M365 Roundup, November 2023: Ignite Month Brings Auto-Enforced MFA and Passkeys

Ignite dominated November 2023, but the announcement with the sharpest teeth was quieter: Microsoft started creating Conditional Access policies inside customer tenants on its own, with a 90-day clock before they enforce themselves. Add device-bound passkeys arriving in preview, a hard cutover date for classic Teams, two new paid Intune add-ons, and multi-tenant management coming to Defender XDR, and this month rewrote defaults across the stack. Product by product, here is everything that matters.

Entra ID: MFA stops being optional#

Microsoft-managed Conditional Access policies appear in your tenants#

Building on the security defaults introduced in 2020, Microsoft is introducing Microsoft-managed Conditional Access policies. Between early November 2023 and late December 2023, these policies are created directly in tenants as part of Microsoft's ongoing security push.

The mechanics matter:

• Policies arrive in report-only mode: they block nothing, but report on what they would affect when switched On.
• After creation, you have 90 days to evaluate and configure them.
• Policies not moved to On or Off within that window are automatically moved to On, and covered users must then use multifactor authentication.

For MSPs this is a per-tenant review task with a deadline, not an FYI. Full article: Automatic Conditional Access policies in Microsoft Entra streamline identity protection (opens in new tab)

Device-bound passkeys are coming in January 2024#

Beginning January 2024, Entra ID supports device-bound passkeys stored on computers and mobile devices as a preview authentication method, alongside existing FIDO2 security key support, extending phishing-resistant authentication to hardware users already carry. The renames to watch for:

• In the Entra admin portal, "FIDO2 security keys" becomes "Passkeys (FIDO2)" in the authentication methods policy and in Conditional Access authentication strengths.
• In the My Security Info portal, a new "Passkey (preview)" registration option appears for registering a device-bound passkey on computers, mobile devices, or security keys.
• The end-user sign-in option for Windows Hello for Business and FIDO2 security keys is renamed "Face, fingerprint, PIN, or security key," with "passkey" used in the updated sign-in experience to cover credentials from security keys, computers, and mobile devices.

Authenticator goes quiet on suspicious requests#

Microsoft Authenticator now suppresses pop-up notifications when a request looks anomalous, such as originating from an unfamiliar location or exhibiting other risk signals. The change is generally available and significantly reduces the MFA-fatigue attack surface without user action. Full article: Emphasizing security by default with advanced Microsoft Authenticator features (opens in new tab)

Teams: Copilot everywhere, plus a hard deadline for classic clients#

Classic Teams gets a forced retirement date#

Microsoft confirmed that after March 31, 2024, any classic Teams users who have not updated to new Teams will be updated automatically. Plan migrations before the platform does it for you.

Copilot lands in the compose box#

Among the wave of Ignite announcements for Copilot in Teams: compose assistance in chat and channels. Enter a draft message in chat, meeting chat, or a channel, and Copilot can rewrite it, adjust the tone (casual, professional, confident, enthusiastic), and change the length before sending. Generally available for users with a Microsoft 365 Copilot license, with one large caveat as of November 2023: those licenses are limited to a select audience and not available in CSP, with CSP estimated for roughly April 2024.

The full Ignite list for Teams: What's New in Microsoft Teams at Microsoft Ignite 2023 (opens in new tab)

Voice isolation filters out everything but you#

Voice isolation uses AI and your enrolled voice profile to strip all background noise from calls and meetings, including other people's voices, so only the speaker's voice is transmitted, whether the user is in a busy office, a noisy cafe, or a crowded airport. It is built on Microsoft's deep learning, speech services, and audio processing work. Rollout: mid-January 2024, completing by mid-February 2024.

Generative background effects (Teams Premium)#

Decorate your background lets meeting participants use generative AI to enhance their real-world room, cleaning up clutter or adding plants to a wall, rather than replacing it. Available in early 2024 for users with a Teams Premium license.

Teams Phone: shared calling, click-to-call, and private lines#

• Shared calling lets groups of users make and receive PSTN calls on a shared phone number and calling plan, saving admin setup time. Generally available now when licensed through E5 or Teams Phone Standard, configurable with Teams Calling Plans Pay-As-You-Go or operator calling plans. Deployment is via PowerShell today, with a Teams admin center experience coming. Watch the shared calling demo (opens in new tab).
• Click-to-call lets customers reach sales and support teams from a webpage or app with a single click. Developers can add, customize, and program the widget to connect to a specific Teams user, call queue, or auto attendant. Available in early 2024.
• Private line enables a second, private phone number for a select set of callers that bypasses delegates, admins, or assistants, with a distinct notification and ringtone. Incoming calls only. Available in early 2024.

Smaller Teams changes worth noting#

• Files app becomes OneDrive. The Files app on the left side of the Teams desktop client is updated to the new OneDrive app experience in both classic and new Teams, with performance improvements, more views, and all existing Files features intact. Rollout: late November 2023, completing by mid-December 2023.
• Teams chat embeds in Outlook on the web. The Teams chat icon in the suite header currently opens a new browser tab; it will instead open an embedded chat experience inside Outlook on the web. Rolling out now over the coming months, with Teams integrations also planned for the new Outlook on Windows 11 next year.
• Simpler team and channel creation. Users can create a team or channel from the top "+" button. Elevating "create channel" is meant to nudge users toward channels instead of new teams, reducing team proliferation. Rollout: early December, completing by mid-December 2023.

Intune: Security Copilot plus two new paid add-ons#

Security Copilot embeds in the Intune console#

Microsoft is bringing an embedded Security Copilot experience to Intune, aimed at faster, better-informed endpoint decisions: visibility across security data with full device context, real-time guidance while creating policies, and quicker root-cause discovery and remediation for device issues. It launches in December 2023 as a private preview for select customers in the Security Copilot Early Access Program. Full article: Microsoft Intune introduces Security Copilot-embedded experience (opens in new tab)

Enterprise App Management ($2/user/month or Intune Suite)#

Enterprise App Management consolidates the application update process into a single screen showing every catalog app with an available update, current and new versions side by side, cutting the traditional work of monitoring updates, gathering app data, and packaging. It requires the Intune Suite add-on or is available standalone at $2 per user per month, arriving February 1, 2024 for enterprise customers and March 1, 2024 for government customers. Full article: Introducing Microsoft Intune Enterprise App Management (opens in new tab)

Advanced Analytics ($5/user/month or Intune Suite)#

Coming February 2024, Intune Advanced Analytics adds near real-time device data with device query functionality and a battery health report. Like Enterprise App Management, it requires the Intune Suite add-on or sells standalone, at $5 per user per month. Full article: Announcing Microsoft Intune Advanced Analytics (opens in new tab)

Mac management keeps maturing#

Microsoft published a roundup of macOS MDM improvements in Intune, making the case that Mac endpoints belong under the same management roof. Full article: Now is the time, manage your Mac endpoints with Microsoft Intune (opens in new tab)

Outlook: Stream video, recorded and played inline#

• Record video directly in Outlook. Soon users can record themselves, their screen, or both from inside Outlook and insert the recording into an email. Rollout: December 2023, completing by March 2024.
• Watch Stream videos inline. When someone pastes a Stream video link in a supported Outlook app, recipients in the same organization can watch it directly in their inbox without leaving Outlook. External recipients, and those not on new Outlook or web, see a link to the Stream web app instead, subject to the organization's file sharing settings. Rollout: December 2023, completing by March 2024.

SharePoint: a first-party eSignature service#

SharePoint eSignature is Microsoft's first-party electronic signature service, letting users request signatures on a PDF via SharePoint Online, with signers adding their electronic signature and signed documents saved securely back to SharePoint. Pricing is pay-as-you-go, per request. Rollout begins in the US in late November 2023, completing by Q1 2024. Setup documentation: Set up Microsoft Syntex eSignature (opens in new tab)

Microsoft 365 platform: backup, archive, Loop, and a Copilot rename#

Microsoft 365 Archive and Backup hit public preview#

SharePoint admins and Global admins can pick inactive sites in the SharePoint admin center, or via PowerShell, and archive them, individually or in bulk from the Active sites page command bar. Archived storage is deducted from active storage and billed on consumption as archived storage instead.

• Announcement: Introducing Microsoft 365 Backup and Microsoft 365 Archive (opens in new tab)
• Setup: Set up Microsoft 365 Backup (Preview) (opens in new tab)
• Setup: Set up Microsoft 365 Archive (Preview) (opens in new tab)

Bing Chat Enterprise is now Copilot, GA December 1#

Announced at Ignite 2023, Bing Chat Enterprise was renamed Microsoft Copilot, keeping the same commercial data protection for Entra ID (work account) users and gaining a new home at copilot.microsoft.com. Entra ID users on Microsoft 365 E3, E5, Business Standard, Business Premium, or A3/A5 for faculty remain eligible at no additional cost, and Microsoft 365 F3 licenses become eligible at no additional cost as well (see message center item MC684891 for timing).

Microsoft Loop reaches general availability#

Loop is generally available for Microsoft 365 Business Standard, Business Premium, E3, and E5 customers on web and mobile, bringing people and resources together in centralized AI-enhanced workspaces. Full announcement: Microsoft Loop, generally available to Microsoft 365 work accounts (opens in new tab)

Defender XDR goes multi-tenant#

Multi-tenant management in Microsoft Defender XDR gives security operations teams a single, unified view of all the tenants they manage, enabling faster incident investigation and advanced hunting across data from multiple tenants. For MSPs and MSSPs running security operations across a customer base, this is the Ignite item to pilot first. More info: Multi-tenant management in Microsoft Defender XDR (opens in new tab)