Topic
August 2026 in Microsoft 365: the new hero link grants nobody access by default, SharePoint reports what Everyone-except-external-users exposed, and passkeys can be a first MFA method.
Microsoft-provided SMS and voice authentication retires February 1, 2027, and automatic passkey migration starts September 1, 2026. Here is the migration order for MSPs.
July 2026 in Microsoft 365: Entra sets a retirement date for Microsoft-provided SMS and voice MFA, Defender adds prompt injection protection for email, and FY27 CSP incentives change.
March 2026 in Microsoft 365: the new E7 suite and Agent 365 go GA May 1, Entra Backup and Recovery enters preview, external MFA hits GA, and SPO one-time passcodes get a retirement date.
Entra passkey profiles auto-enable in March 2026, Teams gains four security features, and standalone SharePoint and OneDrive plans head for retirement. The January 2026 changes, sorted by what to do.
Adversary-in-the-middle phishing steals session tokens after a successful MFA prompt. Here is how to deploy MFA in 2026 so the stolen phish is worthless.
Ignite 2025 delivered Agent 365, Security Copilot free for E5, and Baseline Security Mode. Plus synced passkeys, Teams impersonation protection, and a full month of M365 changes.
As of September 30, 2025, authentication methods can no longer be managed in Entra's legacy MFA and SSPR policies. Here is the migration path and what breaks.
Microsoft blocks legacy browser auth and requires admin consent by default, Safe Attachments loses Monitor mode, passkey profiles go per-group, and Teams channels learn to thread.
Microsoft blocks 7,000 password attacks per second, yet only 41% of Entra sign-ins use MFA. The data behind the passwordless push, and an honest look at what the passkey experience is like today.
Copilot picks up enterprise data protection and usage APIs, Autopatch and WUfB-DS merge into one service, Entra ships AiTM detection and FIDO2 provisioning, and Teams adds CAPTCHA for anonymous joins.
Passkeys stop phishing, not stolen sessions. A real $530K wire fraud shows how pass-the-cookie walks past FIDO2, and the layered Microsoft 365 controls that actually close the gap.
