Microsoft 365 security,
decoded for MSPs

M365 Roundup, October 2026: Entra Opens Agent Creation to Every User

October 2026 in Microsoft 365: Entra lets default users create agent blueprints from November 4, Teams adds AI phishing detection, and Targeted Release retires in January 2027.

Passkey Registration Keeps Failing? Three Questions Find the Cause

ScubaGear 2.0: What Changed and How It Checks Microsoft 365

MFA Didn't Stop the SkyKick Attackers. Your App Controls Can.

Security Defaults Is No Longer All or Nothing: What the New Preview Means for MSPs

Microsoft is splitting Security Defaults into four separately managed protections, enforcing MFA on every in-scope sign-in, and letting it run alongside Conditional Access.

The Accounts Nobody Uses Are the Ones Attackers Want: Cleaning Up Dormant Identities in Entra ID

M365 Roundup, September 2026: Copilot Spending Gets Guardrails and Four Deadlines Land Before Year End

Copilot Grants No New Access. It Just Makes Years of SharePoint Sprawl Searchable.

M365 Roundup, August 2026: Sharing Links Stop Granting Access by Default

August 2026 in Microsoft 365: the new hero link grants nobody access by default, SharePoint reports what Everyone-except-external-users exposed, and passkeys can be a first MFA method.

Microsoft Retires SMS and Voice MFA on February 1, 2027. The Part That Breaks First Is Account Recovery.

Inactive SharePoint Sites Keep Their Permissions. Retire Them on a Policy, Not a Hunch.

Microsoft Frontier Puts Prerelease Copilot in Your Tenant. Scope It to a Pilot Group First.

M365 Roundup, July 2026: Microsoft Puts an Expiry Date on SMS Authentication

July 2026 in Microsoft 365: Entra sets a retirement date for Microsoft-provided SMS and voice MFA, Defender adds prompt injection protection for email, and FY27 CSP incentives change.