Critical: Support for Office LTSC 2021, and additional apps will end on October… + 4 more E8 changes (Mon 19 Oct)

19 October 2026 · 10 changes that matter, 462 reviewed.

  1. Support for Office LTSC 2021, and additional apps will end on October 13, 2026 — Office LTSC 2021, Visio LTSC 2021, and Project LTSC 2021 will reach end of support on October 13, 2026. Continued use after this date will result in no security updates, creating significant vulnerability and compliance risks. [Patch Applications]
  2. (Updated) Microsoft Entra: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication — Microsoft Entra will default to passkeys for authentication by September 2026, phasing out Microsoft-provided SMS and voice MFA by February 2027 due to their phishing vulnerability. Organisations must transition to phishing-resistant methods or procure third-party telecom providers. [Multi-Factor Authentication]
  3. Hardening changes for ReFS volumes on removable media — Microsoft is hardening the Resilient File System (ReFS) on removable media to improve Windows security. This change adds visibility and control to block unsupported external ReFS configurations, requiring admin action to review audit data and address dependencies. [Patch Operating Systems] (act before 2027-01-01)
  4. SharePoint: Agent chat web part — SharePoint now supports a new web part for embedding M365 Copilot agents directly onto modern pages. This introduces new vectors for data exposure and prompt injection risks.
  5. Microsoft Purview: Data Loss Prevention-Admin Units Support for Copilot & Cowork DLP — Purview DLP now supports Administrative Units for Copilot and Cowork, enabling delegated policy management without granting tenant-wide permissions. This improves security posture by enforcing least privilege for DLP administration. [Restrict Administrative Privileges]
  6. Visio: Desktop Model Context Protocol (MCP) Server — Visio Desktop now supports AI client connections for diagram creation/editing via natural language. This introduces a new local attack surface for data exfiltration and unauthorized diagram modification through AI agents.
  7. Microsoft Contact Center AI: Connect existing agents from Azure Foundry to agents in CCAI — Microsoft Contact Center AI can now integrate with existing Azure Foundry agents. This expands the attack surface for AI agents and introduces new data flow complexities requiring careful security governance. [Restrict Administrative Privileges]
  8. Microsoft Purview: Information Protection-Auto-labeling for legacy Office files — Microsoft Purview auto-labeling now supports legacy Office files (.doc, .xls, .ppt) in SharePoint and OneDrive. This enhances data protection by automatically applying sensitivity labels to a broader range of historical documents.
  9. Dynamics 365 Supply Chain Management: Warehouse management - Integrate the Warehouse management module with external labor management systems — Dynamics 365 Supply Chain Management now integrates with external Labor Management Systems (LMS). This enables data sharing for workforce planning and performance tracking, potentially exposing sensitive HR and operational data to third-party systems.
  10. Microsoft Purview: Data Loss Prevention-Apply Purview network data security DLP policies to all websites, or all websites except specific cloud apps, through Entra GSA Internet Access integration — Purview DLP can now apply network data security policies to all websites or all websites except specific cloud apps via Entra GSA Internet Access. This extends data loss prevention to uncatalogued cloud apps and websites.

What we ignored

  • Windows Office Hours: October 15, 2026 — This is an informational event, not a security-relevant change.
  • Dynamics 365 Project Operations: Full-screen mode on task grid — UI change, no security relevance.
  • Updated My Task experience in Planner — UI/UX update, no security relevance.
  • Power Apps: Modern, refreshed look for the mail app — This is a UI/UX cosmetic change with no security relevance.
  • Power Apps: Modern, refreshed look for embedded model-driven apps — Purely cosmetic UI change, no security relevance.