Apply these, but read the instability advisory below first before proceeding on any host.

  • Exchange servers may become unstable after October 2026 Windows updates [GA] - October 13 Patch Tuesday updates are causing OWA failures (MapiExceptionMdbOffline), growing mail queues, and DAG quorum problems on Exchange SE, 2019, and 2016 servers. Consult the Exchange Team blog post for current mitigations before applying or after observing symptoms; this is the most operationally urgent item this week.

  • Introducing a team knowledge base curated by Copilot and agents [Preview] - In Frontier Preview, Copilot and agents can now build and maintain a team knowledge base in SharePoint to give agent teammates the context they need for tasks and Q&A. This addresses fragmented and outdated information as a core blocker for human-agent collaboration; review Frontier Preview eligibility if your org wants early access.

  • Microsoft Teams: AI Interpreter for Teams Events [GA] - Real-time AI-powered audio interpretation for Teams Town Halls and Webinars reaches GA in November 2026. Organizers configure supported languages, giving global attendees a more natural multilingual experience beyond translated captions; useful for global all-hands and large-format events.

  • Microsoft 365 Apps admin center: Inventory Update Repair [Preview] - Preview is live now, with GA targeting November 2026. Admins can identify Windows devices with outdated or broken Microsoft 365 Apps, trigger remote Online Repair, and follow guided manual remediation steps, all from the M365 Apps admin center.

  • Microsoft Teams: Expanded Markdown support in the compose box [GA] - Full Markdown syntax support in the Teams compose box reaches GA in November 2026. Engineers and technical teams who already write in Markdown will get consistent formatting without switching authoring modes.

  • Work IQ: Human in the loop for agent flows [Preview] - Preview in November 2026, GA in January 2027. Agent and agent flows can now pause for human input or approval before continuing, giving admins and process owners a governance checkpoint inside automated workflows.

  • Work IQ: Real-time transcripts for Teams meetings [Preview] - Applications and agents can now access Teams meeting transcripts in real time, with GA targeting November 2026. This unlocks live assistance and insight scenarios during meetings, not just post-meeting analysis.

  • Microsoft Teams: Audio announcement for recording and transcription [GA] - Admins can enable a policy that plays an audio announcement when recording or transcription starts, applicable tenant-wide or to specific groups. GA targets December 2026; evaluate your compliance and accessibility policies to determine whether to enable this tenant-wide.

  • Human in the loop for AI pen testing agents in Project Perception [GA] - Project Perception’s pen test agents pause for human approval before executing any consequential action, letting security teams steer agent reasoning and confirm assumptions. Worth reviewing if your org is evaluating AI-assisted red team tooling.

AI & Copilot

  • Agents are your newest insiders: Security must move at their speed [GA] - Microsoft 365 E7 and Project Perception introduce controls to contain agent risk and adapt protection continuously as agent behavior evolves. If your org is rolling out Copilot agents or integrating third-party agents, this is the threat model framing you need to take to your security architecture discussions now.

  • What each AI agent team does in Project Perception [GA] - Project Perception structures agents into red, blue, and green teams: red agents find attack paths and prove vulnerabilities, blue agents investigate and build detections, green agents harden posture and remediate. Useful orientation for security teams evaluating the platform.

  • MAI Cyber Flash: Dedicated cybersecurity model in MDASH [GA] - MAI Cyber Flash handles roughly 90% of security queries including vulnerability finding, patching, and fix validation, deferring only the hardest tasks to a larger frontier model. The token-efficiency angle matters for orgs sizing AI security tooling budgets.

  • Managing open-weight model risk in enterprise deployments [GA] - Microsoft and NVIDIA published a joint whitepaper with a shared taxonomy, evaluation framework, and controls for managing open-weight AI model risk. Reference material for any org running or planning to run self-hosted or fine-tuned models in enterprise environments.

  • Go multilingual with the Power Pages plugin [GA] - The Power Pages plugin for GitHub Copilot CLI and Claude Code now supports localization across 43+ languages, including right-to-left languages like Arabic and Hebrew. Relevant for orgs building externally facing Power Pages portals for multilingual audiences.

  • Create Power Pages sites from SPA templates [GA] - The /create-site skill in the Power Pages plugin now generates sites from ready-made SPA templates rather than building every component from scratch. Significantly speeds up new portal scaffolding for Power Platform developers.

  • Microsoft Viva: Enhanced Copilot in Viva Engage [GA] - Powered by Engage MCP and Work IQ integration, Copilot in Viva Engage now goes beyond catch-ups and summaries, enabling users to synthesize discussions, analyze leader post feedback, surface key themes, and export insights to PowerPoint. Admins should verify Copilot licensing is in place for users expected to access these features.

  • Dynamics 365 Project Operations: Zero-effort task completion [GA] - GA in November 2026, this lets project managers and team members mark tasks complete even when no effort was planned or recorded, covering milestones, admin activities, and checklists. Relevant for orgs using Project Operations in either core or ERP-connected deployment.

  • Copilot Studio: Computer Use for web browsing via GitHub Copilot Harness [Preview] - Preview targets November 2026, GA in January 2027. Agents can browse websites, extract information, and download files using natural language, extending agent reach beyond configured knowledge sources. Evaluate your data handling and acceptable use policies before enabling in production.

  • Microsoft Dataverse: Add unlicensed Entra users as activity recipients [Preview] - Preview is live now, GA in January 2027. Active Entra users without Dataverse or Power Apps licenses can be added to activity recipient fields; created records remain disabled and grant no Dynamics 365 app access. Useful for scenarios where external stakeholders need to be included in activity tracking without consuming a license.

Employee Experience

No new Viva or employee experience platform items this week beyond the Copilot in Viva Engage update covered in AI & Copilot above.

Security & Compliance

  • Troubleshooting playbook for auto-labeling in SharePoint and OneDrive [GA] - Tenant auto-labeling is now capped at 500,000 files per day, and Microsoft has published a structured checklist for diagnosing labeling gaps caused by missing prerequisites, simulation behavior, or label-precedence rules. If you run auto-labeling at scale on SharePoint or OneDrive and have unexplained coverage gaps, start here before opening a support ticket.

  • Endpoint DLP: FTP/SFTP egress controls [GA] - Purview Endpoint DLP now supports policy enforcement for FTP and SFTP file transfers, closing a common exfiltration vector that was previously outside DLP scope. Review your existing Endpoint DLP policies and determine whether FTP/SFTP egress warrants a new rule in your environment.

  • Agents are your newest insiders: Microsoft 365 E7 agent risk controls [GA] - E7 and Project Perception introduce adaptive protection for AI agent activity, treating agents as a distinct insider risk vector rather than lumping them with user risk. Security architects planning E7 or reviewing insider risk policies should read the full post.

  • Managing open-weight model risk: Microsoft and NVIDIA whitepaper [GA] - Shared taxonomy, evaluation framework, and enterprise controls for open-weight AI model risk. Bookmark for AI governance teams and any team running self-hosted models; the taxonomy is useful for building internal risk classification frameworks.

  • CVE-2026-83831 Microsoft Edge (Chromium-based) Remote Code Execution [GA] - Severity not yet rated by MSRC. A double-free vulnerability in Edge allows an unauthorized attacker to execute code over a network. Monitor MSRC for a severity rating update and Edge channel release notes for the patched build.

Action Required

Documentation Updates

Identity & Access