Top 5

  1. Global Secure Access unifies Private Access and Internet Access into a single SASE purchase: Microsoft is now selling Private Access and Internet Access together as one offering, completing the commercial SASE story that has been in preview for over a year. If you have been piloting either component separately, this is the consolidation point: review your licensing posture and align network access policy with your Entra Conditional Access strategy before renewals.

  2. Conditional Access policy plans GA in Microsoft Entra: Policy plans let you define shared conditions (users, resources, risk levels, network locations) once at the plan level, then add individual rules for each access requirement, including AI agent risk. The built-in migration tool pulls shared conditions out of existing policies without disrupting enforcement. This is the most significant structural change to Conditional Access management in years; plan a review of your current policy sprawl.

  3. Defender for Endpoint now discovers local AI agents and MCP servers on managed endpoints: GA for Windows (requires Defender AV platform 4.18.26090.9+) and macOS (requires MDE 101.26072.0017+), this feature populates the AI agent inventory and enables advanced hunting queries against locally running agents and their configured MCP servers. If your users are running Claude Code, Cursor, or similar tools locally, you now have visibility. Check version prerequisites before your next hunting run.

  4. October Intune release: Windows 365 for Agents security baseline and expanded compliance controls: The new Windows 365 for Agents Cloud PC security baseline gives admins a ready-made configuration set for agent-accessible Cloud PCs. Combined with expanded BitLocker compliance controls and update scheduling improvements, this release is the ops foundation for any tenant standing up agentic workloads. Review and deploy the baseline before agent pools go into production.

  5. Critical CVE-2026-111497: Brotli decoder buffer overflow affects Microsoft products: Critical severity, CVSS 8.1, this buffer overflow in the Brotli decoder is inherited by any Microsoft product that bundles the library. Exploitation status is currently No, but the attack surface is broad given how widely Brotli is embedded. Verify your update posture across affected builds and apply available patches promptly.

Identity & Access

  • Global Secure Access: Private Access and Internet Access in one offering [GA] - Microsoft has consolidated Private Access and Internet Access into a single purchasable SASE offering, meaning you no longer need separate licensing tracks for outbound internet filtering and private app tunneling. Every connection, including to AI services, is evaluated against the full Zero Trust context (identity, risk, device, app, network). If you are mid-pilot on either component, align your procurement and network policy work now.

  • New Conditional Access policy plans in Microsoft Entra [GA] - Policy plans replace the pattern of duplicating users and conditions across dozens of individual policies: define your shared scope once at the plan level, then add rules per access requirement. Templates for common personas and a built-in migration tool that lifts shared conditions out of existing policies without interrupting enforcement are both included. Start by auditing your current policy list for shared condition duplication.

  • Migrate Conditional Access Policies to Policy Plans [GA] - The migration tool in the Entra admin center identifies shared conditions across selected policies, elevates them to the plan level, and converts each original policy into a rule, leaving your existing policies enforced until you explicitly cut over. Useful for teams with large, organically grown policy sets who need a safe migration path.

  • What Are Conditional Access Policy Plans? [GA] - Policy plans organize access controls around an objective (a persona such as employees or admins, or a security goal such as requiring phishing-resistant MFA) rather than managing policies one at a time. If your current list is held together by naming prefixes, this is the structural answer.

  • How Conditional Access Plans and Rules Work [GA] - Each plan defines identities, resources, user actions, authentication context, and shared conditions once; every rule inherits them automatically and adds its own grant or session controls. Plan metadata (name, description, owner, tags) travels with the plan, making ownership and audit significantly cleaner.

  • Conditional Access for AI Agents in Microsoft Entra [GA] - A plan built for agent access uses a single shared condition (high agent risk) and separate rules for high-risk agent users versus high-risk autonomous agents, covering both delegated and agent-specific permissions without requiring a standalone policy per scenario.

  • Phishing-Resistant MFA with Conditional Access Authentication Strength [GA] - New rules in a policy plan inherit the plan’s included and excluded groups automatically, so adding a phishing-resistant MFA authentication strength requirement for all HQ users across all resources requires configuring the grant control once, not rebuilding group scope in every policy.

  • AI agents are coming: are your identity controls prepared? [GA] - AI is accelerating credential theft (automated phishing, social engineering, privilege escalation) while simultaneously creating new exposure through agent identities that need the same Zero Trust treatment as user accounts. This post lays out the Microsoft identity hardening framework for the agentic era, including extending PIM and Conditional Access to agent identities. Worth circulating to your security architects.

  • Why identity needs network insight to make Zero Trust work [GA] - Identity controls authenticate the session, but session hijacking, degrading device posture, and traffic to non-federated SaaS and AI apps all happen after sign-in. This post makes the case for combining Entra identity signals with Global Secure Access network telemetry to close the post-authentication visibility gap.

  • From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths [GA] - Attackers used Teams support impersonation to gain remote access, then escalated through Active Directory Certificate Services via ESC1 (misconfigured certificate templates) and ESC8 (NTLM relay to AD CS web enrollment). If you have AD CS in your environment, audit template permissions and web enrollment exposure against these paths now.

  • The CISO’s evolving role: Protecting and defending in the agentic era [GA] - Aarti Borkar’s framing of the dual CISO mandate (enabling innovation with identity and data guardrails, and modernizing defense against AI-powered threats) is a useful reference for building the security leadership case for agentic governance investments.

  • Dynamics 365 Business Central: USA - Manually upload 1099 forms to the IRIS [Preview] - The IRS FIRE system retires at end of 2026; IRIS becomes the only electronic filing channel from January 1, 2027. Business Central will support generating IRIS-compatible 1099 submission files for manual upload, with GA in January 2027 and preview in December 2026. US-based finance teams using Business Central need to plan the cutover before the FIRE deadline.

Endpoint & Device Management

Collaboration & Productivity

  • SharePoint Showcase: Refreshed SharePoint mobile app [GA] - The redesigned SharePoint mobile app aligns with the Discover experience on web, bringing sites, files, news, and people into a single starting point for mobile workers. No admin configuration required; the update rolls out automatically. Worth communicating to field and frontline user populations.

  • The GitHub app in Microsoft Teams is now generally available! [Preview] - The GitHub app in Teams moves to GA, enabling engineering, support, and business teams to file issues, investigate bugs, and build prototypes from Teams channels. The new GitHub Canvas surfaces work review directly in Teams. Admins should evaluate app permission policies before broad enablement, particularly for tenants with tight app governance.

  • Microsoft Teams: Default meeting templates [GA] - IT admins can now configure default meeting templates that automatically apply preferred settings (including protection settings) whenever a user schedules a Teams meeting through Outlook or Teams calendar. Requires Teams Premium for organizers. GA is November 2026; start building your template library and identifying which meeting types need enforced settings.

  • Microsoft Teams: Customize blocked file extensions for Weaponizable File Protection [GA] - Admins will be able to override the Microsoft-default blocked file type list for Weaponizable File Protection in Teams, aligning restrictions to organization-specific security requirements. GA is December 2026. Review your current file protection policy and prepare a custom extension list if the default list is not a match for your environment.

  • Microsoft Teams: Intelligent call recap for call queue calls on Mobile [GA] - AI-generated notes, key discussion points, and follow-up tasks will be available in the Queues app on Teams Mobile after call queue calls, extending the intelligent recap capability to mobile agents and supervisors. GA is December 2026. No specific admin action required, but confirm Queues app is deployed to mobile users who will benefit.

  • Microsoft Teams: Automatic recording indicator for call queue calls on Mobile [GA] - Teams Mobile will surface a clear indicator when a call queue call is being automatically recorded and transcribed, with no option to stop it, matching the desktop experience. GA is December 2026. Relevant for compliance teams ensuring consistent recording disclosure across device types.

  • Microsoft Teams: Manage call groups on Mobile [GA] - Users will be able to create, manage, and configure call groups (including ring settings and forwarding rules) directly from Teams on Mobile, eliminating the need to switch to desktop for call handling configuration. GA is December 2026.

  • OneDrive: Respond to access requests directly in the Share dialog [GA] - Pending access requests for files, folders, and libraries will appear inside the Share dialog, letting anyone with share permission approve, decline, or bulk-action requests and message requesters without leaving context. GA is January 2027. Reduces the friction that leads users to overshare proactively.

  • Microsoft Teams: Activity in other accounts and orgs improvements [Preview] - Users will be able to preview and open chats, channels, and activity from other accounts and organizations directly from their main Teams window without a full tenant switch. GA is January 2027. Relevant for multi-tenant environments and external collaboration scenarios; evaluate against your guest access and information barrier policies.

AI & Copilot

Employee Experience

  • Introducing Glint Labs and The Next Generation of Employee Listening Research Report [GA] - Microsoft People Science launches Glint Labs as the public home for employee listening research and AI-powered HR tools, alongside a new report on adaptive listening systems and the Analyze tool for exploring survey data. Relevant for HR and Viva Glint admins building or revisiting employee listening programs; the research report is worth sharing with people leaders evaluating their current survey cadence.

Action Required

Documentation Updates

Identity & Access