Microsoft 365 security,
decoded for MSPs

Copilot Grants No New Access. It Just Makes Years of SharePoint Sprawl Searchable.

Copilot only surfaces what a user could already open. Here is how to audit who can reach every SharePoint site in your tenant, and the five cleanup actions worth running on all of them.

M365 Roundup, August 2026: Sharing Links Stop Granting Access by Default

Microsoft Retires SMS and Voice MFA on February 1, 2027. The Part That Breaks First Is Account Recovery.

Inactive SharePoint Sites Keep Their Permissions. Retire Them on a Policy, Not a Hunch.

Microsoft Frontier Puts Prerelease Copilot in Your Tenant. Scope It to a Pilot Group First.

Microsoft Frontier hands your tenant prerelease Copilot features. Here is how to enable it, why Microsoft agents have to be allowed too, and who belongs in the pilot group.

M365 Roundup, July 2026: Microsoft Puts an Expiry Date on SMS Authentication

When Someone Quits, Does Their Claude Account Leave With Them?

During an Insider Threat, Copilot Follows the Rules. Your Response Plan Is What Breaks.

Copilot Cowork Automates Real Work. Predicting the Bill Is the Hard Part.

Copilot Cowork finishes multi-step Microsoft 365 work instead of just answering questions, but it bills separately through usage-based Copilot Credits MSPs should model first.

M365 Roundup, June 2026: Copilot Cowork Goes GA, and the Meter Starts Running

Claude's Riskiest Features Are Off by Default. Check Before a Client Turns Them On.

Your Users Connected Claude to Microsoft 365 Before You Did

Shadow AI Is Already in Your Clients' Tenants. Here Is How to See It.

Users are pasting client data into AI tools nobody approved. Defender for Cloud Apps can already show you — here is the MSP playbook for turning it on and reading it.