Week 39 sources
Microsoft published 3 Windows KB releases (3 optional previews). MSRC published 1 new Microsoft CVE, none rated critical. 65 roadmap changes, led by Dynamics 365 (19) and Microsoft 365 Copilot (14). CISA added 1 Microsoft CVE to its Known Exploited Vulnerabilities catalog. 49 lifecycle milestones fall in the next 30 days. 10 Azure updates, including 4 retirements. 25 Windows and security articles from Microsoft blogs.
Security to act on1
Windows releases3
Windows and security news25
- CoreDNS in AKS: service discovery, upstream DNS, and failover25 Sep
- Interim time zone guidance for Alberta, British Columbia, and Morocco25 Sep
- Announcing new builds for 25 September 202625 Sep
- Storm-3168: Agentic-driven cloud attacks using compromised service principals25 Sep
- WAF - WAF Release - 2026-09-25 - Emergency25 Sep
20 more
- Windows Deployment Services (WDS) deprecation in the next Windows Server release24 Sep
- Trust and the enticing consultancy offer24 Sep
- Cisco Identity Services Engine Authentication Bypass Vulnerabilities24 Sep
- Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments24 Sep
- What’s new in Microsoft Security: September 202624 Sep
- Edge 154.0.4258.37: Chromium security fixes24 Sep
- Giving you more control over camera, microphone, and location23 Sep
- Integrated Security Operations Center in Microsoft Defender23 Sep
- Reimagining the SOC for the agentic era in Microsoft Defender23 Sep
- Reimagining Case Management in Microsoft Defender23 Sep
- Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SSL VPN Denial of Service Vulnerability23 Sep
- GitLab Critical Patch Release: 19.0.9, 18.11.1223 Sep
- GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.723 Sep
- Security Advisory Bulletin 06922 Sep
- (Updated) The September 2026 Windows non-security preview update is now available22 Sep
- Unmasking EvilTokens: Getting to the root of device code phishing22 Sep
- The Closed Quorum: Inside the first reported autonomous AI C2 implant22 Sep
- Introducing CAIRN: Frontier tracking for AI-integrated malware22 Sep
- WAF - WAF Release - 2026-09-2222 Sep
- Beyond the Build – September 202621 Sep
Lifecycle milestones in the next 30 days49
- Retirement · 11 products: Azure API for FHIR; Azure API for FHIR Gen 1 offering; Azure Container Registry ACR 2017-03-01-(GA) API; Azure FXT Edge Filer; Azure Maps Web SDK v2 Subversion (v2.0~v2.0.32) and Service Module Retirement; Azure Virtual Desktop (Classic); Container Log V1; Get AlertSummary API; Service Bus Control plane APIS v2014-09; v2015-08; v2016-07; Single URL Ping Test in Application Insights; Track 0 and 1 Service Bus SDKs and SBMP protocol 30 Sep
- Retirement · 5 products: Azure Anomaly Detector; Azure Metrics Advisor; Azure Personalizer; Personalizer; Translator Billing Model 1 Oct
- Retirement · 10 products: Access 2021; Excel 2021; Office 2021; OneNote 2021; Outlook 2021; PowerPoint 2021; Project 2021; Publisher 2021; Visio 2021; Word 2021 13 Oct
- End of support · 16 products: Access LTSC 2021; Excel LTSC 2021; Office LTSC 2021; Office LTSC 2021 for Mac; OneNote LTSC 2021; Outlook LTSC 2021; PowerPoint LTSC 2021; Project 2021 (LTSC); Publisher LTSC 2021; Skype for Business LTSC 2021; Visio LTSC 2021; Windows 10 2016 LTSB; Windows 10 IoT Enterprise LTSB 2016; Windows Server 2012 R2, Extended Security Update Year 3; Windows Server 2012, Extended Security Update Year 3; Word LTSC 2021 13 Oct
- End of servicing · 2 products: Dynamics 365 Business Central on-premises (Modern Policy), 2025 release wave 1, version 26.x; Windows 11 Home and Pro, Version 24H2 13 Oct
- Moves to extended support · 5 products: Office LTSC 2021 for Mac; Windows Server 2022; Windows Server 2022 Datacenter: Azure Edition; Windows Server 2022 Standard (MSL); Windows Server IoT 2022 13 Oct
Product news128
- Identity and access (v1.0): 3 API change passages26 Sep
- Identity and access (v1.0): Added the device resource.26 Sep
- Identity and access (v1.0): Added the provision method to the device resource.26 Sep
34 more
- Identity and access (v1.0): Added the provisionResponse resource.26 Sep
- Identity and access (beta): 1 API change passage24 Sep
- Identity and access (beta): Added the requireCertificateSidAlignment property to the x509CertificateAuthenticationMethodConfiguration resource.24 Sep
- Files (beta): 1 API change passage23 Sep
- Files (beta): Added the isPatternToken property to the fileStorageContainerCustomPropertyValue resource.23 Sep
- Files (v1.0): 1 API change passage23 Sep
- Files (v1.0): Added the isPatternToken property to the fileStorageContainerCustomPropertyValue resource.23 Sep
- Security (beta): 7 API change passages23 Sep
- Security (beta): Added the errorAction property to the errorSettings complex type.23 Sep
- Security (beta): Added the errorSettings complex type to represent enforcement behavior when policy evaluation can't be completed.23 Sep
- Security (beta): Added the errorSettings property to the policyConfiguration complex type.23 Sep
- Security (beta): Added the isEnabled property to the errorSettings complex type.23 Sep
- Security (beta): Added the lastModifiedDateTime property to the policyConfiguration complex type.23 Sep
- Security (beta): Added the policyConfiguration complex type to represent configuration that applies to policy evaluation scenarios.23 Sep
- Security (beta): Added the policyConfiguration property to the policyScopeBase resource type to expose the effective Secure by Default configuration returned by the protection scope APIs.23 Sep
- Mailbox import and export (beta): 3 API change passages22 Sep
- Mailbox import and export (beta): Added the isHidden property to the mailboxFolder resource to identify hidden mailbox folders.22 Sep
- Mailbox import and export (beta): Added the optional includeHiddenFolders parameter to the List child folders method on the mailboxFolder resource.22 Sep
- Mailbox import and export (beta): Added the optional includeHiddenFolders parameter to the List folders method on the mailboxFolder resource.22 Sep
- Identity and access (beta): 2 API change passages21 Sep
- Identity and access (beta): Added the provision method to the device resource.21 Sep
- Identity and access (beta): Added the provisionResponse resource.21 Sep
- Files (v1.0): 3 API change passages21 Sep
- Files (v1.0): Added the isOfficeRestricted member to the fileStorageContainerTypeSettingsOverride enumeration.21 Sep
- Files (v1.0): Added the isOfficeRestricted property to the fileStorageContainerTypeRegistrationSettings resource.21 Sep
- Files (v1.0): Added the isOfficeRestricted property to the fileStorageContainerTypeSettings resource.21 Sep
- People and workplace intelligence (beta): 1 API change passage21 Sep
- People and workplace intelligence (beta): Added the relationshipLabel property to the relatedPerson resource.21 Sep
- Security (beta): 5 API change passages21 Sep
- Security (beta): Added the errorActions enumeration type.21 Sep
- Security (beta): Added the evaluationErrorCategory enumeration type.21 Sep
- Security (beta): Added the evaluationErrorDetail complex type.21 Sep
- Security (beta): Added the evaluationErrorType enumeration type.21 Sep
- Security (beta): Added the evaluationIncompleteActivityMetadata complex type to the contentActivity resource for reporting Secure by Default policy evaluations that couldn't be completed.21 Sep
- Proaction boosts sales 60% and saves 75+ hours with Codex25 Sep
- Lowe’s answers millions of home improvement questions with OpenAI25 Sep
- Fixed a bug in image encoding that degraded image understanding in GPT-6 Sol and GPT-6 Luna.25 Sep
21 more
- Wayfair boosts catalog accuracy and support speed with OpenAI25 Sep
- Two years of OpenAI Academy23 Sep
- OpenAI extends cyber access to Ukraine for civilian defense23 Sep
- Harvey turns legal context into stronger drafts with GPT-6 Astra23 Sep
- How invideo improves color grading 3x with GPT‑6 Astra23 Sep
- Ringg’s AI agents resolve up to 65% of customer calls with OpenAI23 Sep
- Sam Altman’s remarks at the United Nations Security Council23 Sep
- Introducing MentalHealthBench23 Sep
- ChatGPT Ads expands to Southeast Asia and Taiwan23 Sep
- Airbnb widens access to GPT-6 Astra and OpenAI frontier models23 Sep
- Grab and OpenAI bring practical AI skills to Southeast Asia23 Sep
- Better prompt caching for GPT-622 Sep
- Introducing GPT-6 Sol and Luna22 Sep
- Parallel cut research time and cost in half with GPT‑6 Astra22 Sep
- Priorities and principles for effective third party assessments22 Sep
- Released GPT-6 Sol (gpt-6-sol) and GPT-6 Luna (gpt-6-luna).22 Sep
- Advisory Group on Mathematics and Artificial Intelligence21 Sep
- Higgsfield AI ships new video features in a day with GPT-6 Astra21 Sep
- Building standards for the next phase of AI21 Sep
- Expanding OpenAI Academy with new learning paths21 Sep
- V7 cuts costs 78% while boosting accuracy with GPT-5.6 Luna21 Sep
- CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode25 Sep
- JNUC 2026 Day 3 Recap25 Sep
- JNUC 2026 Day 2 recap24 Sep
8 more
- JNUC 2026 Day 1 recap: powering up in Kansas City24 Sep
- Central US Certificate Issues24 Sep
- Education State of the Union: JNUC 202623 Sep
- Platform State of the Union: JNUC 202623 Sep
- Beyond model guardrails, part 2: from credentials to consequences22 Sep
- Why Device Visibility Matters for Digital Employee Experiences22 Sep
- PamStealer adapts again: a move to Swift with a server-side decryption chain21 Sep
- The hidden productivity cost of everyday technology friction21 Sep
- The Compliance API Activity Feed no longer returns file names, project document names, or artifact titles.24 Sep
- The Compliance API local session endpoints are out of beta for Claude for Microsoft 365 sessions in Excel, PowerPoint, Word, and Outlook (product_surface values beginnin…24 Sep
- We're resuming billing for refusals that arrive before any output when stop_details.category is "bio", "frontier_llm", or "reasoning_extraction", the categories where we…24 Sep
5 more
- Cache diagnostics is out of beta on the Claude API and no longer requires the cache-diagnosis-2026-04-07 beta header.23 Sep
- Fast mode (research preview) is available for Claude Opus 5.5 on the Claude API.22 Sep
- On Claude Opus 5.5, thinking can't be disabled: thinking: {"type": "disabled"} and thinking: {"type": "enabled", ...} return a 400 error.22 Sep
- Tools can now be defined inside a mid-conversation system message, in beta on the Claude API with the inline-tools-2026-09-15 beta header.22 Sep
- We've launched Claude Opus 5.5 (claude-opus-5-5), a model for long-running agentic coding and knowledge work.22 Sep
- CleanupMonster 3.1.2227 Sep
- CleanupMonster 3.1.2126 Sep
- CleanupMonster 3.1.2025 Sep
4 more
- CleanupMonster 3.1.1924 Sep
- CleanupMonster 3.1.1824 Sep
- CleanupMonster 3.1.1724 Sep
- CleanupMonster 3.1.1624 Sep
- Introducing the new Copilot: One connected experience, designed for the next phase of AI-powered work25 Sep
- Nonprofit promos to drive Copilot growth24 Sep
- Validate eligibility for CSP growth margins through APIs23 Sep
- Alternate regions for Business Continuity and Disaster Recovery are now generally available21 Sep
- Business Continuity and Disaster Recovery in Cloud PC Settings is now generally available21 Sep
- Developer Configuration with pre-installed Microsoft 365 Apps is generally available21 Sep
2 more
- Introducing Gemini 3.8 Live with Live Avatar24 Sep
- A new wave of Connected Apps is rolling out to Gemini.23 Sep
- Gemini 3.8 text-to-speech says hello23 Sep
- AG-UI Protocol now has a first-class .NET SDK25 Sep
- Microsoft is updating its author-signing certificate starting September 23, 202623 Sep
- Creating a memory dump in C#22 Sep
- Catalyst: Frontier stories of AI Infrastructure innovation23 Sep
- Expanding access to specialized GPU infrastructure through Dapple and Azure22 Sep
- Cloudflare’s 2026 Annual Founders’ Letter27 Sep
- Agents can now set up your website’s security with Turnstile Spin25 Sep
- Work IQ: Business and workplace intelligence in the flow of work25 Sep
- Build the future of agentic ERP with new Microsoft Dynamics 365 capabilities23 Sep
- Released: September 2026 Exchange Server Security Updates24 Sep
- Introducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement22 Sep
- Microsoft Intune and Apple OS 27: New settings, support, and platform changes24 Sep
- Stage app and policy rollout with deployment plans21 Sep
- Microsoft Entra Connect 2.6.92.023 Sep
- Prepare your tenant estate for AI: Join our upcoming webinars21 Sep
- Simplify Site Governance with Self-Service Ownership Transfer in Power Pages27 Sep
- Modern List in Power Pages is now generally available23 Sep
- Mailozaurr 3.0.224 Sep
- PSWriteOffice 3.0.827 Sep
Azure updates10
- [In preview] Public Preview: Azure HorizonDB supports PostgreSQL 1825 Sep
- Retirement: Azure Communication Services (ACS) standalone services will be retired on September 30, 202824 Sep
- [Launched] Generally Available: Instant Access for VM restore points24 Sep
- Retirement: Support for PowerShell 7.4 ends on November 10, 202623 Sep
- Retirement: Support for .NET 8 and .NET 9 ends on November 10, 2026—upgrade your apps to .NET 1023 Sep
5 more
- Retirement: Support for Node.js 22 ends on April 30, 202722 Sep
- [In preview] Public Preview: Flex Nodes for AKS22 Sep
- [Launched] Generally Available: Azure Sphere OS version 26.09 is now available21 Sep
- [In preview] Public Preview: Introducing a Guided Copilot Experience for Building Azure Apps in VS Code21 Sep
- [Launched] Generally Available: Azure Functions support for PowerShell 7.621 Sep
From the community41
- Entra 🆔 News #168 → This week in Microsoft Entra27 Sep
- What’s in the Microsoft Enterprise App Catalog? Finding Out with PowerShell and Microsoft Graph27 Sep
- Faster Win32 App Delivery in Intune with Push Notifications27 Sep
- Faster Required App Delivery After Autopilot26 Sep
- First Ring Daily: Super Pilot26 Sep
36 more
- Graph API adds (limited) support for onPremisesExtensionAttributes for group objects26 Sep
- Patch My PC Publisher Preview Version 3.1.0.462 Released25 Sep
- Flying Friday: the one where I’m pissed off25 Sep
- slmgr.vbs replacement in PowerShell using the OSLicense module25 Sep
- Where to store your Microsoft 365 passkey?25 Sep
- The Growing Trust Problem in AI-Powered IT Recruitment25 Sep
- Microsoft Copilot App Gets Home, Code, and Autopilot Features to Expand Automation25 Sep
- Intune Newsletter – 25th September 202625 Sep
- A bit of reorganization25 Sep
- Microsoft Cancels the Microsoft 365 Companion Apps25 Sep
- Entra ID telephony providers for SMS and voice MFA: first look25 Sep
- Report on items shared with Everyone or Everyone Except External Users in SharePoint Online25 Sep
- September 23, 2026 Apple Update24 Sep
- Microsoft Adds User-Initiated Provisioning to Windows 365 Reserve Cloud PCs24 Sep
- How Unsupported Devices Can Bypass Microsoft Entra Conditional Access Policies24 Sep
- SharePoint Flaw Shows How Attackers Can Chain Small Weaknesses into Bigger Breaches24 Sep
- When was the start of the security industry?24 Sep
- How to Use Separate Apps to Control Access to the Microsoft Graph PowerShell SDK24 Sep
- Microsoft Bets on Local AI Processing with New Surface Devices23 Sep
- AI-Powered Attacks are Exposing the Limits of Fragmented Security Operations23 Sep
- The hits for September just keep on coming23 Sep
- New Apple Business verification methods23 Sep
- Microsoft Draws Hard Line for OneDrive Storage Quotas23 Sep
- Organizations Still Relying on SMS MFA Face a Forced Move to Passkeys22 Sep
- Organizations Face a Growing Gap Between Cyber Risks and Security Resources22 Sep
- How Easy is It to Restore Microsoft 365 Tenants After a Catastrophic Attack22 Sep
- MS-DEFCON 2: Guiding you in for a landing22 Sep
- How to track browser extension installations with Microsoft Defender21 Sep
- Making sure the multi-app kiosk configuration is applied after the installation of the applications21 Sep
- Intune App Inventory From Four Hours to About Five Minutes21 Sep
- Fix High CPU Usage Caused by .NET Runtime Optimization Service21 Sep
- Pope Leo on AI and the Internet21 Sep
- To err is human … and we’d like to keep it that way21 Sep
- Protect your money from the coming ‘bitcoin apocalypse’21 Sep
- Not all passkeys are created equally21 Sep
- How to Access Teams Meeting Transcripts with the Microsoft Graph21 Sep
Microsoft 365 roadmap65
- Dynamics 365 Field Service: Expand your service offering through subcontractors without the onboarding overhead25 Sep
- Dynamics 365 Field Service: Support multiple payers across Work Order lines25 Sep
- Dynamics 365 Field Service: Support multiple warehouse assignments for field technicians25 Sep
16 more
- Dynamics 365 Field Service: Close out bookings and work orders from subcontractor service reports24 Sep
- Dynamics 365 Field Service: Create and apply reusable maintenance plans to assets24 Sep
- Dynamics 365 Field Service: Enhanced visibility into work order financial performance24 Sep
- Dynamics 365 Field Service: Onboard mid-lifecycle assets into maintenance plans24 Sep
- Dynamics 365 Field Service: Process subcontractor photos, completion documents, and inspection results24 Sep
- Dynamics 365 Field Service: Review and visualize an asset's maintenance schedules24 Sep
- Dynamics 365 Field Service: Forecast asset usage to predict maintenance due dates23 Sep
- Dynamics 365 Field Service: Forecast planned maintenance demand23 Sep
- Dynamics 365 Field Service: Optimize asset maintenance schedules using completed service23 Sep
- Dynamics 365 Field Service: Plan asset maintenance using time, actual usage, and service sequences23 Sep
- Dynamics 365 Field Service: Choose how work order services flow into project financials22 Sep
- Dynamics 365 Project Operations: Transaction Journals22 Sep
- Dynamics 365 Customer Service: Detailed quality evaluation score breakdown21 Sep
- Dynamics 365 Customer Service: Inactivate quality evaluation records21 Sep
- Dynamics 365 Customer Service: Quality evaluation supports knowledge source in criteria21 Sep
- Dynamics 365 Customer Service: Support Not Applicable answer option for quality evaluation criteria21 Sep
- Microsoft Copilot (Microsoft 365): Copilot Chat in Outlook expands to reason over inbox, calendar, and enterprise data25 Sep
- Microsoft Copilot (Microsoft 365): Copilot in SharePoint25 Sep
- Microsoft Copilot (Microsoft 365): Planner capabilities in Copilot chat (M365 Copilot)25 Sep
11 more
- Microsoft Edge: Ground Microsoft 365 Copilot Chat in Edge for Business in your open OneDrive and SharePoint documents25 Sep
- OneNote: Multimodal capture in Copilot Notebooks (Windows)24 Sep
- Microsoft Copilot (Microsoft 365): Local inferencing23 Sep
- Microsoft Copilot (Microsoft 365): Reference files saved in SharePoint libraries and OneDrive folders when creating a presentation with Agent Mode in PowerPoint23 Sep
- PowerPoint: Skills in Brand Kit23 Sep
- Microsoft Copilot (Microsoft 365): Ask Copilot about highlighted response content22 Sep
- Microsoft Copilot (Microsoft 365): Attach and reference an image when creating a presentation with Copilot in PowerPoint using Agent Mode.22 Sep
- Microsoft Copilot (Microsoft 365): Attach and reference an image when creating a presentation with Copilot in PowerPoint using Agent Mode.22 Sep
- Microsoft Copilot (Microsoft 365): Federated Copilot Connectors will support write, update and delete actions22 Sep
- Microsoft Copilot (Microsoft 365): Work IQ APIs: Pay‑As‑You‑Go usage21 Sep
- Microsoft Copilot (Microsoft 365): [Copilot Extensibility] Users in DoD will be able to use custom engine agents21 Sep
- Microsoft Teams: Enhanced IntelliFrame with AI data channel for intelligent cameras25 Sep
- Microsoft Teams: New sharing panel in meetings - improved content discovery and ease of sharing25 Sep
- Microsoft Teams: Proximity join support for attendees in Teams events from Teams Rooms on Windows and Android25 Sep
11 more
- Microsoft Teams: AI-powered notes for in-person meetings with Facilitator in Teams Rooms on Android24 Sep
- Microsoft Teams: Schedule Channel Meetings from Outlook Calendar24 Sep
- Microsoft Teams: Schedule Teams Channel Meeting from Win3224 Sep
- Microsoft Teams: Additional health signals available for Teams Rooms on Android on Pro Management Portal23 Sep
- Built‑in AI Interpreter for Calls on Teams Phone Devices22 Sep
- Microsoft Teams: Analytics for desk utilization on Teams Pro Management portal22 Sep
- Microsoft Teams: Improved copy and paste support for @mentions and shared contacts22 Sep
- Microsoft Teams: Upgraded call history in Teams Calls app22 Sep
- Microsoft Teams: Events in Meet app in Teams in GCC High and DoD21 Sep
- Microsoft Teams: Report a Security Concern in Meetings21 Sep
- Microsoft Teams: Teams Admin Center - Single pane for monitoring & troubleshooting for meetings and calls across the organisation21 Sep
- Microsoft Purview compliance portal: Information Protection - MIP auto-labeling for Azure SQL & Storage24 Sep
- Microsoft Purview: Data Security Investigations – analyze files tied to endpoint DLP alerts24 Sep
- Microsoft Purview: DSPM-Copilot Readiness and Data Explorer24 Sep
5 more
- Microsoft Purview: Information Protection-Auto-labeling per-policy coverage report23 Sep
- Microsoft Purview: Data Lifecycle Management - Ensure regulatory compliance by deleting inactive OneDrives and mailboxes for departing employees21 Sep
- Microsoft Purview: Data Lifecycle Management - Insights and policy recommendations on sensitive M365 data for better Data Security and Compliance posture21 Sep
- Microsoft Purview: Data Loss Prevention– Unmanaged cloud app discovery and protection with Microsoft Purview and the Island Enterprise Browser21 Sep
- Microsoft Purview: eDiscovery - In-product diagnostics to troubleshoot common challenges21 Sep
7 more products · 10 changes
- Microsoft Viva: Viva Engage: New left navigation controls — collapse, resize, increased favorites cap, and reorder favorites capabilities23 Sep
- Microsoft Viva: Ability for leaders to publish Power BI reports21 Sep
- Microsoft Viva: Fresh Copilot Metrics in Custom Person Queries & Reports- Viva Advanced Analysis21 Sep
- SharePoint: Create charts on pages with AI21 Sep
- SharePoint: eSignature for Microsoft 365 - Recipient groups21 Sep
- Outlook: Insert Symbol24 Sep
Every line opens its detail page or the original Microsoft source. This briefing uses public sources only and says nothing about your tenant or devices.