Top 5

  1. Storm-0940 ARTEX agentic AI supply chain campaign targeting M365: A nation-state actor (Storm-0940) used an agentic AI tool called ARTEX to accelerate a ConnectWise supply chain compromise, leading to application credential abuse across M365 tenants. Review your ConnectWise integrations, audit app registrations and service principal credentials in Entra ID, and check for anomalous OAuth consent grants. If you run LiteLLM in any AI pipeline, see the separate supply chain compromise writeup this week.

  2. CVE-2026-105014 Azure Pipelines Remote Code Execution - Critical CVSS 9.1: Command injection in Azure Pipelines allows an unauthenticated attacker to execute code over a network. If your pipelines are internet-exposed or use shared hosted agents, treat this as urgent. Validate your patching posture against this CVE immediately.

  3. CVE-2026-111497 Brotli decoder buffer overflow in .NET - Critical CVSS 8.1: An out-of-bounds write in .NET’s Brotli decoder allows network-based privilege escalation. Any .NET workload processing compressed content from external sources is exposed. Patch .NET runtimes across all managed endpoints and servers.

  4. Exchange Online EWS retirement - apps are breaking now: EWS is being turned off in Exchange Online and applications are actively failing, including Apple Mail and Calendar on macOS, classic Outlook for Mac, and third-party backup tools. Run the EWS usage report in the Exchange admin center, identify every dependent app in your estate, and get migration to Graph API on the roadmap now.

  5. Power Platform Admin Plugin for Copilot Cowork - natural language governance: Admins can now query tenant-specific Power Platform data in natural language through Cowork, surfacing things like orphaned assets owned by departed employees without manually correlating multiple admin views. If Power Platform governance is a gap in your environment, this is worth enabling immediately.

Identity & Access

  • Designing smarter access policies for hybrid enterprises [GA] - As AI agents act on users’ behalf across distributed environments, perimeter-based trust assumptions break down further. This Entra blog walks through a structured approach to Conditional Access policy design that accounts for users, workload identities, and adaptive risk signals. Use it as a framework review checklist for your CA policy estate, particularly if you haven’t revisited policies since adding Copilot or third-party agents to your tenant.

  • Dynamics 365 Finance: Optimized Customer data entities [Preview] - Finance introduces purpose-specific customer data entities for core info, addresses, electronic contacts, and associations, replacing the need to use a single broad entity for all integration scenarios. Relevant if your org runs D365 Finance integrations via OData or Data Management; review whether existing integrations should be migrated to the optimized entities when they GA.

  • Excel: Get and transform data with Copilot in Excel [GA] - Copilot can now connect to data sources, build Power Query transformations from a natural language description, and load results directly into a workbook. Authentication is still required per data source, so this doesn’t bypass existing data access controls. Verify that your Copilot data access policies account for this new skill, particularly for users with broad connector permissions.

  • Dynamics 365 Commerce: Support trade counter sales in POS [GA] - Trade Counter POS capabilities are now GA in D365 Commerce, enabling bulk item entry, customer credit term visibility, and contract pricing at the point of sale. Relevant for Commerce deployments in wholesale or B2B retail scenarios; no identity or access changes required, but confirm POS role assignments align with which associates should see credit and pricing data.

Endpoint & Device Management

  • Your guide to Intune at Microsoft Ignite 2026 [GA] - Microsoft has published the session guide for Intune content at Ignite 2026, covering endpoint management, AI security, and cross-platform device management. Block time for the relevant sessions now; Ignite announcements frequently include previews that require early enrollment decisions.

  • Your Windows release information toolbox [GA] - Microsoft has published a consolidated guide mapping all Windows release information resources (release health, release notes, Windows Update for Business reports, lifecycle dashboards) to specific admin use cases. Worth bookmarking and distributing to your team to reduce time spent hunting for the right data source during incident response or update planning.

  • Outlook: Multiple Intune Accounts in Outlook for Android [GA] - Multiple MAM-enrolled accounts will be supported in Outlook for Android, while MDM remains limited to one account per device. GA is November 2026. If your users have personal and work MAM policies applied simultaneously, validate that your app protection policies behave correctly once this ships.

Collaboration & Productivity

  • Publish rich and interactive content with HTML pages in SharePoint [GA] - SharePoint now supports HTML pages stored in the Site Pages library alongside modern pages, buildable via Copilot or by uploading existing HTML files. This meaningfully expands what site owners can publish without IT involvement. Review your SharePoint site permissions and content governance policies before this reaches your users; arbitrary HTML pages in SharePoint can introduce script injection or data exfiltration risks if sharing is too permissive.

  • Exchange Online EWS application stopped working? Do this. [GA] - EWS is being retired in Exchange Online and breakages are happening now. Apple Mail, classic Outlook for Mac, some Outlook Desktop add-ins, and third-party backup tools are all affected. Run the EWS usage diagnostics in the Exchange admin center, map every dependent application, and prioritize migration to Microsoft Graph where a replacement API exists.

  • Turn GitHub notifications into code with GitHub Copilot in Microsoft Teams [GA] - GitHub Copilot integration in Teams now lets users @mention GitHub in a notification thread to trigger actions: reproducing bugs, running tests, implementing fixes, and opening pull requests. This is a meaningful developer workflow acceleration but also a new permission surface; confirm that GitHub Copilot org policies and Teams app permissions are scoped appropriately before enabling broadly.

  • Making Microsoft Teams more responsive, reliable, and ready for work [GA] - Microsoft is continuing to publish performance gains from the Teams client re-architecture, with improvements to chat switching speed, freeze reduction, and hardware-accelerated rendering. No action required, but this is useful context for support teams fielding ongoing performance complaints from users still on older hardware.

  • Cross-Platform Meeting Connect: Teams Rooms joining Zoom Meetings [GA] - Direct Guest Join now allows Teams Rooms to join Zoom Meetings and Zoom Rooms to join Teams meetings, using the room’s full AV setup. If your organization manages Teams Rooms and your users regularly join Zoom meetings, review the Direct Guest Join configuration in the Teams Rooms admin center and validate firewall rules for Zoom media traffic.

  • Microsoft Copilot (Microsoft 365): App Blocks [GA] - M365 Copilot Chat users can now generate interactive mini-apps (calculators, dashboards, forms, simulations) inline within their Copilot conversation, grounded in live data. This is GA in October 2026. Understand whether your Copilot deployment governance covers interactive app generation, particularly where grounded data retrieval is involved.

  • Microsoft Teams: Workflow to automatically add tag members to relevant channels [GA] - Teams will support associating channels with tags so members added to a tag are automatically enrolled in the corresponding channels. GA is November 2026. For large orgs managing Teams channel membership at scale, this reduces drift between org chart and channel access but warrants a review of existing tag assignments before the automation kicks in.

  • Microsoft Copilot (Microsoft 365): SharePoint Site Builder [Preview] - Copilot can now generate a full SharePoint site plan and build the site on confirmation, currently in preview with GA targeted for December 2026. Review SharePoint site creation policies in your tenant; if site creation is currently restricted, confirm whether this Copilot capability respects those restrictions or requires additional controls.

  • Dynamics 365 Contact Center: Real-time streaming analytics [GA] - The new supervisor application in D365 Contact Center ships with near-real-time streaming dashboards, visual anomaly alerts, and full-screen wallboard support. Relevant for Contact Center deployments; no broad M365 admin action required.

AI & Copilot

  • Power Platform Admin Plugin for Copilot Cowork - agentic governance with natural language [GA] - The new plugin surfaces tenant Power Platform data directly in Cowork, enabling natural language queries over connector inventory, asset ownership, and sharing configurations. For orgs where Power Platform sprawl is a governance gap, this is immediately useful: run a query for assets owned by departed employees as a starting audit.

  • AI that understands your business: Dataverse and Work IQ at PPCC 2026 [Preview] - Work IQ business applications entered public preview, giving Copilot and agents awareness of business-specific context stored in Dataverse. If your org is building agents in Copilot Studio that need to reason over structured business data, evaluate Work IQ as a grounding layer.

  • Inside the LiteLLM 1.107.0 supply chain compromise [GA] - Microsoft Threat Intelligence details how LiteLLM version 1.107.0 was trojanized to steal credentials via Python startup hooks and load remote code at runtime. If any team in your org uses LiteLLM in an AI development or agentic pipeline, audit the version in use immediately and review credential exposure. This is a concrete example of AI toolchain supply chain risk that warrants a broader inventory of open-source AI libraries in your environment.

  • Microsoft named a Leader in two next-generation app development platform evaluations [GA] - Analyst recognition for Power Platform and Copilot Studio across AI-powered development and enterprise governance categories. Useful as procurement and business case support if your org is evaluating low-code platforms.

  • Introducing the customer conversation harness in Microsoft Copilot Studio [GA] - Copilot Studio now includes a customer conversation harness for testing and evaluating agent conversations at scale, enabling builders to validate personalization and context handling before production deployment. Relevant for any team owning customer-facing agents; incorporate into your agent release gate process.

  • Dynamics 365 Finance: Expand localization in LATAM countries for Argentina [Preview] - Argentina localization is now in preview, completing the 14-country LATAM expansion framework in D365 Finance (alongside Brazil and Mexico). Scope covers VAT, provincial taxes, taxpayer register imports, and certificate management. Relevant only for orgs with Argentina operations on D365 Finance.

  • Dynamics 365 Sustainability: Restate previously calculated emissions [Preview] - Organizations can now restate prior emissions calculations in D365 Sustainability while preserving the original result and capturing the reason for restatement. Supports audit trails for ESG reporting corrections. Relevant for sustainability reporting teams using D365 Sustainability.

  • Dynamics 365 Project Operations: Configure actions on task grid [Preview] - Administrators can now configure which task-grid actions and views are visible to users within Task Grid View Templates, covering toolbar commands, row-level controls, and context menu items. Useful for Project Operations deployments where role-based UI simplification is needed.

  • Excel: Edit with Copilot in Excel on iPhone [GA] - Copilot can now make edits and transformations to Excel workbooks directly on iPhone using natural language, including background processing when users switch apps. GA is October 2026. Confirm your M365 Copilot mobile app policies permit this use case and that MAM policies cover the data being processed.

Security & Compliance

  • AI-driven nation-state campaign using ARTEX enables supply chain compromise [GA] - Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain attack, resulting in application credential abuse across M365 environments. Review all ConnectWise-related app registrations and OAuth permissions in Entra ID, audit service principal credentials for anomalous activity, and verify your Conditional Access policies cover non-human identities accessing M365 workloads.

  • Power Pages: First Class Support for Connector APIs [GA] - Power Pages can now connect directly to enterprise back-end systems (SQL, SAP, Oracle) via the Power Platform on-premises data gateway and native connector framework, without custom integration middleware. For regulated environments, this capability needs a data classification and network security review before enabling: confirm that only appropriately scoped data is surfaced through public-facing portals.

  • PowerPoint: Clear view-only messaging [GA] - PowerPoint will display a prominent “Viewing Only” message bar when a user opens a file they lack edit permission for, identifying the file creator and directing them to request access. GA is November 2026. Low administrative overhead, but useful for reducing helpdesk tickets around permission confusion.

Action Required

Documentation Updates

Identity & Access