Weekly GCC Microsoft 365 Roadmap Updates

Microsoft is adding admin-controlled expiration policies for “Anyone” and “People in your organization” sharing links in OneDrive and SharePoint. Administrators can require expiration dates and enforce a maximum access duration, with separate settings for each service. When access expires, the link itself remains and direct permissions are preserved — only the broad sharing access is revoked.

Microsoft Purview Insider Risk Management is adding the ability to classify alerts as True Positive, Benign (Operational), or False Positive. Analysts with appropriate permissions can select from predefined classification reasons on any alert, replacing the existing dismissal reasons workflow. The capability supports compliance reporting and policy tuning for GCC, GCC High, and DoD environments.

Insider Risk Management is extending its detection coverage to Microsoft Fabric, with ready-to-use risk indicators built around Power BI activity. Organizations can incorporate these indicators into data theft and data leaks policies — bringing the same pseudonymized, privacy-by-design IRM framework to the analytics layer. Available for GCC, GCC High, and DoD environments.

Microsoft Teams is introducing phishing detection in messaging, identifying and flagging suspicious messages that attempt to deceive users into revealing credentials or clicking malicious links — directly within the Teams chat experience. As Teams becomes a primary communication channel across GCC organizations, it has also become an increasingly targeted vector for social engineering attacks. This update brings the same category of threat detection already applied to email into the Teams messaging layer, giving organizations a frontline defense against phishing without relying solely on user awareness. For GCC environments where security posture is a compliance requirement, this update adds a concrete enforcement layer to the messaging platform. The feature is currently in development and expected to begin rolling out in November 2026.

Microsoft Purview Endpoint Data Loss Prevention is expanding to monitor and protect sensitive data transferred from managed endpoints over FTP and SFTP, closing a gap where file transfer protocols operated outside DLP policy coverage. Organizations can now detect and prevent unauthorized movement of sensitive content through these channels — extending the same visibility and enforcement already in place for email, SharePoint, and OneDrive to a transfer pathway commonly used for large file movement and legacy system integrations. For GCC organizations where endpoint data protection is a compliance requirement, this update brings FTP and SFTP transfers under centralized Purview governance. The feature is currently rolling out for GCC environments.