This week: Microsoft API Hub: Zendesk OAuth tokens will require expiration and a… + 3 more E8 changes (Sun 18 Oct)

18 October 2026 · 10 changes that matter, 411 reviewed.

1. Dynamics 365 Contact Center: Administrator experiences - Use industry templates to set up autonomous contact centers — New industry templates for Dynamics 365 Contact Center simplify deploying autonomous AI agents. This accelerates AI adoption but introduces new attack surfaces for data exposure and prompt injection, requiring careful security configuration.
2. Microsoft Purview: Information Protection - Apply default SharePoint library labels to data at rest — SharePoint libraries can now automatically apply default sensitivity labels to existing files at rest. This closes data labeling gaps, ensuring consistent, secure-by-default protection without manual user intervention.
3. Microsoft Teams: Phishing Detection in Teams Messaging — Microsoft Teams now uses AI to detect phishing and social engineering in external chats, particularly first-contact messages. This enhances protection against malicious links and credential theft, displaying warnings to users when suspicious activity is identified. [User Application Hardening]
4. Dynamics 365 Commerce: Enable MCP tools for POS returns — New agentic tools for Dynamics 365 Commerce POS returns expose return capabilities as structured actions. This enables conversational or agentic return experiences, potentially increasing data exposure and requiring careful governance of AI agents. [Restrict Administrative Privileges, User Application Hardening]
5. Microsoft API Hub: Zendesk OAuth tokens will require expiration and automatic refresh — Microsoft API Hub will enforce expiring OAuth tokens and automatic refresh for Zendesk connections. This enhances security by reducing the lifetime of credentials, requiring reauthorization for existing connections to adopt the new, more secure model. (act before 2027-01-31)
6. Dynamics 365 Supply Chain Management: Procurement Agent - Define custom scenarios for agent-generated supplier emails — Dynamics 365 agents can now use custom scenarios for generating supplier emails. This introduces new avenues for prompt injection and data exfiltration risks via user-defined agent instructions.
7. Power Pages: Create Power Pages SPA site from the Power Pages studio — Power Pages now supports creating Single-Page Application (SPA) sites directly from the studio. This simplifies development but introduces new attack surfaces for web applications, requiring careful security configuration.
8. SharePoint: Copilot Search in SharePoint and OneDrive — Copilot Search in SharePoint and OneDrive uses AI for natural language search and summarisation. This changes how users discover and access information, potentially exposing sensitive data if permissions are not strictly enforced.
9. Microsoft Copilot (Microsoft 365): Integrate the Sales Development agent with Salesforce — Microsoft Copilot's Sales Development Agent now integrates with Salesforce CRM. This allows the agent to access and manage sales data, increasing automation but also expanding the attack surface for sensitive customer information. [Restrict Administrative Privileges]
10. Microsoft Teams: Event Chat now available for Events optimized for a large audience in GCC, GCC High and DoD — Microsoft Teams now enables public chat for large events in GCC clouds. This expands communication but introduces new vectors for information leakage and unmoderated content, requiring review of existing event policies.

What we ignored

• Windows Office Hours: October 15, 2026 — This is an informational event, not a security-relevant change.
• Dynamics 365 Project Operations: Full-screen mode on task grid — UI change, no security relevance.
• Updated My Task experience in Planner — UI/UX update, no security relevance.
• Power Apps: Modern, refreshed look for the mail app — This is a UI/UX cosmetic change with no security relevance.
• Power Apps: Modern, refreshed look for embedded model-driven apps — Purely cosmetic UI change, no security relevance.