Skip to content

Email & collaboration this week: 16 changes (6 November 2026)

Sixteen confirmed Exchange, Outlook, Teams and Defender for Office 365 changes from the week to 6 November 2026, each with who acts, the check and the source. The nearest date is today: Microsoft's rollout of cross-tenant Calendar Sharing through Cross-Tenant Access Policy is due to complete on 6 November.

This is our weekly Email & collaboration roundup. We re-read the primary source for every item on 6 November 2026, except the Planner Agent post (MC1539002), where we rely on our notes from 5 November.

Already briefed

  1. Project usage report retires on 4 December 2026; export the data before 20 November. Microsoft 365 admins who keep Project usage data. Brief: Project usage report retirement. Source: MC1539001.
  2. Exchange Server 2016 and 2019 get no more security updates after October 2026. Anyone still running them, including hybrid management servers. Brief: Exchange 2016/2019 ESU end. Source: KB5128896.
  3. Outlook adds .msix to the default blocked attachment types, rolling out to mid-November. Exchange Online admins with custom OwaMailboxPolicy settings. Brief: Outlook blocks .msix attachments. Source: MC1488841.
  4. The month's dated Microsoft 365 admin changes in one list. Brief: Microsoft 365 changes in November 2026.

New this week

MC1446796: cross-tenant Calendar Sharing moves to Cross-Tenant Access Policy by 6 November 2026

Exchange Online is moving cross-tenant Free/Busy, MailTips and Calendar Sharing off EWS organization relationships and onto Microsoft 365 Cross-Tenant Access Policy (XTAP). Microsoft expects to complete the rollout "by September 15, 2026 for Free/Busy, Mailtips and November 6, 2026 (previously October 30) for Calendar Sharing". "Exchange Web Services (EWS) deprecation begins October 1, 2026", and temporary EWS access lasts "until the final EWS shutdown on April 1, 2027." If you do nothing, partner organisations may stop seeing your tenant's "Free/Busy, MailTips, or shared calendars." The post was last updated on 30 October 2026 and says "Gov rollout of this feature is paused at this time."

  • Who acts: Exchange Online admins with organization relationships or sharing policies to other Microsoft 365 tenants. The post's Act by date (1 October 2026) has already passed.
  • Check: in Exchange Online PowerShell, Get-OrganizationRelationship | Format-List Name, DomainNames, Enabled, FreeBusyAccessEnabled, FreeBusyAccessLevel, FreeBusyAccessScope, MailTipsAccessEnabled, MailTipsAccessLevel, MailTipsAccessScope and Get-SharingPolicy | Format-List Name, Domains, Enabled, Default. Any enabled relationship to a Microsoft 365 partner needs moving to XTAP using Microsoft's migration guide.
  • Source: MC1446796. Guide: Migrating to Microsoft 365 Cross-Tenant Access Policy for sharing Free/Busy, Calendars, and MailTips. Related: Exchange Online Protection Kit.

Exchange Server October 2026 security update (13 October): the last one for 2016 and 2019

Microsoft's October 2026 security updates cover Exchange SE RTM, Exchange 2019 CU14 and CU15, and Exchange 2016 CU23. For 2016 and 2019 you "must be enrolled into the Period 2 ESU program". Microsoft says "October 2026 is the last month when customers who enrolled in the Period 2 Extended Security Update (ESU) program are eligible", and from now "Updates will be released for Exchange Subscription Edition (SE) only." The update also fixes two issues: published calendars (.ics) returning HTTP 500 (KB5126672) and a ContentEngine deadlock from missing Korean WordBreaker rule files (KB5130098). The Exchange 2019 CU15 KB lists CVE-2026-70571 among the fixes. The post was published on 13 October and updated on 16 October.

Also logged

  • MC1530613, Teams meeting impersonation protection: GA from mid-December to late December 2026. Teams shows warnings and risk indicators when it detects a possible impersonation attempt in a meeting. "No immediate admin action is required"; tell the helpdesk and the SOC what users will see. MC1530613.
  • MC1532241, Defender XDR advanced hunting for Teams calls and meetings: GA "Beginning in early November 2026 and expected to complete by mid-November 2026". It adds the CallActivityEvents table, which joins to MessageEvents on ThreadId. "This capability is available to organizations with Microsoft Defender for Office 365 Plan 2." Check: Defender portal > Advanced hunting, run CallActivityEvents | take 10 once the table appears. MC1532241.
  • MC1536045, Defender URBAC: "Emails associated with alerts" now covers URL-click alerts, "Available now". Analysts with the "Email & collaboration content: Emails associated with alerts" permission can now preview and download emails tied to potentially malicious URL-click alerts too. Check who holds it in Defender portal > System > Permissions > Microsoft Defender XDR > Roles. MC1536045. Related: Defender RBAC auto-enable.
  • MC1536056, Teams Facilitator Protection skill: "Beginning in late January 2027 and expected to complete by mid-February 2027". In meetings with external people, it scans the transcript for attempts to get users to reveal sensitive information and offers to end the meeting or limit sharing. "No action is required to enable the Protection skill." MC1536056.
  • MC1509801, Teams Weaponizable File Protection custom extensions: GA "Beginning in early December 2026" (previously early November), complete by mid-December 2026 (previously mid-November). Tenants that have the protection on keep the Microsoft-recommended list by default. Admins can add or remove extensions, or reset to that list. MC1509801.
  • MC1470410, Teams QR code protection for external messages: GA "expected to complete by end of November 2026 (previously late October)". "Images containing QR codes sent by external users will be blurred by default in Teams messages." Users can reveal the image. "No administrator configuration or policy changes are required"; brief the helpdesk. MC1470410.
  • MC1459141, Teams policy to block identified external meeting bots: GA completes by "end of November 2026 (previously late October)". "Default state: Off." It is a new option in the "Manage bots" meeting protection settings in the Teams admin center, assigned through meeting policies. Pilot it with one group first. MC1459141.
  • MC1539002, Copilot Chat Planner Agent: the post carries "Act by Dec 4, 2026" but no required action. The changes are "enabled by default for users with access to Planner Agent". Not re-read today. MC1539002.
  • MC1245222, new Outlook for Windows local file sharing: worldwide rollout now "mid-January 2027" (previously early November 2026), complete by mid-February 2027 (previously early December 2026). Users can attach locally stored Word, Excel and PowerPoint files in the new Outlook for Windows. The feature is on by default, and "No admin action is required"; existing Outlook and Exchange policies still apply. MC1245222.
  • Update, MC1530615, Teams report guest invitations: GA begins "mid-November 2026 (previously early November)". Setting: Teams admin center > Messaging policies > Report a security concern. MC1530615.

Related guides: Exchange Online SMTP AUTH basic auth checklist · EOP preset policies and DMARC.

More: all Email & collaboration news · Microsoft 365 security deadlines.

Last reviewed: 6 November 2026. Runbook Lab is not affiliated with Microsoft.