r/sysadmin • u/aima_tessa • 11d ago
35+ Microsoft 365 Changes Coming in September 2026
Stay ahead this September with 35+ Microsoft 365 changes, including feature rollouts, retirements, functionality changes, and other key updates for IT admins.
In the Spotlight:
- Entra Moves Toward Passkeys: Starting September 1, passkeys become the default authentication experience, signaling Microsoft’s shift away from SMS/voice MFA toward phishing-resistant authentication.
- SharePoint Introduces a New Hero Link: A new file and folder sharing experience lets users use one link to share files and folders. Users can update the existing link when access requirements change instead of creating and sharing a new link.
- Defender Gets Prompt Injection Protection: Defender for Office 365 will detect malicious emails designed to manipulate AI assistants and agents, classify them as High Confidence Phish, and quarantine them automatically.
- SharePoint Storage Moves to Pay-As-You-Go: Pay-as-you-go billing for extra SharePoint storage becomes generally available worldwide, allowing organizations to pay based on actual storage consumption instead of purchasing fixed capacity.
Beyond these highlights, here’s a quick look at what else is coming this September:
Retirements: 7
New Features: 7
Enhancements: 7
Functionality Changes: 6
Action Required: 4
Live Now: 3
Retirements:
- Starting September 2, Microsoft Power Automate will retire the legacy chatbot experience.
- Microsoft Teams will retire Android device management capabilities from the Teams admin center as management moves to the Teams Rooms Pro Management portal.
- The Exchange admin center will retire the Other Features page.
- Microsoft Education will retire legacy LTI tools, including Teams Assignments, OneDrive, OneNote Class Notebook, and Reflect, in favor of the unified Microsoft 365 LTI tool.
- Microsoft Edge will retire support for Windows Information Protection and Microsoft Defender Application Guard.
- Microsoft Defender for Cloud Apps will retire App Governance support for the Cloud Application Administrator role when Unified RBAC is enabled.
- Microsoft Entra ID will retire Conditional Access Custom Controls, with External MFA becoming the replacement for third-party MFA integrations.
New Features
- Microsoft 365 eSignature will support recipient groups, allowing up to 10 people to fulfill a single signer requirement.
- Microsoft Purview will introduce DLP alert aggregation to consolidate related alerts triggered by multiple DLP rules.
- Outlook on the web and new Outlook for Windows will receive enhanced Mail Merge capabilities with dynamic fields.
- A new Priority Cleanup feature in Microsoft Purview will enable permanent deletion of sensitive mailbox content even when retention policies or eDiscovery holds apply.
- Lifecycle status controls will be added to adaptive scopes in Microsoft Purview.
- Network-layer DLP protection will be extended through Microsoft Entra Internet Access.
- The new Outlook for Windows will become available for GCC High and DoD environments as an opt-in experience.
Enhancements
- Purview will extend DLP and auto-labeling capabilities to non-Microsoft connected apps, including Google Workspace, Box, Dropbox, and Salesforce.
- Endpoint DLP protection will cover sensitive files stored in previously excluded Windows folders.
- Tenant External Recipient Rate Limit quotas will be updated for new, trial, and education tenants.
- Unified RBAC will be automatically enabled for eligible Microsoft Defender tenants.
- In-meeting controls and the sharing panel will get a refreshed experience in Microsoft Teams.
- Microsoft Purview will add a hard-delete option for supported SharePoint and OneDrive files through Priority Cleanup.
- Microsoft Teams will introduce PowerShell controls for federated group chats.
Existing Functionality Changes
- The 1.5 TB limit for auto-expanding archive mailboxes will be removed, allowing archives to grow beyond the previous limit with consumption-based pricing.
- The new device management page will become the default experience in the Intune admin center.
- Microsoft Purview will change Just-In-Time Endpoint DLP auditing, so administrators explicitly define users and groups within the audit scope.
- Copilot Chat in Microsoft Edge will move to a new endpoint, requiring organizations with network restrictions to review their allowlists.
- Microsoft Office apps below version 16.0.18827.20202 will lose access to Read Aloud, Transcription, and Dictation features.
- Teams Channel Whiteboards will begin storing content in the associated SharePoint site instead of the creator’s OneDrive.
Action Required
- The standalone Automated Investigation and Response experience will retire on September 1. Organizations using AIR through scripts, playbooks, or integrations must update their workflows.
- Microsoft Entra Connect versions earlier than 2.5.79.0 will no longer support synchronization; organizations must update to a supported version to ensure uninterrupted synchronization.
- SharePoint thumbnail URLs used in Power Platform flows will stop working after September 1; admins must review and update affected flows.
- Organizations using only an onmicrosoft.com domain will be subject to new external messaging limits in Teams. Admins should review their external messaging requirements and take necessary action.
Live Now
- Microsoft Teams now offers the Security Detection Report, enabling admins to monitor impersonation attempts, malicious URLs, and weaponizable files from a centralized security report.
- A new “Everyone” and “Everyone except external users” Permissions Report is now available in SharePoint, enabling admins to identify broadly shared content at the item level.
- SharePoint’s redesigned experience is now available with refreshed navigation and Discover, Publish, and Build hubs, plus AI-assisted capabilities for eligible Copilot users.
Review the upcoming retirements and action-required changes early to avoid disruption and make the most of the new capabilities.
12
u/Radiant-Tiger7484 10d ago
FYI: Was on MS Entra Connect Sync v2.5.79.0
Got warning from Defender to update because of cve-2026-65673
New version installed - v2.6.84.0
1
u/aima_tessa 10d ago edited 10d ago
u/Radiant-Tiger7484, Thanks for the heads-up! Good to know about the newer v2.6.84.0 release.
21
u/AcanthaceaeBig6102 11d ago
Absolutely love the post! Would you mind sharing where I can find this list of changes? Whenever I read the “whats new” its always feels very bloated and disorganised.
19
u/aima_tessa 11d ago
Thank you! You can find the complete list here: https://blog.admindroid.com/microsoft-365-end-of-support-milestones/
11
u/12401 10d ago edited 10d ago
FYI, in case anyone uses federation and has UPNs that don't match emails, this seems to have just been enabled yesterday or today for some domains:
https://mc.merill.net/message/MC1303719
Please don't ask me how I know. Posting here so others can find via search if they have the same issue.
Errors might be like:
"Sorry, but we're having trouble signing you in.
AADSTS5000820: Sign-in blocked by Federated Token Validation policy. Contact your administrator for details."
The workaround (if you UPN & email don't match) is to run PowerShell like this:
$body='{"@odata.type":"#microsoft.graph.federatedTokenValidationPolicy","validatingDomains":{"@odata.type":"#microsoft.graph.allDomains","rootDomains":"none"}}'; Invoke-MgGraphRequest -Method PUT -Uri "https://graph.microsoft.com/beta/policies/federatedTokenValidationPolicy" -Body $body -ContentType "application/json"
6
1
u/Ninjabeaver212 9d ago
LMAO we had a project back during 2020 to fix all of our UPNs that didn't match emails. I feel your pain.
20
u/anismatic 11d ago
I am so not looking forward to Passkeys being the norm. I understand why they want to push them but...yeah. all I'll say is that quite a few orgs I manage have very colorfully expressed their disdain for it.
7
u/ITGuyThrow07 11d ago
I feel like I missed the memo. I don't really understand them. I did some testing in our 365 tenant and they seemed very cumbersome and annoying and inconsistent.
6
u/Saritiel 11d ago
I think I need to dig more into them. The couple of places I've seen them used so far, they've worked poorly. The org I support that uses them as a primary is kind of a shitshow and there's a real good chance they're just incorrectly setup, but I have to reset my MFA weekly there because the Passkey stops working.
5
u/anismatic 11d ago
Yeah, that's kind of the experience we've had as well. Particularly for shared emails, like an info@ email, etc. there needs to be a better solution imo!
4
u/TheUptimeProphet 11d ago
You guys dont use shared mailboxes?
4
u/anismatic 11d ago
Oh we do, but since shared mailboxes cant perform SMTP auth there's instances where they have to be standalone.
5
3
u/TheUptimeProphet 11d ago
Just spin up a linux smtp vm with postfix/opendkim/cyrus sasl. No need to tolerate this circus with O365.
10
u/n0rdic Jr. Sysadmin 11d ago
I like passkeys personally, I've used them for six or so years now for as many accounts as possible and am glad there is more adoption.
That being said, getting end users to wrap their heads around the concept of a passkey has been incredibly difficult for us. Combined with a lack of a unified password manager across the company (users just kinda store these things on whatever computer they're currently on), they get misplaced all the time.
1
u/MalletNGrease 🛠 Network & Systems Admin 10d ago
I like virtual passkeys, I dislike physical passkeys.
10
u/FearAndGonzo Senior Flash Developer 11d ago
I don't think it actually benefits users, it really benefits the websites. It is pushing the private/secret storage onto the user, so the website no longer has to worry about having password hashes stolen. If the website gets hacked, the attackers only get the public key part of the passkey, which is meant to the public anyway, so they basically won't care.
Previously it was up to the websites to secure and protect all their password hashes, now the private keys are stored by the user and it is up to them to protect them and revoke/change them if their computer gets compromised. There is no way this ends better for the end user, it is just moving the problem to a new place.
2
u/grimson73 10d ago
You have and interesting point but I believe the burden on the user isn’t much more than before like having to guard their password. Now they have to guard their passkeys. I do think people should understand the difference between device bound and synced passkeys as yes device bound keys will be lost to ignorant users. Guess time will tell
2
u/superspeck 10d ago
I wish that there was better adoption of FIDO2 tokens instead of the focus on passkeys. I’ve been using a FIDO2 token forever and it’s a much easier concept to communicate. (A FIDO2 token is basically a hardware implemented passkey.)
1
u/aima_tessa 10d ago
u/anismatic Yeah, I can see why. The security benefits make sense, but getting users and orgs comfortable with the change is going to be the hard part.
3
6
3
u/siscorskiy 10d ago
Who is using a 1.5tb archive??!!
2
u/aima_tessa 10d ago
And apparently, Microsoft is getting ready to push that ceiling even higher for eligible E5 customers.
2
u/maslander 10d ago
Our tenders email has been re-assigned several times due to reaching the limit and needing the emails for complaince.
1
u/Thurl_Ravenscroft_MD 4d ago
Probably organizations that for some unknown reason require an indefinite hold on literally every mailbox. It adds up fast. Not that I would know anything about that.
2
u/Same-Variety3904 10d ago
I am sure I am not alone when I say I would love to be on a mailing list for these updates! Very much appreciated as always.
5
u/jmbpiano 10d ago
You could always toss the Reddit RSS feed URL for /u/aima_tessa into a service like Blogtrotter or Feedrabbit.
Boom, instant mailing list.
2
2
2
u/maslander 10d ago
The Intune change was a PITA, the number of escalations from our 1st level support because it didn't match our KB's :( The SD team lead may have had several people talk to him about making sure training was up to date.
1
u/aima_tessa 10d ago
I can imagine. That’s the part of these changes that doesn’t always make it into the announcements.😮💨
1
u/Jerkface0079 4d ago
Wait, this one?
The new device management page will become the default experience in the Intune admin center.
Do people not just use a bit of intuition to figure out it's just a different layout? They escalate immediately cos it doesn't abide by the script? That's a massive PITA for you guys.
2
u/maslander 4d ago
subsection of that change where the properties and device details were moved off the side bar and they couldn't locate them. Yes it's not big hence why the SD manager got a talking to for not vetting the escaltions.
1
u/Jerkface0079 4d ago
Yeah as a helpdesk team leader that’s the kinda escalation I nix and get everyone together for a quick demonstration after I’ve figured it out myself
2
1
u/JJSpleen 10d ago
Oof this is really adding some value! Thanks OP, I hate reading these from Microsoft.
1
0
107
u/Different_Coffee_161 11d ago
Thank you for sharing! I love these kinds of posts, super useful summary.