Microsoft 365 September 2026 Updates: What UK Businesses Need to Know

What Changed in Microsoft 365 in September 2026?

September 2026 was a busy month on Microsoft’s roadmap. Several changes are aimed squarely at security, from blurring suspicious QR codes in Teams to tighter controls on Outlook attachments.

There are also two deadlines worth diarising, a new way of paying for extra OneDrive storage and a significant change to how Copilot is billed.

We’ve gone through Microsoft’s roadmap and pulled out what matters for UK businesses, grouped by the product it affects.

The Key Microsoft 365 Changes at a Glance

• Teams will blur QR code images sent by external users, to help stop phishing
• Outlook attachments now follow your Conditional Access policies
• The standalone Microsoft Whiteboard apps retire on 16 October 2026
• OneDrive is getting a pay-as-you-go option for extra storage
• Entra ID’s MemberOf rule must be replaced by 3 November 2026
• New Microsoft 365 Copilot Business licences bought through a CSP will include usage-based billing by default from 2 November 2026
• Secure Score adds four new device security recommendations

Who Should Read This?

Anyone who runs or manages Microsoft 365 for a business. If you don’t have time to track Microsoft’s monthly changes, our Office 365 consultants in London do it for our clients. You can also see the full range of our Microsoft services for London businesses.

Microsoft Teams: Fewer Interruptions, Safer Messages

Teams gets a mix of productivity and security updates this time.

Can You Pause Teams Notifications?

Yes, from October. Users will be able to pause all Teams notifications for a set period, without changing their normal notification settings.

It’s a simple way to focus during deep work or a presentation. The rollout starts in early October and should finish by late October 2026.

Are QR Codes in Teams Messages Safe?

Not always. QR code phishing, sometimes called “quishing”, hides a malicious link inside an image so it slips past normal link scanning.

From mid-October 2026, Teams will blur images containing QR codes when they come from external users. People can still choose to reveal the image, but they have to make a deliberate decision first.

It’s worth reminding staff what this means, so they don’t simply click to reveal out of habit. For a wider view, read Is Microsoft Teams Secure?

Personal Reminders for Messages

Users will be able to turn a chat or channel message into a personal reminder. This should help stop important follow-ups getting lost in busy chats. It rolls out during October 2026.

Meeting Lobby and Transcript Changes

• Lobby visibility: who can see the meeting lobby will now match who can admit people from it. This rolled out from early September and should finish by early October 2026.
• Report a meeting: participants can report suspicious or fraudulent activity directly from a meeting. Admins can review these reports in the Teams admin centre.
• Profanity filtering: admins will get a policy to control whether profanity is masked in live and saved transcripts, from mid-October 2026.

Automating Responses from SharePoint List Forms

A new Workflows trigger runs automatically when someone submits a form built on a SharePoint list. For example, you could post each new request into a Teams channel. This rolls out from late September to late October 2026.

If you’d like help putting features like this to work, see our Microsoft Teams solutions for business in London.

Outlook and Exchange: Better Control Over Meetings and Mail

Outlook gains a long-requested meeting feature and a useful security change.

Can You Change the Organiser of an Outlook Meeting?

Yes, in stages. Users can ask a colleague to take over as organiser of a meeting or recurring series. The colleague must accept before ownership moves.

Phase 1 covers meetings without a Teams link, rolling out from late September to late October 2026. Teams meetings follow in later phases, which Microsoft hasn’t dated yet.

This is particularly handy when someone leaves the business or changes role and owns a lot of recurring meetings.

Do Outlook Attachments Now Follow Conditional Access?

Yes, and this is available now. If a user doesn’t meet your Conditional Access policies, they won’t be able to download, preview or upload classic attachments, including inline images.

That closes a gap where attachments could be reached from devices or locations your policies would normally block. Check your policies so legitimate users aren’t caught out, especially for staff working away from the office. Our remote work cybersecurity checklist for UK businesses covers the wider picture.

Bigger Email Archives for Some Licences

Auto-expanding archives are increasing from 1.5 TB to 3 TB for eligible mailboxes. This mainly applies to E5, A5 and G5 licences and the Purview suites. It rolls out from mid-October to late October 2026.

OneDrive, SharePoint and Microsoft 365 Apps

There’s a retirement to plan for, plus some welcome storage and collaboration changes.

What Happens to Microsoft Whiteboard After 16 October 2026?

The standalone Whiteboard apps for Windows, iOS and Android will no longer be supported from 16 October 2026. Whiteboard itself isn’t going away.

Staff should use Whiteboard through Microsoft Teams or the web instead. If people have pinned the standalone app, now is a good time to tell them where to find it.

How Much Does Extra OneDrive Storage Cost?

Microsoft is adding a pay-as-you-go option for extra OneDrive storage, priced at $0.20 per GB per month. UK pricing may differ, so check your own billing.

Admins choose which accounts can go over their licensed storage limit. That gives you flexibility without letting storage costs run unchecked. It rolls out from early November to early December 2026.

If storage is a recurring headache, our cloud storage for business in London can help you plan it properly.

Archiving Inactive SharePoint Files

Organisations will be able to move inactive SharePoint content to Microsoft 365 Archive while keeping it under retention policies. That can cut storage costs.

Archived content is also excluded from Copilot, which can make Copilot’s answers more relevant by focusing on current files. This rolls out from early October to early November 2026.

Other App Changes

• PDF comments: in OneDrive and SharePoint, you can attach comments to a specific spot or selected text in a PDF, with replies and @mentions. Rolls out from mid-October to mid-November 2026.
• OneDrive on Mac: sync is increasing from 300,000 to 1 million items per device, from early October to early November 2026.

Microsoft Entra: Identity Changes and a November Deadline

One of this month’s Entra changes needs action before November.

What Is the Entra MemberOf Deadline?

Microsoft is ending the public preview of the MemberOf rule in Entra ID dynamic groups. If you use it in dynamic groups, dynamic administrative units or entitlement management auto-assignment, you must replace it by 3 November 2026.

Microsoft says it can affect dynamic membership processing across a tenant and isn’t recommended for production use. Most small businesses won’t use it, but it’s worth checking.

Passwordless Sign-In for Teams Room Devices

Shared Teams devices, such as meeting room systems, can now sign in with a secure, device-bound credential instead of a stored username and password. This is generally available now.

It’s another step away from passwords. Our guide to passkeys for business explains the wider shift.

Other Entra Previews

• Cloud Sync to on-premises: Entra Cloud Sync can now provision users and groups from the cloud into on-premises Active Directory, in public preview.
• MCP firewall: Global Secure Access adds a firewall to control traffic between AI agents and the external services they connect to, in public preview.

Microsoft Intune: Planning Ahead

Intune has one change that needs action, although not immediately.

Does the Intune Health Attestation Change Affect You?

It might. Intune is moving Windows health attestation checks from the Device Health Attestation service to Microsoft Azure Attestation, by the end of Q1 2027.

If your network blocks the new Azure Attestation addresses, compliance checks that rely on health attestation may fail. Check your firewall rules well before the deadline.

Staged Rollouts for Apps and Policies

New deployment plans let admins roll out apps and policies in rings, moving from one group to the next on a schedule. This is in public preview. It reduces the risk of a bad change hitting everyone at once.

Microsoft Copilot: New Features and Billing Changes

Copilot had the most updates this month, and some affect what you pay.

Is Microsoft 365 Copilot Moving to Usage-Based Billing?

For new licences, yes. From 2 November 2026, new Microsoft 365 Copilot Business licences bought through a Cloud Solution Provider will include usage-based billing by default.

Pay-as-you-go becomes the default, so features such as Copilot Cowork can be used with less setup. It also means costs can grow with usage, so spending controls matter more than before. For background, see Microsoft Announces Copilot Monthly Payments Plan for Businesses.

How Can You Control Copilot Spending?

Microsoft’s September Copilot Cost Management update adds several tools:

• Email alerts when users approach their spending limits
• Spending policies that automatically cover new Copilot services and agents (on by default)
• Spending history that follows users when they move between policies
• Better consumption reports, now visible to more read-only admin roles
• Custom approval routes for Cowork credit requests

If you use Copilot, set threshold alerts now rather than waiting for a surprise bill.

Is Grok Now Part of Copilot?

For some customers. Microsoft added SpaceXAI as a Copilot subprocessor, enabling Grok models in Word, Excel and PowerPoint for eligible Frontier customers from 18 September 2026.

Frontier is Microsoft’s early access programme, so most businesses won’t see this yet. If you are in it, check whether a new subprocessor affects your data protection records.

Other Copilot Updates

• Build apps with Copilot: Copilot Studio and Copilot Cowork can now turn a plain-English request into a working first draft of an app
• Brand control in PowerPoint: Strict Mode can force Copilot to use only approved templates and layouts, and brand managers can share presentation instructions across the organisation
• Browser use controls: admins can enable Copilot Cowork’s browser use for specific users or groups rather than the whole tenant
• Connector actions: Copilot connectors to third-party services will be able to create, update and delete content, not just read it, from October 2026
• PDF help on iPhone: select text in a PDF in OneDrive for iOS and ask Copilot to explain, summarise or translate it

Connectors that can change data in other systems are powerful but need careful permissions. Our secure generative AI for business service covers how to roll out Copilot safely, and our Microsoft Copilot for London businesses page explains our approach.

Security and Admin: New Secure Score Recommendations

Microsoft Defender gets changes that help you strengthen devices and manage alerts.

What Are the New Secure Score Recommendations?

Microsoft has added four recommendations in Defender for Endpoint to check device readiness for AI-accelerated threats. They flag Windows devices without:

• Trusted Platform Module (TPM) 2.0
• Virtualisation-based Security (VBS)
• Hypervisor-Protected Code Integrity (HVCI), also known as Memory Integrity
• Windows Local Administrator Password Solution (LAPS)

These are sensible basics. If your devices are flagged, plan to enable them, and replace any hardware that can’t support them.

Fewer DLP Alerts in Defender XDR

From 12 October 2026, Microsoft Purview data loss prevention alerts will be treated as behaviours by default in Defender XDR. That reduces alert volume, while keeping the data available for investigation.

If your team relies on DLP alerts appearing in the incident queue, you can switch this off.

An Integrated Security Operations Centre in Defender

A public preview, from 23 September 2026, brings XDR, SIEM, threat intelligence and automation together in Microsoft Defender for eligible Defender Suite, E5 and E7 customers. If you’re weighing up the higher licences, read Microsoft 365 E7 licence explained.

Tools only help if someone acts on what they find. Our MDR services in London provide round-the-clock monitoring and response.

What Should You Do This Month?

Here’s a short action list for most UK businesses on Microsoft 365.

Your Microsoft 365 Checklist for October and November

1. Tell staff about blurred QR codes in Teams, and why they shouldn’t reveal them without thinking
2. Point Whiteboard users to Teams or the web before 16 October 2026
3. Check your Conditional Access policies now that they apply to Outlook attachments
4. Replace any Entra MemberOf rules before 3 November 2026
5. Set Copilot spending alerts before usage-based billing becomes the default
6. Review the new Secure Score device recommendations
7. Confirm your firewall allows the new Azure Attestation addresses before Q1 2027

Do You Need an IT Partner to Keep Up?

Not necessarily, but it helps. Microsoft releases dozens of changes every month, and only a few need action.

Our managed IT services in London include tracking these changes and acting on the ones that matter. If you missed last month’s round-up, read Microsoft 365 August 2026 Updates: What UK Businesses Need to Know.

To talk through any of these changes, call us on 0204 511 9111, email hello@speedster-it.com or get in touch.

Louise

With over 15 years at Speedster IT, I’ve built a career around helping businesses navigate the evolving world of technology. I publish all the content for the IT Support London Blog and Cyber Security Blog, where I share practical insights on infrastructure upgrades, cybersecurity trends, and smart IT strategies for growing companies.