Microsoft Roadmap, messagecenter and blogs updates from 31-10-2025

Updated October 30, 2025: We have updated the timeline. Thank you for your patience.     

[Introduction]

We’re introducing Multi-Geo In-Region Routing (IRR) for Exchange Online, a new capability that helps organizations meet regional data residency requirements by allowing inbound email routing to be aligned with user locations. With IRR, admins can configure accepted domains to route messages directly to a designated geo-region, ensuring that email data is processed and stored entirely within the recipient’s region—even if it differs from the tenant’s primary location. This helps organizations meet compliance requirements without compromising email delivery performance.

This message is associated with Microsoft 365 Roadmap ID 410245.

[When this will happen:]

Public Preview: We will begin rolling out in early October 2025 and expect to complete by end of October 2025.

General Availability (Worldwide): We expect to begin rolling out in early October 2025 (previously early December) and expect to complete by late December 2025.

[How this will affect your organization:]

In-Region Routing (IRR) is disabled by default. If you do not plan to use this feature, no action is required.

For domains where you choose to enable IRR, the feature allows you to route inbound emails to accepted domains associated with specific geo-regions. When these domains are aligned with users located in the same geo-region, emails are fully processed and stored within the recipient’s region. This ensures that data remains within the user’s Preferred Data Location (PDL), supporting stronger data sovereignty and compliance with regional regulations.

If your organization uses Microsoft Purview capabilities such as Data Loss Prevention (DLP), retention policies, or eDiscovery, you may need to review and adjust those policies to ensure they align with the new regional routing behavior.

[What you need to do to prepare:]

• Ensure that admins have the necessary permissions to manage accepted domains and access to either Exchange Online PowerShell or to the Microsoft 365 admin center.
• Review your domain configurations and identify users located in secondary geo-regions.
• Prepare to configure accepted domains with the new geo-region property.
• Review the licensing terms, as Multi-Geo licenses will be indefinitely required to use In-Region Routing:
  • https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-multi-geo?view=o365-worldwide#licensing
  • https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-multi-geo?view=o365-worldwide#getting-started 
• Review the documentation for configuring the feature: Configure Multi-Geo In-Region Routing (In Preview) – Microsoft 365 Enterprise | Microsoft Learn”

We value your feedback and want to hear from you if you have any questions or concerns. Please comment or contact us through the M365 Admin Center if you need any assistance.

[Compliance considerations:]

• Does the change alter how existing user data is processed, stored, or accessed? – Yes. Emails are stored in-region based on domain configuration.
• Does the change modify, interrupt, or disable any Purview capabilities? – Maybe. Depends on how DLP or retention policies are scoped by region.
• Does the change alter how admins can monitor, report on, or demonstrate compliance activities? – Maybe. Regional routing may affect reporting granularity.

Updated October 30, 2025: We have added a reminder message to the bottom of this post. Thank you for your patience. 

Introduction

Microsoft Teams is introducing enhanced protection against phishing attacks by detecting and warning users about malicious URLs shared in Teams chats and channels. This feature helps users make safer decisions before clicking potentially harmful links. This message applies to Teams for Windows desktop, Teams for Mac desktop, Teams for the web, and Teams for iOS/Android.

This message is associated with Roadmap ID 499893.

When this will happen

• Targeted Release (Worldwide): Rollout begins early September 2025 and is expected to complete by mid-September 2025.
• General Availability (Worldwide): Rollout begins early November 2025 and is expected to complete by mid-November 2025.

How this affects your organization

When a malicious link is detected, Teams will automatically display a warning to both the sender and recipient. This helps reduce the risk of phishing attacks.

• Targeted Release: Link protection is applied only when all participants in the conversation have the feature enabled.
• General Availability: Link protection is enforced if at least one participant in the conversation has the feature enabled.

Targeted release vs. General Availability behavior:

• Targeted release: Link protection is applied only when all organizations in the conversation have the feature enabled. This feature is off by default and requires admin activation.
• General Availability: Link protection is applied if at least one participant has the feature enabled. This feature is on by default. Admin settings saved during Targeted Release will remain unchanged. 

What you can do to prepare

During Public Preview, administrators must manually enable the feature:

1. Go to the Teams Admin Center
2. Navigate to Messaging Settings
3. Enable the setting: Scan messages for unsafe URLs

This setting is also available via Set-CsTeamsMessagingConfiguration PowerShell cmdlet –UrlReputationCheck parameter.

No action is required once the feature reaches General Availability, as it will be turned on by default.

Learn more: Malicious URL Protection in Microsoft Teams

Compliance considerations

Reminder:

Updated October 30, 2025: We have updated the content. Thank you for your patience.

Introduction

Microsoft Teams is introducing a new protection feature that blocks messages containing weaponizable file types—such as executables—in chats and channels. This helps reduce the risk of malware and file-based attacks by preventing unsafe content from being shared. This message applies to Teams for Windows desktop, Teams for Mac desktop, Teams for the web, and Teams for iOS/Android.

This message is associated with Roadmap ID 499892.

When this will happen

General Availability begins November 3 and will take 2-3 weeks to complete. At GA, “Scan messages for file types that are not allowed” will default to ON, and protection will apply if any participant in a conversation has it enabled.

To use a different setting, go to Teams admin center → Messaging settings → Scan messages for file types that are not allowed, select your preference, and click Save before GA.

Note: Simply viewing the page without saving will not override the default, but settings already saved during Targeted Release will persist.

• Targeted release (Worldwide): Starts early September 2025; expected to complete by mid-September 2025.
• General Availability (Worldwide): Starts early November 2025; expected to complete by mid-November 2025.

How this affects your organization

Once enabled, Teams will automatically block messages that include weaponizable file types. This applies to both internal and external conversations.

• Recipients will see a notification that a message was blocked but cannot access the content.
• Senders will receive a notification and can edit and resend the message without the unsafe file.

Targeted release vs. General Availability behavior:

• Targeted release: Protection is enforced only when all organizations in the conversation have the feature enabled. This feature is off by default and requires admin activation.
• General Availability: Protection is enforced if at least one participant has the feature enabled. This feature is on by default. Admin settings saved during Targeted Release will remain unchanged.

What you can do to prepare

Admins can enable this protection in the Teams Admin Center:

1. Go to the Teams Admin Center
2. Navigate to Messaging Settings
3. Turn on the setting: Scan messages for file types that are not allowed

Alternatively, use PowerShell with the -FileTypeCheck parameter.

Once enabled, all users in your tenant will begin seeing file protection applied in their messages.

Blocked file types include:

ace, ani, apk, app, appx, arj, bat, cab, cmd, com, deb, dex, dll, docm, elf, exe, hta, img, iso, jar, jnlp, kext, lha, lib, library, lnk, lzh, macho, msc, msi, msix, msp, mst, pif, ppa, ppam, reg, rev, scf, scr, sct, sys, uif, vb, vbe, vbs, vxd, wsc, wsf, wsh, xll, xz, z

Learn more: 

• Weaponizable File Protection in Microsoft Teams

Compliance considerations

Updated October 30, 2025: We have updated the timeline. Thank you for your patience. 

[Introduction]

We’re improving the reliability of Copilot chat by ensuring that conversations are preserved even when users navigate away from a chat. With this update, a session entry is created in the navigation pane as soon as a prompt is submitted. This allows users to return to the conversation later without losing context or progress.

This capability will be available to users with a Microsoft 365 Copilot Starter or Premium license. No additional license or add-on is required beyond a valid Microsoft 365 Copilot license.

This message is associated with Microsoft 365 Roadmap ID 500638.

[When this will happen:]

• Worldwide (General Availability): Rolling out from November 5, 2025 (previously October 27), to November 30, 2025 (previously October 31)
• GCC: Rolling out from November 19, 2025 (previously November 3), to November 30, 2025 (previously November 28)
• GCC High: Rolling out from November 26, 2025 (previously November 10), to November 30, 2025 (previously November 28
• DoD: Rolling out from November 19, 2025 (previously November 10), to November 30, 2025 (previously November 28)

[How this affects your organization:]

Who is affected: All users of Microsoft Copilot (Microsoft 365) in commercial, GCC, GCC High, and DoD environments with a valid Microsoft 365 Copilot Starter or Premium license.

What will happen:

• A session entry will now appear in the navigation pane immediately after a prompt is submitted.
• Users can navigate away from a chat and return later without losing the conversation.
• This update improves continuity and reduces the risk of session loss.
• No changes to admin settings or policies are required.

[What you can do to prepare:]

No admin action is required at this time. You may wish to:

• Confirm that users have a Microsoft 365 Copilot Starter or Premium license.
• Inform helpdesk staff of this behavior change.
• Update internal documentation if you describe Copilot chat behavior.

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

Updated October 30, 2025: We have updated the timeline. Thank you for your patience. 

[Introduction]

We’re updating the default experience for users with the Microsoft 365 Copilot license by introducing GPT-5 as the standard model. GPT-5 is OpenAI’s most advanced language model, designed to deliver faster, more accurate, and more context-aware responses. It features dynamic model routing, which automatically selects the best-performing variant for each prompt—using high-throughput models for quick replies and deeper reasoning models for complex tasks. This change simplifies the user experience and enhances performance across all Copilot endpoints.

[When this will happen:]

• General Availability (Worldwide): Phased rollout begins early November 2025 (previously late October) and completes by late November 2025.

[How this affects your organization:]

• Who is affected: All users with a Microsoft 365 Copilot license across web, desktop, and mobile experiences.
• What will happen:
  • The rollout will occur in two phases:
  • Phase 1 (web, desktop): GPT-5 toggle is enabled by default. Users can choose to disable GPT-5 via the toggle and revert to previous models.
  • Phase 2 (web, desktop, mobile): GPT-5 becomes the default model. Users will no longer be able to opt out, and the GPT-5 toggle button will be removed.
  • The GPT-5 default experience will also apply to Copilot Chat in the Microsoft 365 apps. The exception is on Teams mobile, which is planned to rollout beginning late November 2025.
  • Copilot will automatically trigger GPT-5 reasoning based on prompt complexity.
    • Users will be able to bypass GPT-5 reasoning and get a direct response by selecting “Get a quick answer.”

      

[What you can do to prepare:]

• No admin action is required to enable this feature.
• Communicate the phased rollout to helpdesk and support teams.
• Update internal documentation to reflect the default use of GPT-5 and how to bypass reasoning if desired.
• Review any training materials or user guides that reference the GPT-5 toggle.

[Compliance considerations]

Updated October 30, 2025: We have updated the content. Thank you for your patience.

Introduction

To help organizations better assess and improve their identity security posture, Microsoft Secure Score is being enhanced with new improvement actions based on Microsoft Defender for Identity recommendations. These updates provide more accurate insights and actionable guidance to strengthen your security configuration.

When this will happen:

• Public Preview: Rollout begins early November 2025, completes by mid-December 2025
• General Availability (Worldwide, GCC, GCC High, and DoD): Rollout begins early November 2025, completes by mid-December 2025

How this affects your organization:

• Who is affected: Admins managing Microsoft Secure Score and organizations with Microsoft Defender for Identity sensors deployed.
• What will happen:
  • New posture recommendation will appear in Microsoft Secure Score as improvement actions: Change password for on-prem accounts with potentially leaked credentials
  • This recommendation is visible only if your tenant has a Defender for Identity sensor deployed.
  • The update is enabled by default and requires no configuration changes.
  • No impact to end-user workflow unless acted upon by the admin.

What you can do to prepare:

• No admin action is required before or after rollout.
• Review your current identity configuration to assess potential impact.
• Notify relevant administrators and update internal documentation as needed.
• Regularly review Microsoft Secure Score to monitor and act on new improvement suggestions.
• Learn more: Microsoft Secure Score 

Compliance considerations:

No compliance considerations identified, review as appropriate for your organization.

• Schedule and configure online events for up to 10,000 attendees.
• Automatically send personalized invitations based on customer data and behavioral triggers.
• Track attendance and engagement within Customer Insights for post-event follow-up and segmentation.
• Reduce tool switching with a centralized, integrated campaign-to-event workflow.
• Publish video-on-demand after the event to engage attendees who missed the event.

[Introduction]

[When this will happen:]

Public Preview: Rollout begins in early November 2025 and is expected to complete by mid-November 2025.

[How this affects your organization:]

Who is affected: Admins managing Microsoft Defender for Endpoint and Microsoft Secure Score.

What’s changing:

Lightweight Directory Access Protocol (LDAP) is a protocol used to access and manage directory information, commonly for authentication and authorization in enterprise environments.

Customers in Public Preview will see the following new recommendations in Microsoft Secure Score:

1. Require LDAP client signing to prevent tampering and protect directory authentication 
2. Encrypt LDAP client traffic to protect sensitive data in transi 
3. Enforce LDAP channel binding to protect authentication sessions from interception 
4. Require LDAP server signing to ensure integrity of directory traffic

Secure Score will be updated based on the implementation of these recommendations.

[What you can do to prepare:]

• Review the new recommendations in Microsoft Secure Score once available.
• Complete the recommended actions to improve your organization’s security posture.
• Communicate these changes to your security and endpoint management teams.
• Learn more about Microsoft Secure Score: Microsoft Secure Score | Microsoft Defender XDR | Microsoft Defender | Microsoft Learn

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

[Introduction]

To support more granular data governance and compliance, Microsoft Purview is introducing Admin Unit scoping in both Content Explorer and Data Explorer, available through the Microsoft Purview compliance portal. Administrative Units are containers in Microsoft Entra ID that allow organizations to scope admin permissions and policies to subsets of users or resources—such as departments, regions, or business units. By aligning data visibility with these boundaries, this update ensures that data exploration respects organizational structure and improves control over Microsoft 365 data.

This message is associated with Roadmap ID 498915.

[When this will happen:]

• Public Preview: Rollout begins early November 2025, expected to complete by mid-November 2025.
• General Availability (Worldwide): Rollout begins early January 2026, expected to complete by mid-January 2026.

[How this affects your organization:]

• Who is affected: Admins using Microsoft Purview Content Explorer and Data Explorer; organizations using Administrative Units.
• What will happen:
  • The list of items visible in Content Explorer and Data Explorer will be scoped based on the user’s assigned Administrative Units.
  • Users without any assigned Administrative Units will see no change.
  • No changes to existing policies or labels are required.

[What you can do to prepare:]

• Review your current Administrative Unit configurations.
• Create and assign Administrative Units to users as needed.
• Communicate this change to your compliance and governance teams.
• Update internal documentation to reflect this new scoping capability.
• Learn more: Administrative units in the Microsoft Purview portal | Microsoft Learn

[Compliance considerations:]

[Introduction]

We’re introducing a new way for users to stay engaged with conversations in Microsoft Teams. The Follow thread feature allows users to follow any post they see in the Discover feed or in Channels. Followed threads will be accessible in a new Followed threads view within the Chat app, making it easier to track important discussions across Teams.

This message applies to Teams for Windows desktop, Teams for Mac desktop, Teams for the web, and Teams for iOS/Android.

[When this will happen:]

• Targeted Release: We will begin rolling out mid-November 2025 and expect to complete by late November 2025.
• General Availability (Worldwide): We will begin rolling out late November 2025 and expect to complete by early December 2025.

[How this affects your organization:]

• Who is affected: All Microsoft Teams users who access posts via the Discover feed or Channels.
• What will happen:
  • Users will see a new Follow thread option on posts in the Discover feed and Channels.

  

  • Followed threads will appear in a dedicated Followed threads view in the Chat app.
  • There are no changes to tenant-level settings.
  • The feature is enabled by default; no admin action is required to turn it on.

[What you can do to prepare:]

• No action is required to prepare for this change. However, you may want to:
• Notify your users about the new Follow thread feature.
• Update internal documentation to reflect the new Followed threads view in the Chat app.
• Review Microsoft Teams help documentation for user guidance once available.

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

[Introduction]

We’re introducing a new Overview feature in Microsoft 365 Copilot Search that uses AI and Microsoft Graph to surface key information from search results. This enhancement helps users quickly understand the context of a result without needing to open the full item, streamlining their search experience.

A Microsoft 365 Copilot license is required to access this feature.

[When this will happen]

General Availability (Worldwide): Rollout is scheduled to begin in mid-November 2025 (or earlier) and is expected to complete by late November 2025.

[How this affects your organization]

Who is affected: Users with a Microsoft 365 Copilot license who use Microsoft 365 Copilot Search.

What will happen:

• A new Overview option will appear on the Copilot Search results page.
• When selected, users will see a concise, AI-generated summary of the search result.
• The feature is powered by Microsoft Graph and AI to highlight key information.
• The feature will be enabled by default for all tenants for all tenants with eligible licenses.
• No changes to existing admin policies are required.

[What you can do to prepare]

• No admin action is required.
• Ensure users have a Microsoft 365 Copilot license to access the feature.
• Encourage users to explore the new Overview option in Copilot Search.
• If you maintain internal documentation or training materials, consider updating them to reflect this new capability.

[Compliance considerations] 

No compliance considerations identified, review as appropriate for your organization.

[Introduction]

To improve clarity and performance, we’re streamlining the Vulnerable Devices Report experience in Microsoft Defender Vulnerability Management. These changes are based on customer feedback and aim to reduce complexity while ensuring faster report load times.

[When this will happen:]

This update is rolling out now and will be available to all tenants shortly.

[How this affects your organization:]

• Who is affected: Admins using the Vulnerable Devices Report in Microsoft Defender Vulnerability Management.
• What will happen:
  • The “Vulnerable devices by Windows 10 & 11 version over time” widget has been removed.
  • Filters have been simplified; only the role-based access control (RBAC) [Device group] filter is available.
  • Report history is now limited to the last 30 days at launch.

[What you can do to prepare:]

• No action is required to enable these changes.
• Review your internal documentation if it references the removed widget or previous filter options.
• Learn more: Vulnerable Devices Report in Defender

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

• Agents: All agents created in Copilot Studio.
• Apps: All apps created in Power Apps, including canvas apps, model-driven apps, code apps, and all apps created in the new Microsoft 365 App Builder.

Introduction:

We’re introducing Researcher with Computer Use in Microsoft 365 Copilot—a powerful extension that enables users to interact with public, gated, and interactive web content using a secure virtual computer. This enhancement helps users uncover deeper insights, take action, and generate richer reports grounded in both their work data and the web.

When this will happen:

Rollout begins October 30, 2025, for all tenants with Frontier access.

How this affects your organization:

• Who is affected:
  • All tenants with Frontier access using Microsoft 365 Copilot.
  • A Microsoft 365 Copilot license is required to use Researcher with Computer Use.
  • Admins can manage licensing and agent access in the Copilot admin portal.
• What will happen:
  • Users will be able to access premium and authenticated web content that requires credentials and consent.
  • Users can take action directly from the Copilot interface—clicking, typing, navigating, and completing tasks.
  • Rich artifacts such as presentations, spreadsheets, and applications can be generated using advanced code generation.
  • Reports can be tailored using business data including meetings, files, chats, and more.
  • By default, Computer Use is enabled unless configured otherwise by an admin, and work is turned off for the user. The user can still enable work in sources, unless disabled by an admin.
  • The original Researcher agent experience (without Computer Use) remains available if your organization is not enrolled in Frontier or if Computer Use is not enabled.

What you can do to prepare:

• Ensure eligible users have Microsoft 365 Copilot licenses assigned.
• Review and configure feature access in the Microsoft 365 admin center.
• Specify allowed websites and manage work access settings.
• Communicate this change to helpdesk staff.
• Update internal documentation if you detail Copilot capabilities.
• Learn more:
  • Introducing Researcher with Computer Use in Microsoft 365 Copilot | Microsoft 365 Copilot Blog
  • Get started with Researcher agent in Microsoft 365 Copilot | Microsoft 365 Copilot
  • Researcher with Computer Use admin configuration | Microsoft Learn
  • Researcher with Computer Use frequently asked questions | Microsoft Learn

Compliance considerations: