M365 Roundup, May 2026: Teams Gets Its Own Threat Reports
TL;DR
- Microsoft Teams will let users report suspicious external contacts directly from chat, with reports surfacing in the Teams admin center starting mid-June 2026.
- A new Security Detection Report in the Teams admin center unifies messaging threat signals like impersonation, malicious URLs, and weaponizable file types.
- SharePoint Online begins enforcing license-based storage quotas in late May 2026, placing over-quota OneDrive users into a read-only state.
- Microsoft Entra ID will enable App Instance Lock by default for newly created applications starting early June 2026.
- Zero-hour Auto Purge in Defender for Office 365 expands to scan and remediate malicious email in Deleted Items folders.
May 2026 was a security month. Microsoft handed Teams admins two genuinely useful defensive tools, started enforcing SharePoint storage quotas against actual license entitlements, and hardened the default posture of new Entra applications. The collaboration polish is still here too, from background file uploads to a refreshed meeting experience. Here is everything that matters, organized by what we would act on first.
The security changes worth acting on
Users can flag suspicious external contacts in Teams
To help organizations respond more quickly to external security threats, Microsoft Teams will allow users to report suspicious external users directly from Teams. Those reports surface in the Teams admin center.
Rollout: mid-June 2026, expected to complete by late June 2026.
A unified Security Detection Report lands in the Teams admin center
A new Security Detection Report in the Teams admin center provides a single view of messaging security detections across signals such as impersonation, malicious URLs, and weaponizable file types. For anyone who has tried to reconstruct a Teams phishing campaign from scattered logs, this is the consolidation that was missing.
Rollout: late June 2026, expected to complete by late June 2026.
Entra locks new app instances by default
To improve application security, Microsoft Entra ID will enable App Instance Lock by default for newly created applications. The change prevents sensitive application properties from being modified outside the application's home tenant, reducing the risk of unauthorized changes that lead to application compromise. A good default that previously required someone to know the setting existed.
Rollout: early June 2026, expected to complete by late June 2026.
ZAP reaches into Deleted Items
Zero-hour Auto Purge (ZAP) in Microsoft Defender for Office 365 will now scan and remediate malicious emails in users' Deleted Items folders, extending post-delivery protection without any new policies to configure.
Rollout: early June 2026, expected to complete by late July 2026.
Outlook inbox rules can key off the External tag
Outlook Inbox Rules gain the External email tag as a rule condition. The tag is applied by the ExternalInOutlook feature and identifies messages originating outside your organization, which makes rules for triaging external mail much cleaner to build.
Rollout: early June 2026, expected to complete by late June 2026.
SharePoint storage quotas get real enforcement
Microsoft is updating how SharePoint Online enforces user storage quotas so they consistently align with license entitlements. This is the item in this roundup most likely to generate helpdesk tickets if you do nothing.
Who is affected:
- Microsoft 365 tenants using SharePoint Online
- Users currently over the OneDrive for Business storage quota allowed by their assigned license
- Admins who have set user-specific storage limits above licensed entitlements
What happens:
- User storage quotas are re-evaluated against license limits during the refresh process.
- Users whose OneDrive for Business usage exceeds their licensed quota are placed into a read-only state, temporarily restricting write access to existing SharePoint content until storage usage is remediated. This includes cases where an admin-set quota exceeds the license allowance, and EDU-licensed users exceeding their licensed storage limit.
- Users within their licensed limits see no change.
How to prepare:
- Review OneDrive storage usage across the organization to find users exceeding licensed quotas. Microsoft publishes a ready-made script: Identify OneDrive Users Over License-Based Storage Quota (opens in new tab).
- For affected users, either upgrade the license to increase available storage or work with the user to bring usage back within limits.
Rollout: late May 2026, expected to complete in June 2026.
Teams: sharing, meetings, and an AI kill switch
Quick Share extends to images
Quick Share now covers images in Teams, letting users share or copy image links directly from familiar interaction points while preserving existing permissions.
Rollout: mid-June 2026, expected to complete by late June 2026.
Cloud file search inside the attach picker
The file attach picker gains search for cloud files, so users can find and attach the right file directly when sharing in chats and channels instead of browsing for it.
Rollout: mid-June 2026, expected to complete late June 2026.
A redesigned in-meeting experience is coming this fall
Teams is updating its meeting experience with simplified, center-aligned controls, a redesigned share panel featuring live previews and two-step share confirmation, and user customization options. The two-step share confirmation alone should prevent a generation of accidental screen shares.
Rollout: early October 2026, expected to complete by late November 2026.
Download notifications get out of the way
File download notifications in Teams will automatically dismiss after approximately 4 seconds, with an option to open or locate downloaded files after the download completes.
Rollout: mid-June 2026, expected to complete by late June 2026.
Organizers and presenters can toggle Meeting AI mid-meeting
A new in-meeting toggle lets licensed meeting organizers and presenters turn Meeting AI on or off during a live meeting, covering Copilot, Facilitator, and meeting recap. Useful the moment a conversation turns sensitive.
Rollout: mid-June 2026 through end of June 2026.
File uploads stop blocking the send button
Users are currently blocked from sending messages in Teams while a file upload is in progress. With this update, uploads happen asynchronously in the background so users can keep sending messages without interruption.
Rollout: late June 2026, expected to complete by late June 2026.
Copilot keeps spreading through the suite
Cowork picks up plugins, connectors, and partner integrations
Copilot Cowork can now securely access additional Microsoft and third-party services using existing permissions, helping users complete tasks across systems without changing current security or compliance controls. Full details in Microsoft's Cowork in progress post (opens in new tab).
Rollout: Public Preview began early May 2026 and is expected to complete in early May 2026.
Authoritative Sites tell Copilot which SharePoint content to trust
Authoritative Sites lets administrators designate specific SharePoint sites as trusted sources of organizational information. Content from these sites is prioritized in Copilot Chat and Copilot Search, improving reliability and search relevance. Admins designate sites using PowerShell.
Rollout: mid-June 2026, expected to complete by late June 2026.
Flux.2 Flex image generation arrives in PowerPoint
Microsoft 365 Copilot in PowerPoint now supports the Flux.2 Flex image generation model, offering higher-quality visuals and layout.
Rollout: late April 2026, expected to complete by early May 2026.
PowerPoint learns to visualize a slide
A new "Visualize this slide" Copilot skill on PowerPoint for Windows desktop transforms simple text into a visual image and converts text-heavy slides into polished, professional visuals.
Rollout: mid-May 2026, completes by mid-May 2026.
PowerPoint preps you for the Q&A
The "Prepare for Questions" Copilot skill analyzes presentations to identify potential weak points and anticipate audience questions, helping presenters tighten the story before delivering it.
Rollout: late May 2026, expected to complete by late May 2026.
Office apps: small fixes that remove daily friction
Word drops paragraph locks in coauthoring
Lock-free coauthoring lets multiple users edit the same paragraph in Word simultaneously, reducing edit conflicts and interruptions during real-time collaboration.
Rollout: mid-May 2026, expected to complete by early June 2026.
PowerPoint Live can reload a deck mid-meeting
PowerPoint Live presenters will be able to refresh their presentation during a live meeting to load the latest version of the deck without restarting the presentation.
Rollout: early June 2026, expected to complete by mid-June 2026.
Keeping up is the easy part. Staying configured is the hard part.
Every month Microsoft ships changes like these, and every month the gap widens between what a tenant could be enforcing and what it actually is. We built CloudCapsule to close that gap for MSPs: scans average 60 seconds per tenant, collect over 200 data points, and now include remediation and policy management so you can deploy fixes right from the portal.
Frequently asked questions
What should MSPs do about the SharePoint storage quota change?
Before the enforcement completes in June 2026, identify users whose OneDrive usage exceeds their licensed quota using Microsoft's PnP script sample, then either upgrade those licenses or reduce usage. Affected users are placed into a read-only state until storage is remediated.
Does the new Teams Meeting AI toggle require a license?
The in-meeting toggle is available to licensed meeting organizers and presenters, letting them turn Meeting AI features like Copilot, Facilitator, and meeting recap on or off during a live meeting.
Microsoft ships changes monthly. Your baselines drift just as fast.
CloudCapsule scans every tenant you manage against 250+ controls in about 60 seconds, so the settings Microsoft changed last month never become the gap a client finds next quarter.
Run a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
