Microsoft Purview Insider Risk Management is adding granular control over which AI applications are used to detect Generative AI indicators, allowing organizations to precisely target monitoring across specific tools. Admins can now select which AI apps are evaluated for indicators such as entering risky prompts in Copilot, receiving sensitive responses from enterprise AI apps, and related signals — reducing noise and improving the accuracy of insider risk detection as AI usage expands across the organization. Built with privacy by design, users remain pseudonymized by default with role-based access controls and audit logs in place. The feature is currently in development and expected to begin rolling out in June 2026.

Microsoft Purview Insider Risk Management is expanding its integration with Microsoft Defender XDR, surfacing IRM alerts directly in the unified alert and incident queue alongside signals from Defender for Endpoint, Defender for Cloud Apps, and other solutions. Analysts will also gain access to IRM indicators and enriched events through advanced hunting using KQL queries, enabling deeper investigation of potentially hidden risky patterns in user activity. Additional exposure through the Graph API further extends the ability to correlate and act on insider risk data across the security stack. The feature can be enabled through the “Share data with Microsoft Defender XDR” setting in Insider Risk Management and is currently in development with an expected rollout beginning in June 2026.

Microsoft Teams is expanding Meeting Notes availability to instant meetings started via “Meet Now” from the calendar. Powered by Loop, Meeting Notes allow participants to co-create agendas, capture decisions, and track action items in real time — with changes staying in sync across every location where the notes have been shared. Notes can also be accessed and edited in the Loop app in a web browser, keeping teams aligned on outcomes well after the meeting ends. This feature is currently rolling out and expected to complete in April 2026.

Microsoft is updating external sharing in OneDrive and SharePoint to use Microsoft Entra B2B for invitation and authentication, replacing the legacy SharePoint One Time Passcode (OTP) experience. With this change, external users will be added as guest accounts in the organization’s directory, enabling more consistent identity management and stronger control over external access. By aligning external sharing with Microsoft Entra standards, organizations gain improved visibility, governance, and security over how external users interact with shared content. The feature is currently in development and expected to begin rolling out in April 2026.

Microsoft Purview is introducing a new Endpoint Data Loss Prevention Device Status API, enabling organizations to access device-level health and onboarding data programmatically. Previously limited to manual exports, this information can now be integrated directly into dashboards, reporting tools, and automated workflows. This update allows security and compliance teams to monitor endpoint DLP posture at scale, reduce manual effort, and streamline reporting across environments. The feature is currently in development and expected to begin rolling out in April 2026.

Microsoft Purview is expanding Endpoint Data Loss Prevention capabilities to support classification of Office files protected with Azure Rights Management Services (Azure RMS) on Windows devices. With this update, Endpoint DLP will be able to classify RMS-protected documents when they are used in applications or when just-in-time classification is enabled. This enhancement improves visibility into protected content and helps organizations apply data protection policies more effectively, ensuring that sensitive information remains governed even when files already have RMS protection applied. The feature is currently in development and expected to begin rolling out in April 2026.

A new agents usage report is coming to the Microsoft 365 admin center, giving administrators deeper visibility into how agents are being used across Microsoft 365 Copilot and Copilot Chat. The report will track both licensed and unlicensed user activity, including total active agents, active users, and usage patterns across different agent types—such as user-created agents, organization-built agents, and those developed by Microsoft or partners. Admins will also be able to review usage details by user, agent, and user-agent pair, providing clearer insight into how agents are being adopted and used across the organization. The feature is currently in development with a planned release in March 2026.

Microsoft Teams is introducing simplified controls for managing external collaboration through a new overview page in the Teams Admin Center. Administrators can review and modify their organization’s external collaboration configuration using a guided workflow that supports open, controlled, or fully customized collaboration modes. By consolidating these settings into a single experience, Microsoft is making it easier for IT teams to balance external collaboration with organizational security and governance requirements. The update is rolling out beginning February 2026 for Commercial and GCC environments.

Microsoft Teams is introducing the ability to create and manage custom templates for immersive events directly within the Teams Meet app. Event organizers can design immersive experiences, save them as reusable templates, and store them in collections for future use. Templates can be shared with co-owners and members, enabling consistent, repeatable event experiences across teams and departments. This update expands Teams’ immersive collaboration capabilities and supports more structured virtual engagement scenarios. The feature is rolling out beginning February 2026 for worldwide standard multi-tenant environments.

Microsoft Teams is introducing a new admin policy setting that allows tenant administrators to generate 8-digit numeric-only passcodes for meetings organized by selected users or groups. Because numeric-only passcodes may increase the risk of unauthorized access, the setting includes a warning and requires explicit confirmation before it can be enabled. This update gives organizations more flexibility in meeting configuration while reinforcing awareness of the associated security tradeoffs. The feature is currently in development and is expected to roll out beginning March 2026 across Commercial, GCC, GCC High, and DoD environments.