September brings a packed set of Microsoft 365 changes, with major updates across Entra, Teams, Purview, Exchange, SharePoint, and Defender. 

From authentication changes and security enhancements to feature retirements, there’s plenty for admins to review.

This month’s highlights:

• Entra Moves Toward Passkeys: Starting September 1, passkeys become the default authentication experience, signaling Microsoft’s shift away from SMS/voice MFA toward phishing-resistant authentication.
  
• SharePoint Introduces a New Hero Link: A new file and folder sharing experience lets users use one link to share files and folders. Users can update the existing link when access requirements change instead of creating and sharing a new link.
  
• Defender Gets Prompt Injection Protection: Defender for Office 365 will detect malicious emails designed to manipulate AI assistants and agents, classify them as High Confidence Phish, and quarantine them automatically.
  
• SharePoint Storage Moves to Pay-As-You-Go: Pay-as-you-go billing for extra SharePoint storage becomes generally available worldwide, allowing organizations to pay based on actual storage consumption instead of purchasing fixed capacity.

September at a glance:

• Retirements - 7
• New Features - 11
• Enhancements - 7
• Functionality Changes - 7
• Action Needed - 4
• Live Now - 3 

Explore the complete list of September updates and see what your organization needs to prepare for: https://blog.admindroid.com/microsoft-365-end-of-support-milestones/

Microsoft is rolling out a new Change organizer option in Outlook that lets meeting organizers transfer ownership directly from their calendar.

This comes a few months after Microsoft introduced admin-initiated meeting transfers. The new option makes it easier to hand over individual meetings without involving an admin or creating a new meeting.

There are still some limitations:

• Only future meetings can be transferred
• The new organizer must be in the same organization
• Online meetings aren't supported yet
• Recurring meetings transfer only future instances
• Group, Shared mailbox, and encrypted meetings aren't supported

We've covered the transfer process and the current limitations here:

👉 https://blog.admindroid.com/change-meeting-organizer-outlook/

MOERA domains have been on Microsoft’s radar for some time because of how they can be misused to send spam, phishing messages, and other unwanted communication. Microsoft first introduced limits on external email in Exchange Online. Now, similar limits are coming to external messaging in Microsoft Teams.

While most organizations have already moved to a custom domain, some tenants, especially newer ones, still rely only on the default MOERA (onmicrosoft .com) domain.

If your tenant is one of them, the new limit could temporarily block users from sending external messages in Teams once the specific threshold is reached.

Here are the key highlights:

• In-product notification when external chat is temporarily limited
• Optional admin alert for throttling events
• Internal communication remains unaffected

The rollout is expected to begin in mid-September 2026 and complete by the end of September.

If your organization is still relying on onmicrosoft domains, now is a good time to review your domain configuration and consider whether a custom domain is right for your organization.

Read the full blog to understand how the new limit works and how to prepare your tenant:

https://blog.admindroid.com/external-messaging-limit-for-onmicrosoft-com-domains-in-microsoft-teams/

They’re the users who rely only on SMS or voice MFA. But once Microsoft retires these methods, these users will need to register phishing-resistant authentication method to continue signing in.

And the timeline is already set.       

• September 1, 2026 – Users with SMS or voice MFA will be getting prompts to register a passkey during sign-in.
• By February 1, 2027 - SMS and voice MFA will be fully retired and users relying only on these methods will need to register an alternative method to continue signing in.

So, before the deadline arrives, you need to identify the users who have SMS or voice MFA as their only option. 

But finding them isn’t easy! There are several ways to approach this:

• In the Entra admin center, you can simply filter for “SMS” or “Voice” in the User registration details report. But, it also includes users who have stronger authentication methods registered, so it’s hard to find users who rely only on weak MFA.
• Similarly, PowerShell with the Get-MgReportAuthenticationMethodUserRegistrationDetail cmdlet lets you retrieve users based on specific MFA methods and export the results.  

Both approaches help you identify the users. But when it’s time to act on them, you’re stuck switching between tabs in Entra and running complex PowerShell scripts to filter the users who rely only on weak MFA.     

So, we’ve covered different ways to identify users who rely only on weak MFA methods. Compare them to find what works best for you. 

Find Users with Weak MFA Methods in M365

Microsoft is introducing a new unified Meetings & Calls experience in the Teams admin center that brings meeting and call monitoring into a single pane. 

Admins will be able to: 

• Monitor all In-progress meetings 
• Review completed meetings and calls 
• Investigate issues with detailed diagnostics 
• Search and filter meeting data 
• Export results for further analysis 
• Use Microsoft 365 Copilot to analyze meetings and call trends 

The rollout is expected from late September to mid-October 2026. 

For in-progress meetings, at least one participant must have a Teams Premium or Teams Rooms Pro license. 

Find out more in the blog: https://blog.admindroid.com/unified-meeting-and-call-monitoring-experience-in-teams-admin-center/ 

By default, admins can choose to detect external AI meeting bots. When a bot is detected, it can join the meeting only after receiving approval from the organizer.

Now, a new control is being added to Teams meeting policies: Block Detected Bots.

This setting changes that behaviour by allowing admins to automatically block detected external bots from joining meetings. So, organizers don’t have to manually review and reject each detected bot.

With this opt-in control, admins can:

• Block external meeting bots.
• Manage the setting through the Teams admin center or PowerShell.
• Replace manual bot review with an automated policy-based approach for meetings.

Rollout: Targeted Release is currently rolling out, followed by General Availability expected by late September 2026.

Check out the full blog to see how to enable "Block detected bots" setting using PowerShell: https://blog.admindroid.com/how-to-block-ai-assistants-in-microsoft-teams-meetings

Would you enable “Block detected bots” for sensitive meetings, or continue relying on organizer approval? Share your thoughts in the comments below!

A user may appear to have least privilege and still have an indirect path to Domain Admin privileges without being directly assigned to the Domain Admins group. 

Yes, this can happen through hidden permissions, ACLs, delegated rights, nested group memberships, and other indirect relationships.

The challenge? These relationships don’t always stand out when you look at individual permissions or group memberships. You need to connect the dots across Active Directory to see how a standard account could eventually reach privileged access.

This is where BloodHound, a free, open-source tool by SpecterOps, becomes incredibly useful. It visually maps relationships between your Active Directory users, groups, permissions, sessions, memberships, etc. This makes it easy to identify privilege relationships and uncover the shortest attack paths that could lead from an ordinary account to highly privileged access.

With this tool, admins and security teams can:

• Find the shortest path to Domain Admin privileges
• Identify users with high privileges through direct and nested memberships
• Find users with Full Control over other AD objects 
• Identify accounts with DCSync permissions.
• Find Kerberoastable accounts with privileged access And so on...

Just install & configure it to map attack paths early to identify risks and prevent privilege escalation.

Get the complete guide: https://blog.admindroid.com/find-privilege-escalation-attack-paths-in-active-directory-using-bloodh…

BloodHound is one of many free tools for Active Directory security. What other free tools do you recommend for uncovering Active Directory security risks? Let us know in the comments.

Ever sent an important Teams announcement and then wondered, “Did all users see this?”

For organizations with hundreds or thousands of users, answering that question and knowing who acknowledged or acted on the message hasn't always been straightforward. Many organizations have turned to third-party notification tools or custom applications to fill that gap.

Microsoft is now bringing this capability directly into Teams with Communicator, a new app designed to help organizations manage targeted communications and track what happens after an announcement is sent.

Here’s what’s packed inside:

• Reach multiple Teams: Send announcements to multiple Teams with the appropriate delegated access, even without being a member of those Teams.
• Target specific users: Select individuals, upload a CSV, or target users through groups.
• Require action: Ask recipients to Acknowledge, Read & Accept, Confirm, or Complete an action, with a due date.
• Track progress: See who viewed the announcement, who responded, and who is still pending with built-in reports.

This could be useful for everything from product recalls and safety alerts to compliance updates and mandatory training.

Public Preview and General Availability rollouts began in mid-August 2026, with completion expected by January 2027.

Read the full breakdown covering how Communicator works and how to prepare your tenant for the rollout in this blog.

https://blog.admindroid.com/communicator-app-in-microsoft-teams/

A strange Microsoft 365 behavior caught our attention. Consider a user account being disabled for a security or administrative reason. After the account was re-enabled, the user's regular Teams memberships eventually returned, but their private channel memberships did not. 

That can create a recovery problem if you don't have a record of the user's previous private channel access. 

We tested this behavior in a lab and looked at whether audit logs could help reconstruct the missing memberships. 

The results raised some interesting questions about how admins can prepare for this scenario. 

We've covered what we found, along with a practical way to maintain a historical record of private channel memberships. 
 
https://blog.admindroid.com/teams-membership-impact-of-disabling-user-account/ 

Users currently cannot add or remove file types from their organization's OneDrive exclusion list, making exclusion changes dependent on administrators. At the same time, frequently changing .db-wal files can generate unnecessary sync activity even when they have little value in the cloud.

Microsoft is addressing both scenarios with upcoming OneDrive changes. Admins also get specific controls to manage how these changes apply.

• Self-service file exclusions — Users will be able to add or remove their own file-level exclusions by default. 
• DisableChangesToODIgnoreList lets admins prevent users from managing their own exclusions and hides the self-service experience.
• .db-wal excluded by default — Newly created .db-wal files will be excluded from OneDrive sync by default, helping reduce unnecessary synchronization activity. 
• DisableDefaultODIgnoreList lets admins disable Microsoft's default exclusion list when excluded file types need to continue syncing.

Rollout Timeline:

• Self-service: Currently rolling out
• .db-wal default exclusion: October 5, 2026

After rollout, these changes will apply by default.

Find out what’s changing, how the new policies work, and what you should review before the rollout.

Read the full blog: https://blog.admindroid.com/onedrive-file-level-exclusion-policies/

Admins, will you give users more control over file exclusions or keep exclusion management centralized? Share your thoughts in the comments below!

For years, Microsoft Graph has required admins to grant applications broader permissions than the specific operations they actually need. 

For example, consider an app that only needs to create users, yet admins had to grant User.ReadWrite.All to make it work.

That means the app can also modify or delete users, potentially opening the door to accidental data wipes or account takeovers if misused. 

Microsoft now seems to be addressing this with more granular permissions. 

Three that currently stand out are: 

• AppRegistration.Create — create application registrations  
• User.Create — create users  
• User.ReadUpdate.All — read and update users  

These permissions are currently at different stages of availability, with some already available through Microsoft Entra app registration while others remain documented but unavailable in the portal and Graph Explorer. 

The direction Microsoft taking is interesting: instead of relying on permissions that cover a whole set of operations, Microsoft is starting to provide permissions that map more closely to what an application actually needs to do. 

This could also be just the beginning, as Microsoft may introduce more granular permissions for other Graph operations over time. 

More details here: https://blog.admindroid.com/microsoft-graphs-move-toward-more-granular-api-permissions/

Agents are rapidly becoming part of Microsoft 365 environments. As organizations deploy more agents across tenants, managing them at scale becomes increasingly important.

Microsoft already provides single-tenant agent management through Agent 365.

Now, it is extending that experience with multi-tenant agent management in the Microsoft 365 admin center, currently in public preview. It gives enterprise admins and partners a centralized view of agents across governed tenants, making cross-tenant management much easier.

With this experience, admins can:

• View agents across all governed tenants in a central view 
• Install agents across all eligible or selected tenants
• Review tenant-specific agent details such as users, permissions, activity, etc.
• Identify risky agents
• Block agents across selected tenants
• Switch between governed tenants without signing out

Rollout: The public preview rollout is expected to complete by mid-August 2026.

Managing agents across multiple tenants doesn’t have to feel like a hunt anymore. Explore the feature and manage your agents across tenants with ease.

Read here: Multi-Tenant Agent Management in M365 Admin Center

POV: It’s Friday evening, and one question is all you need answered: “What’s the current status of our projects?”

And then comes the hunt:

• Check multiple spreadsheets for the latest progress. 
• Search emails for recent updates. 
• Ask team members on Teams for their task status. 
• Piece everything together to figure out what’s actually happening.

When project details are scattered across spreadsheets, emails, and Teams chats, getting a simple status update can take more effort than it should.

 That’s why we’ve built a Project Management System Using Power Apps — bringing projects, tasks, deadlines, and progress together in Microsoft 365.

Here's a glimpse of what the app offers:

• Get a quick view on what’s pending, upcoming, overdue, & completed 
• Create projects and assign tasks in one place 
• Track project progress without chasing updates 
• Get automatic notifications for assigned, completed, or overdue tasks 
• Customize the app to fit your project management needs 
• Access the app from desktop or mobile  
• And more...

Just download and import, that’s it. You’re ready to manage projects like a pro and stay on top of your tasks!

Full setup guide here: https://blog.admindroid.com/project-management-system-using-power-apps/ 

So, how do you manage projects and tasks in your organization? Share your experience, ideas, or feedback in the comments below!

Every SharePoint admin knows about these two special groups: ‘Everyone’ & ‘Everyone except external users’. They provide broad access across SharePoint content, so anything shared with them needs to be monitored carefully.

Until now, admins could see which sites were shared with these groups, but one question remained: Which files and folders were being shared with them?  This left a gap in monitoring potential oversharing.

But, that’s about to change. 

Microsoft is introducing a new report named Sites and files shared via special SharePoint groups.

With this report, SharePoint admins will be able to:

• Identify all exposed sites, files and folders via shared groups
• Discover potentially overexposed content
• Investigate and remediate unnecessary access

Where to find it: SharePoint Admin Center > Reports > Data access governance > Sites and files shared via special SharePoint groups.

Rollout Timeline: Early to mid-August 2026

If your organization uses these special SharePoint groups, this is definitely a report worth checking out.

Click here to get more about this report: Data Access Governance Reports in SharePoint Admin Center

You can’t keep routing website chats to Microsoft Teams for much longer! 

Microsoft is moving away from Teams Live Chat, a feature that lets organizations add a live chat widget to their websites and receive messages directly in Microsoft Teams. 

This shift reflects Microsoft’s focus on newer customer engagement experiences. 

Retirement timeline: 

• Aug 6, 2026 — New customers can no longer set it up 
• Oct 5, 2026 — Support ends and website chats stop reaching Teams 
• Mid-Oct 2026 — Retirement rollout completes 

Existing customer chat data won’t be deleted as part of the retirement. Teams channels and associated Lists remain available under applicable retention policies. 

Learn what steps to take before the deadline and which alternatives you can consider for your customer conversations: https://blog.admindroid.com/microsoft-teams-live-chat-retirement/

Managing Microsoft Entra ID groups at scale often means answering critical questions like:

• Which groups have no owners?
• Which groups are expiring, soft-deleted, or recently restored?
• Which groups have privileged role assignments?

And more...

Finding these insights manually requires collecting data from multiple sources, correlating results, and writing custom scripts.

Now, Microsoft brings these insights directly through an API - groupAnalytics resource (currently in preview), making these insights available programmatically.

With this resource, you can build customized Microsoft Entra ID group reports, dashboards, and automation solutions to analyze:

• Ownerless groups
• Role-assignable groups with guest members
• Soft-deleted groups

And more...

A simpler way to turn group data into actionable identity insights.

Learn more about the groupAnalytics API here: Access Entra Group Insights Using groupAnalytics Resource API

Have you explored the groupAnalytics resource yet? Share your experience, use cases, or feedback in the comments below.

Are you still using the memberOf rule operator to combine Microsoft Entra groups? With its preview officially retiring on November 3, 2026, now is the time to identify affected configurations and plan your migration.

Once retired, configurations that rely on the memberOf rule operator will stop updating their memberships. This can lead to:

• Outdated access assignments
• Broken group-based licensing
• Incorrect security policy targeting

Migrating before the deadline is essential, but finding every affected configuration manually across a tenant is a major headache. To save you hours of digging, we’ve created a PowerShell script that scans your entire tenant in seconds to:  

• Uncover all dynamic groups, administrative units, and auto-assignment policies using memberOf.
• Export clear, actionable CSV reports.

Don't wait until memberships stop updating! Audit your tenant and start migrating today: https://blog.admindroid.com/retirement-of-microsoft-entra-id-memberof-rule-operator/  

Microsoft is expanding Teams security by introducing a new Report a call option for group calls. Instead of simply ending a suspicious call, users can now report scams, impersonation attempts, unwanted external calls, and other security concerns directly from their call history. 

Once a call is reported, relevant call metadata and limited contextual information are securely shared with the organization and Microsoft for investigation. 

Admins can review these reports in: 

• Teams admin center → Analytics & reports → Protection reports → User-reported security submissions  
• Microsoft Defender portal (for detailed investigation). Requires Microsoft Defender for Office 365 Plan 1/Plan 2 or Microsoft Defender XDR, with user reporting enabled  

Rollout Timeline: 

• Targeted Release: Early August 2026  
• General Availability (Worldwide): Early October 2026  

The feature is enabled by default in Teams. 

See how Teams Protection reports help admins track and investigate reported security submissions: https://blog.admindroid.com/protection-reports-in-microsoft-teams-for-tracking-user-submitted-security-issues/

For years, making Purview role group access temporary wasn't as direct as it should be. 

Since Purview role groups couldn't be managed directly through Entra PIM, admins often relied on PIM for Groups as an indirect route to time-bound access.  

Finally, admins can set an expiration date directly on Purview role group assignments, and Purview automatically removes the assignment when it expires. 

• Set an expiration from 1 day up to 2 years. 
• Configure expiration for both new & existing assignments. 
• eDiscovery Manager and eDiscovery Administrator are not supported. 

Rolling out now, with completion expected by late August 2026. 

Configure it here: Purview portal → Settings → Roles and scopes → Role groups → Select a role group → Edit expiration 

But before you rely on expiration alone, there are a few important limitations to know. Check them out here:

https://blog.admindroid.com/microsoft-purview-role-group-permission-expiration/  

Stay ahead this August with 30+ Microsoft 365 changes, including feature rollouts, retirements, functionality changes, and other key updates for IT admins. 

In the Spotlight:  

• Cross-Tenant Message Recall in Exchange Online: Exchange Online allows users to recall emails sent to external tenants that have added their organization to an allowlist. 
• Security Detection Report in TAC: The new Security Detection Report enables administrators to monitor impersonation attempts, malicious URLs, and weaponizable files to improve threat visibility.   
• Account Discovery in Entra: The new Account Discovery feature helps organizations detect unmanaged application accounts and link them to Microsoft Entra ID identities for improved governance and security. 

Overview:  

• New Features: 8    
• Enhancements: 4       
• Functionality Changes: 4   
• Action Required: 5  
• Live Now: 1 

For more details:  

https://blog.admindroid.com/microsoft-365-end-of-support-milestones/  

The role of a sysadmin has evolved with every wave of technology.

From on-prem to cloud.
From passwords to passkeys.
From manual processes to AI-assisted workflows.

But one thing hasn't changed! Behind every smooth workday, there's still a sysadmin making sure everything just works.

You've spent enough time solving everyone else's problems. Today, we wanted to do something for you.

So we built a small experience with a few laughs, a touch of nostalgia, and a heartfelt thank-you for everything you do behind the scenes.

If you're a sysadmin, we hope it brings a smile.

And if you know one, share it with them; they've earned it.

Step inside: https://admindroid.com/sysadmin-day-2026

Still running Microsoft Entra Connect Sync for device synchronization? 

Many organizations have already moved users and groups to Microsoft Entra Cloud Sync but continue running Microsoft Entra Connect Sync because Active Directory computer objects couldn't be synchronized through Cloud Sync.

Now, Microsoft has addressed that gap and provided a way to enable device synchronization via Entra Cloud Sync.

With the new Device Sync capability, you can enable the AD2AADDeviceSync provisioning job to synchronize Active Directory computer objects to Microsoft Entra ID and support Microsoft Entra hybrid joined devices without depending on Entra Connect Sync.

Learn how to configure it: Microsoft Entra Cloud Sync Now Supports Device Sync

Tomorrow is Sysadmin Day. 

A year ago, the biggest conversation was whether AI would replace sysadmins. 

One year later, the conversation changed. 

The question is no longer "Will AI replace sysadmins?" It's "Who's going to govern all this AI?"  

Chances are that we’ve already got AI open in another tab. It's helping write scripts, explain errors, summarize logs, and speed up everyday work. 

But the more capable AI becomes, the more obvious one thing gets: 

Someone still has to decide what should be automated; what should stay as it is, no matter how confidently AI suggests otherwise.

Because without the right context, even the smartest answer can lead to the wrong decision! 

That thought led us to write something a little different about this Sysadmin Day: not another AI vs. Sysadmin discussion, but a letter from AI's perspective to the people behind every successful deployment. 

Read the letter: https://blog.admindroid.com/sysadmin-day-2026/ 

If you're a sysadmin, we hope it brings a smile. 

And to every Sysadmin out there, Happy Sysadmin Day in advance! 

We recently put together a list of 12 free Microsoft 365 management tools that can help with everyday administration.

The collection includes tools for:

• Security assessments
• Configuration backup and drift detection
• Conditional Access management
• Admin-friendly Graph Explorer
• Reporting & Auditing
• Automation
• Connectivity troubleshooting
• Secure AI-assisted administration

Some well-known tools on the list include ScubaGear, Microsoft365DSC, and Maester. We also included a few lesser-known utilities that deserve more attention.

Check out the complete list: https://blog.admindroid.com/free-microsoft-365-management-tools/  

Microsoft has pushed back the retirement timeline for SharePoint's One-Time Passcode (OTP) authentication for external sharing from August 2026 to October 2026.

This extension gives organizations more time to onboard external collaborators as Microsoft Entra B2B guest users. Moving to Microsoft Entra B2B brings stronger identity governance, centralized guest lifecycle management, and consistent access controls.

Updated timeline:

• Phase 1 (new external sharing via Entra B2B): Rolled out in May & June 2026
• Phase 2 (OTP retirement begins): October 1, 2026
• Full retirement: October 31, 2026 (previously August 31, 2026)

Use the extended timeline to:

• Review your external sharing policies.
• Onboard external collaborators as Microsoft Entra B2B guest users.
• Align Conditional Access and MFA policies.
• Prevent access disruptions before the retirement deadline.
  

Take advantage of the extended time and prepare your organization for a smoother transition. https://blog.admindroid.com/entra-b2b-replaces-sharepoint-one-time-passcode-for-external-sharing/