The Microsoft 365 for IT Pros Blog

  1. Fetching SharePoint Online Sites with PowerShell. How to Retrieve SharePoint Sites with the Microsoft Graph PowerShell SDK October 13, 2026 7:00 am - If you use the Microsoft Graph PowerShell SDK, you might know that the Graph APIs for SharePoint sites sometimes need a little help. For instance, finding a set of sites to process can be problematic because the APIs do not support extensive filtering capabilities. The solution is to use other Microsoft 365 cmdlets to find objects associated with sites. Inserting an intermediate step might seem crazy, but it can be the most effective way of solving the problem.
  2. Update Azure Automation Runtime Environments after PowerShell Modules Change. Maintaining Stable Azure Automation Runtime Environments October 12, 2026 7:00 am - The problem with V2.41 of the Microsoft Graph PowerShell SDK that stopped runbooks executing in PowerShell V7 runtime environments was disappointing. However, it was also a good wake-up call for tenant administrators to pay attention to maintaining healthy Azure Automation custom runtime environments. This article proposes a separation between current and production environments and explains how to use PowerShell to get the right modules to the right place.
  3. Exchange Online send from alias. Microsoft Finally Makes Send Mail from Alias Generally Available October 9, 2026 7:00 am - Nearly five years after going into preview, Microsoft has made the send from alias feature for Exchange Online generally available. It’s a very useful feature that eliminates the need to use a shared mailbox to be able to send messages with different email addresses. Microsoft has closed some functionality gaps since the preview started, but sending from an alias is not the same as sending from a mailbox’s primary SMTP address. Some user training might be necessary!
  4. Exchange Online archive mailboxes and Microsoft 365 Copilot. Can Microsoft 365 Copilot Access Archive Mailboxes? October 8, 2026 7:00 am - After writing about the new 100GB mailbox quota for Microsoft 365 Business Tenants, I was asked if Microsoft 365 Copilot supports Exchange Online archive mailboxes. It does. Microsoft Search indexes items in archive mailboxes, so Copilot can find and use items from those mailboxes. Interestingly, the DLP policy to block external email for Copilot didn’t work. That’s definitely something to investigate!
  5. Group mailboxes with Import Export Graph API. Using the Exchange Import-Export Graph API to Access Group Mailboxes October 7, 2026 7:00 am - After saying that the Graph didn't offer much support for group mailboxes, I was promptly countered with an article explaining how to use the Exchange Import-Export API to access folders and items in group mailboxes that wasn’t limited to just the Inbox. Well, the good news is that the approach works, as seen in a complete script written to prove the case, but whether I would ever use this API for a purpose it was never designed for is quite another matter.
  6. File-level archiving for email sent to Teams. How to Archive Old Teams Channel Email Files with Microsoft 365 Archive October 6, 2026 7:00 am - The File-level archiving API supports any file stored in a SharePoint Online document library, including the emails sent to Teams channels and stored in folders where the email files often disappear from view, occupying valuable storage quietly and without fuss. Finding and moving the email files to Microsoft 365 Archive makes sense because it saves on storage and stops AI tools using old email to generate responses. Here’s how to archive old email files with PowerShell.
  7. Microsoft Graph PowerShell SDK V2.41 Fixes Longstanding Assembly Clashes. Microsoft Graph PowerShell SDK V2.41 Finally Fixes Assembly Clash October 5, 2026 7:00 am - The Microsoft Graph PowerShell SDK has long been plagued by assembly clashes that meant it couldn't be used in the same session as other Microsoft 365 modules. After Microsoft engineering groups looked at the problem for 18 months, a solution was found by MVP Stephen van Rooij and is now available in V2.41. Apart from an issue with old PowerShell 7 versions, the fix looks solid and the SDK can once again be loaded into PowerShell sessions alongside the Exchange Online and Teams modules.
  8. Federated Chat File Sharing Made Easier. Teams Enables Easier File Sharing in Federated Chat October 2, 2026 7:00 am - A change to Teams makes it easier for users to share files in federated chat. Sounds good, but Microsoft planned to overwrite existing tenant controls to make the feature work, and that’s wasn't so good. That issue is now resolved, but the real question is whether Microsoft 365 tenants want users to share files through federated chat. I’m not so sure and would control this facility tightly. Apart from anything else, you might need some more MDO licenses to protect against possible infection.
  9. Microsoft 365 for IT Pros October 2026 Update. Microsoft 365 for IT Pros October 2026 Update October 1, 2026 7:00 am - Updated EPUB and PDF files for the four books in the Microsoft 365 for IT Pros eBook bundle are available for current subscribers to download from Gumroad.com. September 2026 was a busy month for the writing team as lots happened across the Microsoft 365 ecosystem. We discuss some of the more important changes that occurred over a 3-day period together with a 9,000 limit for Planner tasks in a plan that we met during the month.
  10. Outlook Groups and Graph APIs. Microsoft 365 Groups, Conversations, Threads, and Posts September 30, 2026 7:00 am - When launched in 2015, Outlook groups were an email-based collaboration platform. Now called Microsoft 365 Groups, the few Outlook groups that host email-based discussions have a distinctive Graph API to create and manage the conversations, topics, and posts which make up their discussions. This article reviews how to fetch these objects and how to create new conversations and reply to posts (using the Outlook Groups APIs, of course).
  11. Azure ECS and HVE Services. Microsoft to Drop Most Azure Communication Services September 29, 2026 7:00 am - Microsoft has announced that it will retire most Azure Communication Services offerings on September 30, 2028. Among the affected services is Email Communication Services (ECS), leaving Microsoft without a dedicated cloud service for high-volume external email. Exchange Online's High Volume Email (HVE) service currently lacks that capability, but Microsoft could choose to fill the gap with a new pay-as-you-go HVE offering aimed at bulk email workloads.
  12. Microsoft Learn Documentation and External Contributors. Microsoft Learn Plans to Remove External Contributions via GitHub September 28, 2026 7:00 am - On September 23, Microsoft Learn announced that many of its public GitHub repositories for documentation would become private. The net effect is that external contributors will no longer be able to suggest changes to documentation. Although some change requests are probably not high quality, removing the route for the technical community to engage with and improve Microsoft documentation doesn’t seem like a good idea, especially if Microsoft thinks that AI can fill the gap.
  13. Microsoft 365 Companion Apps Get the Chop. Microsoft Cancels the Microsoft 365 Companion Apps September 25, 2026 7:00 am - Microsoft launched the Microsoft 365 companion apps in November 2025 and now they have cancelled the apps. No obvious purpose or need for the apps and customer confusion is a fatal mix for any software to fight against, especially during an era when Microsoft is trimming engineering costs to free up investment for priority projects (mostly AI). The companion apps might have set a new record in terms of the shortest Microsoft 365 app lifetime.
  14. Interactive Graph Sessions and Separate Entra ID Apps. How to Use Separate Apps to Control Access to the Microsoft Graph PowerShell SDK September 24, 2026 7:00 am - Administrators know how to use the default Microsoft Graph Command Line Tools app for delegated interactive Graph sessions. In this article, we cover the topic of using custom Entra ID apps to enable granular access for selected users who need some, but not all, Graph permissions to get their work done. Some changes have taken place in this area due to the advent of WAM, but the concepts and implementation steps are straightforward.
  15. Microsoft clamps down on OneDrive storage quotas. Microsoft Draws Hard Line for OneDrive Storage Quotas September 23, 2026 7:00 am - After promising essentially unlimited OneDrive storage some years ago, Microsoft is now putting a hard 5 TB limit on what a user can have and forcing tenants who used Microsoft’s own process to expand to 25 TB to reduce account sizes. It’s an unfair approach, especially when viewed together with the launch of a PAYG option for OneDrive storage to allow Microsoft 365 tenants who need a little more to buy that storage.
  16. Restore Microsoft 365 te.nant with all workloads How Easy is It to Restore Microsoft 365 Tenants After a Catastrophic Attack September 22, 2026 9:00 am - Backup vendors sell on their ability to restore data. Usually, recovery covers one or two workloads and ignores configuration data. But Microsoft 365 tenants become more complex over time as workloads meld together and configurations become more complicated. The need to be able to recover a complete tenant is more obvious than ever before, but no vendor appears willing to take on the challenge, even with AI assistance.
  17. Graph API controls for Teams meeting transcripts. How to Access Teams Meeting Transcripts with the Microsoft Graph September 21, 2026 7:00 am - Microsoft has introduced a new control to stop Graph API-powered apps and agents from having unfettered access to Teams meetings transcripts. The new control is tenant-wide and either blocks or allows Graph API access. But after that, apps need the appropriate permissions and access through a Teams application access policy. To help, we illustrate how everything works with a PowerShell script.
  18. Replacing Office 365 Connectors with Teams workflows. Replacing Retired Office 365 Connectors with Teams Workflows September 18, 2026 7:00 am - Microsoft retired Office 365 Connectors in May 2026. You might not have noticed that some Teams channels no longer receive updates from different network sources via adaptive cards. The solution is to replace the old connectors with new Power Automate workflows. In this article, we discuss updating two PowerShell scripts to post information about Microsoft 365 roadmap items and service health to Teams channels. It’s only four months since the connectors stopped working…
  19. Microsoft Graph PowerShell SDK Drops PowerShell 5.1. Microsoft Starts Twelve-Month Retirement of Windows PowerShell Support for Graph SDK September 17, 2026 7:00 am - On September 16, 2026, Microsoft announced a 12-month retirement period for support of PowerShell V5.1 by the Microsoft Graph PowerShell SDK. Microsoft also announced V3 of the Graph SDK and said that the new version will only support PowerShell V7. The transition for most scripts should be straightforward, but attention needs to be paid when scripts use outdated .NET assemblies. Famous last words...
  20. Teams Remind Me Feature. Teams Gets Messaging Reminders September 16, 2026 7:00 am - The Teams Remind Me feature is a new action available to allow users to create future reminders for chat and channel messages. When the set time comes around, Teams notifies the user about the marked messages, with the intention that users can pick up a topic discussed in a chat or channel conversation. It’s a good idea that’s similar to the way that email reminders work. The only wonder is why reminders have not appeared in Teams before now.
  21. New Outlook and Its Outlook Summaries. New Outlook’s Copilot-Driven Summaries September 15, 2026 7:00 am - New Outlook is an acceptable email client. Some dislike its lack of support for different features, like COM add-ins. Then Copilot gets involved and adds options to generate morning briefing and nightly wrap-ups without any way to disable the feature for individual users or the entire tenant. Plugging Copilot in like this will please some people, but I suspect that it will harm the reputation of new Outlook, especially without settings to stop Copilot seeking to be quite so helpful.
  22. Entra ID accountEnabled Property is invalid. Why Entra Administrators Cannot Disable Their Own Accounts September 14, 2026 7:00 am - When attempting to disable a user account in an interactive Graph session, I was told that the command failed because the accountEnabled property was invalid. The error is obviously incorrect because it’s very possible to update the property to disable or enable an account. However, different rules apply when the account is holds a privileged role, like Global Administrator. Entra imposes some reasonable blocks, even if the error messages are not good.
  23. DLP Policies and the Retrospective effect. Why Some DLP Policies Need Days to Start Working September 11, 2026 7:00 am - While testing the new DLP capabilities to block sharing to users and domains and stop Copilot from using external email, it was noticeable how long it took before policies became active. DLP policy synchronization to workloads is reasonably work (and getting faster), but these policies have a new retrospective effect that requires workloads to process files and messages to stop them being available. It’s a new twist to the DLP story.
  24. Auto-expanding archives incrrease 1.5 TB limit. Microsoft Bumps Auto-Expanding Archive Limit Past 1.5 TB September 10, 2026 7:00 am - First revealed in 2015, the history of auto-expanding archives in Exchange Online has been spotty with several false starts. Now the limit will go past 1.5 TB, but only for eligible E5 licenses. Although the roadmap item has roll-out scheduled for October 2026, Microsoft hasn’t revealed details of what the new upper limit will be or how the new limit will be managed. Having a massive archive mailbox will never concern me, but there must be some who need such a monster archive.
  25. Group mailboxes and the Graph API. Why Microsoft Graph Does Not Support Group Mailboxes September 9, 2026 7:00 am - A reader asked why the Outlook Mail Graph API doesn't support access to group mailboxes. The basic reason is that a group mailbox doesn't have an account and the Outlook Mail API only supports mailboxes that are linked to an account. When you look at the current usage of group mailboxes, it doesn’t seem like there’s much data to mine. Maybe the need for Graph API support for group mailboxes isn’t such a big thing?
  26. CAE coverage for Microsoft 365 apps. Entra ID Continuous Access Evaluation and Microsoft 365 September 8, 2026 7:00 am - Continuous Access Evaluation (CAE) is supported by core Microsoft 365 workloads like Exchange Online, SharePoint Online, and Teams, and the reach of CAE is gradually spreading throughout the Microsoft cloud ecosystem. However, security researchers report inconsistent coverage across first-party apps and clients that take a little gloss off the promise of instant access revocation when critical events like user password changes happen.
  27. Classic Outlook style for the new Outlook and OWA. Outlook Classic Stamps Its Style on the New Outlook September 7, 2026 7:00 am - In an attempt to ease the transition to the new Outlook, Microsoft has introduced the classic Outlook style for the new Outlook and OWA. The style essentially redoes the existing GUI for the web clients to make their appearance very close to the win32 client. After using the two clients side by side for a week, sometimes I find it difficult to know what client I’m interacting with. The question is what average users rather than IT people think of a different face for the new Outlook.
  28. 40 months after Copilot launch what are the lessons for Microsoft 365 tenants. Preparing a Microsoft 365 Tenant for Copilot in Late 2026 September 4, 2026 7:00 am - 40 months ago, Microsoft launched Copilot. Looking back, the lack of guardrails at the time was staggering, and AI had a great time wandering across SharePoint, OneDrive, Teams, and Exchange. Now Microsoft Copilot is a unified client and there’s a bunch of essential steps for tenants to take to keep AI processing under control and their sensitive and confidential information safe. Here’s what we know about implementing Copilot in late 2026.
  29. Revoking access for service principals with CAE. Revoking Access Tokens for Risky Service Principals September 3, 2026 7:00 am - A Technical Community post discusses the topic of using the Entra ID continuous access evaluation (CAE) feature to revoke access for service principals when apps become risky or potentially compromised. The Microsoft Graph Command Line Tools app is a good example of a service principal in common use, so we examine the access tokens issued for interactive Graph sessions to discover if they are CAE-enabled. Just for fun!
  30. Clampdown on MOERA-only tenants. Teams Clamps Down on MOERA-Only Tenants September 2, 2026 7:00 am - The latest restriction on tenants using MOERA (service domain) addresses in production is that Teams will restrict external collaboration from September 2026. At this point, there is zero sense in any organization using a MOERA-only tenant for production purposes. Restrictions in Exchange Online and Teams should drive that point home, and the likelihood is that further clampdowns will follow in the future.
  31. Microsoft 365 for IT Pros September 2026 Update. Microsoft 365 for IT Pros September 2026 Release September 1, 2026 7:00 am - The September 2026 update for the four books in the Microsoft 365 for IT Pros (2027 edition) package are available for subscribers to download. EPUB and PDF files can be downloaded. The paperback edition of the Automating Microsoft 365 with PowerShell eBook has also been updated. August was a busy month with lots happening, most of which ended up in chapter updates. We expect more interesting changes during the coming month.
  32. Use PowerShell and Azure Automation to Watch for New Graph Permissions. Running a Regular Check for New Graph Permissions August 31, 2026 7:00 am - After Microsoft released some new Graph permissions, thoughts turned to how to discover new permissions after they are released. Code is the best way to perform automatic checks, and this article explains how to use PowerShell to check a last known set (stored in SharePoint Online) against the current set. Any variations are reported to administrators via email. It’s nice to automate this kind of operation.
  33. Microsoft to enforce WAM for Interactive Graph sessions. Microsoft To Enforce WAM for Delegated Interactive Graph Sessions August 28, 2026 7:00 am - In a GitHub post, Microsoft says that interactive Graph sessions using the default Microsoft Graph Command Line Tools app will use WAM in the future. Some administrators use older versions of the Microsoft Graph PowerShell SDK for continued access to browser-based authentication, but this won’t be possible once Microsoft makes the server-side change to enforce WAM on an undefined future date. Teams and Exchange Online also use WAM, apparently for better security.
  34. Loop workspace expands to fill 88 GB SharePoint Embedded Container. The Case of the Massive Loop Container August 27, 2026 7:00 am - Why would a seemingly simple Loop workspace develop into a monster SharePoint Embedded container? That's the question to answer when a Loop container grew to fill nearly 88 GB of SharePoint Embedded storage. The workspace had been through many hundreds of edits, but that’s an unlikely reason to spread and occupy so much storage. Loop and SharePoint Embedded are black boxes when it comes to administration, so we must wait for Microsoft to explain.
  35. Granular Graph Permissions Create Questions for Tenant Admins. New Graph Permissions Pose Questions for Microsoft 365 Tenants August 26, 2026 7:00 am - Microsoft issues new granular Graph permissions on an ongoing basis. That's good, but only if tenants use the permissions to replace wider permissions in apps and scripts. Three new permissions recently became available, including two to reduce what apps can do with user account objects. The question is how to discover when Microsoft releases new permissions so that a decision can be made whether to use the new permissions.
  36. Exploring how to fix the Teams meeting problem for transferred meetings with PowerShell. How to Update Teams Settings After Transferring Meetings August 25, 2026 7:00 am - When discussing the transfer ownership of calendar events, we pointed out the Teams meeting problem. Essentially, if an event is a Teams meeting, details of the online meeting are not updated to allow the new owner to control its settings. The result is that recordings and other online meeting artifacts can end up in the wrong place. Microsoft should fix the problem. In the meantime, a PowerShell script illustrates the issue and shows how a fix might work.
  37. New Teams Meeting Policy to contol recording and notetaking bots. New Teams Policy Controls Meeting Recording and Notetaking Bots August 24, 2026 7:00 am - Microsoft recognized the problem posed when users attempt to join recording or notetaking bots to Teams meetings in early 2026. Now a new Teams meeting policy setting is available to control whether bots can join meetings. Allied to smarter bot detection and a program to work with ISVs to identify bots, organizations have a better chance of stopping the unexpected export of confidential information for processing outside the tenant.
  38. Microsoft 365 Business Tenants and the 100 GB mailbox quota. Primary Mailbox Quota Increases to 100 GB for Microsoft 365 Business Plans August 21, 2026 7:00 am - Microsoft announced details about how they will deploy the 100 GB mailbox quota to Microsoft 365 Business tenants. A new service plan is being deployed to tenants to liberate the additional 50 GB of quota. Having a larger mailbox quota delivers a fantastic opportunity to fill a mailbox with all sorts of digital debris, something that can cause problems in the era of AI. Perhaps enabling mailbox archiving for Business tenants would have been better?
  39. Move to Microsoft 365 Archive for Purview DLM. New Archiving Capability for Purview Data Lifecycle Management August 20, 2026 7:00 am - Tenants with Microsoft 365 Archive configured can incorporate an archiving step in how Purview retention policies and labels process SharePoint Online and OneDrive for Business files. It makes perfect sense to move inactive files to lower-cost archive storage as an intermediate point some time before their final deletion. You’ll save on storage and stop AI tools processing the digital debris that invariably accumulates in SharePoint.
  40. Clean out old Planner tasks. Cleaning Up Old Planner Tasks with PowerShell August 19, 2026 7:00 am - Microsoft Purview supports retention policies for Planner tasks and that's the supported way to remove old tasks from plans. But you can also remove old Planner tasks with PowerShell. Just for fun, we show how to find and delete old tasks using the Microsoft Graph PowerShell SDK. Cleaning out obsolete tasks that have been hanging around plans for years speeds up client access. It’s a form of colonic irrigation for plans!
  41. Calculating Entra P1 licensing requirement for CA policies. Calculating the Licensing Requirement for Entra Conditional Access Policies August 18, 2026 7:00 am - After the discussion about the licensing gap prompts shown in the Entra admin center, here's a PowerShell script to compute the set of user accounts that should have Entra P1 licenses. The information comes from the conditions property of conditional access policies with group and directory role membership expanded to find individual accounts. The set is checked against the set of users licensed for Entra P1 to find the accounts that need to be licensed.
  42. JSON batching and mailbox item removal. How to Use JSON Batching to Permanently Remove Mailbox Items August 17, 2026 7:00 am - Following up on the primer explaining how to use JSON batching, this article expands on the principles explored in the primer and explains how to permanently remove batches of mailbox items. Removing mailbox items requires more care and attention than updating some Entra ID user accounts, and we explain what the batch commands are to effect both permanent and recoverable deletions. A full working script is available for you to try out.
  43. DLP and Information Protection for External Services. Expanding Purview DLP and Information Protection to Foreign Platforms August 14, 2026 7:00 am - Microsoft Purview is expanding its ability to process data from external services such as Google Workspace and Box through DLP policies and Information Protection auto-labeling. Everything depends on Microsoft Defender for Cloud Apps connectors to fetch data from the external services to Azure to be processed there. This is an esoteric play that will appeal to certain enterprise Microsoft 365 tenants with the need for a common protection strategy across multiple cloud platforms.
  44. Licensing gap reported in Entra admin center. Entra Admin Center Flags Licensing Problems with Conditional Access August 13, 2026 7:00 am - The Entra admin center is flagging licensing gaps for conditional access. The messages are informational, not the beginning of a new automated billing procedure to charge tenants when Entra ID notices that some accounts use conditional access policies when they don’t have a license. In this article, we discuss the product license insight and how Microsoft measures conditional access usage, and show how to use PowerShell to find who’s using conditional access
  45. Sensitivity Label Support for OneNote and Video Files. SharePoint Online Expands Sensitivity Labels to OneNote and Video Files August 12, 2026 7:00 am - Microsoft has updated SharePoint Online to provide full support for sensitivity labels assigned to OneNote and MP4 files. Full support means that SharePoint Online can decrypt and encrypt file content, which then allows SharePoint to protect the content while storing it in a way that's accessible to Purview services like Data Loss Prevention and eDiscovery, and of course, accessible to Copilot…
  46. Open Tasks Report with PowerShell Creating a Week-by-Week Report for Open Planner Tasks August 11, 2026 7:00 am - Accumulating statistics for open tasks in a Planner plan is helpful to understand how active team members are in clearing assigned tasks. Creating a report showing how the number of open tasks vary by team member over a six-week period delivers another type of insight. It’s the kind of thing that PowerShell is very good at. If data is available, we can report it in different ways!
  47. Invoke-ChangeMeetingOrganizer. How to Bulk Transfer Meeting Ownership Between Mailboxes August 10, 2026 7:00 am - The Invoke-ChangeMeetingOrganizer cmdlet can transfer meeting ownership from one user to another. In this article, we discuss using a script to transfer meetings in bulk between users. The code requires a mixture of Exchange Online and the Microsoft Graph using a registered Entra ID app. It all sounds complicated, but really isn’t – and the code handles scenarios like transferring meetings from someone leaving the organization.
  48. MemberOf Rule Operator Retirement. Entra ID Drops the memberOf Rule Operator for Dynamic Groups and Dynamic Admin Units August 7, 2026 7:00 am - MC1448379 (5 August 2026) announces the retirement of the MemberOf rule operator from Entra ID in early November 2026. The removal of the rule operator might affect the membership rules used for dynamic groups, dynamic administrative units, and auto-assigned entitlement management policies. If a tenant doesn’t act, Entra ID will stop processing the rules and memberships will become increasingly inaccurate. And that’s a bad thing!
  49. Using the Invoke-ChangeMeetingOrganizer Cmdlet. Use the Invoke-ChangeMeetingOrganizer Cmdlet to Transfer Meeting Ownership August 6, 2026 7:00 am - The Invoke-ChangeMeetingOrganizer cmdlet transfers meetings from one organizer to another and makes sure that all calendar settings are preserved. All of which sounds good, but some limitations exist that you should be aware of. The most important limitation is that although Exchange Online can switch ownership for a meeting event, it does nothing to update any online component, like a Teams meeting join URL. That remains a manual task.
  50. Restricted Content Discovery Gets a Makeover. Restricted Content Discovery Gets a Makeover August 5, 2026 7:00 am - Restricted Content Discovery (RCD) is an important guardrail for Microsoft 365 Copilot deployments. Microsoft is tightening how RCD works to eliminate a corner case where recently accessed files from protected SharePoint Online sites could still surface in Microsoft Search and become available to Copilot. The update closes that loophole by ensuring that recently accessed files from RCD-enabled sites remain hidden from Search and Copilot.
  51. MDO Blocks Prompt Injections - Microsoft Defender for Office 365. Microsoft Defender for Office 365 Blocks Prompt Injections August 4, 2026 7:00 am - Microsoft Defender for Office 365 (MDO) can detect and quarantine email containing prompt injections. Shared mailboxes might need MDO Plan 2 licenses if they receive email from external domains. This requirement existed before MDO introduced Prompt Injection Protection, but the advent of the new capability is another reason to check mailbox licensing, especially if your tenant uses Copilot. We have a script to help!
  52. Block Nested Security Groups. Entra ID Enables Blocking for Nested Security Groups August 3, 2026 7:00 am - A new Entra ID feature enables the ability to block nesting for security groups. In other words, you can’t include other groups as members of a group. That might not sound important, but it is to those who manage permissions, especially when the time comes to figure out who exactly has access to something confidential. The new feature isn’t fully implemented yet, but it should be very valuable when it’s fully deployed to tenants.
  53. Microsoft 365 for IT Pros August 2026 Update. Microsoft 365 for IT Pros August 2026 Update August 1, 2026 7:00 am - The August 2026 monthly update for the Microsoft 365 for IT Pros eBook is now available for subscribers to download. All four books are updated and the new EPUB and PDF files are available from Gumroad.com. This month we discovered that a Gumroad bug was preventing bookmarks appearing in book PDFs. The issue has been fixed and new PDFs downloaded should have bookmarks. If not, let us know.
  54. Is Microsoft 365 too complex to manage. Is Microsoft 365 Too Complex for Humans to Understand? July 31, 2026 7:00 am - A recent Reddit thread asked the very good question whether Microsoft 365 is now so complex that no single person can understand the ecosystem. There’s no doubt that Microsoft 365 is much more challenging to manage today than ever before. More features, more functionality, more settings, and more updates create an ever-changing environment that’s interconnected in many different ways. What would executives do if their tenant administrator left?
  55. Azure Tops $100 Billion As Microsoft Reports FY26 Q4 Results July 30, 2026 12:34 am - On July 29, Microsoft released their FY26 Q4 results. We learned that Microsoft 365 Copilot has 30 million paid seats, but that's still less than 7% of the Microsoft 365 installed base, so there’s lots of room for Copilot to grow. Microsoft didn’t provide a number for Teams monthly active users, which is strange because no new data has appeared for 11 quarters. Among all the numbers, one thing’s for sure. The Microsoft Cloud makes lots of money.
  56. DLP Block to stop Copilot using external email. DLP Prevents Microsoft 365 Copilot from Processing External Email July 29, 2026 7:00 am - A new (preview) DLP capability allows Microsoft 365 tenants to block Microsoft 365 Copilot from processing the content of external email. When set, any message coming from a domain that’s not in a tenant’s accepted domain list is blocked for Copilot for grounding, referencing, or summarization. It’s an effective way of blocking threat like prompt injections transmitted in email too, but some people might not like blocking all their external email.
  57. Planner Tasks and Retention Policies. Data Lifecycle Management Adds Support for Planner Retention Policies July 28, 2026 7:00 am - From next month, Microsoft 365 tenants can apply retention policies to Planner Tasks. We began our preparation to create a retention policy for Planner tasks by writing some PowerShell to test the likely effect of retention. The code scans Microsoft 365 Groups for groups with plans and checks each plan for tasks that would be removed by a retention policy. It’s amazing what some PowerShell can do…
  58. Exchange Online PowerShell goes to 3.10.1 Exchange Online PowerShell Updates to 3.10.1 July 27, 2026 7:00 am - Microsoft rushed out version 3.10.1 of the Exchange Online management PowerShell module to fix a problem with certificate-based authentication. It seems like a change in an internal Microsoft identity platform caused the tokens issued after a successful connection to Exchange Online to not authorize the execution of further cmdlets. To their credit, Microsoft fixed the issue, but is this the kind of thing that should be caught in testing?
  59. Federated chat controls and Teams PowerShell. Teams PowerShell Embraces Web Account Manager and Imposes Control Over Federated Chat July 24, 2026 7:00 am - Teams released a new version of their PowerShell module on July 19. The new module contains WAM support and cmdlets to limit federated chat for specific users and tenants. The new controls are welcome, but it’s a sad state of affairs that to configure the settings you must install a new version of a module that doesn’t work so well alongside other Microsoft 365 modules.
  60. Permissions creep for the Microsoft Graph PowerShell SDK. How Permissions Creep Can Halt the Microsoft Graph PowerShell SDK July 23, 2026 7:00 am - The Microsoft Graph PowerShell Command Line tools app is how people run Microsoft Graph PowerShell SDK cmdlets. The app can suffer from permissions creep, meaning that over time, the app accrues a set of delegated permissions used by people to access different types of Microsoft 365 and Entra ID information. All is fine until an internal limit is reached, at which point authentication fails and some permissions must be pruned.
  61. DLP external sharing block. Purview DLP Blocks Sharing Files with Specific Domains or Users July 22, 2026 7:00 am - A new DLP rule is available to control sharing of SharePoint and OneDrive files with selected domains and email addresses. The new rule supports an allow list (permit sharing) and can also specify a deny list (block sharing). The user interface takes a little getting used to, but when everything is configured, the rule works and any attempt by a blocked user to use a sharing link is refused.
  62. JSON batching speeds up Graph processing. Primer: How to Use JSON Batching to Speed up Graph Processing July 21, 2026 7:00 am - JSON batching is one of the most effective ways to speed up the processing of Graph API requests. Although it might seem complicated, once you understand how batches are put together and submitted to the Graph batch endpoint, it's not that hard. JSON batching is of particular interest to large Microsoft 365 tenants that might need to process tens of thousands of accounts, mailboxes, groups, and so on. All explained here, along with a PowerShell script to show how it’s done.
  63. User assigned managed identity and the Microsoft Graph. Using User Assigned Managed Identities with Microsoft 365 Automation July 20, 2026 7:00 am - A user assigned managed identity (UAMI) is a secure method to authenticate with many important endpoints, including the Microsoft Graph. It’s like a system assigned managed identity (SAMI), but the big difference is that a UAMI is an Azure resource that isn’t tied to an automation account. It can be used in multiple areas of Azure and a UAMI might be a better option for large organizations that make extensive use of Azure resources.
  64. OWA Light client. The Demise of the OWA Light Client July 17, 2026 7:00 am - On July 8, Microsoft said that they will retire the OWA Light client for Exchange Server in August 2026. But what happened to the OWA Light client for Exchange Online? It seems like Microsoft announced the retirement of OWA Light for Exchange Online in June 2024, but didn’t really make the fact clear in a blog post about consumer accounts. In any case, you can’t run OWA Light for Exchange Online, even if you wanted to.
  65. Schedule Teams Meetings from Shared Mailboxes. How to Schedule Teams Meetings from Shared Mailboxes July 16, 2026 7:00 am - It is possible to schedule Teams meetings from shared mailboxes without incurring the need to license the shared mailboxes. However, Microsoft’s recent clampdown on unlicensed OneDrive for Business accounts creates a problem because Teams meeting recordings are stored in the OneDrive account for the organizer (shared mailbox). And if that account remains unlicensed for 365 days, it will be removed along with all the recordings.
  66. Cross-tenant message recall. Cross-Tenant Message Recall and Duplicate DDG Detection Enhance Exchange Online Messaging July 15, 2026 7:00 am - Last week, the Exchange development team announced two interesting developments. Stopping duplicate dynamic distribution groups and cross-tenant message recall. Preventing tenants from creating duplicate DDLs saves service resources and might make tenants easier to manage. The real value is in cross-tenant message recall, which solves a problem by allowing users to recall messages delivered outside their tenant. The facility only works if the receiving tenant allows, but nothing can be done for messages delivered outside Microsoft 365.
  67. No more SMS one-time codes for Entra ID. Microsoft to Stop Providing Telephony-Based Authentication Methods for MFA in February 2027 July 14, 2026 7:00 am - In an important announcement for all tenants, Microsoft revealed that Entra ID will no longer provide SMS one-time codes or voice calls for MFA challenges after February 1, 2027. Tenants can continue to use telephony-based authentication methods after that date, but only by purchasing a service from a telecom provider. This is arguably the biggest change in Entra ID authentication since mandatory MFA for administrative interfaces – and we have a PowerShell script to help identify the affected accounts.
  68. Find obsolete sites with PowerShell. How to Identify Obsolete SharePoint Online Sites with PowerShell July 13, 2026 7:00 am - Microsoft 365 has been around for many years, and it's likely that a tenant has some obsolete SharePoint Online sites. This article explains how to identify obsolete sites based on usage data extracted from the Microsoft Graph. Combining the usage data with basic site properties taken from SharePoint creates a report that should help administrators to figure out what sites they should consider removing.
  69. M365Mutator. Make Your Test Data Less Boring with M365Mutator July 10, 2026 7:00 am - Testing Microsoft 365 scenarios often involves test data. If the data is stale or always the same, it might not generate good results or help to identify lurking problems. The M365Mutator app helps to solve the problem by mixing things up in your test data. The app can change properties of Entra ID accounts, send email, update calendars, and generally make sure that whatever you’re testing has fresh information to run against.
  70. Inactive distribution lists and Get-MessageTraceV2. How to Check Distribution Lists for Activity Over the Last 90 Days July 9, 2026 7:00 am - The new Get-MessageTraceV2 cmdlet can fetch 90 days of message trace data, which means that we can check for inactive distribution lists using data for the last 90 days instead of being constrained to the last 10 days. Distribution lists are still important to Exchange Online and Microsoft 365, and it’s good to know which distribution lists are in active use (and how much traffic they get) and which are not. All done with PowerShell.
  71. Generate report about Managers and Direct Reports from Entra ID. How to Report Managers and Direct Reports from Entra ID July 8, 2026 7:00 am - An old article from 2021 written about how to create a report detailing managers and direct reports from Azure AD needs revision. This version uses the Microsoft Graph APIs and explains how to work around a known issue with Graph filtering with a mixture of server-side and client-side filters. It’s the kind of update that PowerShell scripts need when technology change – or when we learn how to do things better.
  72. Outlook Calendar Agent. The Sadly Unfulfilled Promise of the Outlook Calendar Agent July 7, 2026 7:00 am - The Outlook calendar agent seemed to be the answer to the difficulties that I sometimes encounter when trying to sort out my schedule. Alas, the agent failed to deliver when it was given guidelines about how I wanted to create appointments. The overall experience makes me consider whether the huge investment Microsoft is making to infuse AI into its products sometimes turns out duds. Like an agent that can’t schedule.
  73. DLP Move to Quarantine. Purview Data Loss Prevention Introduces File Quarantine July 6, 2026 7:00 am - Data Loss Prevention (DLP) policy rules can now use the move to quarantine action to block access to SharePoint Online and OneDrive for Business files. If blocked, DLP replaces the quarantined file with a plain text “tombstone” file explaining why the block is in place. Releasing the block requires manual administrator intervention. The capability adds to the ways to protect highly confidential files.
  74. Teams membership snapshots. How to Record Snapshots for Teams Memberships July 3, 2026 7:00 am - A lawyer asked if it is possible to take a snapshot of Teams memberships (people who were members at a certain point). This isn’t something that every Microsoft 365 tenant will want to do, but good reasons no doubt exist for the request. In any case, PowerShell makes it easy to find the team membership data and record it in a CSV file or XLS spreadsheet.
  75. External chat API. The Misleading Teams Remove External Chat from User View API July 2, 2026 7:00 am - The Graph removeAllAccessForUser API is supposed to remove external chat messages from the view of a tenant user when the chat contains some objectionable material. Unless the documentation is erroneous, the API doesn't work as advertised and the results are disappointing. All of which means that blocking content for external chats isn’t really possible. If someone gets to start an external chat, they can pump some horrible stuff into your tenant.
  76. MIcrosoft 365 for IT Pros 2027 edition. Announcing Microsoft 365 for IT Pros (2027 Edition) July 1, 2026 12:02 am - We're happy to announce the publication of Microsoft 365 for IT Pros (2027 edition) eBook, the most comprehensive and up-to-date book covering tenant management. Previously named Office 365 for IT Pros and now spanning four books, Microsoft 365 for IT Pros includes coverage of Exchange Online, SharePoint Online, Entra ID, Teams, Planner, and many other aspects of the Microsoft 365 ecosystem, including hundred of examples of using PowerShell and the Microsoft Graph to automate tenant operations.
  77. Incoming Teams Calls Get a Small Window. Using the Small Window for Incoming Teams Calls June 30, 2026 7:00 am - A recent improvement is the introduction of a small window for incoming Teams calls. It doesn't sound like a great step forward, but switching to the small window is a surprisingly useful step. The sad thing is that many users won’t know that the option to switch exists because it’s buried in Teams settings. If you’re a busy person who takes lots of Teams calls, switching is definitely recommended.
  78. Copilot Memory Improves. Two Microsoft 365 Copilot Changes That Just Make Sense June 29, 2026 7:00 am - Two recent changes to the Microsoft 365 Copilot Chat app have made the app easier to use. Interaction persistence is better, meaning that chat threads are always created and available to go back to if necessary, and Copilot memory is managed more easily. Copilot memory is an intensely personal capability. If you spend the time to figure out the instructions that Copilot should always remember, the quality of Copilot responses will be much better.
  79. DragonForce Attacked and Compromised a Network, Not Teams. What the DragonForce Attack Against Teams Is All About June 26, 2026 7:00 am - Recent reports from security companies and news outlets about an attack by the DragonForce ransomware group against a U.S. services company highlighted the use of Teams. It’s true that Teams was involved in this very artful attack, but the most critical point is that the network was compromised well before the attackers went near Teams. And when your network is compromised, all sorts of bad things happen. Stop compromises and stay safe!
  80. Delta Queries for Entra ID Groups. Using Graph Delta Queries with Entra ID Groups June 25, 2026 7:00 am - Delta queries are a Microsoft Graph mechanism to allow applications to query resources to find objects that have changed since a baseline was established. The technique is most useful for applications that need to synchronize a local store with online content. It’s not an appropriate method to use for reporting changes because knowing that an object changed doesn’t mean much by itself.
  81. Find inactive channels with PowerShell. How to Use PowerShell to Identify Inactive Teams Channels June 24, 2026 7:00 am - It's common to find that tenants have many inactive channels in their Teams deployment. Becoming inactive is a natural side-effect of time eroding interest in the topics people discuss in channels. And if you don’t go looking for inactive channels, they’ll remain silently in place doing nothing except acting as a container for potentially obsolete long-over discussions. But we can find inactive channels with PowerShell. What you next is up to you.
  82. Automating Microsoft 365 with PowerShell 2027 edition. Automating Microsoft 365 with PowerShell (2027 Edition) June 23, 2026 7:00 am - The third edition of the Automating Microsoft 365 with PowerShell eBook is now available in EPUB and PDF formats. The paperback version will be available on July 1. This 430-page eBook offers the most comprehensive coverage of automating tenant management operations for Microsoft 365 and includes a swathe of practical, worked-out examples to help tenant administrators build scripts to automate tasks.
  83. Microsoft Cannot Make PowerShell Modules Work Together. The Grief and Joys of New PowerShell Releases June 22, 2026 7:00 am - A new version of the Microsoft Graph PowerShell SDK (V2.38) is available, as is a new version of the Exchange Online Management module. They don't work well together. It’s annoying and beyond frustrating that two critical PowerShell modules in the Microsoft 365 ecosystem cannot work together. If anything, the situation is getting worse. On the upside, I found out about two cmdlets that I might never use – but who knows!
  84. Baseline scopes and CA policies. Entra ID Tightens Conditional Access Processing for Baseline Scopes June 19, 2026 7:00 am - Microsoft is closing a gap in conditional access policies where apps that only request baseline scopes with at least one exclusion are not processed. The rollout has already started and should be finished by mid-August. For most tenants, the change shouldn’t be an issue, but it is possible that some apps are in use that fit the profile and cannot handle conditional access. If MC1223829 appeared in your tenant, it’s time to check.
  85. Copilot Interactions and APIs. Microsoft Blocks Graph Access to Non-IPM Folders June 18, 2026 7:00 am - An app written to fetch details of Copilot interactions from the TeamsMessagesData folder suddenly stopped working when the Graph refused to return items. The 403 forbidden error can’t be argued with. It's a pain when apps stop working just because of a change made at an API level. Fortunately, the aiInteractionHistory API fills the gap.
  86. Microsoft to tighten SSPR security in Sept 2026. Microsoft Tightens Security for Self-Service Password Reset June 17, 2026 7:00 am - Microsoft plans to improve the security of the Self-Service Password Reset (SSPR) facility in September 2026 by requiring users to register at least one authentication method. SSPR will then use the registered authentication method to verify user accounts when changing passwords. The change aligns SSPR with user sign-ins and improves security by removing fallback on directory attributes, which might be altered by attackers.
  87. Monthly Price Increase for Microsoft 365 tenants. How Much Will the July 2026 License Increases Cost Your Tenant? June 16, 2026 7:00 am - July 1, 2026, sees a bunch of monthly price increases that will affect Microsoft 365 tenants. How much will the increases cost your tenant? One way to find out is to use PowerShell to retrieve the licenses assigned to users which are affected by the price increases and compute the effect of the monthly increase (which varies across products). It’s a great example of how flexible PowerShell is for tenant management.
  88. Teams Chat Threads Removal. How to Remove Teams Chat Threads with PowerShell June 15, 2026 7:00 am - Sometimes, Microsoft 365 tenants need to remove problematic Teams chat threads from user view. The usual reason is because someone posted some bad or objectionable content to Teams. This article covers how to use Microsoft Graph PowerShell SDK cmdlets to find chat threads, to check thread messages for targeted content, and to remove matching chat threads. The code can be run interactively by an administrator to clean up Teams.
  89. Unlicensed OneDrive for Business Accounts will be deleted after 365 days. Microsoft to Delete Unlicensed OneDrive for Business Accounts June 12, 2026 7:00 am - Microsoft will delete unlicensed OneDrive for Business accounts that aren’t paid for (to be archived) after July 2026. Up to now, it’s been possible to leave unpaid-for accounts linger in Microsoft 365 archive until retention policies and holds expire. Now, tenants must decide which accounts they wish to keep and pay for. Unpaid accounts will be removed, even if retention policies or eDiscovery holds apply to their content.
  90. Three ways to get sensitivity labels with PowerShell. Primer: Finding Sensitivity Labels with PowerShell June 11, 2026 7:00 am - Three cmdlets exist to fetch sensitivity labels. One is in the Exchange Online module; the others are powered by Graph APIs. What are the differences between each method and how can you make sure that the set of sensitivity labels fetched by PowerShell is the full set of available labels? These and other questions are investigated in this article.
  91. Microsoft 365 Copilot Deployment. Restricting Access is The Most Important Step in a Microsoft 365 Copilot Deployment June 10, 2026 7:00 am - I was asked what the most important step is in the deployment of Microsoft 365 Copilot. It's a good question. Put simply, restricted access is the answer. That is, restricting Copilot access to information stored in Microsoft 365 locations until your tenant is ready for unrestricted Copilot search and retrieval. The fortunate thing is that tools exist today to make it relatively easy to establish guardrails for Copilot, which is exactly what you need to do.
  92. Find inactive accounts and remove underused licenses. How to Find Inactive (Stale) User Accounts June 9, 2026 7:00 am - Inactive accounts can soak up a lot of paid-for but unused product licenses. With increases for Microsoft 365 licenses due to come into effect from 1 July 2026, it’s time to find and remove unused licenses from inactive user accounts. We discuss two approaches by using the Microsoft 365 Licensing Report or a PowerShell script that assesses inactivity based on sign-in dates and refresh token baselines.
  93. BlockContentAnalysisServices setting for sensitivity labels. Microsoft Extends Sensitivity Label Block for Connected Services June 8, 2026 7:00 am - The BlockContentAnalysisServices sensitivity label setting blocks access to Microsoft connected services for the content of labeled Office documents. The intention is that users assign sensitivity labels with the block setting to protect an organization’s most sensitive files. Regretfully, Microsoft’s documentation and explanation offered in the message center post don’t convey a clear story about its value.
  94. Microsoft Artifact Registry and PowerShell modules. Microsoft Wants PowerShell Developers to Change How They Download Microsoft Modules June 5, 2026 7:00 am - A Microsoft blog describes some changes for PowerShell developers in terms of installing modules and the role of the Microsoft Artifact Registry (MAR). In a nutshell, Microsoft intends the MAR to be the go-to place to download first-party PowerShell modules and other artifacts. This solves the problem of potentially compromised modules found in the PowerShell Gallery, but MAR can’t work if it doesn’t contain the modules people use.
  95. User-owned Loop workspace workflow. The Great Loop Departed User Process June 4, 2026 7:00 am - When employees leave a Microsoft 365 tenant, they might leave a user-owned Loop workspace behind which contains some valuable information that the organization wants to retain. Two years or so after announcing that a workflow to handle user-owned workspaces was coming, Microsoft is rolling out the update to tenants worldwide. The process is manual, but not much automation is possible to review and preserve workspace content.
  96. Security groups support for container management labels. Microsoft Launches Container Management Support for Security Groups June 3, 2026 7:00 am - A recent blog from the Microsoft Digital (IT department) discusses the preview implementation of container management labels for security groups. The implementation is limited because it encompasses just one control: the ability to have guest accounts in the membership of security groups. However, just that limited control is sufficient to stop unintended access to sensitive information by guest accounts, and that’s a very good thing.
  97. Track distribution list changes with PowerShell. How to Report Recent Changes made to Distribution Lists June 2, 2026 7:01 am - A recent discussion about reporting changes to Microsoft 365 groups provoked the question about how to report distribution list changes. The answer is that the same structure can be taken in a PowerShell script to fetch and report data, including the audit records containing the information about the changes, but the actual code is very different. Distribution lists Exchange Online objects and not Entra ID groups…
  98. June 2026 update for Office 365 for IT Pros. Office 365 for IT Pros June 2026 Update June 1, 2026 7:00 am - The 132nd monthly update for the Office 365 for IT Pros eBook is now available for subscribers to download the refreshed EPUB and PDF files from Gumroad.com. In addition, we announce some changes that are coming for the 2027 edition, including a rename for the book, a new chapter covering Copilot and agents, and two new books covering Microsoft Purview and the Power Platform that we’ve split out of the main book. All done to provide even more coverage about Microsoft 365.
  99. Microsoft 365 Usage Analytics Power BI app. Microsoft Cans Power BI App for Reporting Microsoft 365 Usage May 29, 2026 7:00 am - Microsoft has announced that the Microsoft 365 Usage Analytics Power BI app will retire on August 1, 2026. The alternative is the usage reports in the Microsoft 365 admin center or to develop a custom Power BI dashboard based on data imported through the Graph usage reports API. The decision isn’t surprising, but I’m sure that some will mourn the passing of Microsoft’s first tool to report usage information.
  100. Moving from MAPI to REST calendar sharing. Microsoft Rolls Out the New Calendar Sharing Model May 28, 2026 7:00 am - An automatic upgrade is currently ongoing to move Outlook calendar sharing from the old MAPI-based model to a new REST-based model. The new model has been available to Outlook classic clients on an optional basis and is now becoming the default. The REST model is simpler and exploits the Exchange Online service instead of depending on client transactions. It’s also part of the transition to the new Outlook.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.