Exchange Online protection, phishing and BEC defense, DKIM, DMARC and SPF, plus Teams and SharePoint security and external sharing controls.
May 2026 in Microsoft 365: Teams adds external user reporting and a Security Detection Report, SharePoint starts enforcing storage quotas, and Entra locks new app instances by default.
Teams disables file attachments in chats with external users by default. One Files Policy setting, changeable only through PowerShell as of May 2026, turns it back on.
Entra passkey profiles auto-enable in March 2026, Teams gains four security features, and standalone SharePoint and OneDrive plans head for retirement. The January 2026 changes, sorted by what to do.
A stolen session token becomes a BEC campaign fast. This runbook walks the full cleanup, confirm, scope, evict, recover, with the exact portals, KQL queries, and PowerShell for each step.
Copilot Chat arrives free for Entra users, Teams flips transcription on by default for new tenants, and small businesses get live chat. The January 2025 M365 changes, sorted by what to check first.
New Outlook migration turns opt-out for SMBs in January 2025, monthly billing on annual terms gets a 5% markup, Viva Goals gets a retirement date, and Teams ships ten quality-of-life features.
By default, anyone with a Microsoft 365 tenant can open a Teams chat with your users. Here is the attack that exploits it and the four controls that break the kill chain.
Ignite 2024 set the Teams roadmap for 2025: speech-to-speech interpretation in nine languages, email-verified external attendees, bot-blocking CAPTCHA, and a merged chat and channels experience.
External collaborators do not need download rights to do their job. Two settings force guests into authenticated, browser-only access and block local downloads in SharePoint and OneDrive.
Copilot agents reach general availability, Teams adds impersonation warnings for external chat, a new calendar lands in January, and Office 2016/2019 get one year of support left.
Microsoft 365 email is not phishing-resistant by default. SPF/DKIM/DMARC, a tuned anti-phishing policy, Safe Links and Attachments, external sender tags, and keyword mail flow rules close the gap.
Copilot picks up enterprise data protection and usage APIs, Autopatch and WUfB-DS merge into one service, Entra ships AiTM detection and FIDO2 provisioning, and Teams adds CAPTCHA for anonymous joins.
