M365 Roundup, December 2025: E3 and E5 Absorb the Intune Suite

December's biggest Microsoft 365 news is not a feature, it is a repackaging: Intune Suite capabilities are heading into E3 and E5, with a pricing update attached for July 2026. Around it, Microsoft shipped a genuinely useful batch of security tooling, from DLP that holds the send button to a SharePoint report that finally answers "what can this user touch?"

Here is everything from the December 2025 cycle that deserves a place on your radar, grouped by what it means for the tenants you manage.

The licensing headline: Intune Suite capabilities land in E3 and E5#

Microsoft is bringing capabilities of the Microsoft Intune Suite to Microsoft 365 E3 and Microsoft 365 E5, alongside updated pricing arriving in July 2026.

The details live in Microsoft's announcement (opens in new tab) and the Partner Center pricing and packaging update (opens in new tab). For the 2026 product additions, administrators of eligible organizations get a Microsoft 365 admin center notification 30 days before each change takes effect. If you quote E3 or E5 renewals, this is the line item to model now.

Data protection picks up four real tools#

Outlook learns to hold the send button. New Outlook for Windows will support Wait on Send for oversharing, letting admins block email sending until Data Loss Prevention policy evaluation completes for labeled or sensitive content. The experience supports multitasking: users keep working in New Outlook while the mail sits in evaluation. Configuration steps are in Microsoft's Wait on Send documentation (opens in new tab). Rolling out early January through late January 2026.

SharePoint answers "what can this user access?" A new Permissions report in the SharePoint admin center, under Data access governance, identifies every site a specific user can reach and whether access comes directly or through group membership. That is oversharing investigation work that used to take scripts.

Details in Microsoft's snapshot report documentation (opens in new tab). Mid-December 2025 through mid-January 2026.

Defender can block external Teams users. A new integration between Teams and Microsoft Defender for Office 365 lets security admins manage blocked external users in Teams through the Tenant Allow/Block List (TABL) in the Defender portal, the same place the rest of the block management already lives.

Early January through mid-January 2026.

Purview investigations gain a purge action. Microsoft Purview Data Security Investigations (DSI) adds a purge mitigation action so admins can delete sensitive or overshared content during an investigation, directly in the product. It complements DSI's AI-powered categorization, search, and risk analysis, shortening the window between finding a leak and closing it.

Early March through late March 2026.

Bonus mailbox hygiene: Exchange Online gains auto archiving to prevent mail flow disruptions from full mailboxes. When usage passes 96 percent of quota, the oldest items move to archive automatically, backed by real-time mailbox health monitoring. Documentation is in Auto-archiving in Exchange Online (opens in new tab). Early January through late January 2026.

Multi-tenant work goes first-party#

Two December items matter disproportionately to anyone managing more than one tenant.

One interface for cross-tenant migrations. Microsoft's new migration orchestrator gives administrators a unified interface to move user data, including Exchange mailboxes, OneDrive files, and Teams chats and meetings, across Microsoft 365 tenants. It is E3 and E5 only, and public preview began worldwide in early December 2025. If tenant-to-tenant migrations are part of your practice, read the migration orchestrator overview (opens in new tab) before renewing the third-party tooling.

Security groups sync across tenants. Microsoft Entra adds cross-tenant security group synchronization, allowing shared access to resources across tenants while group management stays centralized. Useful for multi-tenant organizations and merger scenarios alike. Setup is covered in Configure cross-tenant synchronization (opens in new tab). Lands late April 2026.

Copilot: new brain modes and admin presets#

The GPT-5 mode selector shipped fast. Copilot now offers Auto, Instant, and Thinking modes. Auto is the default, users can switch to quick response or deeper reasoning, and the choice persists into new chats. Notably for admins: there are no admin controls for this feature, no configuration changes required, and it is enabled by default for all tenants. It rolled out December 4 through December 8, 2025.

Copilot Readiness Packages arrive in the admin center. Microsoft 365 admin center gains a centralized experience for discovering Microsoft's recommended admin presets, grouped by administrative outcome, aimed at admins navigating AI rollout decisions. Mid-January through late February 2026.

Email triage by natural language. Copilot now handles pin and unpin, flag and unflag, mark tasks complete, archive clutter, and mark emails read or unread, all from plain-language commands. Mid-December 2025 through late January 2026.

Calendar Search understands fragments. Type what you remember, like "last week's design review" or "budget sync with marketing," and Copilot Search finds the meeting and everything connected to it. Began early October 2025, completing late December 2025.

RSVP from Copilot chat. Users can respond to meeting invitations directly inside the Copilot chat experience. Early January 2026 (moved from mid-December 2025), completing by end of January 2026.

Teams: six updates, two that need an admin decision#

The two with governance implications first:

Express voice enrollment. A voice profile powers voice isolation, speaker recognition, identification in meeting rooms, improved transcripts, and richer Copilot meeting recaps. Unenrolled users get an in-product prompt to opt in by simply speaking during a meeting. Admins can enable or disable the feature for the organization, and it affects all enterprise Teams customers except Education tenants. Mid-February through end of February 2026. Decide your stance before the prompts start appearing.

Customizable recording and transcription notices. IT admins can customize the message and privacy link shown in Teams notifications when recording or transcription is in use, which legal and compliance teams have been requesting for a while.

Early January through late January 2026.

And the quality-of-life batch:

• Message previews expand to channel, mention, and reaction notifications. Mid-January 2026.

• Autocorrect arrives in compose, fixing commonly misspelled words automatically. Enabled by default, no admin configuration. Mid-January through late January 2026.
• Multi-message forwarding lets users select up to five messages from a chat or channel and forward them in one message, preserving context and order. Mid-January through late January 2026.

• Meeting and call troubleshooting gains automatic issue identification and recommendations, so admins can find root causes faster. Late January through mid-February 2026.

Intune: OOBE quality updates, off by default#

Starting with the January 2026 security update, the AllowOOBEUpdates CSP policy becomes available, disabled by default, and appears as a new setting on the Windows Autopilot Enrollment Status Page (ESP). Enabled, it installs the latest Windows quality updates during the out-of-box experience on eligible devices. Requirements: Microsoft Entra joined or hybrid joined, running Windows 11 version 22H2 or later. Worth enabling for most Autopilot deployments, since shipping a device that is patched from first boot beats patching it an hour later.