25 September 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Storm-3168: Agentic Threat Actor Conducts Destructive Azure Attacks via Compromised Service Principals
Microsoft has published detailed research on Storm-3168 (also tracked as JADEPUFFER), identified by Sysdig in July 2026 as the first documented agentic ransomware operation. Two compromised service principals within a single Azure tenant worked in concert: one performed reconnaissance with over 300 successful read operations across Azure Virtual Machines, subscriptions and resource groups over 15.5 hours; the second executed more than 150 destructive or credential-collection operations in just 35 seconds. Resources deleted included Azure Storage Accounts, Key Vaults and App Service plans; more than 30 storage account access keys were also retrieved. Backup and recovery resources — including Azure Site Recovery locks — were specifically targeted to impair victim recovery.
Australian organisations using Microsoft Azure and Microsoft 365 should treat this as an active threat. The automated, agentic pattern of attack means damage can occur rapidly once a service principal is compromised. Microsoft recommends reviewing service principal permissions and applying least-privilege access, enabling Microsoft Defender for Cloud to detect anomalous bulk operations, and auditing Azure role assignments regularly. The tactics are consistent with ransomware and extortion operations and represent an evolution in cloud-focused threats.
Source: Microsoft Security Blog, 25 September 2026 →
23 September 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Microsoft Introduces Integrated Security Operations Centre in Defender, Unifying SIEM and Threat Protection
Microsoft has announced the Integrated Security Operations Center (ISOC) in Microsoft Defender, currently in preview. ISOC combines security information and event management (SIEM) with threat protection in a single platform, operating across six integrated layers: sensors and signals, context, actuators, models, harness, and agents. Microsoft argues that as attackers now deploy AI agents to execute attacks at scale, defenders need a continuous protection loop rather than separate tools that introduce dangerous response delays.
For Australian businesses using Microsoft 365, ISOC removes the need to integrate multiple security products separately. Human analysts and AI agents share the same context and controls, which Microsoft says will reduce investigation time and increase analyst productivity without requiring new infrastructure or operating models.
Source: Microsoft Security Blog, 23 September 2026 →
17 September 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
AI-Era Security Fundamentals: Microsoft Outlines Actions That Materially Reduce Risk
Microsoft Corporate VP Ron Pessner has outlined the security fundamentals organisations should prioritise as AI adoption accelerates: governing AI agent identities and execution environments, strengthening phishing-resistant authentication, and applying Zero Trust endpoint controls. The post emphasises that as AI agents increasingly act autonomously — browsing the web, executing code, and invoking tools — organisations must apply the same least-privilege and isolation principles to agents as they do to human users, including isolating execution environments and restricting outbound connectivity for automated systems.
Australian organisations deploying Microsoft 365 Copilot and autonomous AI agents can act on Microsoft’s Secure Now feature within Microsoft Security Exposure Management to prioritise remediation. Key steps include blocking device-code flow where unnecessary, enforcing Conditional Access policies requiring managed devices, deploying attack-surface reduction rules on endpoints, and restricting remote-support tools and WinRM access. The guidance reflects how standard Microsoft 365 security controls must be extended to cover AI agent workloads as they become part of everyday operations.
Source: Microsoft Security Blog, 17 September 2026 →
17 September 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Microsoft Defender Blocks 55% More High-Severity Email Threats Than Nearest Competitor, New Data Shows
New quarterly benchmarking data published by Microsoft shows that Microsoft Defender for Office 365 missed 55.4% fewer high-severity threats per 1,000 users than the next-closest secure email gateway (SEG) vendor during the May–July 2026 period. Defender also caught 92% of post-delivery malicious messages on average, while competing integrated cloud email security (ICES) vendors saw their malicious email detection rates rise to 0.30%—up from 0.13% the prior quarter—reflecting an escalation in attacker sophistication driven by AI-generated threats.
The report highlights that AI-enabled attacks are making impersonation emails and prompt-injection attempts harder to detect, with executive impersonation and invoice fraud schemes identified as key threat vectors. For Australian organisations running Microsoft 365, the data reinforces the value of layered security that combines pre-delivery filtering with post-delivery detection, and it supports keeping Defender configurations current rather than relying on third-party email gateways. The benchmarking period covered May through July 2026.
Source: Microsoft Security Blog, 17 September 2026 →
13 September 2026 — Microsoft 365 Blog, techcommunity.microsoft.com
Office LTSC 2021 Support Ends 13 October 2026 — Less Than One Month for Australian Businesses to Act
Microsoft has confirmed that Office LTSC 2021, Visio LTSC 2021 and Project LTSC 2021 will reach end of support on 13 October 2026. After that date, Microsoft will provide no further security updates, bug fixes or technical support for these products. Unlike Windows Server, there is no Extended Security Updates (ESU) program for Office LTSC 2021, meaning any newly discovered vulnerabilities will remain permanently unpatched.
Microsoft recommends Australian organisations migrate to Microsoft 365 Apps (with Microsoft 365 E3 as the primary path for enterprises, and Microsoft 365 Business Premium or Standard for businesses under 300 users). For environments with offline or regulatory constraints, Office LTSC 2024 is available and supported until October 2029. Organisations should also note that Microsoft 365 Copilot requires cloud-backed Microsoft 365 Apps — perpetual Office versions are not eligible.
Source: Microsoft 365 Blog, 13 September 2026 →
10 September 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Generative AI Used to Mass-Produce CEO Impersonation Emails Targeting Accounts Payable Teams
Microsoft has documented a large-scale phishing campaign that sent over one million emails between 3–5 August, combining CEO and CFO impersonation with fake ServiceNow invoices and fabricated email threads to manipulate accounts payable departments into authorising fraudulent ACH payments of approximately USD $50,000 each. Microsoft’s analysis found HTML comments, structured section labelling, and uniform template construction consistent with generative AI involvement in crafting the emails at scale. Primary targets were IT services, business advisory, and consumer goods companies.
Australian organisations should treat AI-generated executive impersonation as an active threat. Microsoft recommends enabling automatic attack disruption in Microsoft Defender XDR, Zero-hour Auto Purge for retroactive threat removal, and properly configuring SPF, DKIM, and DMARC email authentication. Finance and accounts payable teams should apply additional verification steps — including verbal confirmation via a separate channel — before processing any invoice received by email, regardless of how convincing the sender identity appears.
Source: Microsoft Security Blog, 10 September 2026 →
8 September 2026 — Microsoft Tech Community, techcommunity.microsoft.com
Microsoft 365 September 2026: Multi-Tenant Agent Management, GitHub Copilot Harness, and FY27 Pricing Offers
Microsoft’s September 2026 partner update introduces multi-tenant agent management in the Microsoft 365 Admin Center, now in public preview. Administrators can view a consolidated agent inventory, install or block agents across all governed tenants from a single interface, and review tenant-specific risk and activity insights — without maintaining separate administrator accounts. The update also confirms the Microsoft Copilot app has moved from m365.cloud.microsoft to copilot.cloud.microsoft (effective 18 August), with security and governance controls unchanged. Organisations should ensure copilot.cloud.microsoft and *.cloud.microsoft are allow-listed. The GitHub Copilot harness is also now generally available in Microsoft Copilot Studio, giving developers a new orchestration option for building code-intensive agents.
Australian Microsoft 365 partners and customers can take advantage of September and December 2026 pricing offers: up to 25% off Microsoft 365 Business Basic bundled with Copilot Business (up to 300 licences, through 31 December), and 10–15% off new Microsoft 365 E7 subscriptions (through 30 September). Microsoft Ignite runs 17–20 November 2026.
Source: Microsoft Tech Community, 8 September 2026 →
4 September 2026 — Microsoft 365 Copilot Blog, techcommunity.microsoft.com
OpenAI GPT-6 Astra Now Available in Microsoft 365 Copilot
OpenAI’s GPT-6 Astra has been added to the frontier model selection in Microsoft 365 Copilot Cowork and Copilot Studio. The model is designed for long-horizon, autonomous tasks: users can delegate larger assignments and focus on reviewing results and making decisions, rather than guiding AI through individual steps. Microsoft’s Work IQ grounds Astra in an organisation’s files, meetings, chats, and business data, all within existing permissions, producing more relevant responses.
Availability may vary by region and organisation; admins can configure access through the Microsoft 365 admin centre. For Australian businesses on Microsoft 365 Copilot, GPT-6 Astra expands the range of complex work that can be handed off to AI — joining a growing selection of frontier models available in Copilot products.
Source: Microsoft 365 Copilot Blog, 4 September 2026 →
27 August 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Microsoft Security August 2026: Purview Auto-Labeling Quintuples, Entra Tenant Governance and AI Agent Containment Controls Arrive
Microsoft’s August 2026 security update introduces several significant changes for Microsoft 365 administrators. Microsoft Purview auto-labeling policies now process up to 500,000 SharePoint and OneDrive files per day — five times the previous 100,000 limit — accelerating Copilot readiness by extending sensitivity label coverage across larger file repositories. Microsoft Entra Tenant Governance also reaches general availability, bringing multi-tenant environments into a single pane with centralised policy management and configuration drift monitoring to reduce shadow-tenant risk.
Additional updates include Microsoft Defender Experts MDR expanding managed detection and response to cover third-party data sources (Palo Alto Networks, AWS and Okta) ingested through Sentinel, and new “Secure Now” guidance from Microsoft Security Exposure Management for constraining AI agent actions before they expand across the environment. For Australian organisations progressing Microsoft 365 Copilot deployments, the expanded Purview auto-labeling limit is particularly significant: sensitivity labels govern encryption and data loss prevention controls required for responsible Copilot adoption at scale.
Source: Microsoft Security Blog, 27 August 2026 →
24 September 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Microsoft September 2026 Security Update: Shadow AI Data Blocking Reaches General Availability, AI Agent Visibility Added to Defender
Microsoft’s September 2026 security digest confirms that Microsoft Purview and Microsoft Entra Global Secure Access have reached general availability with the ability to block sensitive data in transit to shadow AI tools. Organisations can now enforce real-time policies that stop employees — and AI agents acting on their behalf — from uploading proprietary documents or sensitive text to unsanctioned AI applications. Microsoft Security Copilot gains an email detonation summary that provides AI-generated explanations of URL and file sandbox results, reducing manual effort for SOC analysts. Purview auto-labeling scales to 20 million items and 50,000 sites through adaptive scopes, and eDiscovery has been extended to cover content from Microsoft Copilot Notebooks, Loop pages, and user-owned SharePoint embedded containers.
For Australian organisations running Microsoft 365, the general availability of network-layer shadow AI controls is directly relevant to Australian Privacy Act compliance: any AI tool that processes personal information requires a valid legal basis, and being able to automatically block transfers to unsanctioned AI services reduces the risk of accidental offshore data processing. Microsoft Ignite (17–20 November 2026, San Francisco or online) will showcase these security innovations in depth.
Source: Microsoft Security Blog, 24 September 2026 →
21 September 2026 — Microsoft Tech Community, techcommunity.microsoft.com
Microsoft launches dedicated monthly MSP resource series covering Intune and Backup updates
Microsoft has launched a new dedicated blog series for managed service providers, providing practical guidance on product updates, partner perspectives, and peer insights for MSPs managing multiple customer tenants. The September edition highlights two key Microsoft 365 product updates: Intune Suite’s Unattended Remote Help for Windows reached general availability in August 2026, enabling remote device access when no user is present — particularly useful for after-hours support; and Microsoft 365 Backup’s configurable recovery window is now rolling out, affecting compliance commitments and storage planning for existing backup services.
A Public Preview of full-workload backup for Microsoft 365 Backup is also available, offering simplified backup configuration across customer tenants. The edition also introduces Microsoft Meetups for MSPs, a new session format with an AI operating model discussion covering client data protection, tenant configuration standardisation, and human accountability for high-impact decisions — directly relevant to Australian MSPs managing cloud environments.
Source: Microsoft Tech Community, 21 September 2026 →
10 September 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Detect and Disrupt AI-Themed Attacks with Microsoft Defender
Microsoft Threat Intelligence has documented a growing set of campaigns impersonating popular AI platforms, including ChatGPT, Microsoft Copilot, DeepSeek, and Claude. One campaign used a ChatGPT-themed phishing kit to send up to 100,000 emails in a single day harvesting credit card data, while a separate Claude-themed adversary-in-the-middle (AiTM) campaign harvested credentials. An initial access broker tracked as Storm-3075 has used AI-themed malvertising to distribute payloads for multiple downstream threat actors, demonstrating how quickly this tactic is being commoditised across the criminal ecosystem.
Australian organisations using Microsoft 365 and Copilot should treat AI-platform impersonation as an active threat. Microsoft recommends configuring Defender’s anti-phishing policies to detect domain and user impersonation, enabling Safe Links for URL scanning at delivery and at time-of-click, and enabling Safe Attachments to detonate suspicious files before delivery. Automatic attack disruption in Defender XDR can contain incidents that move beyond the inbox by automatically disabling compromised accounts and isolating affected devices before threats spread laterally.
Source: Microsoft Security Blog, 10 September 2026 →
3 September 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
AI Prompt-Injection Technique “ASCII Smuggling” Repurposed in Large-Scale M365 Phishing Campaign
Microsoft researchers have documented a high-volume phishing campaign (February–May 2026) that adapted ASCII smuggling — a technique first demonstrated in AI prompt-injection research — to evade Microsoft 365 Defender’s email security filters. The attackers inserted invisible Unicode tag characters (U+E0000–U+E007F) inside financial keywords such as “funding” to hide them from human view while remaining detectable by AI-based filters. At peak, the campaign generated 2.37 million messages per day, with approximately 96% originating from around 148 finance-themed disposable domains. Over 99% of messages were caught by Defender for Office 365’s layered protection stack, which combines sender reputation, URL detonation, machine learning, and brand-impersonation detection. Compromised ActiveCampaign accounts were used to leverage established sender IP reputation.
Australian businesses relying on Microsoft 365 should ensure Unicode normalisation is applied before content signatures and treat the presence of U+E0000–U+E007F tag-block characters as an anomaly indicator, since these characters rarely appear in legitimate communications. The campaign highlights that AI-era attack techniques are now migrating from research into mainstream phishing toolkits, requiring organisations to review email gateway configurations and update incident response playbooks to account for Unicode-based evasion.
Source: Microsoft Security Blog, 3 September 2026 →
2 September 2026 — Microsoft Tech Community, techcommunity.microsoft.com
Copilot in SharePoint: Personal Skills, Evaluations, and AI Agent Guidance in September 2026
Microsoft’s September 2026 SharePoint Copilot update introduces reusable personal skills that follow users across SharePoint and OneDrive. Skills define preferred formats, standards, and repeatable ways of working — created once, used anywhere across your sites. A new evaluations feature lets Copilot suggest tests and measured changes to improve a skill’s output rather than requiring manual rewriting.
The update also adds tenant-specific HTML guidance for Microsoft 365 organisations, allowing Cowork, Scout, GitHub Copilot, Copilot Studio, and other AI assistants to generate SharePoint-safe HTML — including reports connected live to SharePoint lists. For Australian Microsoft 365 organisations rolling out Copilot, these changes make AI workflows more portable and easier to govern.
Source: Microsoft Tech Community, 2 September 2026 →
20 August 2026 — Microsoft Community Hub (Viva Engage Blog), techcommunity.microsoft.com
Microsoft Refreshes Viva Engage Navigation and Community Layout, Removes Header Tabs
Microsoft has rolled out the first phase of a Viva Engage interface simplification, replacing the previous community page header tabs (About, Events, Files) with a consolidated right panel. The right panel now organises community content into four purpose-driven modules — what the community is, what admins need, what is happening right now, and recurring resources — and only shows modules when they contain content. Navigation across the Home feed, Leaders, Answers, Community, and Storyline pages now has a consistent right-panel layout. Community management tasks (members, experts, settings, agents) are brought together in a single destination. The changes are enabled by default and require no administrator configuration.
For Australian organisations using Microsoft 365 with Viva Engage, this update changes where community members find Files and Events: both are now accessed through the right panel rather than header tabs, with Files requiring an extra click via ‘Pinned links and files’ → ‘View all’ → ‘Files’ tab. Community administrators should communicate the change to members and update any internal guides or training materials that reference the former tab layout. Existing file permissions are unchanged.
Source: Microsoft Community Hub (Viva Engage Blog), 20 August 2026 →
13 August 2026 — Microsoft Community Hub (Microsoft 365 Copilot Blog), techcommunity.microsoft.com
Copilot Notebooks Adds Support for Markdown, Plain Text, and Rich Text Files
Microsoft has expanded Copilot Notebooks to support three additional file formats: Markdown (.md), plain text (.txt), and Rich Text Format (.rtf). Users can now add these files directly as references in a notebook and chat with Copilot about their content — enabling READMEs, architecture notes, runbooks, system logs, transcript exports, and formatted reports to be analysed without prior reformatting or conversion.
For Australian organisations using Microsoft 365 Copilot, the update means technical and operations teams can bring project documentation, support ticket exports, and customer feedback files into a single notebook workspace for analysis and insight generation. The feature rolled out to all Copilot Notebooks users from the week of 13 August 2026.
Source: Microsoft Community Hub (Microsoft 365 Copilot Blog), 13 August 2026 →
10 August 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
DeadLock Ransomware Targets Global Sectors with Dual Extortion and Decentralised Recovery Infrastructure
Microsoft Security Research has published an analysis of DeadLock, a financially motivated ransomware operation active since July 2025 that has listed more than 80 compromised organisations on its data leak site. The malware uses XChaCha20 encryption with Curve25519 key exchange, applies dual extortion — encrypting files while simultaneously exfiltrating data — and targets organisations in IT, mining, transportation, logistics, manufacturing and hospitality. Geofencing exclusions focus on former Soviet and CIS-linked countries, leaving most regions including Australia fully in scope. DeadLock’s infrastructure is notably decentralised: victim–operator communications run over the Session encrypted messaging network, ransomware configuration and victim records are stored on the Polygon blockchain, and stolen data is hosted via Wasabi cloud storage.
Australian organisations in mining, logistics, IT and manufacturing should treat DeadLock as an active threat. Microsoft recommends ensuring endpoint detection and response tooling is deployed and current, verifying backup integrity and testing offline recovery procedures, and confirming Windows Defender is not disabled — DeadLock’s payload specifically terminates security services and clears Windows event logs as part of its execution routine.
Source: Microsoft Security Blog, 10 August 2026 →
12 August 2026 — Microsoft Community Hub (Partner News), techcommunity.microsoft.com
Microsoft Retires Standalone Defender Threat Intelligence and Schedules Cloud App DLP Consolidation Into Purview
Microsoft’s August 2026 security partner update confirms two significant product lifecycle changes. Microsoft Defender Threat Intelligence (MDTI) as a standalone product was retired on 1 August 2026; its capabilities are now available only within Microsoft Defender and Microsoft Sentinel, requiring an active licence for either product. Effective 31 December 2026, Data Loss Prevention (DLP) capabilities in Microsoft Defender for Cloud Apps will be deprecated and consolidated into Microsoft Purview, which becomes the single hub for unified data security across Microsoft 365. Microsoft is preparing migration documentation and a phased rollout schedule for both transitions.
Australian businesses using Microsoft security tools should act now: confirm Defender or Sentinel licensing is current to retain threat intelligence features, and begin reviewing Defender for Cloud Apps DLP policies ahead of the December 2026 cutover to Microsoft Purview. Organisations eligible through Cloud Solution Providers can also take advantage of an extended Microsoft 365 E5 promotion — 15% off a one-year term or 10% off a three-year term — through 30 September 2026.
Source: Microsoft Community Hub, 12 August 2026 →
10 August 2026 — Microsoft Newsroom, news.microsoft.com
Microsoft Introduces Mandatory Age Verification for Australian Microsoft Store and Xbox Users
Microsoft has announced that Australian users accessing 18+ rated content on the Microsoft Store and Xbox storefronts will need to verify their age. From the coming weeks, users must confirm they are over 18 through one of four privacy-protecting methods offered via partners Yoti and Verifymy: email-based verification, facial age estimation, official document scanning, or credit card confirmation. Microsoft notified all account holders by email on 30 July 2026. The requirement aligns with Australia’s Age Restricted Material Online Safety Codes.
Australian organisations managing Microsoft accounts for staff or students — including schools, businesses, and enterprises with corporate Microsoft licences — should communicate this requirement to their users and ensure personal accounts complete verification before it becomes mandatory. IT administrators should also review any shared or service accounts that may access Microsoft Store content to confirm compliance with the new age assurance requirements.
Source: Microsoft Newsroom, 10 August 2026 →
30 July 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Microsoft 365 E5 Gains Full Intune Suite as Passkeys Become Default and AI-Targeted Defences Expand
Microsoft’s July 2026 security round-up delivers several changes that directly affect Microsoft 365 subscribers. As of 1 July 2026, the full Microsoft Intune Suite — advanced endpoint management, certificate management and AI-powered troubleshooting — is included in Microsoft 365 E5 at no additional cost, with select capabilities also extended to E3. Passkeys are now the default authentication method in Microsoft Entra ID, reducing reliance on SMS and voice authentication and strengthening phishing resistance. Microsoft Purview now integrates with Entra Internet Access to detect and block sensitive data being shared with unmanaged cloud and AI applications in real time. Microsoft Defender introduces prompt injection protection in preview, identifying and quarantining emails containing malicious AI instructions before delivery.
For Australian organisations, the Intune inclusion represents a meaningful cost saving for E5 subscribers previously paying separately. IT and security teams should audit current authentication policies to align with the passkeys-first default and review Purview configurations to take advantage of the new AI app data controls.
Source: Microsoft Security Blog, 30 July 2026 →
17 July 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Microsoft to Present AI Agent and Supply Chain Attack Research at Black Hat USA 2026
Microsoft’s threat intelligence team has outlined its agenda for Black Hat USA 2026 (from 20 July), warning that attackers are increasingly exploiting trusted systems rather than vulnerable ones. The headline presentation, “Poisoned at the Source,” covers npm package supply chain compromises where malicious payloads are embedded at the package level and distributed through software build pipelines. Additional sessions address AI agent security — specifically agents with misconfigured access permissions and browser-based AI tools that introduce new attack surfaces. Microsoft is also launching a new Defender Experts Threat Intelligence service and extending Managed Detection and Response (MDR) coverage to third-party and multicloud environments.
For Australian businesses using Microsoft security services, the expanded MDR coverage and new Defender Experts service deliver broader threat detection across hybrid and multi-cloud deployments. The supply chain and AI agent research is directly relevant to any organisation adopting open-source software packages or deploying AI-powered workflows. A free Microsoft Black Hat Skilling Challenge begins 20 July for security practitioners looking to build AI-era defence skills.
Source: Microsoft Security Blog, 17 July 2026 →
Published 16 July 2026 — Microsoft Community Hub (SharePoint Blog), techcommunity.microsoft.com
Microsoft Rolls Out Wave of Copilot AI Features for SharePoint in July 2026 Update
Microsoft released its July 2026 Copilot in SharePoint update, adding capabilities that let users generate finished documents, interactive reports, and file shares directly from content already stored in SharePoint. Users can now ask Copilot to create a Word document, Excel workbook, or PowerPoint presentation from site content without copy-pasting across applications, and to build an interactive HTML report for dashboards and readouts. File sharing has also moved into the chat interface, allowing users to share specific files with colleagues directly from Copilot chat.
Additional updates include natural language approval workflows — letting users configure request tracking and sign-off processes using conversational instructions — along with built-in AI skills for automation and a /Skills command that makes team-created shortcuts discoverable across the platform. Copilot in SharePoint has been on by default for all Microsoft 365 Copilot licence holders since 16 June 2026. Australian organisations using SharePoint as their document and knowledge management platform can access these capabilities immediately as part of their existing Microsoft 365 Copilot subscription.
Source: Microsoft Community Hub (SharePoint Blog), 16 July 2026 →
Published 16 July 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Microsoft Publishes Security Framework for Least Privilege Controls on AI Agents in M365 Environments
Microsoft’s security team has published detailed guidance on securing AI agents in enterprise deployments, identifying four common failure patterns: agents operating without dedicated identities that create accountability gaps during incidents; permission creep as access expands incrementally without reassessment; cross-system risk as agents accumulate combined permissions across email, files, ticketing, and code repositories that exceed any individually evaluated boundary; and audit trail deficiencies where logging of LLM responses alone cannot establish who authorised an action or whether it was within intended scope. The recommended framework includes dedicated agent principals, task-based least-privilege role definitions, controlled tool allowlists, and comprehensive end-to-end auditability.
The guidance has direct implications for Australian organisations deploying Microsoft 365 Copilot agents. As agentic workflows act autonomously across M365 services — sending emails, accessing SharePoint files, and writing to ticketing systems — the risk of agents operating beyond intended scope grows significantly without these controls. Organisations under Privacy Act obligations should treat the recommended access review and scope documentation procedures as a compliance baseline for any automated system that processes customer or employee data.
Source: Microsoft Security Blog, 16 July 2026 →
Published 15 July 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Microsoft Launches Defender Experts Threat Intelligence Service and Expands MDR to Multi-Cloud via Sentinel
Microsoft has announced two managed security services aimed at closing the gap between threat detection and action. Microsoft Defender Experts Threat Intelligence is a new expert-delivered service providing curated threat insights tailored to a customer’s industry, geography, and environment, including early-warning alerts on emerging campaigns and recurring expert briefings. Microsoft Defender Experts MDR has been expanded to cover third-party and multi-cloud environments through Microsoft Sentinel, providing 24/7 monitoring and cross-platform threat analysis under Plan 2.
Microsoft also confirmed that Defender Threat Intelligence capabilities are now fully converged into the Defender portal, giving security teams a unified interface for detection, investigation, and response workflows. For Australian businesses running Microsoft 365 in hybrid or multi-cloud environments, these services offer a way to strengthen security operations without significant additional in-house investment — particularly relevant as the Australian Cyber Security Centre continues to report rising volumes of threats targeting enterprise environments.
Source: Microsoft Security Blog, 15 July 2026 →
Published 13 July 2026 — Microsoft Security Blog, microsoft.com/en-us/security/blog
Microsoft to Make Passkeys the Default in Entra ID and Phase Out SMS Authentication by February 2027
Microsoft has announced it will make passkeys the default authentication method in Microsoft Entra ID and discontinue its own delivery of SMS and voice one-time codes, citing an alarming rise in AI-enabled phishing campaigns that now achieve click-through rates as high as 54 per cent — compared with roughly 12 per cent for traditional phishing. From 1 September 2026, Entra ID will automatically prompt users still relying on SMS or voice to register a passkey (through Microsoft Authenticator, Windows Hello, or a FIDO2 security key). Organisations that still need SMS or voice authentication after that date must contract directly with third-party telecom providers via the Microsoft Security Store, which opens for configuration on 30 October 2026.
From 1 February 2027, Microsoft will stop providing SMS and voice authentication entirely, and passkey registration will become mandatory with no opt-out. Australian organisations running Microsoft 365 should audit which users rely on SMS-based multi-factor authentication, plan passkey rollout and user communications now, and assess any additional costs from switching to a third-party telecom provider for edge cases where SMS remains necessary.
Source: Microsoft Security Blog, 13 July 2026 →
Published 10 July 2026 — Microsoft Tech Community (Partner News), techcommunity.microsoft.com
Microsoft 365 Business with Copilot Becomes Permanent and FY27 Volume Incentives Launch for Partners
Microsoft has made the Microsoft 365 Business with Copilot SKUs permanently generally available, removing the trial limitations that previously applied to partner-sold AI bundles for small and medium businesses. Microsoft 365 Business Standard with Copilot is now priced at $23.50 per user per month, and Business Premium with Copilot at $32 per user per month. Agent 365, Microsoft’s AI agent subscription, now requires Microsoft 365 E5 or Business Premium as a licensing prerequisite. For FY27, Microsoft has launched two Copilot promotions: 15 per cent off for deployments of 300 or more Copilot licences, and 30 per cent off for 1,000 or more licences — both running through 30 September 2026. Copilot Cowork, which allows Copilot to complete multi-step agentic tasks autonomously in the background, also reached general availability during the month.
For Australian MSPs and partners, the permanent GA of M365 Business with Copilot means these SKUs can now be quoted and sold as standard products without trial caveats. The FY27 volume promotions create a material incentive to consolidate SMB customers onto Copilot platforms before the 30 September deadline. The July partner update also included an Australian customer success story: Increment partnered with Australian public education systems on AI readiness, with Microsoft 365 Copilot positioned as a core tool for institutional AI adoption across the sector.
Source: Microsoft Tech Community (Partner News), 10 July 2026 →
Published 9 July 2026 — Microsoft Community Hub (Microsoft 365 Copilot Blog), techcommunity.microsoft.com
OpenAI’s GPT-5.6 Becomes the Preferred Model in Microsoft 365 Copilot
Microsoft has made OpenAI’s GPT-5.6 the preferred model for Microsoft 365 Copilot, available from 9 July 2026 across Word, Excel, PowerPoint, Chat, and Cowork. GPT-5.6 comes in three variants — Sol for complex multi-step reasoning, Terra as the balanced everyday default, and Luna as a lightweight cost-efficient option — and Copilot selects the best-suited variant automatically, though users can also choose one from the model selector.
For Australian organisations using Microsoft 365 Copilot, the model upgrade brings measurable improvements across core apps: in Word, Copilot produces more complete drafts with stronger structure from rough input; in Excel, it handles more complex analysis with less manual guidance; and in PowerPoint, it generates richer slides with better visual balance. Copilot Cowork also benefits, with GPT-5.6 now able to execute multi-step agentic tasks end-to-end and return finished deliverables rather than draft recommendations.
Source: Microsoft Community Hub, 9 July 2026 →
Published 8 July 2026 — Microsoft Community Hub (Microsoft 365 Blog), techcommunity.microsoft.com
Microsoft 365 Copilot Connects Xero Financial Data Directly to the Workplace
Microsoft has detailed how Microsoft 365 Copilot now integrates with Xero through a Copilot-native financial agent, allowing users to query profit and loss, invoice status, and other Xero records in natural language without leaving Microsoft 365. Microsoft describes this as the start of “the agentic era” for small business technology, with Xero remaining the authoritative source for all financial records while Copilot surfaces the insights on demand.
For Australian small and medium businesses, the development is directly relevant: Xero is an Australian-founded accounting platform used by a large share of SMBs locally, and many already run Microsoft 365. The integration removes the need to export data or switch between apps to answer common financial questions, helping business owners who manage operations and finances simultaneously to retrieve timely information within the tools they already use daily.
Source: Microsoft Community Hub (Microsoft 365 Blog), 8 July 2026 →
Published 7 July 2026 — Microsoft Community Hub (FastTrack Blog), techcommunity.microsoft.com
How to mitigate the six identity and device risks before scaling Microsoft 365 Copilot
Microsoft’s FastTrack team has published a step-by-step guide to addressing the six Layer 1 identity and device risks (R1–R6) that organisations should resolve before broadly deploying Microsoft 365 Copilot. The risks include unmanaged identity access, inconsistent multi-factor authentication, noncompliant devices, licence sprawl, absent real-time risk evaluation, and an app protection gap on unmanaged mobile devices — each of which can expose a user’s entire Microsoft 365 data surface if left open.
For Australian organisations running Microsoft 365 E5, the required controls — Entra ID, Conditional Access, Intune, and Defender — are already included in the licence. The post maps each risk to its specific mitigation, including phishing-resistant MFA enforcement, Entra Lifecycle Workflows for identity hygiene, risk-based Conditional Access policies, and Intune App Protection Policies for personal mobile devices used to access Copilot.
Source: Microsoft Community Hub (FastTrack Blog), 7 July 2026 →
Published 2 July 2026 — Microsoft Community Hub (Microsoft 365 Copilot Blog), techcommunity.microsoft.com
Microsoft Sales Agent for Microsoft 365 Copilot Reaches General Availability
Microsoft has made Sales Agent in Microsoft 365 Copilot generally available, following a public preview launched in December 2025. The tool integrates CRM data with Microsoft 365 work data — including emails, meetings, and enterprise content — allowing sales teams to query account histories, generate pre-meeting briefings, and update CRM records using natural language, without switching between applications.
For Australian organisations using Dynamics 365 or other supported CRM platforms, Sales Agent is now available within Dynamics 365 Sales and on Outlook Mobile, enabling sellers to capture voice notes and update opportunity details from their mobile devices. A new AI-powered Opportunity Summary consolidates deal details, engagement signals, and recommended next steps into a single view, aimed at reducing post-meeting administration and helping sales teams maintain accurate pipeline data at scale.
Source: Microsoft Community Hub, 2 July 2026 →
Published 2 July 2026 — Microsoft Community Hub (Microsoft 365 Copilot Blog), techcommunity.microsoft.com
Anthropic Claude Sonnet 5 Now Available in Microsoft 365 Copilot, Enabled by Default for Australian Tenants
Microsoft has made Anthropic’s Claude Sonnet 5 available inside Microsoft 365 Copilot, rolling out to Copilot Cowork and Copilot in PowerPoint from 2 July 2026. The model is built for agentic, multi-step work across documents, spreadsheets, and presentations, with performance close to Anthropic’s Opus 4.8 tier at lower cost. Anthropic has been formally onboarded as a Microsoft subprocessor, meaning Claude Sonnet 5 and other standard Anthropic models used through Microsoft Online Services are covered by the Microsoft Data Protection Addendum and the Customer Copyright Commitment.
For Australian Microsoft 365 Copilot customers, the change is opt-out rather than opt-in: Anthropic models are enabled by default for all commercial tenants outside the EU, EEA, and UK, which includes Australia. Admins can restrict or scope access to specific users or Microsoft Entra ID security groups through the Microsoft 365 Admin Centre under Copilot > Settings > AI providers operating as Microsoft subprocessors. Higher-capability preview models — Claude Fable 5 and Claude Mythos 5 — remain off by default everywhere and require explicit admin opt-in; data from those models is retained by Anthropic for up to 30 days under separate terms.
Source: Microsoft Community Hub, 2 July 2026 →
Published 2 July 2026 — Microsoft Community Hub (M365 Copilot), techcommunity.microsoft.com
Microsoft Moves Copilot Studio and AI Agent Roadmaps to Microsoft 365 Roadmap
From 2 July 2026, feature updates for Microsoft Copilot Studio, Sales Agent, Finance Agent, and Service Agent are published on the Microsoft 365 Roadmap rather than Release Planner, consolidating product roadmap information for Microsoft 365 administrators into a single destination. Microsoft also introduced the Release Communications MCP Server, which provides natural-language access to official Microsoft 365 Roadmap and Azure Updates information through AI agents.
Australian IT administrators and Microsoft 365 Copilot users should update internal bookmarks and governance processes to reference the Microsoft 365 Roadmap for upcoming changes to Copilot Studio and the AI agent suite. Teams using Release Planner for change management should inform stakeholders and revise any documentation pointing to the old location.
Source: Microsoft Community Hub, 2 July 2026 →
Published 30 June 2026 — Microsoft Community Hub (Microsoft 365 Copilot Blog), techcommunity.microsoft.com
Microsoft 365 Copilot June 2026: Claude Now in Copilot Chat, Vision on Screen, and Work IQ Expanded to Power BI
Microsoft’s June 2026 What’s New post for Microsoft 365 Copilot covers a broad release wave across the platform. Anthropic’s Claude (Opus and Sonnet variants) is now available as a model option directly in Microsoft 365 Copilot Chat, giving users the ability to choose between Claude and OpenAI GPT 5.5 for different task types within the same tool. A new Vision feature lets users share their screen or point their phone camera at content, allowing Copilot to read and respond to visual context in conversation. Work IQ — introduced earlier in June — has been extended to Power BI reports and Dataverse business data, enabling natural-language queries against enterprise data sources without manual query-building.
Additional June updates include Deep Citations, which link Copilot responses back to specific sections of referenced Word or PowerPoint files rather than the whole document, and a Regenerate action that lets users request a fresh response or switch models mid-conversation. Copilot Cowork reached general availability with image generation via Imagen 2, local browser use through Microsoft Edge (using existing sign-ins), and usage-based billing now visible in the Microsoft 365 admin center. All features are rolling out progressively to Australian Microsoft 365 Copilot tenants.
Source: Microsoft Community Hub (Microsoft 365 Copilot Blog), 30 June 2026 →
Published 29 June 2026 — Microsoft Community Hub (Microsoft Security Blog), techcommunity.microsoft.com
Microsoft Sentinel Adds Table Insights for At-a-Glance Cost and Data Monitoring
Microsoft has released Table Insights, a new panel on the Microsoft Sentinel Tables page that shows 30-day data ingestion volume by tier (Analytics vs. Lake), day-over-week volume fluctuation alerts, the top five highest-volume tables with 30-day trends, the last-received timestamp for each table, and estimated daily ingestion costs.
For Australian businesses and MSPs running Microsoft Sentinel as their SIEM, the feature gives security teams a faster way to spot cost spikes, catch a third-party data connector that has silently stopped sending data, and confirm new connector onboarding has succeeded — without writing custom queries or maintaining separate monitoring workbooks.
Source: Microsoft Community Hub (Microsoft Security Blog), 29 June 2026 →
Published 26 June 2026 — Microsoft Community Hub (Microsoft Security Blog), techcommunity.microsoft.com
Six MCP Security Risks Enterprises Must Address as AI Agents Move Into Production
Microsoft’s security team has published an updated guide on the six principal security risks in Model Context Protocol (MCP) deployments, as organisations move from experimentation to production. MCP is now the standard mechanism by which AI agents—including Microsoft 365 Copilot extensions—connect to enterprise data, tools, and systems. The six risks are: prompt injection and tool poisoning (malicious instructions hidden in tool descriptions); OAuth authorisation failures known as the “confused deputy” problem; over-broad credential access across multiple systems; supply chain and rug-pull attacks on previously approved servers; shadow MCP servers created outside IT governance; and command injection from unsanitised inputs.
For Australian organisations using Microsoft 365 Copilot or any AI agent platform, Microsoft recommends treating every tool description and schema as untrusted input, adopting OAuth 2.1 with PKCE and audience-bound tokens, and assigning each agent a managed identity through Microsoft Entra Agent ID for centralised governance. All MCP traffic should route through a validated API gateway—Azure API Management can verify Entra tokens before requests reach any connected tool or data source.
Source: Microsoft Community Hub (Microsoft Security Blog), 26 June 2026 →
Published 26 June 2026 — Microsoft Community Hub (Microsoft 365 Blog), techcommunity.microsoft.com
10 Key Facts to Know Before Enabling Microsoft 365 Backup
Microsoft has published an official guide covering 10 critical considerations before enabling Microsoft 365 Backup, the platform’s native data protection service for Exchange Online, SharePoint, and OneDrive. The service delivers restore speeds of approximately 2 TB per hour and is purpose-built for bulk ransomware recovery, enabling organisations to roll back hundreds or thousands of affected sites or mailboxes to a pre-attack state using append-only backup storage that resists tampering.
All backup data remains within the Microsoft 365 trust boundary—in the same region with the same data residency requirements as live content—making it well-suited for Australian organisations with data sovereignty obligations. The service is accessible through the Microsoft 365 admin center and through partner-built applications on the Microsoft 365 Backup Storage platform.
Source: Microsoft Community Hub (Microsoft 365 Blog), 26 June 2026 →
Published 25 June 2026 — Microsoft 365 Blog, microsoft.com
Copilot in Excel Adds Finance-Grade Controls, Six Market Data Connectors, and Reusable Skills for Financial Workflows
Microsoft has released a significant update to Copilot in Excel, adding capabilities designed for financial professionals. The update introduces reusable Skills — instruction sets that guide teams through repeatable workflows such as discounted cash flow (DCF) models, book-close processes, and variance analysis. Six new federated data connectors bring live market data from CB Insights, Daloopa, FactSet, Morningstar, PitchBook, and S&P Global directly into Excel workbooks. A “Plan with Copilot” feature lets users preview which ranges, worksheets, formulas, and assumptions Copilot intends to change before execution, and a Copilot Attribution pane in Show Changes tracks which modifications were made by AI versus human collaborators. All features are generally available now to Microsoft 365 Copilot customers on Excel for Web, Windows, and Mac; custom skills roll to general availability next month, and partner-built skills will be deployable through Microsoft Marketplace from Q3 2026.
For Australian businesses with finance, accounting, or treasury teams on Microsoft 365 Copilot, these updates directly address a core accountability requirement: every AI-assisted calculation is now traceable, auditable, and defensible. The Skills capability lets teams standardise recurring financial models — FY close, board reporting, sensitivity analysis — as shareable, reusable templates accessible to the whole team. The six institutional-grade data connectors bring trusted market data into the Excel environment teams already use, without switching to separate platforms or copying data manually.
Source: Microsoft 365 Blog, 25 June 2026 →
Published 24 June 2026 — Microsoft Learn (Partner Center), learn.microsoft.com
Windows 365 GPU Enterprise Select 256 GB SKU Available for CSP Purchase from 1 July 2026
Microsoft has announced that the Windows 365 GPU Enterprise Select 256 GB SKU will become available for purchase through the Cloud Solution Provider (CSP) channel from 1 July 2026. The SKU has been temporarily unavailable due to system configuration updates. It provides GPU-enabled Cloud PC access designed for graphics-intensive workloads including design, data visualisation, and advanced software development.
For Australian MSPs and technology partners, the availability window opens on 1 July — the same day Microsoft’s global pricing update takes effect. Partners should re-engage any customers who paused evaluation of high-performance Cloud PC options, and factor the new GPU-enabled tier into conversations with clients in architecture, engineering, media, or development sectors that need powerful virtual desktops without on-premises hardware investment.
Source: Microsoft Learn (Partner Center), 24 June 2026 →
Published 19 June 2026 — Microsoft Tech Community (Partner News), techcommunity.microsoft.com
Microsoft June Security Update Introduces AI-Powered Vulnerability Scanning and New Defender, Sentinel and Purview Capabilities
Microsoft’s June 2026 security update introduces new capabilities across Microsoft Defender, Microsoft Sentinel, Microsoft Purview, and Microsoft Agent 365. The headline addition is Codename MDASH—a multi-model, agent-based vulnerability scanning system using more than 100 AI agents to find, validate, and prove exploitability across codebases—now in limited partner preview, integrating runtime security context directly into developer and security workflows.
Australian organisations using Microsoft 365 security products should note that the Azure Security Engineer Associate (AZ-500) certification retires in August 2026 and will be replaced by the Cloud and AI Security Engineer Associate (SC-500). As AI adoption accelerates both the speed and sophistication of cyberattacks, these expanded Defender, Sentinel, and Purview capabilities provide Australian businesses with stronger tools to maintain their Microsoft security posture.
Source: Microsoft Tech Community, 19 June 2026 →
Published 17 June 2026 — Microsoft Tech Community (Microsoft Entra Blog), techcommunity.microsoft.com
Microsoft Entra Rolls Out Unified Identity Risk Score and New SOC Response Roles as AI Accelerates Attacks
Microsoft has published new updates to Microsoft Entra, responding to AI-accelerated cyberattacks that now automate credential analysis, reconnaissance, and social engineering at scale. The new unified identity risk score correlates signals across accounts, sessions, workloads, and applications into a single real-time risk evaluation that feeds directly into Conditional Access policies. An updated Microsoft Entra ID Protection dashboard consolidates risky users, sign-ins, workloads, and detections into one view, replacing the previous approach of piecing together signals from separate tools.
For Australian organisations running Microsoft 365, a new identity-focused RBAC role—arriving in public preview soon—will let security operations teams take targeted response actions without broad administrative permissions, reducing the gap between detection and containment. The Conditional Access Optimization Agent has also gained a “Block risky user agent” policy to counter AI agent-based abuse, and Microsoft has expanded the flow of Defender threat detections directly into Conditional Access recommendations.
Source: Microsoft Tech Community (Microsoft Entra Blog), 17 June 2026 →
Published 16 June 2026 — Microsoft 365 Blog, microsoft.com
Copilot Cowork Reaches General Availability with Usage-Based Pricing
Microsoft has made Copilot Cowork generally available worldwide, moving the agentic system out of its three-month Frontier preview, during which more than half of Fortune 500 companies trialled it. Cowork executes complex, multi-step tasks and returns finished results rather than drafts. Microsoft now bills usage through Copilot Credits, either pay-as-you-go at $0.01 per credit or via a capacity commitment, with nine partner plugins available at launch — including Moody’s, S&P Global, and Miro — and eight more coming soon.
For Australian businesses, accessing Cowork requires a Microsoft 365 Copilot User Subscription Licence, and admins now get tenant, group and user-level spending limits and alerts to control costs. Organisations that trialled Cowork under the Frontier program have a grace period through 30 June 2026 to move to the new licensing and budget-control model before standard usage billing applies.
Source: Microsoft 365 Blog, 16 June 2026 →
Published 11 June 2026 — Microsoft Tech Community (Microsoft 365 Copilot Blog), techcommunity.microsoft.com
Copilot Notebooks Expands to Microsoft 365 Copilot Chat Users
Microsoft began rolling out Copilot Notebooks to Microsoft 365 Copilot Chat commercial and education users on 11 June 2026, extending AI-powered knowledge management to a wider range of licence tiers. Users can now add Word, PowerPoint, Excel, and Outlook files into a shared notebook and query all sources at once, with responses grounded in the uploaded material. A new mind-maps view visualises topic relationships across a notebook’s content, and a study guide feature converts material into structured learning aids.
For Australian organisations running mixed-licence environments, the update means staff on the Copilot Chat tier can access notebook collaboration alongside full Microsoft 365 Copilot subscribers in the same shared notebook. Full-licence users retain premium sources and advanced creation capabilities. Copilot Notebooks will also become available in OneNote on the web for Copilot Chat (Basic) commercial customers from mid-June 2026.
Source: Microsoft Tech Community (Microsoft 365 Copilot Blog), 11 June 2026 →
Published 9 June 2026 — Microsoft Newsroom, news.microsoft.com
KPMG and Microsoft Expand Partnership to Deploy Agent 365 and Copilot Across Enterprise Clients
KPMG and Microsoft have announced an expansion of their global relationship to help enterprise clients deploy AI at scale. Under the agreement, KPMG will adopt Microsoft Agent 365 to underpin the KPMG Trusted AI framework, enabling firms to manage, monitor, and secure AI agents across client organisations. KPMG will also deploy Microsoft 365 Copilot across its own professional workforce, embedding AI across audit, tax, and advisory service delivery. At the centre of the expansion is KPMG Workbench, a multi-agent coordination platform built on Microsoft Azure AI Foundry.
KPMG Australia is part of the global KPMG network and will be covered by this agreement. For Australian businesses that engage KPMG for advisory, audit, or tax services, the partnership signals that AI agents — specifically those powered by Microsoft 365 Copilot and Agent 365 — will increasingly shape how professional services are delivered and how client engagements are managed. Organisations using Microsoft 365 themselves can expect the same platform to be rolled out across their services providers, raising interoperability and governance questions worth addressing now.
Source: Microsoft Newsroom — KPMG and Microsoft scale trusted enterprise AI agents globally, 9 June 2026 →
Published 8 June 2026 — Microsoft Tech Community, techcommunity.microsoft.com
Microsoft Entra June 2026: Phish-Resistant MFA Extended to Linux, Passkey Campaigns Go GA
Microsoft has released its June 2026 Entra update, introducing several features now generally available. Phish-resistant multi-factor authentication has been extended to Linux desktops, supporting Ubuntu 24.04 and 26.04, and RHEL 8, 9, and 10 via the Microsoft Identity Broker — bringing Linux to parity with Windows and macOS for strong authentication. Passkey (FIDO2) Registration Campaigns have also moved to general availability, allowing administrators to configure sign-in prompts that nudge users to register passkeys and accelerate the shift to passwordless. External MFA — which permits organisations to use their preferred third-party MFA provider alongside Entra — has reached GA. The maximum number of passkey profiles per tenant has increased from 3 to 10, and Cross-tenant group synchronisation is now GA.
For Australian businesses managing Microsoft 365 environments, these updates raise the baseline security posture across mixed operating system fleets. The Linux phish-resistant MFA improvement is relevant for organisations running hybrid Windows/Linux infrastructure or RHEL in production. Passkey adoption supports the ASD/ACSC Essential Eight guidance on multi-factor authentication, and the External MFA GA release provides a supported path for organisations already running third-party MFA solutions — common in Australian financial services, healthcare, and government agencies.
Source: Microsoft Tech Community, 8 June 2026 →
Published 4 June 2026 — Microsoft Learn (Partner Center), learn.microsoft.com
Microsoft 365 E5 Now Required as Licensing Prerequisite for Agent 365
Effective 1 June 2026, Microsoft requires Microsoft 365 E5 as a licensing prerequisite for all new Agent 365 purchases. Enterprise customers must hold an M365 E5 licence before acquiring Agent 365; frontline workers require Microsoft Defender and Purview (F5 level); and small to medium businesses must have Microsoft 365 Business Premium. Organisations already on Microsoft 365 E7 — which bundles E5, Agent 365, Microsoft 365 Copilot, and Entra Suite — are unaffected by the change.
Australian businesses planning Agent 365 deployments should review their current licence tier before purchasing. Organisations on M365 E3 or lower-tier plans will need to upgrade to E5 first, adding both cost and planning lead time to any Agent 365 rollout. Microsoft has confirmed that customers without the prerequisite licences may not have access to certain Agent 365 capabilities even after purchase, making a pre-deployment licence review essential.
Source: Microsoft Learn, 4 June 2026 →
Published 2 June 2026 — Microsoft Tech Community (FastTrack Blog), techcommunity.microsoft.com
Microsoft: Copilot on Mobile Spreads Through Teams Faster Than IT Rollout Plans Assume
Microsoft’s FastTrack team has published guidance on how Microsoft 365 Copilot mobile adoption can outrun staged IT rollout plans. Once Copilot is available on mobile, usage spreads through everyday workplace behaviour — a teammate shares a faster way to prepare for a meeting, a leader asks for a summary while travelling, a project team starts referencing Copilot outputs in a chat thread — rather than following the structured phased rollout IT planned. Mobile compresses the typical pilot-to-scale timeline, creating what Microsoft describes as “behavioral adoption momentum that doesn’t wait for the next planned phase.”
For Australian IT teams and MSPs managing Copilot deployments, the practical implication is that governance decisions and user communication need to be in place before mobile usage accelerates, not after. Microsoft recommends planning across four areas before broad mobile adoption begins: rollout sequencing, user behaviour expectations, governance and readiness, and early, clear communication of what is permitted and recommended. Organisations that establish clear policies before usage spreads are better positioned to avoid conflicting local norms forming without IT oversight.
Source: Microsoft Tech Community — FastTrack Blog, 2 June 2026 →
Published 2 June 2026 — Microsoft 365 Blog, microsoft.com
Microsoft Work IQ APIs Go Generally Available 16 June: New Intelligence Layer for Enterprise AI Agents
Microsoft has announced that Work IQ APIs will reach general availability on 16 June 2026. The APIs serve as the intelligence layer for AI agents operating within Microsoft 365, enabling agents to process data from email, calendar, meetings, chats, files, and collaboration patterns and work with business context rather than raw data. Fortune 500 organisations already using Work IQ average over 600 terabytes of data through the platform; the APIs run twice as fast as traditional alternatives and consume 80% fewer tokens in coding scenarios.
For Australian businesses on Microsoft 365, Work IQ APIs make it practical to build or deploy enterprise AI agents that operate within existing tenant data boundaries and governance controls. Pricing is consumption-based via Copilot Credits, with new cost management dashboards in the Microsoft 365 admin centre enabling spending limits at tenant, group, and user levels — a useful control for MSPs managing multiple client accounts. Developers access four API domains — Chat, Context, Tools, and Workspaces — through a simplified surface of 10 generic tools replacing more complex legacy interfaces.
Source: Microsoft 365 Blog, 2 June 2026 →
Published 2 June 2026 — Microsoft 365 Blog, microsoft.com
Microsoft Launches Scout: An Always-On AI Agent for Microsoft 365
Microsoft has unveiled Scout, a new AI agent that works continuously in the background across Teams, Outlook, OneDrive, and SharePoint — without needing to be prompted. Scout proactively schedules meetings, flags important calendar items, generates preparation materials, identifies upcoming deliverables, and blocks calendar time before deadlines hit. Microsoft describes Scout as the first product in a new “Autopilot” category of always-on enterprise AI agents, built on Work IQ technology that learns individual work patterns over time to become increasingly personalised.
Scout operates under individual Microsoft Entra identities rather than shared service accounts, enforcing existing Microsoft Purview data protection policies, sensitivity labels, and data loss prevention controls already configured in a tenant — meaning it works within an organisation’s existing governance framework, not around it. Scout is currently available through private preview for Frontier organisations, with full deployment requiring Frontier enrolment and Intune policy configuration. Australian businesses on Microsoft 365 Enterprise or Business Premium SKUs enrolled in the Frontier programme can request preview access now.
Source: Microsoft 365 Blog, 2 June 2026 →
Published 28 May 2026 — Microsoft 365 Blog
Microsoft 365 Business with Copilot Launches 1 July 2026
Microsoft has announced two new product tiers launching 1 July 2026: Microsoft 365 Business Standard with Copilot and Microsoft 365 Business Premium with Copilot. For the first time, Copilot AI will be included directly in standard small business subscriptions — not as a separate, high-cost add-on.
The new plans include Copilot built into Word, Excel, PowerPoint, and Outlook, plus access to multiple AI models from both OpenAI and Anthropic via a model selector. Australian SMBs that have held off on Copilot due to pricing now have a clear date to reassess.
Source: Microsoft 365 Blog, 28 May 2026 →
Published 28 May 2026 — Microsoft 365 Blog
Copilot Now Connects to Over 1,000 Business Applications — Including Xero
The new Microsoft 365 Business with Copilot integrates with more than 1,000 third-party connectors, including Xero, Shopify, PayPal, Docusign, Asana, Jira, Canva, and BambooHR. This means Copilot can pull data from external systems and automate cross-platform workflows directly from within Microsoft 365 — without switching applications.
For Australian businesses, the inclusion of Xero as a named connector is immediately practical — the majority of Australian SMBs use Xero for accounting, and this integration opens up automated invoicing, reporting, and financial workflows through Copilot.
Source: Microsoft 365 Blog, 28 May 2026 →
Published 28 May 2026 — Microsoft 365 Blog
Redesigned Copilot Experience and New Work IQ Feature
Microsoft has also announced a redesigned Copilot interface across all Microsoft 365 apps, described as “cleaner, faster, and in the flow of work.” A new Work IQ feature aggregates team activity across the M365 suite, giving individuals and managers a unified view of where time is being spent.
Early data from a government pilot found users saving nearly an hour per day on summarisation and drafting tasks, with 61% reporting measurable improvements in the quality of their work output.
Source: Microsoft 365 Blog — New Copilot Design, 28 May 2026 →
Published 5 May 2026 — Microsoft 365 Blog, microsoft.com
Microsoft Research: Culture Drives 2× More AI Impact Than Individual Skills
An analysis of trillions of anonymised Microsoft 365 productivity signals — combined with a 20,000-person survey across 10 countries — found that organisational factors (culture, manager support, talent practices) account for twice the reported AI impact of individual capability (67% versus 32%). Among advanced Copilot users, 80% report producing work they could not have done a year ago; 49% of all Copilot conversations now involve cognitive work such as analysis, synthesis, and problem-solving.
The research also found a significant leadership gap: only 1 in 4 AI-using employees report clear leadership alignment on AI strategy. For Australian businesses planning Copilot rollouts, the finding suggests that investment in organisational change and manager capability will deliver more return than tool access alone. Microsoft also announced general availability of Microsoft 365 E7 (the Frontier Suite) and Microsoft Agent 365 for governing AI agents across the tenancy.
Source: Microsoft 365 Blog, 5 May 2026 →
Published 5 May 2026 — Microsoft 365 Blog, microsoft.com
Copilot Cowork Now Available on iOS and Android with Reusable Skills
Microsoft has launched Copilot Cowork on iOS and Android, enabling users to delegate tasks to Copilot from anywhere and track progress in the background. The update introduces Cowork Skills — reusable instruction sets that teams can build to standardise recurring workflows such as document creation, meeting coordination, and research. New native integrations include Power BI via Fabric IQ, Dynamics 365 (sales, customer service, ERP), Miro, and monday.com.
For Australian businesses already on Microsoft 365, the ability to build custom Skills for their own processes — and connect them via plugins to existing internal systems — reduces the barrier to automating repetitive work without specialist development resources. All capabilities are rolling out through the Frontier programme.
Source: Microsoft 365 Blog, 5 May 2026 →
Effective 1 July 2026 — Microsoft Licensing, microsoft.com
Microsoft 365 Pricing and Plan Changes Take Effect 1 July 2026
Microsoft has confirmed pricing and packaging updates across its Microsoft 365 commercial, nonprofit, and government tiers, effective 1 July 2026. Alongside pricing adjustments, Microsoft is adding new capabilities to existing plans — including Microsoft Defender for Office 365 Plan 1, Intune Remote Help, Intune Advanced Analytics, and Copilot Chat features. Microsoft 365 E5 customers will also receive Microsoft Security Copilot as part of their plan.
Existing customers remain on current pricing until their next renewal. Microsoft has committed to providing at least 30 days’ notice via the Microsoft 365 Message Center before changes take effect on a given tenancy. Australian organisations should review their current Microsoft 365 subscription against the updated plan inclusions before their next renewal date — the new bundled features may reduce or eliminate the need for add-on licences they currently purchase separately.
Source: Microsoft Licensing — Microsoft 365 Packaging and Pricing Updates →
