M365 Roundup, October 2025: Windows 10 Runs Out of Road
TL;DR
- The October 2025 monthly security update was the final one for Windows 10 version 22H2; unmigrated devices need Windows 11 or the Extended Security Updates program.
- GPT-5 became the default model for Microsoft 365 Copilot licenses between late October and late November 2025, with dynamic routing across model variants.
- Starting February 2026, Microsoft Authenticator will wipe Entra credentials from jailbroken or rooted devices, with no admin configuration required.
- Intune can now remove pre-installed Microsoft Store apps by policy on Windows 11 Enterprise and Education, version 25H2.
- Defender for Office 365 quarantine now lists messages per individual recipient, and ReleaseToAll applies to a single user.
October 2025 closed a chapter: the last security update for Windows 10 shipped, a decade after launch. The rest of the month was quieter but busy, with GPT-5 rolling out as Copilot's default brain, a coming change that wipes Authenticator credentials from jailbroken phones, and a stack of Teams and OneDrive quality-of-life updates. Here is everything an MSP should have on the radar, grouped by what it means for your clients.
The headline: Windows 10 reaches end of support
The October 2025 monthly security update is the final update for the last supported versions: Windows 10 version 22H2 (Home, Pro, Enterprise, Education, and IoT Enterprise editions), Windows 10 2015 LTSB, and Windows 10 IoT Enterprise LTSB 2015. Devices on these versions will no longer receive monthly security and preview updates containing protections from the latest threats.
Organizations still on Windows 10 should plan their migration to Windows 11 (opens in new tab). For devices running Windows 10 version 22H2 that cannot move yet, the Extended Security Updates (ESU) program (opens in new tab) maintains security coverage.
Security and identity changes worth flagging
Authenticator will refuse jailbroken and rooted devices
Starting February 2026, Microsoft is introducing jailbreak and root detection for Entra credentials in the Microsoft Authenticator app on both iOS and Android. Entra credentials will stop functioning on jailbroken or rooted devices, and all existing Entra credentials on such devices will be wiped. The capability is secure by default and requires no admin configuration or control.
Timing: begins February 2026, expected to complete by April 2026.
Transfer user Source of Authority to the cloud (preview)
Microsoft is enabling the transition of user Source of Authority (SOA) from on-premises Active Directory Domain Services to the cloud, a meaningful step for anyone unwinding hybrid identity. Details: Embrace cloud-first posture and transfer user Source of Authority (SOA) to the cloud (Preview) (opens in new tab)
Timing: currently in preview as of October 2025.
Defender for Office 365 reworks the quarantine
Quarantine in Defender for Office 365 is getting backend and workflow changes:
- Quarantined messages will be listed by individual recipient instead of grouped across multiple recipients
- Backend enhancements improve durability and consistency
- Existing quarantine release cmdlets all remain functional, but note that
ReleaseToAllnow applies to a single user since aggregation has been removed; admins must release messages for each intended mailbox individually - No changes to the end-user experience
What changed in Copilot this month?
GPT-5 becomes the default model
Microsoft is updating the default experience for Microsoft 365 Copilot license holders by making GPT-5 the standard model. GPT-5 features dynamic model routing, automatically selecting the best-performing variant per prompt: high-throughput models for quick replies, deeper reasoning models for complex tasks. Timing: late October 2025, completing by late November 2025.
Shared and delegated mailboxes open up to Copilot
Two related updates landed in late September 2025:
- Users with access to shared mailboxes can now ground Microsoft 365 Copilot Chat conversations in the content of those mailboxes.
- Users with delegate access can use Copilot to reason over emails in delegated mailboxes.
AI video generation in Create, without a Copilot license
Microsoft is providing standard access to AI video generation in the Create experience of Microsoft 365 Copilot to users without a Microsoft 365 Copilot license. Timing: mid-November 2025, completing by late November 2025.
Copilot chat sessions persist when you navigate away
A session entry is now created in the navigation pane as soon as a prompt is submitted, so conversations are preserved even when users navigate away mid-chat. Timing: October 27 to October 31, 2025.
Teams channels arrive in Context IQ prompts
When writing Copilot prompts in the chat box, users can use Context IQ to search for and select Teams channels as context. Timing: rollout begins early November 2025 (previously mid-October) and completes by late November 2025 (previously late October).
Copilot+ PCs expand their AI surface
Windows 11 is integrating AI deeper into the OS, with multiple new features arriving first for Windows Insiders in Copilot Labs. Copilot+ PCs deliver native AI experiences like Click to Do, Copilot Voice, Copilot Vision, and Copilot Action, with Windows 365 extending the AI-ready environment to the cloud. Many features are available now for non-IT-managed devices in Windows Insider Preview, with more detail promised at Microsoft Ignite, November 17 to 21, 2025. More: Making every Windows 11 PC an AI PC (opens in new tab)
Teams updates: recording, search, and shared channels
Audio-only recording
Users can keep cameras on during meetings while recording only the audio, a more comfortable option for camera-shy rooms. Timing: early October 2025, completing by late November 2025.
Image search
You can now search for images in Teams: screenshots, whiteboard photos, or any visual shared in chats or channels. Images surface by person name or message content in Autosuggest, and the search results page shows the chat or channel where the image was shared for context. Timing: mid-November 2025, completing by early December 2025.
Apps in shared channels
Users can add and use apps, including bots, tabs, and message extensions, directly within shared channels, enabling richer cross-team and cross-org collaboration. Timing: early November 2025, completing late November 2025.
Search in settings
A new search bar inside Teams settings lets users locate specific options without browsing categories, a direct response to customer feedback. Timing: early November 2025.
Full HD town halls for Teams Premium
Town halls gain 1080p resolution (1920 x 1080 pixels) for sharper, more professional broadcasts. Available to Teams Premium customers; IT admins enable it via policy. Timing: mid-December 2025, expected completion by late December 2025.
SharePoint, OneDrive, and the icon refresh
Tenant rename goes GA with no scale limits
Organizations renaming after rebrands, mergers, acquisitions, divestitures, or tenant consolidations can change the SharePoint domain name in their URLs. Advanced tenant rename is now generally available with no site count limitation, opening the feature to all customers regardless of tenant size. Docs: Change your SharePoint domain name (opens in new tab). Timing: early October, completing by mid-October 2025.
Departing employee file transfer gets less painful
OneDrive content handling for departing employees improves on four fronts:
- Redesigned notifications: account cleanup emails are more prominent and harder to overlook
- Improved filtering: new filters help managers quickly locate shared or important files
- Bulk file transfer with preserved sharing: "Move and keep sharing" transfers multiple files while retaining existing sharing permissions
- Consolidated alerts: when six or more files are moved, collaborators receive a single streamlined notification
Timing: mid-October, completing by early November 2025.
Microsoft 365 app icons get a visual refresh
Word, Excel, PowerPoint, and other app icons are being updated with a unified, symbol-led design reflecting Copilot integration. Timing: rollout began early October 2025, phasing across web, desktop, and mobile.
Intune: remove pre-installed Store apps by policy
Starting in October 2025, you can remove select in-box apps with a straightforward policy on Windows 11 Enterprise or Education, version 25H2. The new policy, "Remove default Microsoft Store packages from the system," is disabled by default. To configure it:
- In the Microsoft Intune admin center (opens in new tab), go to Devices → Manage devices → Configuration → Create → New policy to create a settings catalog policy (opens in new tab)
- Use these settings:
- Category: Administrative Templates\Windows Components\App Package Deployment
- Setting name: Remove default Microsoft Store packages from the system
- Value: Enabled
- Set the toggle to True for each app you want removed
- Assign the policy to the desired device group or groups. Note: Intune will not apply this policy to unsupported devices and shows "Not applicable" for them instead
Frequently asked questions
What happens to Windows 10 devices after October 2025?
They keep working but no longer receive monthly security updates. Organizations should migrate to Windows 11, or enroll devices running Windows 10 version 22H2 in the Extended Security Updates (ESU) program to maintain coverage.
Does the Defender quarantine change break existing release scripts?
Existing quarantine release cmdlets all remain functional, but ReleaseToAll now applies to a single user because recipient aggregation was removed. Admins must release messages for each intended mailbox individually.
Every month Microsoft moves the goalposts
New defaults, retired features, changed behaviors: tenant settings that passed last quarter can quietly fail this one. CloudCapsule re-checks 250+ controls across your tenants in 60 seconds, every time.
Run a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
