What’s New in the Hybrid Data Center & Microsoft | June 2026

Hybrid Data Center Team

eGroup

This month’s updates center on stronger identity controls, broader cloud workload protection, and operational modernization across hybrid infrastructure and Microsoft Cloud. IT teams should prioritize identity hardening, backup and recovery validation, TLS retirement planning, AI governance, and endpoint compliance because several updates introduce security improvements alongside future-breaking changes and licensing considerations.


What’s the Buzz at eGroup?

We Have Been Named to the 2026 CRN Solution Provider 500 List! 

We recently wrapped our Microsoft Virtual Roadshow Days, covering Azure + Security, Microsoft 365 + Security, and Data + AI, with hundreds attending each day, ready to learn and participate. Time is valuable, and we appreciate you spending it with us.

The conversations, along with audience poll responses, painted a consistent picture of where teams are right now: working to strengthen their cloud foundation, close security gaps, and make progress with data and AI. It’s also where we’re seeing organizations take action, turning those priorities into active engagements that move the needle.

We’re proud to share that eGroup was just named to the 2026 CRN Solution Provider 500 List, recognized for the 14th year as a key influencer propelling growth in the IT industry and the global technology channel.

That recognition reflects the work being done alongside organizations like yours, tackling the same challenges, from strengthening security with ThreatDefender MXDR to advancing data governance with Purview, as well as taking the next steps through AI workshops and cloud modernization.


What’s New in the Hybrid Data Center?

Cohesity

Cohesity Cloud Edition 7.4: Expanded Azure Backup and Recovery Options
Cohesity is focused this month on improving Azure workload protection, recovery flexibility, and operational backup performance. The updates affect Azure SQL Managed Instance, Azure virtual machine disks, and file-level recovery scenarios.

View full Cohesity update
  • Azure SQL Managed Instance Backups Without CDC: Cohesity Cloud Edition 7.4 now supports backup of Azure SQL Managed Instance without requiring Change Data Capture to be enabled. This matters because CDC is required for incremental backups, but disabling CDC allows teams to perform native full backups more quickly when fast full-backup operations are preferred over incremental capture.
  • Disk-Level Backups for Azure VMs: Cohesity Cloud Edition 7.4 now supports disk-level backups for Azure virtual machines. Disk-level backups can be recovered to the original VM or to a different VM, where the recovered disk is attached as a new disk. This improves recovery flexibility for targeted restore scenarios, but disk-level recovery is only supported for VMs protected with native snapshots.
  • Individual File and Folder Recovery for Azure VMs: Cohesity Cloud Edition now supports recovery of individual files and folders from Azure virtual machines. Files and folders can be restored to the original VM or to a different VM, helping teams recover specific data without requiring a full VM restore.

Everpure (Pure Storage)

Pure Storage FlashArray and FlashBlade: Security Assessment, File Auditing, and QoS Controls
Pure Storage, noted in the source notes as Everpure formerly Pure Storage, is emphasizing security visibility, file activity auditing, and workload isolation. The updates affect Pure1 Security Assessment, FlashBlade NFS auditing, and FlashArray file quality of service controls.

View full Everpure (Pure Storage) update
  • Pure1 Failed and Unusual Login Anomaly Detection: Pure1 Security Assessment now includes a new anomaly type that evaluates failed and unusual logins across a customer’s full install base of FlashArray and FlashBlade systems. This matters because it accelerates discovery of suspicious access patterns and helps teams respond more quickly to potential credential misuse or unauthorized access attempts.
  • NFS File Auditing for FlashBlade: NFS file auditing is now available on the FlashBlade platform for tracking and reporting NFS and mixed SMB/NFS activity. File auditing logs can be exported locally or forwarded to a syslog server, enabling SIEM-based analysis of file access patterns and potential anomaly detection.
  • File QoS for FlashArray: New file quality of service controls on FlashArray support IOPS and throughput limits for specific managed directories and file systems. This matters for operational resilience because teams can reduce the risk that rogue or noisy workloads consume storage performance needed by critical workloads.

Why It Matters: These updates give storage and security teams better visibility into suspicious access activity and stronger controls to limit noisy workloads. They also improve the ability to feed file access activity into SIEM workflows for anomaly detection and investigation.


Rubrik

Rubrik Security Cloud: Passkeys and Granular Least-Privilege Permissions
Rubrik is advancing identity security and role-based access control across Rubrik Security Cloud. The updates focus on phishing-resistant authentication and more precise administrative permissions aligned to Zero Trust principles.

View full Rubrik update
  • Phishing-Resistant Passkeys for RSC Login: Rubrik Security Cloud now supports login using phishing-resistant passkeys as a secure alternative to traditional passwords. RSC supports platform security keys stored on a user’s device, such as iCloud Keychain or Windows Hello, and roaming security keys such as YubiKey hardware tokens. Once configured, users can authenticate with a device PIN, fingerprint scan, facial recognition, or hardware token.
  • Granular Permissions for Least Privilege: Rubrik Security Cloud has introduced more granular permissions to enforce least-privilege access in accordance with Zero Trust security principles. Earlier broad “View” and “Manage” permissions have been replaced with more specific controls so administrators only receive privileges essential to their role, such as applying cluster upgrades or recovering data.

What’s New in Microsoft Cloud?

Azure

Azure: Identity-Based Storage Access, TLS Retirement, Boost Performance, and Workload Protection

Azure updates this month span storage identity, encryption retirement planning, VM performance, Kubernetes security, web-layer protection, and database scaling. These changes have direct implications for security architecture, legacy application dependencies, and performance planning.

  • Managed Identities for Azure Files SMB Shares: Azure Files now supports managed identities for SMB file shares, allowing organizations to move away from stored access keys and passwords. This is a meaningful Zero Trust improvement for a widely used Azure storage service because it reduces secret sprawl and supports stronger identity-based access patterns.
  • TLS 1.0 and TLS 1.1 Retirement Date: Microsoft has set May 31, 2027 as the retirement date for legacy TLS 1.0 and TLS 1.1 encryption across App Service, Functions, and Logic Apps. Organizations should plan now to avoid disruptions to older integrations, applications, and dependencies that still rely on deprecated encryption protocols.
  • Next-Generation Azure Boost General Availability: The next generation of Azure Boost is now generally available and improves compute, networking, and storage performance for mainstream workloads without requiring application changes. This matters for teams looking to increase performance and efficiency across common workloads without redesigning applications.
  • New Dlsv7, Dsv7, and Esv7 Virtual Machines: New D, Dl, and E v7 virtual machines built on Intel’s latest Xeon 6 processors deliver up to roughly 20% better performance for everyday VM workloads. This provides a modernization path for common compute profiles where performance improvement can be gained through instance selection rather than application refactoring.
  • AKS Built-In Encryption Between Application Components: Azure Kubernetes Service added built-in encryption for traffic between application components without requiring extra configuration. This improves default security posture for Kubernetes workloads by reducing the effort needed to protect service-to-service communication.
  • Azure Front Door Machine Learning DDoS Defense: Azure Front Door gained a smarter machine-learning-based defense against web-layer denial-of-service attacks. This strengthens protection for internet-facing applications by improving detection and response to application-layer traffic patterns that can disrupt availability.
  • Azure Database for PostgreSQL Cascading Read Replicas: Azure Database for PostgreSQL now supports cascading read replicas to better scale read-heavy applications. This matters for application teams that need to distribute read traffic more effectively without overloading primary database resources.

What to Consider: Start identifying legacy dependencies on TLS 1.0 and TLS 1.1 now, especially in integrations tied to App Service, Functions, and Logic Apps. The May 31, 2027 retirement date gives teams time to remediate, but older applications and vendor integrations often require longer planning cycles.

Agent 365

Agent 365: Centralized Agent Registry, Shadow AI Discovery, and Cross-Platform Governance

Agent 365 is positioned as a central control plane to observe, govern, and secure agents across platforms and frameworks. The updates focus on registry capabilities, licensing, shadow AI discovery, and external agent governance.

  • No-Cost Core Agent Registry Components: Several Agent 365 components are available at no extra cost, including the all-inclusive agent registry. This gives organizations a starting point for observing and governing agents without immediately requiring paid advanced monitoring capabilities.
  • Advanced Monitoring Licensing: Advanced agent monitoring and integrations require either a $15 per user per month E5 license add-on or an upgrade to the $99 per user per month E7 license. This matters for budgeting because organizations should distinguish between baseline registry visibility and advanced governance, monitoring, and integration requirements.
  • Shadow AI Discovery with Defender and Intune: New shadow AI discovery built with Defender and Intune helps organizations find and block unmanaged local agents. Initial coverage starts with OpenClaw and expands to GitHub Copilot CLI and Claude Code, helping security teams identify agent usage that may operate outside approved governance channels.
  • External Agent Governance for Amazon and Google Platforms: Agent 365 added day-one governance for external agents running on Amazon Bedrock and Google platforms. This reduces blind spots for organizations using multi-cloud AI platforms and supports more consistent governance beyond Microsoft-native agents.
  • Registry Sync Preview for Third-Party Agents: A new Registry sync preview pulls third-party agents into one unified registry. This matters because agent sprawl can create visibility, accountability, and compliance challenges if agents are tracked only inside separate platforms.

Why It Matters: Agent governance is becoming a core security and compliance requirement as organizations adopt copilots, coding agents, and autonomous workflows. Centralized discovery and registry sync can help reduce unmanaged AI usage and improve oversight across Microsoft, Amazon, Google, and third-party platforms.

Copilot

Copilot: App Experience, PowerPoint Skills, Meeting Controls, Licensing, and Governance

Microsoft 365 Copilot updates cover user experience, presentation assistance, notebook expansion, meeting recap compliance, learning, automation, SharePoint integration, Teams meeting controls, deployment, and licensing. These changes affect end users, administrators, compliance teams, and business stakeholders evaluating Copilot adoption.

User Experience and Surfaces

  • Microsoft 365 Copilot App Redesign: The Microsoft 365 Copilot app received a cleaner and faster redesign intended to feel more integrated across Microsoft 365 apps. Icons now appear floating in the lower-right corner rather than in the top ribbon, changing how users discover and interact with Copilot across their daily workflow.
  • PowerPoint “Visualize This Slide” Skill: The “Visualize this slide” skill in Copilot for PowerPoint for the web, Windows desktop, and Mac is launching in mid-May 2026. It transforms text-heavy slides into visually rich layouts using Anthropic and GPT-5.5 models, is enabled by default, requires no admin action, and gives users the option to apply the suggested design.
  • PowerPoint “Prepare for Questions” Skill: The “Prepare for Questions” skill in Copilot for PowerPoint for web, Windows desktop, and Mac helps users anticipate audience questions by analyzing presentations. It supports Anthropic and GPT-5.5 models, improving presentation readiness for executive briefings, sales reviews, board updates, and internal stakeholder meetings.
  • PowerPoint “Review This Presentation” General Availability: The “Review this presentation” skill in PowerPoint for web, Windows desktop, and Mac Copilot is now generally available. It provides slide review and improvement suggestions using Anthropic and ChatGPT models, helping users improve clarity, structure, and presentation quality before presenting or sharing.
  • Copilot Notebooks in Excel: Copilot Notebook capabilities now extend into Excel, allowing content to be generated and edited directly in spreadsheets. Support for public web links as reference sources is expanding, making Notebooks more flexible for workflows that combine spreadsheet content with external context and mixed data inputs.
  • Classic Outlook Inline Copilot Insights: Classic Outlook now supports inline Copilot insights when users highlight text. This allows users to generate quick contextual summaries without leaving the message experience, reducing friction when reviewing long email threads or dense business communication.
  • AI Meeting Recaps Without Stored Transcripts or Recordings: Copilot’s AI meeting recap scenarios now support environments where transcripts or recordings are not stored. This improves compliance posture for organizations that want AI-assisted meeting value while minimizing retained meeting artifacts and reducing the data footprint of collaboration records.
  • Learning Agent in Copilot: The new Learning Agent delivers role-based learning plans, skill assessments, and personalized training scenarios. This supports workforce enablement by tying Copilot-driven learning to roles, skills, and targeted development needs rather than generic training paths.

Automation and Task Execution

  • Copilot Cowork Long-Running Work: Copilot Cowork gained new capabilities for long-running, multi-step work across skills, integrations, and devices. This moves Copilot closer to task execution across systems rather than single-turn assistance, making governance, monitoring, and clear user expectations more important.
  • Dynamic AI Controls During Teams Meetings: Meeting organizers in Teams can toggle AI features such as Copilot, recap, and facilitator on or off during meetings. This gives organizers more control over when AI features are used during live collaboration and helps align meeting behavior with sensitivity, audience, or compliance expectations.
  • Reusable SharePoint AI Skills: SharePoint now supports reusable AI “skills” that can be created using natural language and existing content. This helps teams package repeatable knowledge workflows and make them available in a more governed collaboration environment.

Governance and Administration

  • Automatic Copilot Installation on Eligible Windows Devices: Microsoft 365 Copilot will be automatically installed on eligible Windows devices with Microsoft 365 apps unless administrators opt out. The rollout occurs in phases through early July, and there is no visible change if Copilot is already installed. Admins should inform users before the rollout and validate whether opt-out controls are needed.
  • SharePoint Copilot Rollout Controls: Admins can now control Copilot rollout within SharePoint at both the tenant and site level. This matters for governance because organizations can phase Copilot availability based on site sensitivity, readiness, data exposure risk, or business requirements.
  • Teams AI Meeting Policy Controls: Teams administrators can manage AI meeting behavior using existing policy controls, including transcription and recording settings. This helps align Copilot meeting features with compliance requirements, organizational meeting data policies, and retention expectations.

Licensing

  • Microsoft 365 Business with Copilot Plans: New Microsoft 365 Business with Copilot plans arrive July 1, bundling Copilot directly into small business subscriptions rather than requiring a separate add-on. This may simplify procurement and adoption for small and medium-sized businesses that want Copilot included in their core productivity licensing.
  • Microsoft 365 Copilot Premium Trial for SMBs: Beginning July 2026, eligible small and medium businesses can start a 30-day Microsoft 365 Copilot Premium trial without payment information. Trials are enabled by default, provide full Copilot access, generate license requests for admins, and can be managed or disabled in the Microsoft 365 admin center.

Data Access and Grounding

  • Copilot Pages to SharePoint News: Copilot Pages content can now be converted directly into SharePoint News posts. This connects AI-generated content to publishing workflows and may require governance around review, approval, publishing rights, content lifecycle, and information accuracy before broader distribution.

Quick Take: Copilot is expanding from assistance into workflow execution, meeting governance, and publishing workflows. Admins should review rollout controls, meeting policies, licensing changes, and data handling requirements before broader adoption.

Copilot Studio

Copilot Studio: Computer-Using Agents, Voice Agents, Workflows, Models, and Governance

Copilot Studio updates focus on agent automation, voice experiences, workflow design, model choice, tuning, evaluation, and governance. These updates are especially relevant for teams building business process agents, customer-facing agents, and workflow automation.

  • Computer-Using Agents General Availability: Computer-using agents are now generally available, allowing agents to operate on-screen applications the way a person would. This extends automation to legacy tools that lack APIs, but it also increases the importance of access controls, session monitoring, and testing for high-risk workflows.
  • Real-Time Voice Agents General Availability: Real-time voice agents are now generally available and support adaptive, back-and-forth voice conversations for complex customer scenarios. This can improve customer engagement workflows, but organizations should evaluate conversation recording, data capture, consent, and compliance requirements.
  • Redesigned Workflows Experience: A redesigned workflows experience makes it easier to blend AI agents with structured business process automation. Expanded Work IQ extensibility helps teams connect agents to organizational context and repeatable business processes.
  • Mistral Medium 3.5 Model Availability: Mistral Medium 3.5 joined the Copilot Studio model lineup as a strong multilingual option with in-region data storage and full admin governance. This expands model choice for organizations with language, residency, and governance requirements.
  • Frontier Tuning for Organization-Specific Agents: Frontier Tuning introduces a new way to tune agents around an organization’s workflows, internal knowledge, and compliance safeguards. This matters because agent quality and safety depend heavily on business context, approved processes, and policy constraints.
  • Expanded Agent Governance and Usage Estimator: New agent governance controls and an expanded usage estimator give IT teams clearer visibility into how agents are used across the organization. This supports operational planning, budget forecasting, and governance oversight.
  • Trace-Based Workflow Evaluation: Copilot Studio now supports trace-based evaluation of workflows, helping teams measure quality and identify failures without re-running scenarios. This improves troubleshooting and quality assurance for production agent workflows.
  • Agent Creation Consolidation: Agent creation is being consolidated into the web experience as Teams-based creation is phased out. Organizations should update enablement materials and admin guidance so makers understand where agent creation and management will happen going forward.

What to Consider: As agents gain the ability to operate applications, hold voice conversations, and execute workflows, governance must cover identity, permissions, monitoring, failure handling, and data access. Teams should validate where agent creation is moving, since Teams-based creation is being phased out in favor of the web experience.

Defender for Office 365

Defender for Office 365: Plan 1 Inclusion in Microsoft 365 E3

Defender for Office 365 is seeing a licensing change that expands access to email and collaboration security capabilities. The key update affects Microsoft 365 E3 customers.

  • Defender for Office Plan 1 Rolling Into Microsoft 365 E3: Defender for Office Plan 1 will be included in Microsoft 365 E3 on July 1, 2026. This matters because more E3 customers may gain access to security controls that help protect email and collaboration workloads, but admins should confirm policy configuration and tenant readiness rather than assuming protection automatically matches organizational requirements.

Why It Matters: Bundling Defender for Office Plan 1 into Microsoft 365 E3 can improve baseline protection for organizations that have not separately licensed it. Security teams should review existing licensing, policy coverage, and feature enablement before July 1, 2026.

Defender for Cloud

Defender for Cloud: Serverless Containers, Kubernetes Enforcement, Multicloud Runtime Visibility, and AWS RDS Billing

Defender for Cloud updates focus on container posture, Kubernetes governance, multicloud vulnerability assessment, and billing visibility. These changes affect Azure, AWS, and Google Cloud workloads.

  • Serverless Container Discovery and Posture Preview: Microsoft added preview coverage for discovery and posture management of serverless container workloads, including Azure Container Apps and Azure Container Instances. This provides more inventory visibility, misconfiguration findings, vulnerability insight, and attack path analysis for workloads that are often deployed quickly and without the same governance as traditional infrastructure.
  • Kubernetes Misconfiguration Enforcement Preview: Defender for Containers added preview support for Kubernetes misconfiguration enforcement. This helps teams move from detecting risky Kubernetes configurations after deployment toward auditing or blocking those risks during admission.
  • Runtime-Discovered Container Image Vulnerability Assessment: Microsoft expanded vulnerability assessment for runtime-discovered container images on Amazon EKS and Google Kubernetes Engine. This matters because registry scanning alone does not always show what is actually running in production.
  • Kubernetes Node Vulnerability Assessment for EKS and GKE: Microsoft is extending Kubernetes node vulnerability assessment to Amazon EKS and Google Kubernetes Engine. This gives security teams more consistent vulnerability visibility across Azure, AWS, and Google Cloud environments.
  • AWS RDS Open Source Relational Database Billing: Defender for Open Source Relational Databases on AWS RDS is now generally available, and usage for previously onboarded preview instances is expected to appear on July 2026 bills. Organizations should review onboarded instances, confirm billing expectations, and align protection coverage with budget owners.

What to Consider: The most important shift is from static inventory and registry scanning toward runtime and admission-time visibility. Security teams should validate which workloads are onboarded, where enforcement is available, and how July 2026 billing changes may affect AWS RDS protection costs.

Defender XDR

Defender XDR: Endpoint Compliance Shift and Cross-Platform Coverage Validation

Defender XDR updates this month focus on endpoint management responsibility and the practical realities of cross-platform coverage. The notes highlight iOS behavior changes and the need to validate endpoint onboarding and health across operating systems.

  • iOS OS Update Notifications Shift to Intune: Defender for Endpoint on iOS is removing in-app operating system update notifications. Responsibility for device compliance shifts fully to Intune, so organizations should validate Intune compliance policies, user notification flows, and remediation processes for iOS devices.
  • Cross-Platform Defender for Endpoint Coverage: Organizations should ensure Defender for Endpoint coverage is consistent across Windows, macOS, Linux, iOS, and Android. Actual protection depends on onboarding state, agent health, licensing, configuration, and platform support, so teams should monitor device posture rather than relying on inventory alone.

Edge for Business

Edge for Business: Browser-Based Data Protection, Contractor Controls, and Session Governance

Edge for Business updates emphasize the browser as a control point for identity, access, DLP, SaaS usage, generative AI tools, and contractor workflows. The notes position Edge as increasingly important for applying security and compliance controls directly into work sessions.

  • Browser Work Session Protection: Users access Outlook on the web, SharePoint, SaaS platforms, generative AI tools, and line-of-business applications through the browser. Edge for Business allows Microsoft customers to apply identity, Conditional Access, Intune, Defender for Cloud Apps, Purview DLP, and sensitivity label protections directly into that work session.
  • Contractor and BYOD Work Profile Controls: Edge for Business is especially relevant for contractor and bring-your-own-device scenarios. A contractor can use an Edge work profile on a non-corporate device while the organization applies controls to that work profile rather than taking full ownership of the endpoint.
  • Purview DLP Browser Controls: Purview DLP integration is becoming one of the strongest reasons to pay attention to Edge for Business. Microsoft Purview can enforce browser-based controls such as blocking or auditing sensitive text uploads, file uploads, downloads, copy, paste, print, and related data movement actions in supported scenarios.
  • Defender for Cloud Apps In-Browser Protection: Defender for Cloud Apps now plays directly into the Edge for Business story through session controls enforced with in-browser protection. This can reduce some of the friction associated with reverse proxy-based controls while still helping manage SaaS and browser-based activity.
  • Unmanaged Device and Licensing Limitations: There are important limitations for unmanaged devices because protections generally depend on users working inside the Edge for Business work profile. Some Purview browser DLP protections also have licensing, platform, and identity limitations, so organizations should validate controls against their actual contractor model.

Entra ID

Entra ID: Password Reset Registration, SAP SuccessFactors Provisioning, SCIM Modernization, and Cloud Sync

Entra ID updates focus on stronger authentication method registration, workload identity adoption, provisioning modernization, and hybrid identity sync strategy. These changes affect identity governance, SaaS provisioning, and hybrid identity architecture.

  • Explicit Authentication Method Registration for Password Reset: Entra ID password reset flows now require users to explicitly register authentication methods. This replaces reliance on directory-synced data and improves clarity around which methods users have registered for recovery and authentication workflows.
  • Workload Identity Authentication for SAP SuccessFactors Provisioning: Microsoft is introducing workload identity-based Entra ID authentication for SAP SuccessFactors provisioning. This moves provisioning away from static username and password authentication toward short-lived tokens and Entra workload identity. SAP has a November 2026 basic authentication deprecation timeline, so organizations should begin planning before the deadline approaches.
  • SCIM Provisioning Authentication Modernization: Microsoft is modernizing SCIM provisioning applications so they can use newer authentication methods such as OAuth 2.0 client credentials and workload identity federation. Existing provisioning jobs will not switch automatically, so customers need to identify, assess, and update configurations.
  • Entra Cloud Sync Positioning: Microsoft continues to position Entra Cloud Sync as the longer-term path for certain hybrid identity synchronization scenarios. Customers using Entra Connect Sync should evaluate whether their environment is simple enough for Cloud Sync or whether they rely on advanced capabilities that require deeper planning.

Exchange Online

Exchange Online: EWS Retirement and Graph-Based Access

Exchange Online updates center on the transition away from Exchange Web Services. This is a planning-critical change for applications, integrations, and workflows that still depend on EWS.

  • Exchange Web Services Transition to Microsoft Graph: Exchange Online is moving away from Exchange Web Services, with Graph-based access becoming required by October 2026. This matters because older integrations that rely on EWS may break unless they are updated, replaced, or migrated to Microsoft Graph permissions and APIs.

What to Consider: The most important shift is from static inventory and registry scanning toward runtime and admission-time visibility. Security teams should validate which workloads are onboarded, where enforcement is available, and how July 2026 billing changes may affect AWS RDS protection costs.

Fabric & Power BI

Fabric and Power BI: Visual Calculations, Copilot Summaries, Secure Outbound Access, Replication, and Real-Time Data

Fabric and Power BI updates span reporting, data preparation, outbound security, replication, Spark readiness, IoT metadata preservation, Delta table optimization, and Excel-to-Delta ingestion. These updates affect analysts, data engineers, BI developers, and platform administrators.

  • Visual Calculations and Custom Totals General Availability: Visual calculations and custom totals are now generally available. Report authors can add running sums, moving averages, and custom totals directly to a visual without creating new data model measures, which can simplify report development and reduce model complexity.
  • Copilot Summary Shortcuts in Reports: Copilot summary shortcuts now sit on the report ribbon and visual header. Viewers can get a one-click AI overview of an entire report or a single visual, improving discoverability of AI-assisted analysis.
  • Modernized Power Query Preview: A modernized Power Query experience in Power BI Desktop entered preview. The update streamlines how users connect to and shape data, improving the authoring flow for analysts and report builders.
  • New Get Data Experience Preview: A new Get Data experience in Power BI Desktop also entered preview. This simplifies the path from data source to report and can reduce friction for users connecting to enterprise and self-service data sources.
  • Outbound Access Protection for Semantic Models Preview: Outbound Access Protection extended to semantic models in preview, blocking workspace outbound traffic by default and allowing only trusted destinations. This is important for data governance because it limits where semantic model workloads can send traffic and helps reduce data exfiltration risk.
  • Fabric Copy Job Change Data Capture General Availability: Fabric’s Copy job now supports change data capture with SQL estate in general availability. This simplifies continuous data replication across clouds and supports more efficient data movement patterns.
  • Custom Live Pools Preview for Fabric Data Engineering: Custom Live Pools for Fabric Data Engineering entered preview and pre-provision ready-to-run Spark capacity. This helps data engineering teams reduce wait time for compute and improve responsiveness for Spark workloads.
  • Fabric Eventstream IoT Hub Metadata Preservation: Fabric Eventstream can now preserve IoT Hub event metadata such as device identity and ingestion time. This unlocks richer real-time analytics and smarter routing by keeping operational context attached to event streams.
  • Incremental Liquid Clustering for Delta Tables: Incremental Liquid Clustering for Delta tables shipped to deliver faster and more efficient data organization. It avoids full re-clustering runs, helping teams optimize Delta table performance with less operational overhead.
  • Shortcut Transformations Preview for Excel to Delta: A new Shortcut Transformations preview lets teams ingest Excel data directly into Delta tables without separate pipelines. This can simplify lightweight ingestion patterns while still landing data in governed lakehouse structures.

Quick Take: Microsoft is improving both the authoring experience and the governed data engineering foundation in Fabric. Security teams should pay particular attention to Outbound Access Protection for semantic models because it changes default outbound traffic assumptions.

Foundry and Azure AI

Foundry and Azure AI: Managed Networking, Fine-Tuning, Evaluation, Models, Foundry IQ, and Local AI

Foundry and Azure AI updates focus on secure agent networking, production model customization, cross-platform evaluation, model choice, local agent projects, cost attribution, content understanding, benchmarks, and enterprise knowledge grounding. These updates are relevant for AI platform teams, developers, security architects, and governance leaders.

  • Managed VNET General Availability: Managed VNET is now generally available and provides a Microsoft-managed network boundary for agent projects. This helps teams secure agent projects without designing their own network infrastructure.
  • GPT-5 Reinforcement Fine-Tuning Gated General Availability: GPT-5 Reinforcement Fine-Tuning has graduated to gated general availability with enterprise SLA coverage for production-grade model customization. This matters for organizations that need model behavior tailored to business tasks while maintaining production support expectations.
  • Trace-Based Evaluation Across Platforms: Trace-based evaluation now works for agents running on any platform, including AWS and Google Cloud. Teams can grade quality from real production activity rather than relying only on curated test sets, improving operational assessment of agent behavior.
  • Expanded Model Catalog: The model catalog added Grok 4.3 from xAI and DeepSeek V4, expanding model choice for agentic and reasoning workloads. Claude Opus 4.8 also became available in Foundry, giving developers access to Anthropic’s most capable model for coding and agentic tasks.
  • On-Device Agent Projects from Microsoft Research: Microsoft Research released three on-device agent projects through Foundry Labs. These include MagenticBrain for orchestration, Fara1.5-9B for browser tasks, and MagenticLite as a local app harness, giving teams more options for local and edge-oriented agent experimentation.
  • New In-House MAI Models: More in-house Microsoft AI models were added, including MAI-Code-1-Flash, a faster coding model now rolling out to every GitHub Copilot plan. This puts more capable and potentially lower-cost generative AI capabilities in reach of business and development teams.
  • Project-Level Cost Attribution: New project-level cost attribution shows AI spending broken down by project. This gives organizations clearer budgeting, chargeback, and cost governance visibility for AI initiatives.
  • Content Understanding General Availability: Content Understanding read and layout analyzers reached general availability, alongside a new Logic Apps connector. This can help teams extract and operationalize information from documents and content-driven workflows.
  • Foundry Local Versions 1.1 and 1.2: Foundry Local has been updated to versions 1.1 and 1.2. The updates add live audio transcription, text embeddings, multilingual speech recognition, and Linux ARM64 support.
  • Open-Source Agent Benchmarks: Two new open-source benchmarks, SocialReasoning-Bench and STATE-Bench, shipped to evaluate agent negotiation, coordination, and memory quality. These benchmarks can help teams assess agent capabilities beyond basic task completion.
  • Microsoft Foundry IQ General Availability: Microsoft Build 2026 announced that Microsoft Foundry IQ reached general availability. Foundry IQ is a unified knowledge layer inside Azure AI Foundry that automatically manages agentic retrieval and securely connects AI agents and Copilots to structured, unstructured, and remote enterprise data sources without requiring custom plumbing or complex data pipelines.

Intune

Intune: Autopatch Hotpatching, Apple Controls, Linux Support, and Identity Broker

Intune updates focus on reducing restart friction, expanding Apple device controls, supporting newer Red Hat Enterprise Linux versions, and improving Linux authentication. These changes affect endpoint administrators, compliance teams, and platform owners managing diverse device fleets.

  • Windows Autopatch Hotpatching: Windows Autopatch hotpatching updates are enabled by default for eligible devices managed through Windows Autopatch. This can reduce restart friction while keeping devices current, but customers should review eligibility, update rings, exclusions, and rollback procedures before relying on it operationally.
  • Apple Intelligence and External Intelligence Controls: Intune added new Apple management controls across iOS, iPadOS, and macOS. These include settings for Apple Intelligence, external intelligence features, writing tools, smart replies, summarization, dictation, and translation, helping organizations govern AI-assisted device features.
  • Red Hat Enterprise Linux 9 and 10 Support: Intune now supports Red Hat Enterprise Linux 9 and 10. RHEL 8 support is scheduled to end in July 2026, so organizations should plan Linux endpoint lifecycle updates.
  • Microsoft Identity Broker for Linux: The Intune app for Linux is moving to Microsoft Identity Broker. This enables newer authentication experiences such as phishing-resistant MFA, smart cards, and certificate-based authentication with Microsoft Entra ID.

OneDrive

OneDrive: Consumption-Based Storage Expansion

OneDrive updates focus on storage flexibility and administrative control over capacity growth. This affects users who exceed licensed storage limits and admins responsible for storage governance and cost control.

  • Pay-As-You-Go Additional OneDrive Storage: OneDrive is adding a new consumption-based meter for additional storage. Admins can control which OneDrive accounts are allowed to grow beyond licensed storage limits and give selected users more space as needed, helping balance user productivity with cost governance.

Quick Take: Pay-as-you-go storage can reduce friction for high-need users, but it also creates a new consumption management responsibility. Admins should define who can exceed licensed limits and how usage will be monitored.

Power Platform

Power Platform: Copilot Tools, Power Fx Types, InfoPath Migration, Controls, Desktop Flow Recovery, and Visio Export Retirement

Power Platform updates span Power Apps, Power Fx, InfoPath modernization, app controls, generative pages, Power Automate desktop, and Visio export retirement. These changes affect makers, automation teams, application owners, and modernization initiatives.

  • Custom MCP-Powered Tools and Visual Widgets in Copilot: Power Apps now supports custom MCP-powered tools and rich visual widgets inside Microsoft 365 Copilot in preview. This brings app-specific logic and interactive UI into natural language conversations, expanding how users interact with business applications.
  • Power Fx User Defined Types General Availability: Power Fx User Defined Types reached general availability. Makers can use reusable, strongly typed data structures that simplify complex formulas and JSON handling.
  • InfoPath Migration to Power Apps with AI Coding Agents: Retired InfoPath forms can now be migrated to Power Apps using AI coding agents like GitHub Copilot or Claude Code. The migration can automate conversion of controls, data connections, and rules, helping organizations modernize legacy forms more efficiently.
  • Data Grid Control Preview: A new Data Grid control entered preview. It provides a fast, searchable, and sortable view designed for high-density tabular data.
  • Grid Container Control General Availability: The Grid container control reached general availability. It adds drag-and-drop layout authoring with full undo and redo, improving app design productivity.
  • Generative Pages with Input Context: Generative pages can now accept input context, so a page can open already aware of the record a user is working with. This allows generative pages to live in more places across an app and deliver more context-aware experiences.
  • Modern Control Upgrades: Modern Button, Slider, Icon, and Dropdown controls were upgraded. The Icon control now supports OnSelect, allowing an icon to trigger actions directly.
  • Power Automate Desktop Flow Self-Healing Preview: Power Automate desktop flows gained a self-healing capability in preview that automatically detects and recovers from failures during unattended runs. This can improve reliability for unattended automation, especially where UI changes or transient failures have historically interrupted execution.
  • Visio Flow Export Retirement: Exporting Power Automate flows from Visio diagrams is being retired. Teams that relied on Visio-based flow export will need to create flows directly within Power Automate.

Purview Information Protection

Purview Information Protection: Claude Visibility, DSPM, Data Investigations, Browser DLP, and Endpoint Enforcement

Purview updates focus on AI activity visibility, unified data security posture management, sensitive data investigations, browser-based DLP, and endpoint enforcement timing. These changes are highly relevant for compliance, legal, security operations, and data protection teams.

  • Claude Enterprise Visibility Through Claude Compliance API: Purview now supports visibility into Anthropic Claude through the Claude Compliance API. This gives teams a way to review Claude Enterprise activity, conversations, and audit signals alongside other enterprise data activity.
  • Data Security Posture Management General Availability: The new Data Security Posture Management experience is generally available. It brings discovery, risk assessment, remediation, reporting, and third-party data visibility into a more unified workflow.
  • Data Security Investigations OCR and Custom Examination: Data Security Investigations added optical character recognition and custom examination capabilities. This helps teams investigate sensitive data in images, attachments, mailbox content, and user activity trails, expanding coverage beyond plain text and structured sources.
  • Purview DLP in Edge for Business: Purview DLP in Edge for Business continues to strengthen browser-based controls for sensitive uploads, downloads, copy, paste, print, protected clipboard, screen capture, unmanaged cloud apps, and shadow AI scenarios. This is important for controlling data movement in browser-based work sessions where users interact with SaaS platforms and AI tools.
  • Endpoint DLP Just-in-Time Protection: Endpoint DLP just-in-time protection is improving enforcement timing on supported Windows and macOS devices. This helps organizations apply data protection controls closer to the moment risky user activity occurs.

SharePoint Server

SharePoint Server: On-Premises Remote Code Execution Risk

SharePoint Server updates this month focus on a security vulnerability affecting on-premises deployments. The update does not affect SharePoint Online, but it is important for organizations still running SharePoint Server.

  • CVE-2026-45659 Remote Code Execution Vulnerability: CVE-2026-45659 is a remote code execution vulnerability affecting on-premises SharePoint Server. It applies to organizations running SharePoint Server Subscription Edition, SharePoint Server 2019, or SharePoint Enterprise Server 2016. SharePoint Online is not affected, so customers fully on Microsoft 365 do not need to take action for this specific vulnerability.
  • Operational Risk Around On-Premises SharePoint: The practical concern is not only the vulnerability score. On-premises SharePoint commonly connects to internal identity, legacy workflows, sensitive documents, service accounts, integrations, and business-critical collaboration data, so compromise can create broader enterprise risk.

Teams

Teams — Client Support Readiness

This core Teams update is focused on client support and device readiness. Admins should confirm macOS versions across managed and unmanaged endpoints to avoid unsupported desktop client scenarios.

  • Teams Desktop Support for macOS 13 Ended: Support for Teams desktop on macOS 13 has ended. Users must upgrade to a newer macOS version to stay supported, which may require endpoint inventory review, user communication, and coordination with device management teams.
Teams Chat & Channels — Cleaner Collaboration Workflows

Teams Chat and Channels updates are focused on improving conversation organization and making workflows easier to launch from the flow of collaboration. These changes help users reduce chat clutter while bringing SharePoint agents and app actions closer to where work happens.

  • Muted and Meeting Chat Sections: Teams is introducing new chat sections for muted and meeting chats to improve organization. This helps users manage conversation volume and separate lower-priority or meeting-related messages from other collaboration streams.
  • Slash Commands in Chat: Slash commands are now supported in Teams chat, allowing users to trigger app workflows directly from the compose box. This can reduce friction for common actions and bring app-driven workflows closer to where collaboration already happens.
  • SharePoint Agents in Teams: SharePoint agents can now be discovered and added directly within Teams chat and the Teams Store. This improves discoverability of knowledge and site-based agents inside the Teams collaboration experience.
Teams Meetings — More Control Over AI and Event Collaboration

Teams Meetings and Conferencing updates give organizers, presenters, and Copilot users more control over AI features and generated meeting content. These changes are especially important for organizations with compliance, retention, confidentiality, or structured event requirements.

  • Dynamic AI Controls in Meetings: AI features in meetings can be enabled or disabled dynamically during the session. This gives organizers more real-time control over Copilot, recap, facilitator, and related meeting capabilities based on the audience, meeting sensitivity, or collaboration need.
  • Delete AI-Generated Meeting Content: Copilot users can now delete AI-generated meeting content, including transcripts, summaries, and notes. This matters for compliance and information lifecycle management because users have more control over generated meeting artifacts that may contain sensitive discussion details.
  • Private Chat for Webinars and Town Halls: Organizers and presenters can use private chat during structured meetings such as webinars and town halls. This supports behind-the-scenes coordination without disrupting the attendee experience or public event flow.
Teams Rooms — Stronger Hybrid Meeting Experiences

Teams Rooms updates are focused on simplifying hybrid meeting participation, improving in-room and remote visibility, and expanding room display value outside of active meetings. Rooms administrators should validate device readiness, Android room capabilities, and third-party signage integrations.

  • Teams Rooms Proximity Join: Proximity join allows presenters to connect personal devices to Teams Rooms during meetings and events. This simplifies room participation and presenter workflows, especially in hybrid meetings where users need to share or control content from their own device.
  • Teams Rooms on Android Webinar Join: Teams Rooms on Android can now join webinars directly without requiring a separate device. This improves room usability for event scenarios and reduces extra setup steps for rooms teams and presenters.
  • Front-of-Room Display Improvements: Front-of-room displays are improving to better prioritize remote and in-room participants. This supports more balanced hybrid meeting experiences by helping attendees stay visible across physical and remote settings.
  • Digital Signage Expansion: Digital signage support is expanding through third-party integrations. Organizations can use Teams Rooms displays for broader communication scenarios when rooms are not actively being used for meetings.
Teams Phone — Queue Administration and AI-Assisted Call Handling

Teams Phone updates affect queue administration and AI-assisted call handling. Admins should review how queue monitoring is performed today and prepare users for Personal Assistant capabilities where Microsoft 365 Copilot and Teams Phone are both licensed.

  • Teams Phone Queue Size PowerShell Change: PowerShell will no longer return real-time queue size. Administrators are directed toward using the Queues app, which may require updates to operational reporting, help desk workflows, and queue monitoring processes.
  • Personal Assistant for Teams Phone: Microsoft 365 Copilot and Teams Phone users can use the Personal Assistant to screen and route inbound calls. This can improve call handling and reduce interruption, especially for users managing high inbound call volume.

Windows

Windows: BitLocker Mitigation Automation

Windows updates this month focus on reducing operational risk around BitLocker mitigation. The update is relevant for endpoint security, recovery planning, and device operations.

  • Updated BitLocker Mitigation Guidance: BitLocker mitigation guidance has been updated with automation options to reduce operational risk. This matters because encryption-related remediation can affect device availability, recovery procedures, and support workflows if not planned carefully.

What to Consider: BitLocker changes should be treated as security and recovery-impacting work. Teams should validate automation options, recovery key availability, endpoint readiness, and rollback plans before broad deployment.

 

Get in Touch with Us

Connect with an expert to learn what we can do for your business.

Request Access to Win Wires

Enter your work email to request access to the eGroup Win Wires repository.

By requesting access, you confirm you are using an approved business email domain. You’ll receive a secure, one-time login link after returning to the Win Wires page.