M365 Roundup, September 2025: Security Suites Come to Business Premium

September 2025 was a licensing month as much as a feature month. Microsoft shipped purpose-built Defender and Purview add-on suites for Business Premium, put Anthropic models inside Copilot, and queued up an automatic Copilot app install that admins need a position on before October. There is also one genuine action item: a Chromium browser policy change that will degrade OneDrive and SharePoint web experiences for any tenant that does not prepare. Everything that matters, grouped below.

Admin and security: new SKUs and a closed phishing gap#

New Defender and Purview suites target Business Premium tenants#

SMB leaders are under pressure to protect sensitive data, hold the line on compliance, and contain the oversharing risk that AI adoption compounds. Microsoft's answer is three new SMB security suite SKUs purpose-built for the mid-market:

• Microsoft Defender Suite for Business Premium
• Purview Suite for Business Premium
• Defender and Purview Suite for Business Premium

For MSPs standardizing on Business Premium, these add-ons are the new upsell path for XDR and data protection without jumping clients to E5. Full announcement: Introducing new security and compliance add-ons for Microsoft 365 Business Premium (opens in new tab).

Hard delete now removes the calendar entry malicious invites leave behind#

SOC teams could always purge a malicious meeting invite from the inbox, but Outlook had already created the calendar entry at delivery, and that entry kept its malicious links. Microsoft is closing the gap: the Hard Delete action now removes the associated calendar entry along with the email. Calendar entries users created manually from .ics attachments are not touched. Rollout: early September 2025, completing by late September 2025.

Defender for Office 365 gets a cleaner email entity page#

The email entity page in Microsoft Defender for Office 365 is getting a streamlined experience that improves navigation between email records during investigations. Rollout: early November 2025, completing by late November 2025.

Teams external access can finally be scoped per user and group#

External access in Teams used to be tenant-wide, with policy-level settings limited to inheriting the tenant default or blocking everything. Now admins can assign custom external access policies to specific users or groups with five options:

• Use organization settings: inherits the tenant default
• Allow all external domains
• Allow only specific external domains
• Block only specific external domains
• Block all

Details: Configure granular domains in external access policies (opens in new tab). Rollout: late October 2025, completing by mid-December 2025.

New CSP promotion: 15 percent off Microsoft 365 Copilot#

Partner Center is running a Copilot promotion worth modeling into Q4 proposals:

• Discount: 15 percent off net partner price
• Minimum license: 10 to 2,400 new Copilot licenses
• Term: 12 months, annual commitment; annual or monthly billing (monthly carries a 5 percent uplift)
• Licenses can be added anytime during the term, up to 2,400 total
• Availability: worldwide, October 1, 2025 through December 31, 2025
• Eligibility: customers new to the Microsoft 365 Copilot SKU transacting via CSP; tenants with any existing paid Copilot license are ineligible regardless of channel

Full announcement: Partner Center September 2025 announcements (opens in new tab).

Two changes that need an admin decision before October#

Action required: Chromium 141 will break OneDrive web performance without a browser policy#

Privacy changes in Chromium-based browsers (Chrome and Edge) are tightening local network access. Once enforcement begins, users opening OneDrive for Web, Microsoft Lists, or SharePoint document libraries will hit a browser permission prompt for local network access, and if they do not click Allow, that device loses performance acceleration and OneDrive Web offline functionality. Expect slower experiences and a bump in helpdesk tickets if nothing is done.

Who is affected: all users reaching OneDrive for Web, Lists, and SharePoint document libraries through Chrome or Edge, and the admins managing browser policy across Windows, macOS, and VDI.

What to do:

• Identify the required domains: your tenant's SharePoint Online and OneDrive endpoints, for example https://YOURTENANT-my.sharepoint.com (opens in new tab) and https://YOURTENANT.sharepoint.com (opens in new tab), plus any sanctioned SharePoint Online host variations such as specialized cloud environments. Avoid overly broad wildcards.
• Configure the Chromium policy LocalNetworkAccessAllowedForUrls (Chrome Enterprise (opens in new tab) / Edge policy (opens in new tab)) to pre-authorize those domains. Deploy via ADMX or JSON on Windows, plist or configuration profile on macOS, across all managed device groups including VDI.
• Deploy the allow-list even if DisableNucleusSync or DisableOfflineMode are currently set by policy, to prevent future prompts and user confusion.
• For users who already clicked Block: the managed policy overrides the per-user deny state once it propagates, no end-user action needed. For immediate remediation, have the user open the affected OneDrive site, use the lock icon, set local/network device access to Allow, and refresh.
• Update the Sync Client to v25.164. On per-machine SKUs it applies the required permissions automatically; on per-user SKUs it prompts users through a Windows toast notification.

Timing: Chrome and Edge ship the change in Chromium 141 at the end of September 2025.

The Microsoft 365 Copilot app installs itself starting October 2025#

Microsoft will automatically install the Microsoft 365 Copilot app on Windows devices that have Microsoft 365 desktop apps, except in the EEA. It appears in the Start menu, enabled by default. Admin checklist:

• Review the documentation (opens in new tab) for management instructions
• Opt out, if desired, in the Microsoft 365 Apps Admin Center
• Brief helpdesk and users to head off confusion and tickets
• Update internal documentation that lists installed apps or Copilot access points

Rollout: begins early October 2025, completing mid-November 2025.

OneNote picks up sensitivity labels everywhere#

Microsoft Purview sensitivity labels are coming to OneNote on desktop, web, iOS, Android, and Mac, letting users classify and protect OneNote sections under the same compliance standards as the rest of Microsoft 365. Rollout: late January 2026, completing by late January 2027.

Copilot: Anthropic models, agents in every channel, and metered cost controls#

Claude models arrive in Researcher and Copilot Studio#

Microsoft is expanding model choice in Microsoft 365 Copilot. Researcher can now run on either OpenAI's deep reasoning models or Anthropic's Claude Opus 4.1, rolling out through the Frontier Program to Microsoft 365 Copilot licensed customers who opt in. In Copilot Studio, Claude Opus 4.1 and Sonnet 4 join the model lineup, and makers who opt in can build custom agents on Claude. The Copilot Studio models are in preview and not intended for production use.

Available September 24, 2025, admin opt-in required. More: Expanding model choice in Microsoft 365 Copilot (opens in new tab) and Connect to AI models (opens in new tab).

Every Teams channel can get its own agent#

Teams channels can now host a dedicated agent that draws on the channel's conversations and meetings to act as a domain expert for the team. The agent adopts the channel's name and handles tasks like flagging deadlines buried in threads, summarizing progress into status reports, assigning tasks and due dates, and answering natural-language questions such as "What's the latest on our budget?" You can even bring the agent into meetings. Public preview: mid-September 2025, completing by mid-October 2025.

Knowledge Agent preps SharePoint content for AI#

Knowledge Agent is a built-in SharePoint capability that helps organizations prepare content for AI at scale, unifying fragmented AI features into one context-aware interface that adapts to user roles. A floating button in the lower-right corner of SharePoint surfaces launches intelligent actions in the flow of work, supporting higher-quality answers from Copilot and custom agents. Opt-in details: Get started with Knowledge Agent (preview) (opens in new tab), with background in Microsoft 365 Copilot: Enabling human-agent teams (opens in new tab). Public preview worldwide: mid-September 2025 through late February 2026.

Copilot memory and personalization get user controls#

Copilot will personalize responses using chat history, with refreshed controls in Copilot settings so users can view and manage what it remembers. Rollout: mid-October 2025, completing by late October 2025.

The AI video creator grows up#

A major upgrade to the AI video creator in Microsoft 365 Copilot turns a text prompt, PowerPoint, PDF, or Word document into professional-quality video. New in this generation: transcript-based editing, swapping stock media for your own OneDrive files, natural-sounding voice options, Brand Kit integration for brand colors, a new scene structure, and a redesigned editing interface. Rollout: late September 2025, completing by late October 2025.

Copilot Chat accepts multiple reference images#

Users will be able to upload several reference images in a single Copilot Chat conversation when generating new images, cutting out repetitive steps. Rollout: late September 2025, completing by the end of September 2025.

One click from Copilot Chat into Word#

A new Open in Word action button moves Copilot-generated responses straight into Word for editing, formatting, and collaboration. Rollout: late September 2025 (previously mid-September), completing by early October 2025 (previously late September).

Library: one home for Copilot-generated content#

Library is a central, visual-first destination in the Microsoft 365 Copilot app for Copilot-generated images and Pages, including content shared with you. Rollout: mid-October 2025 (previously late September), completing by mid-October 2025.

AI workflows land in the Teams Workflows app#

AI Workflows bring intelligent automation templates powered by Microsoft 365 Copilot to the Workflows app in Teams: scheduled Copilot prompts in predefined templates that automate complex tasks. Rollout: mid-October 2025 (previously late September), completing by mid-October 2025.

Prepaid capacity packs for Copilot Chat metered usage#

Global admins can buy prepaid Capacity Packs in the Microsoft 365 admin center to manage metered consumption for Copilot Chat. Each pack includes 25,000 Copilot messages per month, allocated to Copilot Chat environments through the Power Platform admin center, including departmental or custom agents built in Copilot Studio. Usage draws from prepaid packs first, then switches automatically to pay-as-you-go when capacity runs out. Rollout: late September 2025, completing by early October 2026.

Copilot Chat opens side-by-side in Teams#

Copilot Chat becomes a side-by-side experience in Teams chats, channels, calling, and meetings. On desktop (Windows and Mac) and web, users open it from the Copilot icon in the top-right corner of those surfaces. Requires a Microsoft 365 Copilot license. Rollout starts mid-November 2025 and completes in the weeks following.

SharePoint governance gets a dashboard#

Content Management Assessment rolls site health into one view#

The Content Management Assessment (CMA) in SharePoint Advanced Management gives tenant admins a single, actionable dashboard for site health, permissions, and lifecycle readiness. It consolidates reports including Site Lifecycle Management (SLM) and Data Access Governance (DAG) and produces tailored recommendations to tighten governance and accelerate Copilot onboarding. Rollout: begins early October 2025 (previously early September), completing by early November 2025 (previously early October).

Custom site scoping for lifecycle policies#

Admins can now upload a CSV of up to 10,000 SharePoint site URLs to define a custom scope for SLM policy enforcement. Sites with existing retention policies or holds are automatically included, and the inactivity period setting has moved from the Scope page to the Configuration page in both the policy wizard and the policy details panel. Available by default, no extra configuration. More: Site lifecycle management (opens in new tab). Status: generally available.

Entra: identities sync across sovereign clouds#

Cross-cloud synchronization in Microsoft Entra automates creating, updating, and deleting users across Microsoft's commercial, US Government, and China cloud environments. It is in public preview, off by default, and must be explicitly enabled by administrators. More: Configure cross-tenant synchronization (opens in new tab). General availability: late September 2025 (previously early September) through mid-October 2025.

Intune: a Start menu layout users can keep#

Starting with the September 2025 security update, admins can set an initial Start menu layout that users may customize afterward. The older Configure Start Pins policy reverted user personalization to the IT-set layout after a restart; the enhanced policy lets user changes persist. Available through configuration service providers (CSP) now, with Group Policy support following in October 2025. Details: Customize the Start layout (opens in new tab).

Teams: blocked files, flagged links, and friendlier meetings#

Weaponizable file types get blocked in chats and channels#

Teams will block messages containing weaponizable file types, such as executables, in chats and channels, cutting the risk of malware and file-based attacks. It applies to Teams on Windows desktop, Mac desktop, web, and iOS/Android. To enable it: Teams Admin Center → Messaging Settings → turn on Scan messages for file types that are not allowed. Rollout: early November 2025, completing by mid-November 2025.

Warning banners on messages with malicious URLs#

Teams will display a warning banner on messages containing URLs flagged as spam, phishing, or malware, internal or external. The warnings complement existing protections like Safe Links and ZAP. Rollout: early November 2025, completing by mid-November 2025.

Users can dispute false-positive security flags#

Users can now report messages they believe were incorrectly flagged as security threats in chats and channels. Available to organizations with Microsoft Defender for Office 365 Plan 2 or Microsoft Defender XDR. Rollout: early November 2025, completing by mid-November 2025.

Live captions on mobile become customizable#

Live captions in Teams meetings on mobile now support font color, background color, and caption height adjustments, matching the desktop and web experience and improving readability in poor lighting or on the move. Rollout: mid-September 2025, completing by late September 2025.

Collaborative Notes come to group chats#

Teams Collaborative Notes, powered by Loop, arrive in group chats on desktop and web. Users co-create and edit notes, agendas, and action items directly in the chat without switching contexts. Rollout: late September 2025, completing by early October 2025.

Forwarded messages link back to the original#

Forwarded messages in Teams now include a clickable link to the original chat or channel message, visible to recipients with permission to view it. Built in response to feedback asking for better context when messages travel. Rollout: early November 2025, completing by mid-November 2025.

Teams Premium: control what town hall attendees see#

The new Manage what attendees see feature gives organizers and presenters control over layouts, backgrounds, theme colors, and name tags in town halls. Exclusive to organizers with a Teams Premium license. Rollout: late October 2025 to early November 2025.

Outlook: drafts for events and an automated migration#

Save a meeting as a draft#

You can now park a meeting on your calendar as a draft before sending invites, useful while details are still settling. Rollout: complete by mid-October 2025.

Classic Outlook accounts migrate to new Outlook automatically#

Starting in October 2025, Outlook will automatically set up users' classic Outlook accounts and settings in the new Outlook for Windows, in the background, when certain conditions are met. Users can then work across both experiences without manual setup. Rollout begins October 2025 and expands over the following months.

Outlook Lite begins retirement#

The Outlook Lite app starts retiring on October 6, 2025. New installations are blocked after that date, and existing users keep access for a limited time before full retirement.