This week: Action Required: Upgrade ExchangeOnlineManagement PowerShell Module t… + 4 more E8 changes (Mon 12 Oct)

12 October 2026 · 10 changes that matter, 247 reviewed.

1. Action Required: Upgrade ExchangeOnlineManagement PowerShell Module to Version 3.10.1 or Later — Exchange Online PowerShell module 3.10.1+ introduces enhanced authentication to counter emerging threats. Older versions will fail authentication after March 2027, requiring an upgrade to maintain administrative access and security. [Patch Applications]
2. Business Skills in Work IQ - Default On — New Dataverse AI capabilities, including Business Skills and Declarative Agents, will be enabled by default in new environments. This expands AI access to sensitive business data, increasing data exposure risk if not properly governed.
3. Updates available for Microsoft 365 Apps for Current Channel — Microsoft has released routine security and feature updates for Microsoft 365 Apps on the Current Channel. Applying these updates is critical for maintaining security posture and patching known vulnerabilities. [Patch Applications]
4. How to get the Windows 11 2026 Update — Windows 11, version 26H2 (2026 Update) is now generally available, resetting support lifecycles. This update includes security enhancements, requiring organisations to plan deployment to maintain a secure posture and ensure continued support. [Patch Operating Systems]
5. Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection — Microsoft Entra ID will block external script injection on sign-in pages by enforcing Content Security Policy (CSP). This enhances protection against cross-site scripting (XSS) by only allowing trusted Microsoft scripts, improving authentication security.
6. (Updated) Microsoft Teams: Improved file sharing experience in external chats — Microsoft Teams will enable file sharing in external chats by default, automatically assigning permissions. This simplifies cross-organization collaboration but increases the risk of unintended data exposure if not managed.
7. Microsoft Defender for Cloud Apps: Permission changes for select App Governance Entra roles — Microsoft Defender for Cloud Apps (MDCAS) App Governance permissions are changing for specific Entra roles due to Unified RBAC integration. Cloud App Security Admins gain full App Governance access, while Compliance Admins and Compliance Data Admins lose management capabilities. [Restrict Administrative Privileges]
8. SharePoint: HTML pages — SharePoint will support HTML pages, creatable via Copilot or upload. This introduces new content vectors and potential for client-side vulnerabilities, requiring updated content governance and security policies.
9. Dynamics 365 Sales -Streamline Quick Campaigns for confident, one-time bulk email outreach — Dynamics 365 Sales now offers a streamlined, opt-in Quick Campaigns feature for bulk email. This simplifies sending one-time mass emails, increasing the risk of misdirected communications and data exposure if not managed carefully.
10. Microsoft 365 Copilot: Use Microsoft Agent 365 agents as connected agents in declarative agents — Microsoft 365 Copilot now supports connecting declarative agents to Agent 365 agents via the Agent2Agent protocol. This expands AI agent interoperability, enabling more complex workflows and centralized management, but introduces new attack surfaces for agent-to-agent communication. [Restrict Administrative Privileges]

What we ignored

• (Updated) Outlook (new): Right-click to customize the classic ribbon — This is a UI customization, not a security-relevant change.
• Updated My Task experience in Planner — UI/UX update, no security relevance.
• Windows Office Hours: October 15, 2026 — This is an informational event, not a security-relevant change.
• Power Apps: Modern, refreshed look for the mail app — This is a UI/UX cosmetic change with no security relevance.