Microsoft 365 October 2026 Updates: What UK Businesses Need to Know

What Changed in Microsoft 365 in October 2026?

October 2026 brought a big batch of changes to Microsoft’s roadmap. Much of it is about security and AI.

Teams is getting better phishing protection. Entra ID changes who can create AI agents by default. And the way businesses test new features early is being replaced.

We’ve read through Microsoft’s roadmap and pulled out what matters for UK businesses, grouped by product.

The Key Microsoft 365 Changes at a Glance

• Teams adds AI-driven phishing detection in chats and lets users report suspicious guest invitations
• Admins can now edit the list of file types blocked in Teams
• Teams Phone Agent, an AI call-answering assistant, becomes generally available
• Outlook users can send email from any of their aliases
• Targeted Release retires in January 2027 and is replaced by Frontier, Standard and Deferred release
• From 4 November 2026, standard users can create AI agent blueprints unless an admin turns this off
• Copilot gains Projects, Skills and a new coding experience, plus usage-based billing for newer AI models
• Microsoft Defender can now discover AI agents and MCP servers running on Windows and Mac devices

Who Should Read This?

Anyone who runs or manages Microsoft 365 for a business. If you don’t have time to track Microsoft’s monthly changes, our Office 365 consultants in London do it for our clients. You can also see the full range of our Microsoft services in London.

Microsoft Teams: Stronger Phishing Protection

Most of this month’s Teams updates are about stopping attackers who use chat to reach your staff.

Can Teams Detect Phishing Messages?

Yes, from December. Teams will use AI to spot phishing, social engineering and impersonation in messages. It looks at the context of a conversation, not just the links in it. Our guide to the 12 types of social engineering attacks shows the tricks it’s designed to catch.

The rollout runs from early to mid-December 2026.

This matters because attackers increasingly use Teams, not email. A common trick is posing as your IT helpdesk. Our guide to fake IT support on Microsoft Teams explains how that scam works.

Can You Report a Suspicious Guest Invitation in Teams?

Yes. Users will be able to report a guest invitation they don’t trust, directly from Teams. This rolls out from early to mid-November 2026.

Tell your staff the option exists. A report button only helps if people know to use it.

Can You Choose Which File Types Teams Blocks?

Yes. Microsoft’s Weaponizable File Protection blocks file types that are often used to deliver malware. Admins can now edit that list, or keep Microsoft’s recommended default.

This arrives from early to mid-November 2026. For most businesses, the default is a sensible starting point. Only add exceptions you genuinely need.

File Sharing in Chats With External Organisations

The attach button and drag-and-drop will be switched on by default in chats with people from other organisations. Microsoft hasn’t given a date yet.

Before it lands, check your external access and sharing settings are what you expect. For a wider view, read Is Microsoft Teams Secure?

Better Meetings: Two Presenters and Side Chats

• Two presenters at once: two people can share their screens at the same time. This rolls out from late November to mid-December 2026.
• Side conversations: attendees can start a private one-to-one or small group chat from the meeting chat. This follows in January 2027.

What Is Teams Phone Agent?

Teams Phone Agent is an AI assistant that answers incoming calls. It can handle supported questions and book appointments. When a caller needs a person, it passes the call on with AI-written notes.

It becomes generally available from early to mid-November 2026. Check the licensing before you plan around it.

Voicemail Emails Are Changing

Voicemail notification emails will show the caller’s details in the subject line instead of the From field. Organisations will also be able to send them from their own domain.

This starts by early March 2027 and completes by late June 2027. If you have mail rules or filters that sort voicemails by sender, they may need updating.

If you’d like help with Teams calling, see our cloud phone system in London or our Microsoft Teams solutions for business.

Outlook and Exchange: Small Changes That Save Time

Three practical updates for anyone who lives in their inbox.

Can You Send Email From an Alias in Microsoft 365?

Yes. Sending from any of a mailbox’s aliases is now generally available in Exchange Online. It suits people who handle mail for several roles, such as sales and accounts.

It isn’t on automatically. An admin has to enable it, either in PowerShell or the Exchange admin centre.

Can Outlook Rules Reply With a Template?

Yes, from December. Inbox rules will be able to send an automatic reply using a saved template. This works in the new Outlook for Windows and Outlook on the web, rolling out from early to late December 2026.

Is There a Unified Inbox in the New Outlook?

Yes. The All Accounts view shows email from several accounts in one list, without merging the mailboxes. It’s rolling out in the new Outlook for Windows and should finish by late November 2026.

Microsoft 365 Apps: Targeted Release Is Retiring

This is the change most IT teams need to plan for.

What Is Replacing Targeted Release?

Targeted Release lets selected users get new features before everyone else. Microsoft is retiring it in January 2027. Changes to Targeted Release enrolment are disabled from November 2026.

It’s being replaced by three options:

• Frontier: the earliest access, including preview features
• Standard release: features arrive when they are generally available
• Deferred release: features arrive later than Standard, giving more time to prepare

All three are managed from one place in the Microsoft 365 admin centre.

Do You Need to Do Anything About Targeted Release?

Probably. Microsoft won’t move your Targeted Release users into Frontier automatically.

If you use Targeted Release as an early warning group, decide which of the new options replaces it before January. If you don’t use it, there’s nothing to do.

Microsoft Entra: Identity and AI Agent Changes

Entra has two changes that alter default settings, so they are worth checking straight away.

Who Can Create AI Agents in Microsoft 365?

From 4 November 2026, standard users can create agent blueprints by default. An admin can turn this off with the “Users can create agent blueprints” setting in Entra user settings.

Decide whether this fits your business before it takes effect. Unmanaged AI agents are a growing form of shadow IT. Our shadow IT and shadow AI security services help businesses get on top of this. To understand the risk first, read Detect the Unknown: Shadow AI & Shadow IT.

What Happens to Inactive AI Agents?

A new default lifecycle policy for Entra Agent ID is in public preview. It flags agent identities that haven’t been used, notifies the relevant people, and disables the identity if nothing changes.

It’s a sensible clean-up. Just make sure the right people receive the notifications.

Conditional Access Policy Plans

Policy plans group related Conditional Access rules, so shared targeting and exclusions are set up once. This makes policies easier to manage and less likely to drift. It’s in public preview.

Other Entra Updates

• Choose your own telephony provider: from 30 October 2026, organisations can use a supported third-party provider for text and voice call sign-in codes.
• Microsoft Authenticator: a refreshed home screen and clearer steps for restoring accounts, rolling out through October and November 2026.

Text and voice codes remain weaker than app-based or passwordless sign-in. Our article on passkeys for business explains the stronger options.

Microsoft Copilot: Projects, Skills and New Billing

Copilot had the most updates this month. Several are aimed at people who use it every day.

What Are Projects in Copilot?

Projects group related chats, tasks, files and context in one place. It makes longer pieces of work easier to pick up again. It’s rolling out to Frontier users from late October to mid-November 2026.

What Are Skills in Copilot Chat?

Skills are reusable, task-specific instructions. Users can use them, and admins can deploy them across the business. They work in Copilot Chat and Cowork, and rollout runs until mid-November 2026.

PowerPoint is also getting “Record a Skill”, which turns a set of actions you perform into a reusable skill. A new option can also create interactive slides from a prompt or existing content.

What Is Copilot Code?

Copilot Code turns plain-English ideas into simple trackers, dashboards and apps, using your work data. It’s rolling out to Frontier users from late October 2026.

Anything built this way can reach company data, so treat it like any other app. Decide who can build, and who checks what gets shared.

Is Copilot Billing Changing Again?

Yes. Some newer AI models in the Copilot model selector, in Copilot Chat, Word, Excel and PowerPoint, will use usage-based billing. This rolls out from early to mid-November 2026.

New Microsoft Graph tools also let admins set credit spending policies, monitor balances and handle credit requests. These are in beta.

If you’re using Copilot, set spending limits before costs creep up. Our Microsoft Copilot for London businesses page explains how we help.

Other Copilot Updates

• Enhanced memory: Copilot will use more of your Microsoft 365 data to personalise its answers, rolling out until the end of November 2026.
• Cowork plugins: new Sales, Service, Education and Legal plugins with ready-made workflows are now generally available.
• Copilot for Legal: partner-built plugins for legal research, document management, e-signature and e-discovery are rolling out.

Microsoft Defender and Purview: Seeing AI on Your Devices

Two security changes stand out for admins.

Can Microsoft Defender Find AI Agents on Your Devices?

Yes. Defender can now discover AI agents and MCP servers running locally on Windows and Mac devices. It covers more than 50 of them and is generally available.

MCP servers let AI tools connect to other systems and data. Knowing which ones staff are running is a good first step to controlling them. For the wider risks, read 10 AI security risks every London business should know.

Why Are You Seeing Fewer DLP Alerts?

From 12 October 2026, Purview data loss prevention alerts appear in Defender XDR as behaviours instead of alerts by default. This cuts alert noise. The data is still available in Advanced Hunting and Purview.

If you rely on DLP alerts to trigger action, check this hasn’t hidden anything you need. Admins can switch it back in the rule settings.

Integrated Security Operations Centre in Defender

An integrated security operations centre experience is in public preview. It’s for eligible Defender Suite, Microsoft 365 E5 and E7 customers.

What Should UK Businesses Do Now?

You don’t need to act on everything. These are the changes worth looking at first.

• Decide whether standard users should create AI agent blueprints before 4 November 2026
• Choose a replacement for Targeted Release before January 2027
• Tell staff about Teams phishing detection and the guest invitation report option
• Review your external Teams sharing settings before attachments are turned on in external chats
• Set Copilot spending limits if you use Copilot
• Check whether the DLP alert change affects your security processes
• Plan ahead for the voicemail email change in 2027

Several of these changes affect identity and security defaults. If you hold Cyber Essentials, review them as part of your normal controls. Our guide to the Cyber Essentials changes every UK business needs to know explains the current rules. Our article on Microsoft 365 security mistakes we see in London SMEs covers the most common gaps.

Missed last month? Read our Microsoft 365 September 2026 updates.

Need Help Keeping Up With Microsoft 365?

Microsoft releases changes every month, and some of them change your security settings without asking. Speedster IT tracks the roadmap for our clients and makes the changes that matter.

To talk to our team, call 0204 511 9111, email hello@speedster-it.com or get in touch online.

Louise

With over 15 years at Speedster IT, I’ve built a career around helping businesses navigate the evolving world of technology. I publish all the content for the IT Support London Blog and Cyber Security Blog, where I share practical insights on infrastructure upgrades, cybersecurity trends, and smart IT strategies for growing companies.