Changes in Microsoft 365, AI and security that need an admin to do something. Each brief has the date, who is affected, what to check and the primary source.
On 21 October 2026 attackers published a malicious LiteLLM 1.107.0 to PyPI and to the project's Docker images. The payload ran every time Python started, even when LiteLLM was never imported, and sent cloud, AI and developer credentials to a lookalike domain. The release was pulled within hours. Any environment that installed it stays compromised until it is cleaned and its secrets are rotated.
From early November 2026, Microsoft Entra self-service password reset (SSPR) only accepts methods a user registered. The mobile number, office phone and alternate email that sit in the directory stop counting. Microsoft says act by 6 November.
Microsoft will let people attach files in Teams chats with users from other organisations, and it will be on by default. Tenants that haven't explicitly turned the setting off get it. There is no rollout date yet, but Microsoft asks admins to set their choice by the first week of November 2026.
On 12 November 2026 Copilot Studio ends support for several AI models and moves the agents that use them to a replacement model automatically. Nobody has to press a button, which is exactly why it needs a test: the agent keeps its instructions and tools, but the model that reads them changes.
Users who only have a password will be able to register a passkey as their first multifactor authentication method in Microsoft Entra ID. Until now they first had to register another MFA method, such as SMS or voice. Users who are enabled for passkeys will be prompted to register one by default.