M365 Roundup, February 2022: Office Starts Blocking Internet Macros by Default
TL;DR
- Starting with Office Version 2203 in early April 2022, VBA macros in files downloaded from the internet are blocked by default, replacing the one-click Trust bar enablement.
- Teams Connect shared channels enter public preview using Azure AD B2B direct connect, which lets external organizations collaborate without guest accounts.
- External collaboration in shared channels is off by default and governed by Azure AD cross-tenant access policies.
- Coterminosity testing opens in the Partner Center sandbox in March 2022, letting partners align customer subscription end dates, with charges prorated against the first subscription's term.
- All 1.x versions of Azure AD Connect Sync retire on August 31, 2022, and superseded 2.x versions follow a retirement policy from mid-March 2023.
February 2022 delivers one of the most consequential security defaults Microsoft has shipped in years: internet-sourced VBA macros lose their one-click enable button. Around that headline, Teams previews shared channels built on B2B direct connect, Partner Center moves coterminosity into the sandbox, and two retirement clocks start ticking for Azure AD Connect. The details, admin angles included, below.
Admin and security
Internet macros lose their one-click enable (security enhancement)
Previously, end users could enable VBA macros in a downloaded file by clicking a single button on the Trust bar, which made macro-laden attachments one of the cheapest attack paths available. With this change, opening an untrusted Office file from the internet that contains macros shows a Security Risk message bar instead, with a Learn More button rather than an enable button.
The Learn More button leads to an article for end users and information workers (opens in new tab) covering the risk of macro abuse, safe practices against phishing and malware, and instructions for enabling the macros if absolutely needed.
Further reading: Helping users stay safe: blocking internet macros by default in Office (opens in new tab).
Rollout: Version 2203, starting with Current Channel (Preview) in early April 2022.
Superseded Azure AD Connect Sync versions head for retirement (end of life)
A retired version of Azure AD Connect might stop working unexpectedly, and it will lack the latest security fixes, performance improvements, troubleshooting and diagnostic tools, and service enhancements.
- Which versions retire: Azure AD Connect version release history (opens in new tab)
- How to move: upgrade from a previous version (opens in new tab)
Rollout: mid-March 2023. Note that this policy does not change the retirement of all 1.x versions of Azure AD Connect Sync on August 31, 2022.
Tenant-level analytics for Power Automate enters public preview (security enhancement)
Admins gain the ability to monitor usage, maker activities, and inventory of cloud flows across the environments they manage. Tenant-level analytics is off by default; opt in using Microsoft's documented steps (opens in new tab).
Rollout: public preview begins mid-February 2022.
Coterminosity reaches the NCE sandbox (licensing)
Microsoft will bring testing into the Partner Center sandbox for coterminosity, the feature that lets partners align customer subscription end dates so renewals stop being scattered across the calendar. There is no mention yet of whether it can be applied retroactively to subscriptions already purchased on New Commerce.
Charges for coterminous subscriptions are prorated based on the number of months remaining in the original term, meaning the first subscription.
Scenarios coterminosity will not support:
- Adding a seat to an existing subscription (you cannot reset your renewal by incrementing seats)
- Upgrading a seat to a new or existing subscription
- Mid-term adjustments of subscription durations (such as moving from a 1-year to a 3-year term)
- Adjusting subscription end dates after coterminosity is turned on
Rollout: sandbox access opens in March 2022; no official GA date.
Teams
Shared channels preview: external collaboration without guest accounts (new feature)
Shared channels roll out as part of the Teams public preview program. Team owners enrolled in the preview see shared channels as an additional channel type at creation, and they can share the channel with anyone in the tenant.
The interesting part is the plumbing. External collaboration in shared channels runs on Azure AD B2B direct connect, a new way to collaborate with other Azure AD organizations that skips adding the external user as a guest entirely. Cross-tenant access policies give admins control over B2B direct connect, and a shared channel can be shared with as many organizations as the policy specifies. External collaboration is off by default. There is a demo video from the Ignite announcement (opens in new tab) worth watching.
APIs will be available for shared channels as well, which the multi-tenant tooling community will put to work quickly.
Rollout: late March 2022, expected complete by early April.
Chat density options land on desktop (new feature)
Users can customize how many chat messages fit on screen. The compact setting fits 50 percent more messages; the comfortable setting keeps the current Teams display. Rolling out on Teams desktop.
Rollout: mid-February 2022, expected complete late February.
See every team a user belongs to, from the admin center (new feature)
Admins can open any user's detail page via Users, then Manage users, select the user, and open the new Teams tab to view the list of teams that user is part of. Small feature, real time-saver for offboarding and access reviews.
Rollout: early February 2022, expected complete by late February.
LinkedIn profiles surface in 1:1 chats (new feature)
A new LinkedIn tab appears at the top of 1:1 conversations alongside Chat, Files, Organization, and Activity, working the way the contact card in Outlook does today.
Rollout: mid-March 2022, expected complete by early April.
Frequently asked questions
Can users still run macros in files downloaded from the internet?
Yes, but not with one click. Instead of the Trust bar button, users see a Security Risk message bar with a Learn More button that links to safe-practice guidance and instructions for enabling the macros if absolutely needed.
Do shared channels require adding external users as guests?
No. Shared channels run on Azure AD B2B direct connect, a new collaboration model that skips guest accounts entirely. Admins control it through cross-tenant access policies, and it is off by default.
Will coterminosity apply to NCE subscriptions you already purchased?
As of February 2022, Microsoft had not said whether coterminosity can be applied retroactively to subscriptions already purchased on New Commerce. Sandbox testing opens in March 2022 with no announced GA date.
When Microsoft hardens a default, verify it landed
Macro blocking only protects the tenants where it actually took effect. CloudCapsule checks 250+ controls across every customer tenant in about 60 seconds and flags the ones that drifted.
Run a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
