M365 Roundup, October 2026: Entra Opens Agent Creation to Every User
TL;DR
- Starting November 4, 2026, default users in Microsoft Entra can create agent blueprints unless an administrator turns off the Users can create agent blueprints setting.
- Microsoft Entra Agent ID applies a default inactivity policy to every tenant that notifies relevant users and then disables agent identities with no new activity.
- Microsoft Teams adds AI-powered phishing detection for messaging in December 2026 and lets admins customize the file extensions Weaponizable File Protection blocks starting November 2026.
- Microsoft Defender XDR sets Purview DLP alerts as behaviors by default from October 12, 2026, which removes them from the incident queue unless an admin disables the rule.
- Targeted Release for Microsoft 365 services retires in January 2027, replaced by three release options: Frontier, Standard release, and Deferred release.
October's release notes are heavy on Copilot, but the change most worth your attention is a quiet default in Entra. From November 4, ordinary users can create agent blueprints unless you switch that off. Add AI phishing detection in Teams, a Defender change that thins out your DLP incident queue, and the end of Targeted Release, and there is real admin work in this month's list. Here is everything that matters, grouped by what we would act on first.
Agents get easier to create, and easier to lose track of
Default users can create agent blueprints from November 4
Microsoft Entra is changing who can create agent blueprints by default. Starting November 4, default users can create new agent blueprints unless an administrator turns off Users can create agent blueprints. If your clients have not decided who should be building agents, this is the week to decide.
Learn more: Restrict who can create agents (opens in new tab)
Rollout: November 4, 2026.
Entra Agent ID disables inactive agents automatically
To keep agent identities secure and manageable, Microsoft Entra Agent ID gives every tenant a default inactivity policy. It identifies inactive agent identities, notifies relevant users, and disables the identity if no new activity is detected.
Full article: Default inactivity policy for agent identities (opens in new tab)
Rollout: public preview.
Defender now finds local AI agents and their MCP servers
Discovery of AI agents and their configured MCP servers on Windows and macOS is generally available in Microsoft Defender, with coverage expanded to more than 50 supported agents and MCP servers. For anyone chasing shadow AI on endpoints, this is the inventory you were missing.
Rollout: mid-September 2026, expected to complete by late September 2026.
Teams gets serious about phishing and risky files
AI phishing detection comes to Teams messages
Microsoft Teams is introducing AI-powered, context-aware phishing detection to help identify phishing, social engineering, impersonation attempts, and deceptive intent in messages.
Rollout: early December 2026, expected to complete by mid-December 2026.
Users can report suspicious guest invitations
Teams will let users report guest invitations for security concerns directly from Teams.
Rollout: early November 2026, expected to complete by mid-November 2026.
Admins choose which file extensions Teams blocks
Weaponizable File Protection becomes customizable. Admins can pick which file extensions Teams blocks based on their organization's security needs, or keep the Microsoft-recommended default list.
Rollout: early November 2026, expected to complete by mid-November 2026.
File sharing in external chats is on by default
Microsoft is improving file sharing in Teams external (federated) chats by making the Attach file (paperclip) and drag-and-drop options available by default. Worth a look at your external sharing settings before it arrives.
Rollout: to be announced.
Identity and authentication changes
Conditional Access policy plans group related rules
Conditional Access policy plans group related rules under shared assignments and conditions. You define common targeting and exclusions once, then configure each rule for a specific scenario. Anyone maintaining dozens of near-identical policies per tenant will appreciate this.
Full article: New Conditional Access policy plans in Microsoft Entra (opens in new tab)
Rollout: public preview.
Bring your own telephony provider for SMS and voice MFA
Choose Your Own Telephony Provider (CYOT) becomes generally available in Microsoft Entra ID. It lets organizations use a supported third-party telecommunications provider for SMS and voice authentication.
Learn more: Phone providers for authentication (opens in new tab)
Rollout: generally available October 30, 2026.
Microsoft Authenticator gets a usability refresh
Authenticator on iOS and Android picks up a refreshed home experience, clearer guidance for accounts that need to be restored, better restoration and sign-in flows, and prompts that help keep the app working reliably, such as keeping it running in the background.
Rollout: October 2026, expected to complete in November 2026.
Defender changes for the SOC
DLP alerts become behaviors by default
Defender XDR now sets Microsoft Purview DLP alerts as behaviors by default. Alert volume drops, and the DLP data stays available in Advanced Hunting and Purview. If you or your clients rely on DLP events showing up as standard alerts in the incident queue, disable the rule.
Rollout: starting October 12, 2026.
Integrated Security Operations Center enters preview
The Integrated Security Operations Center (ISOC) is in public preview in Microsoft Defender. Eligible Microsoft Defender Suite, Microsoft 365 E5, and E7 customers get XDR, SIEM, threat intelligence, automation, and AI together in Defender as part of their existing licenses.
Learn more: Integrated Security Operations Center in Microsoft Defender (opens in new tab) and Reimagining the SOC for the agentic era (opens in new tab)
Rollout: public preview September 23, 2026.
Copilot adds skills, projects, and model choice
Admins get Graph APIs for Copilot spending
New Microsoft Graph APIs for Copilot cost management let you control credit spending policies, monitor balances, and handle credit requests programmatically. If you manage Copilot credits across clients, this is the piece that makes it scriptable.
Official docs: Copilot cost management APIs (opens in new tab)
Rollout: beta endpoint in mid-October 2026.
Usage-billed models arrive in the model selector
Usage-based billing (UBB) models, including GPT-6 Astra and Claude Fable 5.1, become available in Microsoft Copilot Chat and in Copilot in Word, Excel, and PowerPoint.
Rollout: early November 2026, expected to complete by mid-November 2026.
Copilot Memory personalizes answers with work data
Copilot now uses inferences from Microsoft 365 data as context, so responses are more personalized to each user's work.
Rollout: early October 2026, expected to complete by the end of November 2026 (previously late October).
Skills come to Copilot Chat
Microsoft 365 Copilot Chat supports customizable skills for task-specific instructions. End users can use them and admins can deploy them. Skills work with plugins, show up in the Agent Store, and run across Copilot Chat and Cowork.
Rollout: October 2026, expected to complete by mid-November 2026.
Projects keep related Copilot work together
Projects in Copilot bring related chats, Cowork tasks, files, and context into one place, so users stop re-explaining the same background.
Rollout: late October 2026, expected to complete by mid-November 2026 (Frontier).
Copilot Code turns prompts into apps
Copilot Code is an AI-powered coding experience in Microsoft Copilot that turns natural-language ideas into trackers, dashboards, apps, and other solutions. Work IQ grounds what users build in their emails, meetings, documents, chats, and connected data.
More info: Copilot Code announcement (opens in new tab)
Rollout: late October 2026 (Frontier).
PowerPoint can record a skill
Users can create reusable skills by recording their actions in PowerPoint, then have Copilot repeat common PowerPoint tasks.
Read more: Record a skill in PowerPoint (opens in new tab)
Rollout: early October 2026.
PowerPoint creates interactive slides
The create interactive slide skill lets Copilot generate interactive slides from a prompt or existing content, useful for dashboard insights, business processes, timelines, and side-by-side comparisons.
Rollout: end of October 2026.
Cowork adds role-based plugins
New Sales, Service, Education, and Legal plugins for Cowork package each team's business processes into skills, so Cowork starts from pre-built workflows instead of a blank prompt.
More info: What's new in Cowork (opens in new tab)
Rollout: generally available.
Copilot for legal brings in partner plugins
Partner-built plugins connect legal teams' specialized sources and systems to Copilot, covering legal research; document, matter, and transaction management; agreements and electronic signature; legal AI; and e-discovery. They are rolling out through the Microsoft plugin registry, with more to follow.
Rollout: generally available.
Targeted Release retires in January 2027
Targeted Release for Microsoft 365 services retires in January 2027 as Microsoft 365 moves to three release options: Frontier, Standard release, and Deferred release. Instead of checking several places for previews, admins use one program and one setting to give chosen users early access across Microsoft 365. If you run a pilot ring for clients on Targeted Release today, plan which of the new options replaces it.
Rollout: January 2027.
Teams and Outlook everyday improvements
Two presenters can share screens at once
Two presenters can share a screen or window at the same time in a Teams meeting.
Rollout: late November 2026, expected to complete by mid-December 2026.
Side conversations inside meeting chat
Meeting participants can start and continue one-to-one or small-group conversations directly from the meeting chat.
Rollout: early January 2027, expected to complete in late January 2027.
Teams Phone Agent reaches general availability
Teams Phone Agent is an AI-powered calling solution. It answers incoming calls, helps with supported customer questions and appointment booking, and routes callers to the right person with AI-generated conversation notes when they need more help.
Rollout: early November 2026, expected to complete by mid-November 2026.
Voicemail emails change format
Teams moves caller information in voicemail emails from the From field to the Subject line, and organizations can send those emails from their own domains. Update any mail rules that key off the old sender.
Rollout: early March 2027, expected to complete by late June 2027.
Sending from aliases is generally available
Exchange Online users can now send email from any of their mailbox aliases. Admins enable it through PowerShell or the Exchange admin center.
Learn more: Sending from email aliases, general availability (opens in new tab)
Rollout: generally available.
Inbox rules can reply with a template
In new Outlook for Windows and Outlook on the web, users can build inbox rules that automatically reply to incoming messages with a saved template.
Rollout: early December 2026, expected to complete by late December 2026.
One inbox view across accounts in new Outlook
The All Accounts view (also called Unified Inbox) shows email from multiple connected accounts in a single inbox in the new Outlook for Windows, without merging the mailboxes.
Rollout: late September 2026, expected to complete by late November 2026 (previously late October).
Keep up with the defaults Microsoft changes for you
Two of this month's changes, agent blueprint creation and DLP alert handling, switch behavior in every tenant unless someone acts. Across a client base, that means checking the same settings dozens of times.
CloudCapsule scans each tenant you manage in about 60 seconds, collecting over 250 data points, with remediation and policy management so you can deploy fixes from one portal.
Frequently asked questions
How do I stop users from creating agents in Microsoft Entra?
Turn off the Users can create agent blueprints setting in Entra user settings. From November 4, 2026, default users can create new agent blueprints unless an administrator disables it. Microsoft documents the steps under restricting who can create agents in its delegate app roles guidance.
Why did DLP alerts disappear from the Defender XDR incident queue?
Starting October 12, 2026, Defender XDR sets Microsoft Purview DLP alerts as behaviors by default. The DLP data stays available in Advanced Hunting and Purview. Administrators who want DLP events to keep generating standard alerts and incidents can disable the rule.
What replaces Targeted Release in Microsoft 365?
In January 2027 Microsoft 365 moves to three release options: Frontier, Standard release, and Deferred release. Admins use one program and one setting to give chosen users early access across Microsoft 365, instead of checking several preview programs.
New defaults land every month. Somebody has to check them across every tenant.
The agent blueprint default and the DLP alert change both flip settings without asking. CloudCapsule scans every tenant you manage against 250+ controls in about 60 seconds, with remediation built in, so changes like these show up in a report instead of a client escalation.
Run a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
