Microsoft Roadmap, messagecenter en blogs updates van 17-08-2024

Updated August 15, 2024: We have updated the rollout timeline below. Thank you for your patience.

We’re making two changes to posts in Viva Engage:

Changes to question post type

• Viva Engage is updating its questions to include two parts: a required field for the main question and an optional larger field for extra details. This change will enhance the clarity and readability of the question title, making it easier to scan and read. Additionally, the optional larger field allows users to provide additional context and details. 

New formatting capability: code snippets

• Users will be able to add code snippets to their posts, discussions, replies, questions, polls, and praises on Viva Engage. Additionally, if customers are licensed for Answers in Viva Engage, this feature will also be available when asking questions on Answers. To add code snippets, locate the new button on the publisher command bar.

This message is associated with Microsoft 365 Roadmap ID 376700 and 378778

[When this will happen:]

Worldwide: We will begin rolling out early March 2024 and expect to complete by late September 2024 (previously late July). 

[How this will affect your organization:]

Community admins will retain the ability to convert question posts to discussion posts and vice versa. When thread starters change their post from a discussion to a question, they must also fill in the required question field to finalize this change.

[What you need to do to prepare:]

You may consider updating your training and documentation as appropriate.

Updated August 15, 2024: We have updated the rollout timeline below. Thank you for your patience.

We will be gradually retiring the “Investigation priority score increase” policy support from Microsoft Defender for Cloud Apps between June and July 2024.

After careful analysis and consideration, we have decided to deprecate it due to the high rate of false positives associated with this alert, which we found was not contributing effectively to the overall security of your organization. Our research indicated that this feature was not adding significant value and was not aligned with our strategic focus on delivering high-quality, reliable security solutions. We are committed to continuously improving our services and ensuring that they meet your needs and expectations.

[When this will happen:]

We will begin rolling this out in late June 2024 (previously early June) and expect to complete by late September 2024 (previously late July).

[How this will affect your organization:]

SOC administrators and analysts will no longer be able to access, manage and use “Investigation priority score increase” alerts in “Microsoft Defender for Cloud Apps”, when this change is implemented.

[What you need to do to prepare:]

If this policy type is used in your organization and is needed, we recommend using the Advanced Hunting query in the resource linked below.

Please use the following resources for additional information:

•  Tutorial: Investigate risky users

Updated August 15, 2024: We have updated the rollout timeline below. Thank you for your patience.

We will be gradually retiring the “Cloud Discovery anomaly detection” policy support from Microsoft Defender for Cloud Apps between June and July 2024.

After careful analysis and consideration, we have decided to retire it due to the high rate of false positives associated with this alert, which we found was not contributing effectively to the overall security of your organization. Our research indicated that this feature was not adding significant value and was not aligned with our strategic focus on delivering high-quality, reliable security solutions. We are committed to continuously improving our services and ensuring that they meet your needs and expectations.

[When this will happen:]

We will begin rolling this out in late June 2024 (previously early June) and expect to complete by late September 2024 (previously late July).

[How this will affect your organization:]

SOC administrators and analysts will no longer be able to access, manage and use “Cloud Discovery anomaly detection policy” alerts in “Microsoft Defender for Cloud Apps“, when this change is implemented.

[What you need to do to prepare:]

If this policy type is used in your organization and is needed, we recommend using “App discovery policy” and create dedicated policies, under “Trigger a policy match if all the following occur on the same day” set the filters accordingly.

Please use the following resources for additional information:

•  Cloud Discovery anomaly detection policy

 Updated August 15, 2024: We have updated the rollout timeline below. Thank you for your patience.

Through Microsoft Purview | Information Protection, and for greater consistency and reliability, Microsoft Word, Excel, and PowerPoint for Windows will soon display the same Data Loss Prevention policy tips that admins have set in their tenants for files on Microsoft SharePoint Online and Microsoft OneDrive sites.

This message is associated with Microsoft 365 Roadmap ID 383018.

[When this will happen:]

Public Preview: We will begin rolling out early June 2024 and expect to complete by mid-June 2024.

General Availability (Worldwide): We will begin rolling out mid-July 2024 and expect to complete by mid-September 2024 (previously late July).

[How this will affect your organization:]

DLP policy tips will no longer be shown when a user is offline.

[What you need to do to prepare:]

This rollout will happen automatically by the specified date with no admin action required before the rollout. You may want to update any relevant documentation as appropriate

We will update this comm before rollout with revised documentation.

You can access the Information Protection solution in the Microsoft Purview compliance portal.

Updated August 15, 2024: We have updated the rollout timeline below. Thank you for your patience.. 

Coming soon to Microsoft Defender XDR: We will enhance email remediation capabilities with new Sender’s copy clean-up features in Threat Explorer, email entity, Summary Panel, and Advanced hunting. These new features will streamline the process of managing Sent items, particularly for admins who use Soft delete and Move to inbox actions.

Key Features

• Integration with Soft delete: Sender’s copy clean-up will be incorporated as part of the Soft delete action.
• Wide support: This action will be supported across various Defender XDR platforms including Threat Explorer, Take Action wizard from the email entity, Summary Panel, Advanced hunting, and through Microsoft Graph API.
• Undo capability: An undo action will be available, allowing you to reverse the clean-up by moving items back to the Sent folder.

Note: Sender’s copy clean-up will apply to intra-organization emails and outbound emails, ensuring that only the sender’s copy is soft deleted for these emails and inbound messages are out of scope.

[When this will happen:]

General Availability (Worldwide): We will begin rolling out end of May 2024 and expect to complete by early September 2024 (previously late July).

[How this will affect your organization:]

Before this rollout, admins did not have a way to remove harmful emails from a sender’s Sent items.

After rollout: This step-by-step scenario explains the functionality of Sender’s copy clean-up:

You as the admin have already investigated in Threat Explorer, email entity, or Advanced hunting and have selected entities to remediate.

1. Create remediation: After your entity selection, you choose an action and create the remediation. For the Soft delete action, these items will be visible in the Take action wizard:

• Checkbox for Sender’s copy. Select this option to clean the messages from sender’s Sent folder.
• Email count: Displays the number of emails submitted. This count will reflect sender’s copy as well.
• Sender’s entities in a separate tab.

2. As the remediation begins, the approval ID to track the action is displayed (Note: This is the same as before the rollout.)

3. Track the remediation status: The Unified Action Center (Actions & submissions > Action center > History) contains all the approved actions. You can open any manual remediation action entry in Action center to:

• View the email count: This count will be same as submitted email count.
• Review the action logs: The email count and action logs will reflect the status of remediable, non-remediable, failed, and timed-out emails, including the sender’s copy.
• Export action logs: The export feature will include the new column IsSendersCopy to capture the sender entities and corresponding action status.

4. Undo sent items. The undo capability ensures that you have greater control and flexibility when managing email remediation, providing a safety net for actions taken in error or needing revision. Select the checkbox for Move to Inbox to trigger undo for the recipient copy and previously deleted sender’s copy of a message.

From Advanced hunting: The Delete sender’s copy option under Delete email > Soft delete:

From Threat Explorer: The Delete sender’s copy option under Move to mailbox folder > Soft delete:

From Threat Explorer: The Undo sender’s copy option under Move to mailbox folder > Inbox:

[What you need to do to prepare:]

This rollout will happen automatically by the specified date with no admin action required before the rollout. You may want to notify your admins about this change and update any relevant documentation as appropriate.

Learn more:

• Threat hunting in Threat Explorer and Real-time detections – Microsoft Defender for Office 365 | Microsoft Learn
• Threat Explorer- Threat hunting in Threat Explorer and Real-time detections – Microsoft Defender for Office 365 | Microsoft Learn
• Remediation- Remediate malicious email that was delivered in Office 365 – Microsoft Defender for Office 365 | Microsoft Learn
• Advanced hunting-Take action on advanced hunting query results in Microsoft Defender XDR – Microsoft Defender XDR | Microsoft Learn
• MDO What’s new- What’s new in Microsoft Defender for Office 365 – Microsoft Defender for Office 365 | Microsoft Learn
• XDR what’s new – What’s new in Microsoft Defender XDR – Microsoft Defender XDR | Microsoft Learn

Updated August 15, 2024: We have updated the rollout timeline below. Thank you for your patience.

In Microsoft Teams, users will be able to add their own custom emojis and reactions by uploading an image or GIF file, and their emojis and reactions will be accessible to all users in the tenant alongside the standard Teams emojis and reactions. Up to 5,000 custom emojis can be added per tenant.

This message is associated with Microsoft 365 Roadmap ID 80659.

[When this will happen:]

Targeted Release: We will begin rolling out early July 2024 (previously late June) and expect to complete by mid-July 2024 (previously early July).

Worldwide: We will begin rolling out early August 2024 (previously mid-July) and expect to complete by early September 2024 (previously late July).

GCC: We will begin rolling out late September 2024 (previously mid-July) and expect to complete by early October 2024 (previously late July).

GCC High: We will begin rolling out early October 2024 (previously early August) and expect to complete by mid-October 2024 (previously late August).

DoD: We will begin rolling out mid-October 2024 (previously early August) and expect to complete by late October 2024 (previously late August).

[How this will affect your organization:]

This new custom emojis and reactions feature will be turned on by default. Users in the tenant will be able to upload emojis that are visible to the whole tenant. You can pre-emptively turn this feature off or restrict users who can create new emojis via the Teams Admin Center controls described below.

How do I use this feature?

Custom emojis and reactions will be found in the emoji and reaction menus in the Custom category. Users with upload abilities can add new content through the plus (+) button. Users with delete abilities can right-click any custom emoji to delete. Please note that deleted emojis may take up to 24 hours to reflect for all users in the tenant. Deleted emojis may take up to 24 hours to reflect for other users.

How do I manage this feature?

This feature can be managed through the Teams Admin Center. Admins will have access to the following controls:

• Turn the feature on/off for the whole tenant via the Messaging Settings page (on by default).
• Set which users can create new emojis via the Messaging Policy groups (on for all users by default).
• Set which users can delete emojis via the Messaging Policy groups (off for all users except admins by default).

The Teams Admin Center controls will be made available in early June. We recommend adjusting your settings as needed prior to the Targeted and Worldwide Releases in late June 2024 to ensure that they are in place when the feature rolls out.

[What you need to do to prepare:]

This feature is on by default. If you would like to turn the feature off, please use the provided setting in the Messaging Settings page:

Messaging Settings

This feature allows all users to create new emojis by default and only allows admins to delete emojis by default. If you would like to adjust emoji creation and deletion permissions, please make the appropriate changes through the Messaging Policy groups:

Emoji Creation Setting (enabled for all users by default)

Emoji Deletion Setting (only enabled for admins by default)

Additional feature capabilities:

View custom emojis in the emoji menu

Press the plus (+) menu to select an image to upload

Set a name for your emoji

Right-click on an emoji to delete or to see the creator

Updated August 16, 2024: We have updated the rollout timeline below. Thank you for your patience

Note: If your organization does not support iOS, you can safely ignore this message.

Currently, when viewing a Microsoft Outlook email, users can access the available actions in the top-right corner of the screen. We are updating these actions to be in a bar at the bottom of the screen, and users will now have the ability to customize the order and placement of the actions.

Additionally, users will now be able to access these actions from their Inbox view by long-pressing a message.

This message is associated with Microsoft 365 Roadmap ID 398983.

[When this will happen:]

General Availability: We will begin rolling out in early July 2024 and will finish rolling out by late August 2024 (previously late July).

[How this will affect your organization:]

The functionality of conversation actions will remain the same. With this update, we are specifically changing the position of the actions, adding the ability to customize, and making actions available in the Inbox view on long-press.

Because these actions will now be at the bottom of the screen when viewing a message, the tab bar to switch between mail, calendar, and so on will no longer be available when reading a message. To get to the tab bar, a user simply has to go back to the Inbox view.

[What you need to do to prepare:]

This rollout will happen automatically. You may want to notify your users about this change and update any relevant documentation as appropriate.

Updated August 15, 2024: We have updated the rollout timeline below. Thank you for your patience.

We’re making a change to the shared folder experience in Microsoft OneDrive. Currently, when a user opens a shared folder in OneDrive, they are taken to a view of that folder within the sharer’s OneDrive. In the new experience, opening a shared folder will take the user to the shared folder within the People view of their own OneDrive. This view, organized by people, shows and allows access to all the files and folders that have been shared with the user.

This message is associated with Microsoft 365 Roadmap ID 395378.

[When this will happen:]

General Availability (Worldwide, GCC): We will begin rolling out late July 2024 and expect to complete by mid-September 2024 (previously late August).

[How this will affect your organization:]

With this feature update, opening a shared folder will take the user to the shared folder within the People view of their own OneDrive, as follows.

[What you need to do to prepare:]

This rollout will happen automatically with no admin action required. You may want to notify your users about this change and update any relevant documentation as appropriate.

Updated August 15, 2024: We have updated the rollout timeline below. Thank you for your patience.

License admins and User admins will be able to manage license requests in the Microsoft 365 admin center. Currently, only Global admins can manage license requests. This change drives consistency with other Microsoft Entra portals in which these roles can assign licenses, such as the Microsoft Entra admin center, Intune admin center, and Azure Portal. Otherwise, no changes have been made to these roles’ permissions. 

[When this will happen:]

General availability (Worldwide): Rollout for this change will start in mid-July 2024 and is expected to be complete by late August 2024 (previously late July).

[How this will affect your organization:]

Once available License admins and User admins will be able to manage license requests in the Microsoft 365 admin center. 

[What you can do to prepare:]

License administrators and user administrators should familiarize themselves with the licensing process available at Manage self-service license requests in the Microsoft 365 admin center | Microsoft Learn

Resources:

About admin roles in the Microsoft 365 admin center – Microsoft 365 admin | Microsoft Learn

Updated August 15, 2024: We have updated the rollout timeline below. Thank you for your patience.

Using a Microsoft SharePoint organization asset library as a tenant-based brand asset source, Microsoft Copilot for Microsoft 365 in Microsoft PowerPoint and Microsoft Word is now able to search and download brand-approved images, logos, icons, and illustrations directly from the chat experience. This new feature enables an on-brand Copilot for Microsoft 365 experience and provides a new creative content source beyond the licensed stock images already available today.

This message is associated with Microsoft 365 Roadmap ID 406170.

[When this will happen:] 

General Availability (Worldwide): We will begin rolling out late August 2024 (previously mid-August) and expect to complete by late September 2024 (previously early September).

[How this will affect your organization:]

To use this feature in Copilot for Microsoft 365, tenants can either use existing SharePoint image-based organization asset libraries or create new ones. Tenant admins will need to use a new cmdlet in the management shell to identify the targeted organization asset library and provide consent for Copilot for Microsoft 365 to search from the library. 

[What you need to do to prepare:]

In advance, tenant admins should proactively reach out to their brand team to identify brand content for use in Copilot for Microsoft 365. This content and associated metadata will need to be migrated to the identified organization asset library. Content should include associated image tags and metadata in order for Copilot for Microsoft 365 to provide accurate and relevant search results. If your tenant is already using organization asset libraries with approved content already present, the only admin action will be running the new cmdlet in the management shell that sets the drive ID.

To learn more about Microsoft’s own review of this product with its works councils, please consider reading: https://aka.ms/Copilot/MSWorksCouncilsArticle. 

As mentioned in MC803005, later this year, we expect iOS 18 and iPadOS 18 to be released by Apple. Microsoft Intune, including the Intune Company Portal and Intune app protection policies (APP, also known as MAM), will require iOS/iPadOS 16 and higher shortly after the iOS/iPadOS 18 release. 

[How this will affect your organization:]

If you are managing iOS/iPadOS devices, you might have devices that will not be able to upgrade to the minimum supported version (iOS 16/iPadOS 16). Provided that Microsoft 365 mobile apps are supported on iOS 16/iPadOS 16 and higher, this may not affect you; you have likely already upgraded your OS or devices.

See the following Apple documentation for devices to check which devices support iOS 16 or iPadOS 16 (if applicable):

• Supported iPhone models
• Supported iPad models

For instructions on how to check in the Microsoft Intune admin center which devices or users may be affected, read below. 

Note: Userless iOS and iPadOS devices enrolled through Automated Device Enrollment (ADE) have a slightly nuanced support statement due to their shared usage. The minimum supported OS version will change to iOS 16/iPadOS 16 while the allowed OS version will change to iOS 13/iPadOS 13 and later. For more details, see https://aka.ms/ADE_userless_support.

[What you need to do to prepare:]

Check your Intune reporting to see what devices or users may be affected. For devices with mobile device management (MDM) go to Devices > All devices and filter by OS. For devices with app protection policies go to Apps > Monitor > App protection status and use the Platform and Platform version columns to filter.

To manage the supported OS version in your organization, you can use Microsoft Intune controls for both MDM and APP. For more information, please review: Manage operating system versions with Intune – Microsoft Intune | Microsoft Learn.

[Related information:]

Support ending for Apple User Enrollment with Company Portal

In a security update in 2017, Microsoft Word disabled support for certain Dynamic Data Exchange (DDE) features, as documented in Microsoft Office Defense in Depth Update. At the time, a registry key was added to re-enable the disabled functionality. Beginning in April 2025, the functionality affected by that registry key will be fully removed, and the registry key will no longer have any effect.

[When this will happen:]

This retirement will begin in April 2025.

[How this will affect your organization:]

You may be affected by this change if you currently depend on the HKCU\Software\Microsoft\Office\16.0\Word\Security\AllowDDE registry key being set to a value other than 0. If you do not have that key set or if it is currently set to 0, this change will have no effect.

[What you need to do to prepare:]

This rollout will happen automatically with no admin action required. You may want to notify your users about this change and update any relevant documentation as appropriate.

• Set the Message-Authenticator attribute in Access-Request packets. Make sure all Access-Request packets include the Message-Authenticator attribute. By default, the Message-Authenticator attribute is turned off. We recommend turning this option on.

• Verify the Message-Authenticator attribute in Access-Request packets. Consider enforcing validation of the Message-Authenticator attribute on Access-Request packets. Access-Request packets without this attribute will not be processed. By default, the Access-Request messages must contain the message-authenticator attribute option is turned off. We recommend turning this option on.

• Verify the Message-Authenticator attribute in Access-Request packets if the Proxy-State attribute is present. Optionally, enable the limitProxyState configuration if enforcing validation of the Message-Authenticator attribute on Access-Request packets cannot be performed. This configuration will validate that Access-Request packets containing the Proxy-State attribute also contain the Message-Authenticator attribute. By default, the limitproxystate attribute is turned off. We recommend turning this attribute on.

• Verify the Message-Authenticator attribute in RADIUS response packets: Access-Accept, Access-Reject, and Access-Challenge. Enable the requireMsgAuth configuration to enforce dropping the RADIUS response packets from remote servers that lack the Message-Authenticator attribute. By default, the requiremsgauth attribute is tuned off. We recommend turning this attribute on.

• KB5040268: How to manage the Access-Request packets attack vulnerability associated with CVE-2024-3596
• KB5043417: RADIUS authentication to NPS might fail with the July 2024 security update and later updates
• CVE-2024-3596
• Network Policy Server (NPS)
• User Datagram Protocol (UDP)

Microsoft is set to make Windows Autopatch the one-stop shop for all things Windows enterprise update management. We’re simplifying the update management experience by unifying Windows Autopatch and Windows Update for Business deployment service (WUfB-DS) into one service so you can automate and deploy updates to devices seamlessly. 

[When this will happen:]

General Availability: The changes will take place beginning on mid-September 2024 and gradually rollout to all tenants by mid-October 2024.

[How this will affect your organization:]

With this change, we’re simplifying the experience to make it easier to find and use the update management features you need. Instead of having multiple tabs and menus within the Microsoft Intune admin center, you’ll see update management capabilities organized into three categories:

1. Windows Updates: Create and assign policies to control how and when Quality updates, Feature updates and Driver Updates are installed on your devices. See the Licensing section below.
2. Tenant Management: Use Autopatch groups to create and assign groups to organize your devices into different update rings, such as pilot, production, or test. You can use the Support requests blade to create tickets with Windows Autopatch if you need more assistance. See the Licensing section below.
3. Windows Autopatch reports: Access various reports to analyze the update performance and reliability of your devices and troubleshoot any issues. See the Licensing section below.

Licensing

• Existing customers will continue to use the same licenses for Windows Autopatch: Microsoft Intune, Entra ID Premium, and Microsoft 365 / Windows 11 Enterprise E3/E5, and Microsoft 365 F3. These rights extend to Windows 365 Enterprise. For more information, see Licensing prerequisites for existing Windows Autopatch customers. Feature(s) available: Windows Updates, Tenant Management, and Windows Autopatch reports.

Organizations with A3, A5, and Microsoft 365 Business Premium subscriptions will retain the license rights to use all Windows Update for Business deployment service (WUfB-DS) capabilities. New subscribers will also have rights to use Windows Update for Business deployment service. Feature(s) available: Windows Updates. We will continue to provide the same great functionality available today with Windows Update for Business under this new unified Windows Autopatch. Our goal is to simplify PC update management without limiting the functionality that exists today.

[What you need to do to prepare:]

You should prepare for these changes in the Microsoft Intune admin center and inform your team. If you have any questions or concerns, or need assistance, file a service request by visiting the Microsoft Intune admin center. Additional Information and details will also be included on (docs.microsoft.com) post feature release.

This feature update helps organizations add a Quick Links Card on Viva Connections Dashboard. With this card, the operators can add a list of important links for quick access by the end users.  

This message is associated with Microsoft 365 Roadmap ID 402189.

[When this will happen:]

General Availability (Worldwide, GCC, GCC High, DoD): We began rolling out in August 2024 and expect to complete by mid August 2024.

[How this will affect your organization:]

Operators can now add a new card to their Viva Connections Dashboard. This card will help them set up a list of curated links for quick access for end users.

Card view:

Quick view:

Property pane:

For more information, see Create a Viva Connections dashboard and add cards.

This update is available by default.

[What you need to do to prepare:]

This rollout will happen automatically with no admin action required. You may want to notify your users about this change and update any relevant documentation as appropriate.