Practitioner tests found some new Microsoft Purview DLP policies took days, not hours, to block existing external SharePoint shares and Copilot access to external email after sync looked complete.
MSP survey of 193 pros finds Copilot governance the top rising client request, yet only 10% report most tenants ready. Nearly half saw AI-related data exposure; oversharing and weak baselines block managed Copilot offers.
Reviews of 700-plus tenants find 150–300 overshared SharePoint sites each, with broken inheritance and broad Everyone grants common. Copilot makes that access debt visible, so small admin teams need a targeted cleanup, not a full rewrite.
SharePoint AI citation analytics roll out for tenants with over 50 Copilot seats. Site Usage and page analytics now show which documents, pages and news posts Microsoft 365 Copilot cites in chat, giving intranet teams a signal beyond views for lifecycle decisions.
Microsoft roadmap item 560820 may raise the 1.5 TB auto-expanding archive limit for eligible E5 mailboxes from October 2026. New size, licensing, and management details are not published yet, so tenants should monitor large archives without redesigning retention yet.
Microsoft reports cloud intrusions that start with passkey, MFA, or SSO lures. After identity compromise, attackers add auth methods, map tenants via Graph, and collect SharePoint, OneDrive, and Exchange content with the user’s existing access.
Microsoft Teams adds an opt-in meeting policy that auto-blocks identified external bots from joining calls. The setting is off by default, lives in meeting policies, and reaches Targeted Release mid to late September 2026 after a delayed August window.
Microsoft released KB5002908 for SharePoint Server Subscription Edition, fixing RCE, disclosure, and privilege flaws while disabling GetDataFromDataSourceControl SOAP and ExecuteProxyUpdates. Farms with BCS or legacy SOAP customizations risk breakage after install.
SharePoint News can cross-post to Viva Engage with one synced conversation across SharePoint, Engage, Teams, and Outlook. GA late September to late October 2026. Better reach only if the target community is active and reply ownership is clear.
SharePoint can keep reusable Copilot instructions as per-site skills in Agent Assets, with SHAREPOINT.md capturing purpose, audience and tone so recurring rewrite, list and status tasks start from owned site rules instead of one-off prompts.
SharePoint Alerts retirement leaves teams without simple opt-in for library updates. A Power Automate recurring digest template plus a subscription list lets users subscribe while admins clone flows per list and handle permissions and unsubscribe.
Commercial tenants can meter SharePoint storage above included quota through an Azure-linked billing policy from mid-2026. Quota banners pause while enrolled, but sprawl still hits the Azure bill beside Extra File Storage and Archive options.
Switzerland is expanding an open-source workplace test to around 3,000 federal staff while Microsoft 365 stays in place. The useful lesson is the parallel pilot, not a sudden platform exit.
Microsoft ends classic SharePoint publishing creation in March 2027 and makes classic user pages read-only in October 2028. Admins should inventory high-traffic classic intranet pages and rebuild only those still in active use before escape routes close.
Microsoft CAE can cut Microsoft Graph access for high-risk, disabled, or deleted single-tenant service principals to minutes instead of 60–90 minute token life. Apps must request cp1; Conditional Access, licensing, and a disable-and-recover runbook must already align.
Attackers impersonate IT support in external Teams chats, persuade users to approve remote sessions, then deploy implants and use WinRM toward high-value systems. Unsolicited Teams support contact is an incident path, not a chat request, for Microsoft 365 tenants.
Microsoft will apply outbound external-message limits in Teams from mid-September 2026 for tenants that use only an onmicrosoft.com (MOERA) domain. External chat can pause when limits hit; internal chat stays up. Admins should inventory default-domain tenants and plan verified…
Microsoft moves the Teams web client to teams.cloud.microsoft by end of September 2026. Redirects keep old links working, but the tenant off-switch retires after 2026, so proxy allowlists and hard-coded teams.microsoft.com docs need a pass.
Review SharePoint Sharing Links and Guests Before Copilot Rollout
SharePoint sharing reports flag links and guests but cannot confirm business need. This checklist guides admins through evidence collection, owner routing, decision records, and controlled next actions before Copilot rollout without premature revocation.
Members only
1 like·0 comments
Live 16th Sept 2026
Collab365 Team
Blocker·Last Update: 16th Sept 2026
I can't tell which SharePoint sharing links and guests are still safe
SharePoint admins in small M365 teams see sharing links, guests, and external access pile up but cannot tell which remain justified. Stale project links, contractor guests, and ownerless sites raise risk before Copilot. A defensible owner-review workflow is needed before…