Defender Unified RBAC will be enabled for new tenants with Defender for Office 365 Plan 2
Microsoft is enabling Unified RBAC for new tenants with Defender for Office 365 Plan 2 starting at the end of May 2026.
Security
Defender for Office 365 now alerts on malicious URL clicks in Microsoft Teams
Defender for Office 365 URL click alerts are expanding to Microsoft Teams. When users click malicious links in Teams messages, alerts now appear in the Defender portal for faster detection and investigation.
Microsoft Entra: “Revoke sessions” now invalidates all user sessions
The “Revoke Sessions” action in Microsoft Entra has been updated to invalidate all user sessions, regardless of whether MFA is enforced via Conditional Access or per-user policies.
Updating Secure Boot Certificates on Windows Devices: My Personal Experience
Organizations should update Secure Boot certificates ahead of the June 2026 expiration deadline. In this post, I share my personal experience deploying these certificates via Intune, encountering a licensing error, working around it with a registry key, resolving a BIOS-related failure, and verifying the final result with PowerShell.
Reporting suspicious Teams messages comes to Defender for Office 365 Plan 1
Microsoft is expanding Teams message reporting to Defender for Office 365 Plan 1, allowing users to report suspicious and false-positive messages starting February 2026.
Microsoft will enable new messaging safety protections in Teams starting January 2026
Microsoft will enable new messaging safety protections in Teams for tenants using the default configuration starting January 2026.
Baseline Security Mode for Office, SharePoint, Exchange, Teams, and Entra in the Microsoft 365 Admin Center
Microsoft is introducing Baseline Security Mode in the Microsoft 365 admin center, providing a central dashboard with 18 recommended security settings for Office products, SharePoint, Exchange, Teams, and Entra.
Zero-hour auto-purge (ZAP) in Teams for organizations with Defender for Office 365 Plan 1
Microsoft will enable ZAP in Teams for organizations with Defender for Office 365 Plan 1 starting in January 2026, with an opt-out option available for security admins.
Legacy authentication in SharePoint Online will retire starting February 2026
Legacy IDCRL authentication in SharePoint Online will be retired starting February 2026. Admins should review Purview Audit Logs and update any applications still using legacy protocols.
SharePoint Online Content Security Policy will be enforced starting March 2026
Microsoft will enforce Content Security Policy (CSP) for SharePoint tenants starting in March 2026. Report-only mode runs from April 2025 to February 2026. Admins should review CSP violations now to avoid broken custom scripts and components once enforcement begins.