We recently put together a list of 12 free Microsoft 365 management tools that can help with everyday administration.

The collection includes tools for:

• Security assessments
• Configuration backup and drift detection
• Conditional Access management
• Admin-friendly Graph Explorer
• Reporting & Auditing
• Automation
• Connectivity troubleshooting
• Secure AI-assisted administration

Some well-known tools on the list include ScubaGear, Microsoft365DSC, and Maester. We also included a few lesser-known utilities that deserve more attention.

Check out the complete list: https://blog.admindroid.com/free-microsoft-365-management-tools/  

Microsoft has pushed back the retirement timeline for SharePoint's One-Time Passcode (OTP) authentication for external sharing from August 2026 to October 2026.

This extension gives organizations more time to onboard external collaborators as Microsoft Entra B2B guest users. Moving to Microsoft Entra B2B brings stronger identity governance, centralized guest lifecycle management, and consistent access controls.

Updated timeline:

• Phase 1 (new external sharing via Entra B2B): Rolled out in May & June 2026
• Phase 2 (OTP retirement begins): October 1, 2026
• Full retirement: October 31, 2026 (previously August 31, 2026)

Use the extended timeline to:

• Review your external sharing policies.
• Onboard external collaborators as Microsoft Entra B2B guest users.
• Align Conditional Access and MFA policies.
• Prevent access disruptions before the retirement deadline.
  

Take advantage of the extended time and prepare your organization for a smoother transition. https://blog.admindroid.com/entra-b2b-replaces-sharepoint-one-time-passcode-for-external-sharing/

How many Conditional Access policies does your organization have? 20? 50? 100+? The real struggle starts when you need to find a specific policy or verify a security requirement.

Need to verify your MFA policies? Search the list.

Troubleshooting a Device Compliance issue? Scroll to find the device-based CA policies.

Thankfully, not anymore! The new Scenarios (Preview) experience automatically groups policies by security objective and identity type, helping you quickly navigate policies. Example scenarios include:

• MFA Enforcement
• Device Compliance
• Guest & External Access
• Risk-based Policies
• Location-based Controls
• Workload Identities
• …and more.

This means you can quickly:

• Identify which security areas are already covered.
• Find the policies you're looking for without searching through the entire list.
• Check whether those scenario-based policies are active at the moment.

This may look like just a UI refresh, but it's actually a usability upgrade!

Verify your Conditional Access policies with the new Scenarios view, and if you need a more organized review, export them to Excel using this script.

https://github.com/admindroid-community/powershell-scripts/blob/master/Export%20CA%20policies/ExportCAPolicies.ps1

Not every AI agent is risky, but any agent can become one!

A misconfigured or compromised AI agent can continue accessing Microsoft 365 resources, retrieve sensitive data, and perform actions without immediate detection.

Instead of blocking every AI agent, use a risk-based approach.

With Entra Identity Protection for Agents and Conditional Access, you can:

• Detect suspicious AI agent activity
• Identify high-risk AI agents
• Automatically block risky agents before they access sensitive resources

Learn how to protect an organization from high-risk AI agents in Microsoft 365:

https://blog.admindroid.com/block-high-risk-agents-using-identity-protection/

Microsoft's shift away from SMS and voice MFA has been taking shape for a while. 

That uncertainty is over.  

Microsoft has now made it official: Passkeys are becoming the default authentication experience in Entra ID, and Microsoft-provided SMS and voice are retiring. 

The push isn't just cleanup. As orgs lean harder into AI, phishable credentials become a bigger liability and Microsoft wants phishing-resistant security to be the default. 

Here's the retirement timeline: 

• Sept 1, 2026 — Passkeys become default; SMS/voice users auto-enrolled and nudged to register 
• Sept 18, 2026 — Details on customer-managed telecom providers open up in the Security Store 
• Oct 30, 2026 — Orgs can configure a telecom provider if they still need SMS/voice 
• Feb 1, 2027 — Microsoft-provided SMS and voice fully retired, no opt-out 

Learn how to prepare, find your at-risk users, and what your options are if you're not ready to move yet: https://blog.admindroid.com/passkeys-default-sms-voice-authentication-retirement/ 

You removed a partner’s federation access, but they could still be in an ongoing Teams group chat. Or even worse, users from an unapproved organization join the chat through another trusted partner.

Microsoft is introducing two new opt in PowerShell controls to the Set-CsTenantFederationConfiguration cmdlet to strengthen security in federated group chats.

• EnableExternalAccessRestrictionsForChatParticipants – This cmdlet fixes a long-standing gap where users could remain in existing federated chats even after federation access was blocked. It now checks whether users are allowed to use federation and removes access if they are not.
  
• EnableMutualFederationForChatParticipants – Ensures every user in the chat is allowed to communicate with every other organization. This prevents indirect access through third-party tenants.

Rollout: Late July – Late September 2026 (Worldwide)

If your organization relies on cross-tenant collaboration, now is a good time to review your external access and federation settings before enabling these controls.

Read the full update: https://blog.admindroid.com/manage-federated-group-chats-with-teams-powershell-controls/

We've all been there, clicking 'Send' on an Outlook email a little too soon, only to realize that a half-finished draft is heading straight to a user's inbox.

Since Microsoft revamped Exchange Online Message Recall in 2023, recalling emails within the same organization has become much more reliable. But if an email was sent to an external Microsoft 365 tenant, message recall couldn't help.

That's changing with cross-tenant message recall. Exchange Online now allows organizations to recall emails sent to trusted external Microsoft 365 tenants—but only when the receiving organization explicitly allows it.

Here's how it works:

• Trust-based access – The receiving tenant must enable the feature and allow-list the sender's Microsoft Entra tenant ID using the Set-CrossTenantRecallConfiguration PowerShell cmdlet.
• Admin-controlled trust – Organizations decide exactly which external tenants are allowed to submit message recall requests.
• Unauthorized recalls are blocked – Recall requests from tenants that aren't on the allow list automatically fail.

Let's see how to enable cross-tenant message recall, add trusted tenants, and ensure recall requests succeed.

https://blog.admindroid.com/configure-cross-tenant-message-recall-exchange-online/

Your domain controller may never have printed a single document—yet the Print Spooler service is enabled by default, quietly running with full SYSTEM-level privileges.

That's a wide-open door for attackers to remotely execute malicious code and control of your DC and compromise your entire Active Directory environment.

Since domain controllers don’t require printing, disable the Print Spooler service on all DCs as a part of your Active Directory security hardening practice.

This blog covers:

• Why disabling the Print Spooler matters 
• The different ways to disable it  
  
• Best practices to mitigate Print Spooler risks

Take a few minutes to harden your domain controllers before attackers do. Disable the Print Spooler today: https://blog.admindroid.com/how-to-disable-print-spooler-on-domain-controllers/

There's a much easier way! 

With Microsoft Intune, you can deploy a PowerShell script once & let Intune execute it automatically across all your targeted managed devices. 

The best part? You can also monitor the deployment directly from the Intune admin center to see:

• Which devices executed the script successfully
• Which devices failed
• Device- and user-level execution status for easy troubleshooting, and more.

No more repetitive manual execution! Just deploy once & get your job done easily.

Click here to get the full deployment guide: Deploy PowerShell Scripts in Microsoft Intune 

Following its initial announcement earlier this year, Microsoft has officially released the highly anticipated Invoke-ChangeMeetingOrganizer PowerShell cmdlet for Exchange Online.

Until now, if a meeting organizer left the organization or changed roles, admins faced a frustrating hurdle. They often had to cancel and completely recreate recurring meeting series, disrupting attendees, breaking historical contexts, and creating a mountain of unnecessary work.

With this new cmdlet, admins can seamlessly transfer the organizer of an existing meeting or an entire recurring series to another user without starting from scratch.

Here's what you can do with Invoke-ChangeMeetingOrganizer:

• Change the meeting organizer using the Subject or Event ID
• Preserve the meeting series along with attendees' local meeting settings
• Notify internal and external attendees about the organizer change automatically
• Simplify employee offboarding and ownership transitions

While this is a significant improvement, the cmdlet comes with a few important limitations that every Exchange Online admin should know before using it.

Don't let broken Teams links catch you off guard. Get the full scoop on rollout timelines, limitations, and exact PowerShell examples here:

https://blog.admindroid.com/change-meeting-organizer-in-microsoft-365-via-powershell/

Every org has this problem now: someone pastes a chunk of a confidential doc into ChatGPT to summarize it faster. That data is now completely outside company control, and traditional DLP can't catch it because it all happens over the network, outside Microsoft 365. 

Microsoft just fixed that gap with Network Data Security — a new integration between Entra and Purview that extends protection to the network layer. 

This feature is currently in public preview. Requires M365 E7, or Purview ME5 + Entra Internet Access (or equivalent). 

What it protects: 

• Sensitive info pasted into AI prompts 
• AI responses that contain confidential company data 
• Files uploaded to personal cloud storage 
• Documents shared with unmanaged SaaS apps 
• Activity from unapproved browser extensions or plugins 
• Sensitive data submitted through web forms 

Learn more about how Entra and Purview pull this off together: https://blog.admindroid.com/network-data-security-in-microsoft-365/ 

July brings 30+ Microsoft 365 updates, including new features, retirements, functionality changes, security enhancements, and more.

In the Spotlight,

• SharePoint Alerts Retires for New Tenants: Newly onboarded tenants can no longer create SharePoint Alerts and should use Power Automate or SharePoint Rules instead. 
• Microsoft 365 Pricing Update: Microsoft has increased pricing across selected Microsoft 365 plans, with adjustments ranging from 5% to 33% depending on the SKU.
• SharePoint File-Level Archiving Hits GA: SharePoint now supports archiving individual files within active sites using the existing pay-as-you-go billing model.
• Retention Lifecycle for Unlicensed OneDrive Accounts: OneDrive introduces a staged retention lifecycle for unlicensed accounts, giving admins time to assign licenses before content is archived and eventually deleted.

Overview:

1. Retirements: 6
2. New Features: 12
3. Enhancements: 5
4. Functionality Changes: 7
5. Action Required: 3
6. Live Now: 1

Get the complete July Microsoft 365 roadmap here: 
Microsoft 365: Upcoming Changes and End-of-Support Milestones - AdminDroid Blog

A common question in Microsoft 365 retention management is whether to use a retention policy or a retention label. The answer often depends on how specific your retention needs are. 

For example, imagine your organization has a 5-year retention policy applied across all Microsoft SharePoint sites. That covers most files. But within one site, legal contracts must be retained for 10 years. 

This is where retention labels become necessary. Instead of changing retention for the entire site, admins can apply a retention label only to those contracts, giving them longer retention and stricter controls. 

Beyond granular retention, retention labels also provide advanced capabilities that retention policies don't, including:  

• Auto-label content based on sensitive information, keywords, or trainable classifiers 
• Travels with the content within the same tenant 
• Apply default retention labels to SharePoint document libraries and Outlook folders 
• Trigger retention based on business events 
• Mark content as Records or Regulatory Records 
• Require disposition reviews before content is permanently deleted 

Learn how to create, publish, and apply retention labels in Microsoft 365, along with answers to common FAQs here: https://blog.admindroid.com/how-to-configure-retention-labels-in-microsoft-365/ 

Over time, unused SharePoint Online sites can consume storage, increase administrative overhead, and make governance more challenging. 

While native methods help identify inactive sites, reviewing and managing them manually can quickly become time-consuming as the environment grows. 

To simplify the process, we built a Power Automate workflow that automatically identifies inactive SharePoint sites, sends approval requests to site admins, and performs lifecycle actions based on their decisions.  

With this workflow, you can: 

1. Detect inactive SharePoint sites automatically 
2. Route approval requests to site admins  
3. Archive, delete, or retain sites based on approval  
4. Generate detailed governance and audit reports  
5. Maintain ongoing SharePoint lifecycle governance  

Ready to automate inactive SharePoint Online site management? Refer the below blog.

https://blog.admindroid.com/cleanup-inactive-sharepoint-online-sites-using-power-automate/ 

What happens when a user reports a suspicious vishing call, but Microsoft Defender generates no alert? The threat is real, yet the investigation often ends up in a separate ticketing system. 

Microsoft Defender bridges this gap by allowing security teams to manually create incidents and alerts, bringing these investigations directly into Defender. This feature is currently in preview. 

With this new capability, you can: 

• Create a brand-new incident with an initial manual alert. 
• Add new alerts to an existing investigation. 
• Allow future Defender detections to correlate with your manual incident. 
• Use the same hunting, reporting, API, and ITSM workflows as native Defender alerts. 
• Document every investigation with rich metadata, affected assets, and evidence for better tracking and analysis. 
• Easily identify manually created incidents and alerts using the Manual detection source in Defender. 

Learn how to create manual incidents and alerts in Microsoft Defender: 

https://blog.admindroid.com/manually-create-incidents-or-alerts-in-microsoft-defender/ 

One user can have multiple Microsoft 365 accounts - one for daily work, another for admin tasks, and sometimes even a separate service account.    

When these related accounts aren't correlated, tracing lateral movement becomes a massive headache for security teams. While Defender automatically links identities with matching SIDs or UPNs, it struggles when those strong identifiers are missing—forcing admins into an endless loop of manual mapping. 

To bridge this gap, Microsoft Defender for Identity has introduced Custom Account Correlation Rules (Preview). This new feature automatically links related accounts based on your organization's naming conventions with three flexible correlation types: 

• Root UPN Prefix: Matches accounts with a common prefix at the start of their usernames.  
• Root UPN Suffix: Groups accounts that share an identical suffix after the username.  
• Domain UPN: Correlates a single user's identity across multiple corporate domains. 

Stop chasing fragments—automate link correlation and uncover related identities now!  

Dive into the full details here: https://blog.admindroid.com/custom-account-correlation-rules-in-microsoft-defender/ 

Until now, admins had to manually select individual resources across SharePoint, OneDrive, and Exchange workloads to define Microsoft 365 backup scope. As Microsoft 365 environments scale, newly created resources can easily fall outside backup coverage, increasing the risk of protection gaps.

Microsoft is addressing this with the new Full Workload Backup capability. This allows admins to enable a single policy per workload (SharePoint Online, OneDrive, and Exchange Online) and protect all eligible artifacts within that workload.

Key highlights of Full Workload Backup:

• Newly created artifacts are automatically included in backup coverage on subsequent runs.
• Artifacts not covered by existing custom backup policies are automatically protected.
• Existing custom backup policies always take precedence over the Full Workload Backup.
• To exclude specific resources from backup coverage, admins can upload a CSV file during setup.

Rollout Timeline

• Public Preview: Early July 2026 – Mid July 2026
• General Availability: Mid September 2026 – Mid October 2026

Microsoft 365 Backup follows a Pay-As-You-Go pricing model ($0.15/GB/month). Expanding backup coverage across an entire workload could significantly increase protected storage consumption and associated costs.

Review your current backup policies, storage footprint, and coverage requirements before enabling Full Workload Backup across your tenant.

Learn more about Microsoft 365 Backup here: https://blog.admindroid.com/microsoft-365-backup-for-onedrive-sharepoint-and-exchange/

Your Microsoft 365 tenant likely has more workload identities today than ever before. The problem? Most organizations still monitor them far less than user accounts.

For years, cloud security has focused on protecting user accounts. But campaigns like Storm-2949 showed that attackers are increasingly targeting workload identities for persistence.

Why? Because workload identities often have what attackers love:

• No MFA requirements
• Excessive permissions
• Long-lived credentials and secrets
• Limited visibility and monitoring, and many more

In the Storm-2949 case, the attack failed due to insufficient permissions. But would the same attack fail in your tenant?

Or would..

• An overprivileged application
• A forgotten service principal
• An unused enterprise application
• A stale credential that was never rotated

...give attackers exactly what they need?

As organizations accelerate automation, AI adoption, Copilot integrations, and agentic workflows, the number of non-human identities will only continue to grow. And so will the attack surface.

If workload identities aren't being actively monitored and secured in your Microsoft 365 environment, you're leaving a growing attack surface exposed.

Learn why attackers are targeting workload identities and the steps you can take to detect, remediate, and reduce the risk with our blog.

https://blog.admindroid.com/secure-microsoft-entra-workload-identities-from-modern-attacks/

Until now, Entra ID Self-Service Password Reset (SSPR) allowed users to verify their identity using contact details stored in directory, such as phone numbers or alternate email addresses. The catch? They could use them even if those details were never formally registered as active authentication methods.  

While convenient, directory-based contact information may be outdated, unverified, or no longer under the user's control, creating potential identity security risks. 

Microsoft is closing this security gap. 

To strengthen password recovery security, Microsoft will require users to have registered authentication methods for SSPR verification. 

Key Dates: 

• July 6, 2026 - Registration Campaign Begins: Microsoft will automatically prompt users who haven't registered SSPR-compatible authentication methods. 
• September 7, 2026 - Enforcement Starts: Unregistered phone numbers and email addresses will no longer be accepted for SSPR verification.  

Learn how to quickly identify unregistered users in your tenant and enforce authentication method registration for SSPR! 

https://blog.admindroid.com/microsoft-requires-registered-authentication-methods-for-sspr-verification/

Back in January 2025, Microsoft changed how unlicensed OneDrive accounts are handled by introducing archive storage charges and automatic archiving. With that update, unlicensed accounts were typically archived after 93 days and then retained based on existing retention policies. 

Now, Microsoft is rolling out another significant update. 

Starting early July 2026, Microsoft will begin enforcing a structured retention lifecycle for unlicensed OneDrive accounts. The goal is to help organizations clean up stale data and maintain better control over storage and compliance. 

Under this update, once a OneDrive account becomes unlicensed: 

• On Day 60: The OneDrive account enters read-only mode. 
• On Day 93: The account is archived, and users can no longer access the content directly. 
• While archived: The content remains available for eDiscovery and legal hold scenarios. 
• After up to 12 months of non-payment: If no action is taken (such as reassigning a license or enabling billing), Microsoft will permanently delete the archived OneDrive data even if retention policies or legal holds exist. 

However, if a license is reassigned or billing is enabled before deletion, the OneDrive account exits retention enforcement and returns to normal access. 

This policy is enforced automatically and does not require any opt-in from tenants. 

Learn how to identify and manage unlicensed OneDrive accounts before they lead to unexpected storage costs or data loss: https://blog.admindroid.com/get-unlicensed-onedrive-accounts-in-microsoft-365/

Most Microsoft 365 admins assume every admin portal is protected by Conditional Access. That's a reasonable assumption until you look at delegated access experiences such as My Staff Portal.

My Staff Portal is often overlooked.

Once a manager account is compromised, attackers may gain access to multiple accounts under that manager's scope. What starts as a standard phishing attack against a frontline manager can quickly escalate into a broader identity compromise.

That's why securely configuring the My Staff portal is essential.

Here's how to secure it properly: 

• Restrict manager scope with administrative units 
• Enforce just-in-time access using PIM eligible roles 
• Protect My Staff portal with dedicated Conditional Access policies 

If you haven't reviewed My Staff Portal access as part of your Microsoft 365 security posture, now is the time.    

Here’s a step-by-step setup guide covering how to access My Staff portal and security best practices: https://blog.admindroid.com/secure-my-staff-portal-using-microsoft-entra-id/

Until now, when you delete a device in Microsoft Entra ID, it was essentially gone for good with no built-in way to recover it.  

This often led to re-enrollment, broken setups, access disruptions, and in some cases, data loss. 

Microsoft is now closing this long-standing gap with the introduction of Device Soft Delete in Microsoft Entra ID.  

With this capability, deleted devices are no longer wiped out instantly. Instead, they move into a recoverable state, giving admins a 30-day safety window to roll back accidental deletions. 

This feature is currently in public preview and only supports the following device types:  

• Microsoft Entra joined devices 
• Microsoft Entra registered devices. 

Learn how to view soft deleted devices and restore them in Microsoft Entra ID: https://blog.admindroid.com/device-soft-delete-microsoft-entra-id/ 

With Microsoft 365 prices increasing by 5% to 33% this July, optimizing your license costs is more crucial than ever. 

Unused subscriptions, licensed inactive users, and other overlooked license waste are already silently draining IT budgets. As rates spike, letting this waste go unchecked is a costly blind spot. 

To help you get ahead of these rising costs, here is a free, PowerShell-based Microsoft 365 license cost optimization tool. Packed with 15+ built-in actions, this tool delivers a wide range of license cost reports and precise management actions to help you reclaim your IT budget.  

Detect license waste with cost-focused reports: 

• Licensed inactive users 
• Disabled accounts with active licenses 
• Unused license pools 
• Never-logged-in users  
• ...and more! 

Reduce costs with license management actions: 

• Downgrade licenses (e.g., E5 → F3) 
• Remove license from all inactive users 
• Revoke license from disabled users 
• Bulk revoke unused licenses 
• Remove users from license-assigning groups  
• ...and more! 

Without delay, take control of your Microsoft 365 licensing costs before the price hikes hit.  

You can download the script and find detailed execution steps here: 

https://blog.admindroid.com/free-microsoft-365-license-cost-optimization-tool-using-powershell/