Nation-state actors are weaponizing agentic AI against M365 environments, and two Critical CVEs in .NET and Azure Pipelines demand attention. Ignite 2026 looms with Intune, Copilot, and Teams all shipping meaningful capability updates this week.
EWS deprecation is live in Exchange Online and the ExchangeOnlineManagement module needs an upgrade - alongside Windows 11 26H2 GA, a Critical KDC RCE, and Purview's unified classifiers preview, this is a week for config changes and baseline reviews.
Agent 365 MCP governance tools land alongside a major Intune feature wave and Microsoft's disruption of the EvilTokens device code phishing platform - a week where AI control and endpoint capability both moved meaningfully forward.
Agent 365 lands with cross-vendor AI governance controls, a Critical Windows Secure Kernel EoP vulnerability needs patching, and September Exchange Server security updates are out.
Four Critical CVEs land across Azure AD B2C, Copilot Studio, Azure AI Language, and Microsoft Fabric - plus GPT-6 Astra and Claude Fable 5.1 go live in Copilot, and Exchange hybrid shops face a hard version-floor deadline starting this week.
Autopilot device association reaches GA with hardware-backed pre-enrollment trust, Remote Help gets unattended Windows access, and two Critical-severity CVEs land alongside a heads-up from Exchange Online that legacy identifier properties may be on their way out.
Official Microsoft deployment and setup guides for Intune, Defender, Entra, Copilot, Purview, and Viva, organized by Modern Work practice area, plus what actually changes across Commercial, GCC, GCC High, and DoD.
A plain definition of Modern Work: Microsoft's practice areas spanning identity, endpoints, collaboration, AI, employee experience, and security, explained for engineers and executives.
Entra Tenant Governance hits GA for multi-tenant control at scale, Defender for Identity expands sensor v3.x coverage to AD FS, AD CS, and Entra Connect, and the Copilot Domain Exclusion feature gets quietly rolled back - a lot moved this week.
Defender for Office 365 Plan 1 lands in M365 E3, Writeback for Cloud-Managed Remote Mailboxes hits GA, and Midnight Blizzard is actively targeting hospitality sign-in portals - a rich week of capability unlocks alongside real threat intelligence to act on.
A light data week dominated by MSRC vulnerability disclosures for gawk and node-tar, plus an OWA Light retirement announcement that Exchange Server admins need to plan for.
Copilot Cowork goes GA worldwide with Claude Sonnet 5 and Sales Agent in tow, while five new CVEs land in AI and TLS libraries that may touch your supply chain.
Six CVEs land across libxml2, GNU gzip, attr, and acl for Linux-adjacent workloads, Intune's June release doubles down on AI-era endpoint hygiene, and a malicious Chromium extension spoofing Perplexity AI is actively redirecting browser search. EWS retirement remains on track for its October 2026 deadline.
EWS retirement hits its final phase with a hard October 2026 deadline, Intune Suite advanced capabilities land in M365 E3/E5 by August 1, and three Entra ID legacy auth controls are heading for retirement — this week is heavy on deadlines and migration obligations.
Teams Live Events dies June 30 — migrate now. Exchange Server OWA has an active XSS CVE. Meanwhile, Purview ships posture reporting, Copilot Studio goes fully agentic with computer-use GA, and Entra tackles shadow tenant sprawl.
CVE-2026-42897 demands immediate patch action on all on-prem Exchange deployments, while Teams Live Events hits its June 30 retirement deadline — but this week also delivers real capability unlocks across AI agent governance, Purview posture reporting, and Entra multi-tenant visibility.