M365 Roundup, July 2026: Microsoft Puts an Expiry Date on SMS Authentication
TL;DR
- Passkeys become the default authentication experience in Microsoft Entra on September 1, 2026, and will be enabled automatically for users currently enabled for SMS or voice.
- Microsoft-provided SMS and voice authentication retires on February 1, 2027; after that date only customer-configured telecom providers from the Microsoft Security Store support those methods.
- Microsoft Defender for Office 365 adds prompt injection protection for email in early September 2026, quarantining high-confidence attempts to manipulate AI assistants before an AI workflow processes them.
- Microsoft 365 Business Standard with Copilot lists at $23.50 per user per month and Business Premium with Copilot at $32, both capped at 300 licenses on an annual subscription with annual billing.
- Microsoft Purview role group assignments can now carry an expiration from 1 day up to 2 years, making time-boxed admin access a setting rather than a calendar reminder.
July gave MSPs a date to put on the calendar. Microsoft-provided SMS and voice authentication now has a retirement date, passkeys become the tenant default in September, and the migration path runs through a telecom provider marketplace that did not exist a year ago. Everything else this month sits downstream of AI: Defender started defending the inbox against prompt injection, Purview added time limits to admin roles, and the Copilot feature list kept growing. Here is the month, ordered by what we would put on a project plan first.
Identity gets a hard deadline
Passkeys become the default, and Microsoft-provided SMS and voice retire
This is the item to brief clients on. Passkeys become the default authentication experience in Microsoft Entra on September 1, 2026, and telecom-based methods move to customer-configured providers through the Microsoft Security Store. Full detail in Microsoft's SMS and voice retirement (opens in new tab) documentation.
The timeline has four checkpoints:
- September 1, 2026: rollout begins and reaches tenants gradually. Passkeys are automatically enabled for users currently enabled for SMS or voice. The registration campaign is set to Microsoft-Managed, targeting passkeys for all users in eligible tenants. Users are prompted to register a passkey during MFA sign-in and can skip.
- September 18, 2026: review the telecom providers and related information available through the Microsoft Security Store to evaluate which option fits your regional and compliance requirements.
- October 30, 2026: customers who need to keep using SMS or voice can choose from the list of telecom providers in the Microsoft Security Store.
- February 1, 2027: Microsoft-provided SMS and voice authentication is retired. Only customer-configured telecom providers support those methods, and passkeys become the default recommended method.
Rollout: begins September 1, 2026. Retirement February 1, 2027.
Passkey registration logic gets smarter
The updated registration flow guides users toward passkey types that comply with the administrator-configured passkey profile restrictions, which cuts down on failed or non-compliant registration attempts. It also prioritizes registering a passkey local to the user's current device when policy permits.
Rollout: late August 2026, expected to complete in late August 2026.
Authenticator passkey restore improves on iOS
Moving to a new device gets a clearer, guided restore flow, along with better in-product explanation of cross-device sign-in with passkeys. iOS only for now; Android support comes later. Users with iCloud and iCloud Keychain backup enabled who have passkeys on their previous device see the new experience during device restore, and users restoring Authenticator on a new device get an interface that branches on whether they are setting up new or restoring existing. Enabled by default, with no changes to existing admin configurations or policies.
Rollout: August 2026.
Passwordless users can change passwords without knowing the old one
Entra will let passwordless users change their password from My Sign-Ins using a strong credential such as a passkey or Windows Hello, without knowing the current password and without going through SSPR. This matters for the common middle state where an organization has adopted passwordless but still keeps passwords alive for legacy applications and services.
Rollout: late October 2026, expected to complete by late October 2026.
Custom CSS positioning properties in branded sign-in are being retired
Microsoft is removing custom CSS positioning properties from company branding to reduce the room for deceptive or misleading sign-in page layouts. Brand customization stays, but the layout primitives that made a convincing phishing clone easier go away. Background in Microsoft Entra ID enhances security of branded sign-ins (opens in new tab).
If a client has a heavily customized sign-in page, check it before October.
Rollout: October 2026, expected to complete by late November 2026.
Defender and Purview answer AI-era problems
Safe Attachments can quarantine what it cannot scan
A new opt-in setting in Safe Attachments policies automatically quarantines email containing password-protected attachments when Defender for Office 365 cannot complete scanning or detonation. Unscannable content has always been the gap in attachment protection, and this closes it without breaking business workflows, since controlled release options remain available.
Rollout: early August 2026 through late August 2026.
Prompt injection protection arrives for email
Defender for Office 365 gains prompt injection protection: detection and blocking of malicious prompt injection content embedded in email that tries to manipulate AI assistants and agents. It targets attacks designed to exfiltrate information, discover tools, or expose system prompts, and high-confidence threats get quarantined before an AI-powered workflow can process them. Detail in Defending the inbox against prompt injection attacks (opens in new tab).
Worth noting for anyone running Copilot over mailboxes: the attack surface is the mailbox, not the model.
Rollout: early September 2026, expected to complete by early September 2026.
Purview role groups get an expiration date
Purview can now apply a time limit when you add a user or security group to a role group, with an expiration anywhere from 1 day up to 2 years. Temporary administrative access becomes a setting instead of a note in a ticket, which is the difference between least privilege on paper and least privilege in the tenant.
Rollout: late July 2026, expected to complete by late August 2026.
Copilot keeps expanding its surface area
Planner comes to Copilot Chat
Users can create, update, and ask questions about Planner tasks and plans in natural language inside Copilot Chat, without switching applications.
Rollout: early September 2026.
PowerPoint Copilot reads custom skills from OneDrive
PowerPoint Copilot on the web adds support for personal, user-defined custom skills stored in OneDrive. A user uploads a skill folder containing a SKILL.md file to a designated OneDrive location, and the skill appears automatically in the Copilot Skills menu in PowerPoint.
User-authored skills landing in a personal OneDrive folder is a governance question worth raising before it becomes a habit.
Rollout: late July 2026, expected to complete by late July 2026.
Excel Copilot adds a Brand Kit skill
Copilot in Excel gains a Brand kit skill that applies approved organizational branding to workbook content. Using assets from the Microsoft 365 Brand Center, Copilot formats tables and charts with approved colors, fonts, and logos, so reports come out consistent without a manual styling pass.
Rollout: mid-July 2026, expected to complete by mid-August 2026.
Copilot moves into the Outlook compose window
Microsoft is integrating Microsoft 365 Copilot directly into the Outlook email drafting experience, so composing and collaborating with Copilot happen in the same place.
Rollout: mid-July 2026, expected to complete by early August 2026.
Copilot agents support multiple owners
Microsoft 365 Copilot agents now support multiple owners, which allows collaborative management and removes the single-creator dependency that turns an agent into an orphan when someone changes roles.
Rollout: mid-August 2026.
Copilot Studio can share autonomous agents with end users
You can create triggers for autonomous agents that run using end-user credentials. Agents operate fully in the background, respond to external events, and can be shared with end users so they run on their behalf.
Agents executing under end-user credentials in the background is exactly the pattern that needs a permissions review before it reaches production.
Rollout: public preview July 30, 2026.
Licensing and incentives: three changes that touch margin
Copilot in 30 targets organizations under 300 seats
Built for organizations with fewer than 300 employees, Copilot in 30 combines a new 25-user, 30-day Microsoft 365 Copilot Business trial with resources and guidance partners can use to help customers get started and assess potential value. Full detail in the July 2026 Partner Center announcements (opens in new tab).
Rollout: starting August 1, 2026.
Microsoft 365 Business with Copilot SKUs are now available
Two SKUs, both with a 300-license maximum on an annual subscription with annual billing:
- Microsoft 365 Business Standard with Copilot: 23.50 USD per user per month
- Microsoft 365 Business Premium with Copilot: 32 USD per user per month
Announcement detail in Now available: Microsoft 365 Business with Copilot SKUs (opens in new tab).
FY27 Microsoft incentives change the model
CSP partners earning incentives from reselling Microsoft 365 services face major changes to the model in FY27. Pax8 has a readable breakdown in Microsoft incentives FY27 updates (opens in new tab). If reseller incentives are a meaningful line in your P&L, read it before you finalize next year's numbers.
Teams, OneDrive, and Intune round out the month
The Recap app consolidates meeting recaps
The Recap app in Teams gives users one place to find, review, and catch up on meeting recaps, pulling recordings, transcripts, and AI-generated summaries together instead of scattering them across meetings.
Rollout: early July 2026, expected to complete by early August 2026 (previously late July).
Teams generates AI meeting archive files
Teams is introducing AI-generated meeting archive files that capture key insights from meetings. These archives help Microsoft 365 Copilot and Facilitator give more accurate, context-aware responses while keeping privacy controls intact, because raw meeting content is not stored. Detail in AI archive for Teams meetings (opens in new tab).
Rollout: mid-September 2026 (previously late August), expected to complete late September 2026.
OneDrive can exclude specific folders from syncing
Organizations will be able to exclude specific folders from syncing to OneDrive, keeping machine-specific or development folders local to the device instead of uploading them to the cloud. The examples Microsoft names are the ones every dev machine has: PowerShell modules, Visual Studio configuration folders, and node_modules. Policy reference in Use OneDrive policies to control sync settings (opens in new tab), which Microsoft will update before rollout.
Rollout: mid-August 2026, expected to complete by late August 2026.
Edge enforces screen capture restrictions on labeled PDFs
Microsoft is enforcing Do Not Allow Screen Capture in the OneDrive and SharePoint web PDF viewer when a sensitivity-labeled PDF is opened through Microsoft Edge. Label enforcement reaching the browser viewer closes a real gap for anyone relying on labels as a control rather than a suggestion.
Rollout: mid-August 2026, expected to complete by late August 2026.
SharePoint document library views come to OneDrive
Users can access and manage SharePoint document library views directly within OneDrive, rather than switching to SharePoint to work with a view.
Rollout: mid-July 2026, expected to complete by late July 2026.
Windows device sync status stops being a guessing game
The per-device sync experience in the Intune admin center now shows progress, so admins can confirm an action is running and see where it is in the process. The updated sync action also triggers both the MDM check-in and the Intune Management Extension check-in on Windows, which means one sync pulls policy, app, and script changes in a single pass. Full detail in What's new in Microsoft Intune, July (opens in new tab).
Rollout: July 2026.
The passkey deadline is a project, not a checkbox
Every tenant with users on SMS or voice authentication has work to do before February 1, 2027, and the September default change starts moving them whether or not anyone plans for it. Multiply that across a client base and it is a rollout, not a setting.
CloudCapsule scans every tenant you manage in about 60 seconds, collecting over 200 data points, with remediation and policy management so fixes deploy from the portal instead of five admin centers.
Frequently asked questions
When exactly does Microsoft stop providing SMS and voice authentication?
February 1, 2027. The transition starts September 1, 2026 when passkeys become the default, and from October 30, 2026 tenants that still need SMS or voice can select a telecom provider through the Microsoft Security Store. After February 1, 2027, only customer-configured providers support those methods.
What is Copilot in 30?
A partner-facing offer for organizations under 300 employees, announced for August 1, 2026. It pairs a 25-user, 30-day Microsoft 365 Copilot Business trial with guidance partners can use to help a customer evaluate the value inside that window.
What changed for CSP partners in the FY27 incentive model?
Microsoft made major changes to the model that CSP partners earn from reselling Microsoft 365 services. The specifics are worth reading in full before you model next year's margin, because the earning mechanics differ from FY26 rather than just shifting rates.
Does the new Safe Attachments setting quarantine every password-protected attachment?
No. The opt-in setting quarantines messages with password-protected attachments only when Defender for Office 365 cannot complete scanning or detonation, and controlled release options let admins release legitimate messages.
This month's changes are next quarter's audit finding
CloudCapsule scans each tenant you manage against 250+ controls in about 60 seconds, with remediation and policy management built in, so drift gets caught before a client does.
Run a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
