Microsoft Roadmap, messagecenter and blogs updates from 17-04-2026

Updated April 16, 2026: We have updated the timeline. Thank you for your patience. 

[Introduction]

Organizational Messages will soon include email as a delivery channel, expanding beyond existing surfaces such as the Windows Taskbar, Windows Notifications, Windows Spotlight, and Teams popovers. This enhancement helps organizations reach users through familiar communication channels, improving engagement and adoption.

This message is associated with Microsoft 365 Roadmap ID 503562.

[When this will happen] 

• Public Preview (Worldwide): Rollout began in mid-November 2025 and is expected to complete by late January 2026.
• General Availability (Worldwide): Rollout begins in late April 2026 (previously mid-April) and is expected complete by late May 2026 (previously mid-May).

[How this will affect your organization]

Who is affected: Admins managing Organizational Messages in Microsoft 365.

What will happen:

• Email will be added as a delivery channel for Organizational Messages.
• Admins can send premade, templatized messages via email in addition to existing surfaces like Windows Spotlight, Taskbar, Notification Center, and Teams popovers:



• During Public Preview, new pre-built email templates will be available:

 

• Two welcome messages: Welcome to Copilot and Welcome to Copilot Chat.
• Six weekly Great M365 Copilot Journey emails highlighting features and best practices to drive onboarding and adoption.

[What you need to do to prepare]

No action is required at this time.

[Compliance considerations]

No compliance impacts identified. Review your organization’s policies as needed.

Updated April 16, 2026: We have updated the timeline. Thank you for your patience. 

[Introduction]

Action Segments empower IT admins to target Organizational Messages using dynamic, pre-defined usage segments. This enhancement helps admins deliver more relevant communications based on user activity. For the Public Preview, there are two Action Segments available: Inactive Microsoft 365 Copilot Users and Inactive Microsoft 365 Copilot Users in Teams.

This message is associated with Microsoft 365 Roadmap ID 503563.

[When this will happen]

• Public Preview (Worldwide): Rollout began in mid-November 2025 and is expected to complete by late January 2026.
• General Availability (Worldwide): Rollout begins in late April 2026 (previously mid-April) and is expected to complete by late May 2026 (previously mid-May).

[How this will affect your organization]

• Who is affected:
  • Admins managing Organizational Messages in Microsoft 365.
  • Tenants with Microsoft 365 Copilot licenses (required for Action Segments to apply).
• What will happen:
  • Admins can target messages based on user activity using Action Segments: 
  
  • Two pre-defined segments are available during Public Preview:
    • Inactive Microsoft 365 Copilot Users
    • Inactive Microsoft 365 Copilot Users in Teams
  • No changes to existing admin policies; feature is additive.

[What you can do to prepare]

• No immediate action is required at this time.
• If you want to take advantage of this feature:
• Ensure your organization has Microsoft 365 Copilot licenses (required for Action Segments to apply).
• Review and configure Action Segments in the Microsoft 365 admin center.
• Communicate this change to your helpdesk or support teams.
• Update internal documentation if you detail Organizational Messages or Copilot usage.

[Compliance considerations]

No compliance impacts identified. Review your organization’s policies as needed.

Introduction

Beginning January 30, 2026, Microsoft Entra ID Governance will require all tenants to have a linked Azure subscription to continue using Identity Governance features for guest users. This change ensures accurate billing for governance actions performed by guests and supports continued access to advanced governance capabilities. 

When this will happen:

General availability and enforcement begin on January 30, 2026.

How this will affect your organization:

Who is affected:

• Organizations using Microsoft Entra ID Governance features for guest users (userType = Guest).
• Admins managing lifecycle workflows or Entra ID Governance features in entitlement management for external or guest identities. Access reviews will be included by March 31, 2026.

What will happen:

• If your tenant does not have a linked Azure subscription, creation or updates of policies scoped to guest users using premium Entra ID Governance capabilities will be blocked. 
• The following actions will be unavailable:
• Creating access reviews scoped to guest users (inactive user reviews, user-to-group affiliation helper)
• Creating or updating entitlement management policies involving guests, sponsor approvers, custom extensions, Verified ID, or auto-assignment rules
• Marking a guest as governed in entitlement management
• Directly assigning a guest user to an access package in entitlement management
• Creating or updating lifecycle workflows scoped to guest users.
• Existing policies will continue to run, but no new guest-governance actions can be authored without billing enabled.
• Once a subscription is linked, normal guest governance usage and billing will begin under the Monthly Active User (MAU) model.

What you can do to prepare:

• Before January 30, 2026, link a valid Azure subscription to your tenant:
• Navigate to Entra ID → ID Governance → Dashboard
• In the Guest Access Governance panel, select Get Started
• Choose a subscription and resource group, then select Turn on 
• Confirm your account has at least the Contributor role to enable subscription linking.
• Review any guest-scoped workflows, reviews, or entitlement policies that may require updates after subscription linking.
• Communicate this change to support teams or internal governance admins.
• Update internal documentation regarding:
• Guest governance prerequisites
• Subscription dependency
• Billing behavior for governance actions

Learn more: Microsoft Entra ID Governance licensing for guest users | Microsoft Learn

Compliance considerations:

Updated April 15, 2026: We have updated the content. Thank you for your patience. 

[Introduction]

Copilot Cowork is now available in Frontier. Copilot Cowork enables users to orchestrate complex, multi-step work across Microsoft 365 without switching between apps. Copilot Cowork moves beyond answering questions to turning intent into execution by automatically generating plans, coordinating work across emails, meetings, messages, files, and data, and carrying tasks forward with visible progress and user control. This update reflects customer feedback to reduce manual coordination for real work while maintaining enterprise-grade security, privacy, and controls. Learn more on our blog: Powering Frontier Transformation with Copilot and agents.

Screenshot: The Copilot Cowork interface in Microsoft 365 Copilot

[When this will happen:]

• Copilot Cowork is now available in Frontier.
• General availability will be communicated at a later date.

[How this affects your organization:]

Who is affected:

• Users with a Microsoft 365 Copilot (Premium) license
• Users enabled for Frontier 
• English language only

Prerequisites and controls:

• The tenant must be enrolled in the Frontier program.
• Microsoft‑built agents must be enabled.
• Anthropic must be enabled as a subprocessor (default: on).
  • For tenants based in the European Union (EU), Anthropic as a subprocessor is off by default due to EU Data Boundary requirements and must be explicitly enabled.
  • If anthropic is off, users may still see Cowork but be unable to use it.
• Admins must be enrolled in Frontier to see Cowork in Agent Inventory.

What will happen:

• Users can install Copilot Cowork from the Agent Store in the Microsoft 365 Copilot app and pin it to the left rail.
• Users can describe an outcome in natural language, and Copilot Cowork will:
• Automatically generate a multi-step plan grounded in the user’s Microsoft 365 context
• Coordinate tasks across Microsoft 365 apps such as Word, PowerPoint, Outlook, and others
• Continue work overtime with visible checkpoints and progress tracking
• Copilot Cowork proposes actions and requires explicit user approval before acting on tasks such as:
• Sending emails or Teams messages
• Scheduling, declining, or rescheduling meetings
• Editing or moving files
• Users can pause, adjust, or stop execution at any time and return later to review progress.
• For eligible tenants, the experience is enabled by default and respects existing Microsoft 365 permissions and policies, unless restricted by EU Data Boundary settings.

[What you can do to prepare:]

• No admin action is required.

Learn more:

• Copilot Cowork: Now Available in Frontier | Microsoft Learn
• Anthropic as a subprocessor for Microsoft Online Services | Microsoft Learn 
• Opt-in to use Anthropic’s models | Microsoft Learn
  
• Agent settings in Microsoft 365 admin center | Microsoft Learn 

[Compliance considerations:]

[Introduction]

Azure PST Import provides a structured, PowerShell-based way for administrators to import PST files stored in Azure Blob Storage into Exchange Online mailboxes, which are commonly used to store archived Outlook mailbox content. This capability helps organizations migrate historical email data in a controlled and auditable way by validating readiness before importing and by providing reports throughout the process. The process starts by creating an Azure PST Import endpoint to establish the connection between Azure storage and Exchange Online. Administrators then run a migration batch in Analyze mode to review readiness and validate the input before proceeding. Once the analysis results are reviewed, they use those results to create and start the import batch, which begins importing the PST files into the specified mailboxes.

This message is associated with Microsoft 365 Roadmap ID 557559.

[When this will happen]

Global rollout

• Start: May 4, 2026
• Complete: May 15, 2026

[How this affects your organization]

Who is affected

• Microsoft 365 administrators managing Exchange Online
• Administrators using Microsoft Purview Data Lifecycle Management
• Organizations that import PST files into user or archive mailboxes

What will happen

• Administrators complete the Azure PST Import process using PowerShell cmdlets only.
• The workflow includes:
  • Creating an Azure PST Import migration endpoint
  • Running a migration batch in Analyze mode to validate readiness
  • Reviewing analysis results and reports
  • Creating and starting the import batch
  • Performing post-import cleanup
• This experience is not available through a graphical user interface (GUI).
• Existing mailbox prerequisites and quotas are validated before importing begins.
• There is no direct user impact; the feature is admin-driven.

[What you can do to prepare]

• Ensure your Azure storage account and container exist and are reachable; the endpoint creation cmdlet validates both during setup.
• Grant the Storage Blob Data Reader role to the Office 365 Import Service app on the target storage account. Without this permission, creating the Azure PST Import endpoint will fail.
• Prepare your batch input files (XML and/or CSV) and run the migration batch in Analyze mode first so the service can validate readiness before importing.
• Confirm analysis prerequisites for target mailboxes:
  • Appropriate license assigned
  • Mailbox is not inactive or soft-deleted
  • Recipient type is UserMailbox
  • Archive is enabled if importing to archive
  • Quota validations (ArchiveQuota / RecoverableItemsQuota) occur during analysis
• Validate PST files ahead of time:
  • Analysis verifies that all specified PST files exist
  • PST file size is validated during analysis

For detailed cmdlet usage and guidance, review the Azure PST Import documentation on Microsoft Learn.

[Compliance considerations]

[Introduction]

We’re making planned breaking changes to some Advanced Security Information Model (ASIM) KQL functions used in Microsoft Sentinel for Developers. These changes align parameters with documentation to improve consistency and performance.

[When this will happen]

Rollout timing has not been finalized.

We’ll update this Message center post with specific start and end dates once they’re confirmed.

[How this affects your organization]

Who is affected

• Organizations using ASIM or normalization KQL functions in Microsoft Sentinel for Developers
• Security teams and partners building or maintaining detections and analytic rules that rely on these functions

What will happen (April 19)

• We will update _Im_ProcessCreate with the correct parameter, so that it will take both targetusername and targetusername_has.
• This will give time to partners to update their detections and KQL queries to switch to the parameter name targetusername_has, while not break any existing experiences.

What will happen (May 25 or later)

• Once we have given enough time and also checking with our usage telemetry that targetusername is not being used, we will remove targetusername as parameter. 

[What you can do to prepare]

• Review detections and analytic rules that use ASIM or normalization functions.
• Update queries to use targetusername_has.
• Test updated detections before rollout.
• Notify teams or partners who maintain Sentinel detections.

Learn more: The Advanced Security Information Model (ASIM) Process Event normalization schema reference | Microsoft Sentinel | Security | Azure | Microsoft Learn

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.

[Introduction]

We are improving how users discover Microsoft 365 Copilot capabilities in the file previewer of OneDrive and SharePoint. Ready to use Copilot actions will appear directly in the file preview experience, alongside the Copilot button. When users preview supported files, suggested prompts will help them complete common tasks such as summarizing documents, generating FAQ, and extracting key information without writing their own prompts.

[When this will happen]

General Availability (Worldwide): We will begin rolling out in late April 2026 and expect to complete the rollout by early May 2026.

[How this affects your organization]

Who is affected

• Microsoft 365 tenants using OneDrive for Business
• Users who have access to Microsoft 365 Copilot
• Administrators managing OneDrive and Copilot experiences

What will happen

• Users will see suggested Copilot actions when previewing supported files in OneDrive:

   

• Suggested actions may include summarizing content, generating FAQ, and identifying key points.
• The feature will be enabled by default for eligible users. Suggestions will disappear after a timeout or after a user interacts with a file.
• Existing Copilot, OneDrive, SharePoint, and Microsoft Purview policies will continue to apply.
• There will be no change to file permissions, sharing behavior, or data residency. Copilot will continue to respect existing access controls and Microsoft Purview policies.

[What you can do to prepare]

• No admin action is required.
• Consider notifying users that Copilot suggestions will appear in OneDrive file previews to support awareness and adoption.
• If Copilot is disabled or restricted in your tenant, those settings continue to apply.

[Compliance considerations]

We are introducing a modernized change management model for Microsoft 365 to help IT teams manage the pace of innovation and realize value faster. Based on customer feedback, this new approach provides greater clarity, consistency, and control through flexible release audiences, more actionable Message center posts, and AI enabled access to trusted release information.

Clarity and Control for Admins

Microsoft 365 is evolving how updates are released and giving IT teams greater clarity, consistency, and control over change. 

Audience based rollout model  

• Align rollouts to operational readiness with channels that support both rapid innovation and regulated environments. Expanding release audience options (Frontier program, Standard release, and Deferred release) to better align rollout timing with organizational readiness and governance needs. 
• This is the first step in our modernization change management journey. We’re starting with Microsoft 365 Copilot. 

Actionable communications  

• Enhanced Message center updates are timely and relevant, helping admins anticipate, validate, and prepare changes. Providing more structured, launch‑focused Message center announcements with clearer impact, actions, and compliance considerations. 

AI powered change insights 

• Introducing the Microsoft Release Communications (MRC) Model Context Protocol (MCP) Server, which enables MCP compatible AI clients to retrieve trusted Microsoft 365 roadmap and Azure Updates information using natural language.
• Shift from passively reviewing service updates to actively reasoning over change data. With Microsoft MCP Server for Enterprise, you can give AI agents conversational, read-only access to your organization’s Message center and Service Health Dashboard data.

[When this will happen:]

General Availability (Worldwide): We will begin rolling out mid-April 2026 and expect to complete by late April 2026.

[How this will affect your organization:]

Depending on your configuration and readiness model, you now have the option to choose your release audience preference for your organization:

• Stage feature rollout using release audiences:  
• Frontier program for early experimentation and feedback.  
• Standard release (default) for immediate access at general availability. 
• Deferred release (for eligible major features) to delay rollout by 30 days for additional security or compliance review. 
• To access the Admin Control to select release preference: 

Preferences navigation

Release preferences Standard release

Release preferences Deferred release

• Enable AI tools and agents to query trusted release and roadmap data via the MRC MCP Server and Microsoft MCP for Enterprise. 
• Note: Additional Microsoft 365 workloads will be supported in the future.

[What you need to do to prepare:]

• Review and configure your release preferences: Assign your release audience your tenant and users are assigned to in the Microsoft 365 Admin Center. 
  • Please note we will begin leveraging this new model for Microsoft 365 Copilot features in late May and preferences will be honored.
• Explore MCP-powered insights: Connect the MRC MCP Server and MCP for Enterprise to your AI-enabled tools to streamline change tracking and analysis. 

Learn more 

• Modernizing Change Management for Microsoft 365 Customers | Microsoft 365 Insider Blog
• Modern change management for Microsoft 365 – Overview | Microsoft Learn
• Configure modern release options for Microsoft 365 | Microsoft Learn
• Frequently asked questions about release options for Microsoft 365 | Microsoft Learn 
• Get started with the Microsoft Release Communications MCP Server | Microsoft Learn
• Overview of Microsoft MCP Server for Enterprise – Microsoft Graph | Microsoft Learn 
• What’s new in Message center | Microsoft Learn

[Introduction:]

We’re updating the Microsoft 365 Message center post structure to provide more consistent, concise, and actionable communications. This change standardizes section headings across Message center posts to improve readability, support automation scenarios, and enable future personalized and agentic experiences. As part of this update, existing section headings are being replaced with a new, consistent set of headers.

[When this will happen:]

May 16, 2026

[How this affects your organization:]

Who is affected

• Microsoft 365 administrators
• Admins or partners who use scripts, tools, or automation that parse Message center posts based on section headings

What will happen

• New Message center posts will use the following standardized headings:
  • What and Why
  • Rollout Schedule
  • Impact on Your Organization
  • Action Required/Recommendations
  • Compliance Considerations
• Previous Message center headings will no longer appear in newly published posts.
• Scripts or workflows that rely on the original headings may fail or return incomplete data if not updated.

[What you can do to prepare:]

• Review any scripts or automation that extract or classify Message center content by heading name.
• Update logic to recognize the new standardized headings.
• Validate downstream systems such as dashboards, alerts, or ticketing integrations.
• Communicate this change to admin, operations, and tooling teams as appropriate.

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

[Introduction]

We’re making a change to the characters allowed in naming and description fields across Microsoft Purview eDiscovery. As part of ongoing security hardening efforts, this update strengthens input validation for eDiscovery cases, holds, searches, and review sets to improve service resilience and reliability.

[When this will happen:]

General Availability (Production, GCC, GCC High, DoD): This change will begin rolling out in mid-May 2026 and is expected to be completed by late May 2026.

[How this affects your organization:]

Who is affected:

Organizations with users or administrators who create or manage Microsoft Purview eDiscovery:

• Cases
• Holds
• Searches
• Review sets

What will happen:

• Beginning May 15th, 2026, the following special characters will no longer be permitted in naming or description fields when creating or editing:
  • + (plus sign) 
  • – (hyphen) 
  • = (equals sign) 
  • @ (at sign) 
  • / (forward slash) 
  • * (asterisk) 
• This restriction applies to:
  • Case name and description
  • Hold policy name and description
  • Search name and description
  • Review set name and description
• Existing entities are not affected.
  • Cases, holds, searches, and review sets that already contain these characters will continue to function normally.
• Editing triggers enforcement:
  • If a user edits an existing entity that contains a restricted character in the name or description, they will see a validation message prompting them to update the value before saving.
  • The original name and description are preserved until the user chooses to make changes.
• New entities are enforced immediately:
  • Any newly created case, hold, search, or review set must not contain restricted characters in name or description fields.

[What you can do to prepare:]

No admin action is required to enable this change. However, we recommend the following:

• Inform your eDiscovery users that the characters + – = @ / and * will no longer be accepted in entity names and descriptions.
• Review and update existing naming conventions or templates that include these characters.
• Update internal documentation or guidance for eDiscovery naming standards.
• Communicate this change to helpdesk and compliance teams to prepare for validation messages when editing existing entities.

Learn about eDiscovery (Premium) | Microsoft Learn

No data loss will occur. Existing entities retain their current names and continue to function. Enforcement applies only at the time of creation or editing.

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

[Introduction]

To support industry-wide security improvements and modern cryptographic standards, browsers and platforms that follow Mozilla and Chrome trust stores will begin distrusting the DigiCert Global Root CA (G1) starting April 15, 2026. Microsoft has already migrated Microsoft 365 services to newer, more secure certificate hierarchies (such as DigiCert Global Root G2 and G3).

We’re sharing this notification to help you quickly identify and respond to any unexpected certificate-related connection issues that may arise in edge scenarios due to this industry trust change. This change is driven by industry trust store updates and does not represent a new change or rollout within Microsoft 365 services.

[When this will happen]

• April 15, 2026: Industry-wide distrust of DigiCert Global Root CA (G1) begins
• Microsoft monitoring period: April 15, 2026 and onward

[How this affects your organization]

Who is affected

• Organizations accessing Microsoft 365 services using:
  • Google Chrome or Mozilla Firefox
  • Linux-based systems, containers, appliances, or software stacks that rely on Mozilla/NSS trust stores
• Only scenarios where a service endpoint still presents a TLS certificate chaining to DigiCert Global Root CA (G1)

What will happen

• Most customers will not experience any impact.
• In rare legacy scenarios:
  • TLS connections may fail certificate validation
  • Failures may be intermittent depending on:
    • Client OS patch level
    • Browser version
    • Container or image refresh cadence
• Common error messages may include:
  • NET::ERR_CERT_AUTHORITY_INVALID
  • SEC_ERROR_UNKNOWN_ISSUER
  • SunCertPathBuilderException
  • verify error:num=19:self signed certificate in certificate chain

[What you can do to prepare]

No action is required if you are not experiencing certificate or TLS handshake errors.

If you encounter errors on or after April 15, 2026:

• Review the certificate chain presented by the failing endpoint
  • If DigiCert Global Root CA (G1) appears:
    • Stop local debugging or repeated mitigation attempts
    • Collect the following triage information:
      • Target URL or hostname
      • Full error message and timestamp (including time zone)
      • Client OS, version, browser/runtime, and whether it’s a VM, container, or appliance
      • Certificate chain evidence (log output or screenshot)
• Contact Microsoft Support through your normal support channel and reference:
  • “April 15, 2026 DigiCert Global Root CA (G1) industry distrust”

This information helps route your issue directly to certificate and TLS specialists and avoids unnecessary troubleshooting steps.

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.

Introduction

We’re introducing a new Charts web part with AI assistance in SharePoint, designed to help page authors quickly create rich, interactive charts using plain-language prompts. This update reduces the time and effort needed to visualize data on SharePoint pages and enables more intuitive, AI-powered authoring experiences directly within SharePoint.

This message is associated with Microsoft 365 Roadmap ID 560076.

When this will happen:

• Targeted Release: Rollout begins in early May 2026 and is expected to complete by mid-May 2026.
• General Availability (Worldwide): Rollout begins in mid-May 2026 and is expected to complete by late May 2026.

How this affects your organization:

Who is affected:

• SharePoint page authors
• Tenants using SharePoint Online
• A Microsoft 365 Copilot (Premium) license is required to use this feature

What will happen:

• While editing a SharePoint page, a Chart web part can be added in one of the following ways:
  • Open the AI agent chat pane from the Agents coin icon in the upper-right navigation or the AI sparkle icon on the page toolbar.
  • Open the web part toolbox, search for Chart under the AI category, and add it to the page (this automatically opens the chat pane).

  Screenshot 1: Entry point if adding a chart from the web part toolbox:

  

• Describe the chart to create using plain language, such as the data to visualize and the chart type. Relevant files can be attached to provide additional context.

Screenshot 2: Prompt to add a chart through the chat pane:



• After the chart is created, follow-up prompts can be used to:
  • Add, edit, or remove data
  • Adjust the look and feel of the chart
• Changes can be reverted at any time using the Undo button in the command bar.
• The feature is enabled by default for users with a Microsoft 365 Copilot license, and existing SharePoint permissions and Microsoft 365 policies continue to apply.

What you can do to prepare:

No action is required.

• Optionally inform SharePoint authors of the new capability.
• Update internal documentation if you provide SharePoint or Copilot guidance.
• Review Copilot licensing assignments to confirm which users will have access.

Learn more: Create a chart on pages with AI in SharePoint | Microsoft Support

Compliance considerations:

This change introduces a new way for users to interact with generative AI by using natural language prompts to create and edit charts in SharePoint pages.

[Introduction]

Microsoft Entra passkeys on Windows are now Generally Available, enabling phishing‑resistant, passwordless sign‑in to Microsoft Entra‑protected resources from Windows devices.

The Public Preview of this capability was previously announced in MC1247893.

Users can create device‑bound passkeys stored in the Windows Hello container and authenticate using Windows Hello methods (face, fingerprint, or PIN). This expands passwordless authentication support to Windows devices that aren’t Microsoft Entra‑joined or registered, helping organizations strengthen security and reduce reliance on passwords across corporate‑managed, personal, and shared device scenarios.

[When this will happen:]

• General Availability (Worldwide): We will begin rolling out in late April 2026 and expect to complete by mid‑June 2026.
• General Availability (GCC, GCC High, DoD): We will begin rolling out in early July 2026 and expect to complete by late July 2026.

How this affects your organization:

Who is affected:

Organizations using Microsoft Entra ID with passkeys enabled in the Authentication Methods policy whose users sign in from Windows devices, including:

• Corporate‑managed PCs
• Personal devices
• Shared devices

What will happen:

With this General Availability release:

• Microsoft Entra passkeys on Windows will no longer require explicit opt‑in through Windows Hello AAGUID allow‑listing in a passkey (FIDO2) profile.
• This represents a change from Public Preview behavior, where administrators were required to explicitly allow Windows Hello AAGUIDs in a passkey profile for Microsoft Entra passkeys on Windows to function.
• If your passkey profile allows device‑bound, non‑attested passkeys:
• Users scoped to that profile will now be able to register and use Microsoft Entra passkeys on Windows by default without additional administrator configuration.
• As a result:
  • Users in scope of passkey profiles that allow device‑bound, non‑attested passkeys may begin registering and using passkeys on Windows devices.
  • If Conditional Access policies allow:
    • Passkeys can be created and used on Windows devices that are not Microsoft Entra‑joined or registered, including personal or shared PCs.
• Each Windows device requires separate passkey registration per Entra account.
• Windows Hello for Business remains recommended for managed, Microsoft Entra‑joined or registered devices.
• Passkeys on Windows supplement unmanaged or shared device scenarios and do not support device sign‑in.
• Attestation is not currently supported for Microsoft Entra passkeys on Windows but is planned for a future update.

What you can do to prepare:

No action is required for most organizations.

If you do not want users to register or use Microsoft Entra passkeys on Windows:

• Update the relevant passkey (FIDO2) profile to block Windows Hello AAGUIDs.
• Review existing passkey profiles that allow device‑bound, non‑attested passkeys.
• Add Windows Hello AAGUIDs to the block list in passkey profiles where passkey usage on Windows devices should not be permitted.

Learn more: Enable Microsoft Entra passkey on Windows | Microsoft Learn (will be updated before GA rollout)

[Compliance considerations:]

[Introduction]

We’re updating how users access Copilot in Excel to provide a clearer, more consistent, and more intuitive experience across Microsoft 365 apps. These changes consolidate multiple Copilot entry points into a single, predictable location and establish Excel Edit Mode in the right-side chat pane as the primary Copilot interface. This update improves discoverability, simplifies user workflows, and aligns the Excel Copilot experience with other Microsoft 365 applications.

[When this will happen:]

• General Availability (Worldwide): Rollout begins in late April 2026 and is expected to complete by early June 2026.
• General Availability (GCC, GCC High, and DoD): Rollout begins in early October 2026 and is expected to complete by late October 2026.

[How this affects your organization:]

Who is affected:

• All users of Microsoft 365 apps for Excel on Windows, macOS, and the web with Copilot enabled.
• A Microsoft 365 Copilot (Premium) license is required to use this feature.

What will happen:

• Some Copilot entry points that appear when selecting a cell or opening the right-click menu will be removed.
• A single, consolidated Copilot entry point will appear in a consistent corner location within Excel.

Screenshot: Updated Excel entry point:



• The Excel Agent in the right-side chat pane becomes the primary interface for Copilot prompts and responses.
• Copilot availability, licensing, and existing admin policies remain unchanged.
• The feature is on by default for users who already have Copilot access.

[What you can do to prepare:]

No action is required.

You may optionally:

• Inform users about the updated Copilot entry points and chat-based experience in Excel.
• Update internal documentation or training materials if you reference specific Copilot buttons or menus.
• Notify helpdesk teams to prepare for user questions during rollout.

[Compliance considerations:]