What changed in your Microsoft 365 tenant without you pressing save?

From 1 September, users enabled for SMS or voice are automatically enabled for passkeys in the Entra Authentication Methods Policy. Microsoft also moves the Registration Campaign to its Microsoft-managed state for those users.

The next time an affected user signs in and completes MFA, Microsoft can ask them to register a passkey. The prompt allows unlimited snoozes for now, so this is not an immediate sign-in block. It is the start of the migration.

Microsoft plans to retire its own SMS and voice delivery on 1 February 2027. A user who still relies on one of those methods will need a passkey or another supported method before then. Organisations that still need SMS or voice will be able to choose a telecom provider through the Microsoft Security Store.

Microsoft rolled its managed state for system-preferred authentication through tenants during August. The managed state can now choose the strongest registered method for both the first and second authentication step.

A person with a passkey and password may now see the passkey first. They can still choose another allowed method. Conditional Access and Authentication Strengths still decide which methods are accepted for the resource.

Check Entra ID, Authentication methods, Settings, then System-preferred authentication. Microsoft managed applies the ranking to both authentication steps. Enabled applies it to the second step only. Disabled keeps the earlier sign-in order.

Microsoft creates some Conditional Access policies directly in eligible tenants. They begin in report-only, but Microsoft can turn them on after at least 30 days if an administrator leaves them there. Microsoft says it gives two weeks notice through email and the Microsoft 365 Message center.

Open Conditional Access and check the Created by column for Microsoft. Review the policy impact, sign-in results and exclusions before choosing whether to turn each policy on or off. Make sure the two break-glass accounts are excluded where a policy could block emergency access.

The licence depends on the policy. Standard Conditional Access needs Entra ID P1, which is included in Microsoft 365 Business Premium. Policies using user or sign-in risk need P2.

Microsoft began changing how Conditional Access handles baseline scopes on 15 June. The change affects an All resources policy with a resource exclusion. It only applies when an application requests basic sign-in or directory permissions.

Before the change, those basic scopes could fall outside enforcement when the policy contained a resource exclusion. They can now receive the same MFA or device-compliance challenge as other access. Microsoft is rolling the change through all tenants over several weeks.

Most businesses will never need to name each scope. The practical check is whether an excluded application has started receiving a Conditional Access challenge. Review the All resources policies with exclusions, then check the sign-in logs for the application. If it cannot handle the challenge, confirm whether the exclusion is still needed before retaining the earlier behaviour.

From 1 September, Microsoft Defender for Endpoint no longer offers a separate Automated Investigation and Response screen. Administrators also cannot trigger one manually. Automatic detection and response remains inside the normal Defender for Endpoint protection stack.

For an on-demand endpoint investigation, Microsoft now directs administrators to run a full antivirus scan. This change only applies to Defender for Endpoint. Defender for Office 365 automated investigations remain available.

This only affects businesses that synchronise an on-premises Active Directory through Microsoft Entra Connect Sync. Microsoft says every sync service below version 2.5.79.0 will stop working on 30 September 2026.

Check the version on the Entra Connect server now and upgrade it before the deadline. Microsoft recommends moving to the latest release because it includes current security fixes. Test the upgrade and confirm that users, groups and password changes still synchronise afterwards.

Microsoft Cloud Sync is not part of this deadline. If you are unsure which service you use, check the Microsoft Entra admin centre before changing the server.

Microsoft published its CaptiveCrunch investigation on 31 July. The campaign manipulated traffic on shared networks used by hotels and other venues. Some travellers were redirected into device-code phishing and fake update prompts.

In the device-code path, the victim opened a legitimate Microsoft sign-in page and entered a code supplied by the attacker. The page was real. The code connected the successful sign-in back to the attacker. Microsoft observed the campaign leading to Entra device registration and Microsoft 365 data collection.

The direct control is to block device-code flow unless a documented device or application needs it. Microsoft now includes a block-device-code-flow policy in its managed Conditional Access set. Staff should also know that a real Microsoft page does not make an unexpected code safe to enter.

We would use the hour to record the live state before changing anything. This gives you a list of affected users and policies before the change becomes a support call.