M365 Roundup, June 2024: Token Protection, Device Attestation, and Faster Policy Refresh

June 2024's wave leans toward security and endpoint control: Token Protection and the new Entra PowerShell module land in preview, Intune gains hardware-backed device attestation and a much faster policy refresh, and Copilot's prerequisite list expands to a long roster of standalone plans. Teams, Outlook, and the Office apps round it out. Everything that matters, grouped by product.

One piece of our own news first. June 2024 marked the soft-launch of CloudCapsule, our automated tool for assessing Microsoft 365 tenants against the CIS Controls. We built it to streamline tenant assessments to a trusted standard, raise the tide of security across the space, and help MSPs understand the why behind every policy configuration.

Beyond automated evidence collection for the CIS Controls, it detects tenant misconfigurations against security best practices, and you can run your first assessment against a tenant free. Note that it does not work against M365 dev tenants.

Microsoft Teams: seven mostly quality-of-life updates#

Detect and hide inactive channels#

Teams will automatically detect and hide channels you have not interacted with recently. Users can keep them hidden or show them again, toggling the behavior under Teams > Settings > Chats and channels > Hide inactive channels. Rollout: mid-August 2024, completing by mid-September 2024.

"Files" becomes "Shared" with new features#

The Files tab in chat is renamed Shared and gains recent files, all files, and links. Coming soon after rollout: image previews for links and keyword search; a later version adds media links for images, videos, and GIFs. Like Files, the Shared tab is on by default for all Teams users. Rollout: mid-July 2024, completing by late July 2024.

Teams web PWA on Windows and macOS#

Web users who would benefit from launching Teams on the web as a standalone app can now install the Teams Progressive Web App directly from the browser address bar. Reference: Install, manage, or uninstall apps in Microsoft Edge (opens in new tab) and Using progressive web apps in Chrome (opens in new tab). Rollout: GA.

Teams Premium feature usage report for admins#

A usage report to drive awareness of Teams Premium features and maximize ROI on the investment, available under Teams admin center > Analytics and reports > Usage reports > Teams Premium feature usage report. Rollout: late July 2024, completing by early August 2024.

Per-post notification toggle in channels#

Users can turn notifications on or off for an individual post in a channel from the three-dot menu at the top right of the post, on Teams for desktop and Mac. Rollout: mid-July 2024, completing by late July 2024.

Channel cards#

Hovering over a channel name in the header, or anywhere a channel is mentioned, surfaces a channel card with the description, last activity time, team name, and membership, plus quick entry to notification settings, owner channel management, and the channel roster. Rolling out across Teams for desktop and web. Rollout: early July 2024, completing by late July 2024.

Enhanced sound notification controls#

Users can customize sounds for different notification types: play or mute sounds for standard versus urgent and priority notifications, play or mute while Busy or In a meeting, and pick distinctive sounds per notification type. The Play sounds with notifications setting now offers eight options through a drop-down. Found under Settings > Notifications and activity > Sound. Rollout: mid-July 2024, completing by late July 2024.

Microsoft Outlook: scheduling and account configuration#

Improved suggested meeting times#

Redesigned suggestion time tiles, now accessed from the new Find a time menu, make it easier for organizers to find a slot based on everyone's availability. Applies to new Outlook for Windows and the web. Rollout: early July 2024, completing by late July 2024.

Send updates only to added or removed attendees#

When updating meeting attendees, organizers are prompted to send updates only to added or removed attendees, or to all attendees. Applies to Outlook on the web and new Outlook for Windows. Rollout: late July 2024, completing by late August 2024.

Add shared folders to Favorites#

Users can add shared folders and individual folders from shared mailboxes to Favorites, including calendars and folders containing mail, contacts, tasks, or notes. Rollout: mid-November 2024 (previously mid-July), completing by early December 2024 (previously mid-August).

Automatically configure accounts with new policy#

Before: the first-time login page in new Outlook for Windows has an empty email field. After: the field is auto-filled with the primary SMTP address and cannot be changed. The policy, Automatically configure accounts based on Active Directory Primary SMTP address, is accessed through the Microsoft Intune admin center (opens in new tab) > Apps > Policies for Office Apps. Rollout: mid-June 2024, completing by early July 2024.

Microsoft 365 apps: file menu, permissions, link expiry, and checkboxes#

Enhanced File menu and easier renaming#

An enhanced File menu for Word, Excel, and PowerPoint on the web makes it easier to create, open, share, export, and manage files, with an updated autosave experience and more efficient renaming. Rollout: early August 2024, completing by early October 2024.

Modernized user-defined permissions#

A new dialog for selecting which users get which permissions when a sensitivity label configured for user-defined permissions is applied, or when applying standalone Information Rights Management. Some permission groupings are renamed: Reviewer becomes Restricted Editor, Co-Author becomes Editor, and Co-Owner becomes Owner. The rights in each grouping are unchanged. See Configure usage rights for Azure Information Protection (opens in new tab). Available by default. Rollout: early September 2024, completing by late September 2024.

Set expiration on all share links#

When sharing a link in Microsoft 365, Set expiration date lets users set a date for any link to expire, after which the link stops working and must be recreated. Before this rollout, expiration could only be set for Anyone links. Rollout: early July 2024, completing by mid-July 2024.

Checkboxes in Excel#

Checkboxes ship to production in Excel, useful for checklists, task management, and visualizing data at a glance, inserted into any cell with a few clicks. Full announcement: Checkboxes in Excel (opens in new tab). Rollout: June 26 beginning, complete by end of July.

Microsoft Intune: device attestation and Config Refresh#

Hardware-backed device attestation#

A common attack path is supply-chain impersonation of authorized devices or hardware-level malicious code that antivirus cannot detect. Intune device attestation defends against this by enabling hardware-backed attestation on many platforms. Windows device enrollment attestation, available in the coming weeks, requires a device to be hardware-attested so you can verify it is securely enrolled. The enrollment credentials, the private keys of the enrollment MDM certificate from Intune and the Entra ID access token, are stored on the TPM 2.0 chip and confirmed through attestation. Full announcement: Boost security with Microsoft Intune device attestation (opens in new tab). Rollout: starting now.

Intro to Config Refresh#

Config Refresh reapplies Policy CSP settings when devices drift from your intent, improving security and compliance on MDM-managed PCs. Group Policy refreshes every 90 minutes and MDM policy every eight hours by default; Config Refresh lets you set the interval as short as 30 minutes or as long as 24 hours. Key features:

• A reset operation to reset any settings you manage that use the Policy CSP
• Reset of managed settings as frequently as every 30 minutes
• Offline functionality, with no MDM server connectivity required
• Ability to pause for troubleshooting, with automatic resume after 24 hours

Full announcement: Intro to Config Refresh (opens in new tab). Rollout: GA.

Microsoft Copilot: Catch up, expanded plans, and Teams improvements#

The new Catch up feature#

A Catch up tab on the Copilot page in Microsoft365.com (opens in new tab) and Microsoft Teams shows a carousel of cards, each with an update tied to an important meeting or document plus a suggested prompt to dig in. Teams users may need to add the Copilot app to see it. Rollout: late June 2024, completing by late July 2024.

Expanded availability for Copilot for Microsoft 365#

As of June 12, 2024, the following standalone commercial plans are added to the qualifying prerequisites for Copilot for Microsoft 365:

• Microsoft 365 Apps for Business
• Microsoft 365 Apps for Enterprise
• Microsoft Teams Essentials
• Microsoft Teams Enterprise
• Microsoft Teams EEA (European Economic Area)
• Exchange Kiosk
• Exchange Plan 1
• Exchange Plan 2
• SharePoint Plan 1
• SharePoint Plan 2
• OneDrive for Business Plan 1
• OneDrive for Business Plan 2
• Microsoft Planner Plan 1 (formerly Project Plan 1)
• Microsoft Project Plan 3
• Microsoft Project Plan 5
• Project Online Essentials
• Visio Plan 1
• Visio Plan 2
• Microsoft Clipchamp

Full announcement: June 2024 Partner Center announcements (opens in new tab).

Optimized file link support in Teams chat and channels#

Previously, a file attached to a message did not appear when someone asked Copilot for files shared in the chat. Now attached files are included in Copilot's response, and pasted file links are retrieved faster and more reliably. Rollout: mid-July 2024, completing by late July 2024.

Improved time-based responses#

Copilot in Teams better understands time-related queries in chat and channels. Before, a prompt like "Summarize the key action items from March" was limited to the last 30 days; after, Copilot detects and responds to the specified period, with a simplified timestamp. Rollout: mid-July 2024, completing by late July 2024.

Reference PDF files in PowerPoint#

With Create from File in PowerPoint, Copilot can build a new presentation based on a PDF. Rollout: late May 2024, completing by mid-June 2024.

Recall preview update for Copilot+ PCs#

Recall builds an explorable visual timeline by periodically snapshotting your screen, stored and analyzed locally with on-device AI. Microsoft updated the setup experience to make Recall an explicit opt-in; if you do not proactively turn it on, it is off by default. More: Update on the Recall Preview Feature for Copilot+ PCs (opens in new tab).

Microsoft Admin: DKIM, Entra PowerShell, P2P transfers, and token protection#

Simplified DKIM setup#

Two updates. Easier activation during domain registration: enable DKIM directly from the domain page in the admin portal during domain registration, with a wizard guiding the publish-and-enable steps.

Revamped DKIM page: redesigned to show DKIM status at a glance and enable it via a toggle.

Rollout: mid-June 2024, completing by mid-July 2024.

CSP partner-to-partner subscription transfers for NCE#

P2P is now live. Authorized partners selling new commerce CSP subscriptions can transfer new commerce license-based subscriptions from one partner to another. Partner Center announcement: June 2024 announcements (opens in new tab).

The Microsoft Entra PowerShell module#

A command-line tool for managing and automating Entra resources, including users, groups, applications, service principals, and policies. It builds on the Microsoft Graph PowerShell SDK, is fully interoperable with its cmdlets, and offers a backward-compatibility option with the deprecated AzureAD module (opens in new tab) to speed migration. Full announcement: Introducing the Microsoft Entra PowerShell module (opens in new tab). Rollout: public preview.

Public preview: Token Protection for sign-in sessions#

Token Protection ensures tokens can only be used on the device they were issued on. Enforced through Conditional Access, tokens authorizing access to resources must come from the device where the user originally signed in, the best available protection for high-value users and data against token theft. The first preview protects Office 365 resources like Exchange mailboxes and SharePoint sites from illegitimate use of stolen Windows native client refresh tokens. Full announcements: Public Preview: Token Protection for Sign-In Sessions (opens in new tab) and How to break the token theft cyber-attack chain (opens in new tab).