Microsoft Roadmap, messagecenter and blogs updates from 09-12-2025

Updated December 8, 2025: We have updated the timeline. Thank you for your patience. 

 Coming soon for Microsoft Teams: Meeting participants will be able to request an annotation session while someone else is sharing their screen.

This message applies to Teams for Windows desktop and Teams for Mac desktop. (Users can view and annotate in Teams on the web but cannot initiate annotations.)

This message is associated with Microsoft 365 Roadmap ID 89975.

[When this will happen:]

Targeted Release: We will begin rolling out early February 2026 (previously early January) and expect to complete by mid-February 2026 (previously mid-January).

General Availability (WW, GCC, GCC High, and DoD): We will begin rolling out mid-February 2026 (previously mid-January) and expect to complete by late February 2026 (previously late January).

[How this will affect your organization:]

After the rollout, meeting participants who are not sharing their screens will have the ability to request an annotation session. This request will be sent to the presenter sharing their screen who can choose to accept or deny it:

If the request is accepted, the annotation session will start for everyone in the meeting:

Anonymous users in the meeting will not be able to send a request.

This change will be available by default.

[What you need to do to prepare:]

This rollout will happen automatically by the specified dates with no admin action required before the rollout. You may want to notify your users about this change and update any relevant documentation as appropriate.

Learn more: Use annotation while sharing your screen in Microsoft Teams – Microsoft Support (we will update this before rollout)

Watch: How to use Collaborative Annotations in a Microsoft Teams meeting (2022)

Updated December 8, 2025: We have updated the timeline. Thank you for your patience. 

Copilot Dashboard users can now view metrics that reflect both summarized and recapped meeting activity, offering a more complete view of Copilot’s impact in Teams. These updates replace previous Copilot Assisted Hour calculations and meeting metrics with unified “summarized or recapped” metrics, helping leaders better understand usage across their organization. The updated metrics are available in both the Copilot Dashboard and the M365 Copilot Impact report in Advanced Insights, with additional query support for Intelligent Recap meeting metrics.

This change is associated with Microsoft 365 Roadmap ID: 494687 

[When this will happen:]

Public Preview: We will begin rolling out this change late September 2025 (previously late July) and expect to complete by late October 2025 (previously late September).

General Availability (Worldwide): We will begin rolling out this change early December 2025 (previously early January 2026) and completed early December 2025 (previously end of January 2026).

[How this will affect your organization:]

• Copilot Assisted Hours and Value calculations: values displayed under these metrics will increase, including for prior months, since these numbers will now include meetings where users accessed Intelligent Recap feature on Microsoft Teams.

  

• Meetings card: meeting hours and meetings summarized metrics will be updated to include meetings where Intelligent Recap was accessed.

  

Users who have access to Advanced Insights will see similar updates in the M365 Copilot Impact report. They will also be able to include “Meetings recapped” and “Meeting hours recapped” metrics in their flexible queries.

[What you need to do to prepare:]

The changes mentioned do not impact eligibility criteria to access the M365 Copilot Dashboard or the Microsoft 365 Copilot Impact report on Advanced Insights.

To view the updated metrics in Advanced Insights, you can access the pre-computed Microsoft 365 Copilot Impact report. You can also set-up your own query to customize metrics and additional organizational attributes.

To learn more, please see the following:

1. How to access the Copilot Dashboard and understand Copilot Assisted Hours metrics: Connect to the Microsoft Copilot Dashboard for Microsoft 365 customers | Microsoft Learn
2. To access the Microsoft 365 Copilot Impact report and understand Copilot Assisted Hours metrics: Microsoft 365 Copilot impact report | Microsoft Learn 
3. How we define Copilot meeting metrics: Advanced insights metric descriptions | Microsoft Learn 
4. How to access Advanced Insights: Introduction to advanced insights | Microsoft Learn

Updated December 8, 2025: We have updated the timeline. Thank you for your patience.

In response to customer feedback, we are introducing enhanced flexibility, greater scalability, and streamlined compliance management for private channels in Microsoft Teams.

Note: It is important for compliance managers to review and take appropriate action before migration starts for these changes to private channels.

[What’s changing?]

Private channels will transition use a channel mailbox instead of individual user mailboxes.

Organizations with compliance policies (retention, legal hold, data loss prevention, or eDiscovery) for private channels must review these policies and must apply policies to the Microsoft 365 group for the channel’s team before migration begins to ensure continuity of the policy for a private channel. Existing policies will continue to apply to user mailboxes; post-migration, new data will be governed by policies on the group. Note that policies applied to the team’s group can apply to all channels in the team.

After the transition to updated private channels in your organization, private channels will be updated as follows.

1. Private channels are no longer limited to 30 per team. Instead, private channels can be added up to the limit of 1000 total channels per team.
2. Private channels can now have up to 5000 members, instead of 250.
3. Meetings can now be scheduled in private channels.
4. Compliance policies for private channels are part of the team’s group policies instead of the individual user level.

The migration of private channels to the updated capabilities will begin in early October 2025 and continue through January 2026 (previously December 2025). During this period, private channels will continue to operate normally. Admins and compliance managers should complete any required policy changes by October 2025 (previosly September), before the migration begins. Changes to private channel limits and meeting scheduling will follow in February 2026. Migration can start or end at different times for each tenant during the rollout period. To track progress, a new PowerShell command will be available for tenants to check whether their migration has started or is completed. This post will be updated soon with details on the PowerShell command.

[When this will happen:]

General Availability (Worldwide): We will begin rolling out private channel migration early October 2025 (previously late September) and expect to complete by late January 2026 (previously mid-December 2025). Updated channel limits and meeting scheduling will begin rollout in early February 2026 and we expect to complete by end of February 2026.

Message exceeds character limit for the request portal. Adding html below for reference: https://microsoft-my.sharepoint-df.com/:t:/p/brimcg/ERmYzK2UOKBBi9726qR52nEBGw-0sPPCEc1PfogoBOxb-A?e=mfTqqs 

Updated December 8, 2025: We have updated the timeline below. Thank you for your patience.

Introduction

We’re introducing a new request and approval experience in the Microsoft 365 admin center for Microsoft agents. This update enables users to request access to agents—even those currently unavailable due to your organization’s configuration—directly from the Agent Store.

You can manage these requests centrally from the Copilot > Agents & connectors page in the Microsoft 365 admin center, streamlining access control and improving visibility into user interest.

Note: This request flow applies exclusively to agents built by Microsoft and does not extend to other agents available in the store.

This message is associated with Microsoft 365 Roadmap ID 494809.

When this will happen

Rollout will begin early January 2026 (previously late November 2025) and complete by end of January 2026 (previously mid-December 2025).

How this affects your organization

This update enhances flexibility and transparency in agent access management:

• Admins retain full control over access decisions and benefit from:
  • Centralized management of agent access requests.
  • Granular control to approve or reject requests at the individual user level.

This feature is on by default and requires no configuration to enable.

What you can do to prepare

No setup is required—this feature will roll out automatically.

To prepare:

• Visit the Copilot > Agents & connectors page in the Microsoft 365 admin center to view and manage agent access requests.
• Approve or reject requests based on your organization’s policies.

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

Updated December 8, 2025: We have updated the timeline due to a pending release for the Monthly Enterprise Channel. Thank you for your patience. 

Introduction

IT Administrators will be able to set up Word, Excel, and PowerPoint Windows applications to limit the creation of new files to only Cloud Locations (OneDrive, SharePoint, or third-party Clouds).

This configuration is called enablecloudonlysaveasmode is available only to IT Administrators and deployed using Group Policies. This policy is available now in the Administrative Template files for Microsoft Office (version 5516.1000 or newer).

For the policy to apply, users should be using a Windows version of Word, Excel and PowerPoints Version 2506 (Build 19029.20000) or newer.

This new Policy is part of a new set of tools for IT Administrators to move their organizations towards higher Cloud usage and Increase security and compliance: Files in the Cloud are automatically protected by your company’s security rules and labeling, so you don’t have to take extra steps to keep them safe and compliant.

This policy setting controls whether Word, Excel, and PowerPoint users can use non-Cloud locations (local and network) to create new files. If you enable this policy setting, users will only have Cloud Locations available to perform Save As and Save new files. If you disable or don’t configure this policy setting, users can use any location (Cloud, Local, and Network) to perform Save As and Save new files. Note: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for Enterprise.

When this will happen

• Public Preview: We will begin rolling out late August 2025 and expect to complete by mid-September 2025.
• General Availability (Worldwide, GCC, GCC High, and DoD): We will begin rolling out mid-September 2025 and is now expected to complete by end of December 2025 (previously late September).

How this will affect your organization

If you do nothing, this change will have no impact on your organization.

If you enable the new Policy, Office will limit the creation of new Word, Excel, or PowerPoint files to Cloud Locations; Save and Save a Copy operations will only present Cloud locations and all local destinations will disappear from Office programs.

If Known Folders have been redirected to OneDrive (KFM), these folders are considered Cloud folders and they will be available for Save and Save a Copy operations.

What you need to do to prepare

If your organization already keep all Office files in the Cloud, this policy will prevent users from accidentally saving files outside of the Cloud.

If users in your organization still use local files, this policy will promote the creation of new files in the Cloud and prevent additional files to be created locally. You can communicate this change to end users explaining the advantages of saving the files to the Cloud instead of saving to local folders:

• Easy collaboration: It’s easy to work with others—just share your Cloud file to start collaborating right away. You and your team can add comments and make changes together, and AutoSave keeps your work updated in real time.
• Never lose your progress: Don’t worry about losing your work—files in the Cloud include AutoSave on, meaning your documents are automatically saved for you as you work.​
• Access from anywhere: Files you create in Word, Excel, or PowerPoint on Windows are instantly available from your Mac, web browser, iPhone, or Android device. When you make changes on one device, they are available from everywhere.

To minimize impact on users, we recommend moving (redirecting) known folders to OneDrive (Redirect and move Windows known folders to OneDrive – SharePoint in Microsoft 365)

To deploy this policy:

If you use Active Directory, Microsoft Entra or hybrid environments, you can use Group Policy Objects. Group policy can represent policy settings in the file system or in Active Directory Domain Services. When used with Active Directory, Group Policy settings are contained in a Group Policy Object (GPO). (Group Policy overview for Windows; Create and manage group policy in Microsoft Entra Domain Services – Microsoft Entra ID)

You can also use Cloud Policy Service: Cloud Policy service for Microsoft 365 lets you enforce policy settings for Microsoft 365 Apps for enterprise on a user’s device, even if the device isn’t domain joined or otherwise managed. When a user signs into Microsoft 365 Apps for enterprise on a device, the policy settings roam to that device. (Overview of Cloud Policy service for Microsoft 365 – Microsoft 365 Apps)

Learn More:

• Redirect and move Windows known folders to OneDrive – SharePoint in Microsoft 365
• Download Administrative Template Files (ADMX/ADML) for Microsoft Office
• Overview of Cloud Policy service for Microsoft 365 – Microsoft 365 Apps
• Group Policy overview for Windows
• Create and manage group policy in Microsoft Entra Domain Services – Microsoft Entra ID

Compliance considerations

Updated December 8, 2025: We have updated the content and timeline. Thank you for your patience. 

[Introduction]

Outlook’s Events from email feature helps users stay organized by automatically adding reservations such as flights, hotels, rental cars, and deliveries to their calendars.  To improve reliability and ensure this feature continues to work smoothly, we strongly encourage all providers to adopt Schema.org markup in their transactional emails. This change aligns with industry standards and improves accuracy, consistency, and long-term support.

• Legacy extraction is fragile, and once templates fail, they cannot be fixed.
• We are receiving increasing reports of incorrect or missing events.
• It is technically impossible to make further improvements to the old stack.
• Without migration to Schema.org, the quality and reliability of event extraction will continue to degrade over time.

Screenshot of Settings > Calendar > Events from email

[When this will happen:]

We encourage providers to transition to Schema.org as early as possible, as continued reliance on legacy support is not sustainable. Organizations that do not migrate may experience a gradual decline in the accuracy, reliability, and consistency of automatically generated events. These issues cannot be fixed on the legacy stack, the only long-term solution is migration to Schema.org standards.

[How this affects your organization:]

Who is affected:

• Organizations whose users rely on Outlook’s Events from email feature.
• Partners and providers who send transactional emails (e.g., airlines, hotels, travel agencies, delivery services).

What will happen:

• Emails that continue to rely on legacy extraction may experience increasing failures, missing events, and incorrect calendar entries over time.
• Emails using Schema.org markup will continue to generate calendar events automatically.
• Partners using Schema.org markup report up to 30% higher engagement and more reliable event extraction.

[What you can do to prepare:]

• Identify your Corporate travel partner(s) that are sending booking confirmation emails to your employees and reach out to them for adopting Schema.org support
• To determine whether a provider is using Legacy or Schema.org, you can safely assume most providers are still on Legacy- our data shows that 94% of providers remain on legacy extraction.
• To get more assistance on onboarding a provider to Schema.org, please reach out to [email protected] along with your provider details/contacts and the domains from which these mails are sent, so they can be whitelisted. A detailed onboarding & testing process will be shared. 
• Communicate this change to helpdesk staff.

[Compliance considerations]

Updated December 8, 2025: We have changed the expiration date. Thank you for your patience. 

[Introduction]

The Learning agent is now available in Frontier. This agent helps employees build skills through personalized microlearning and structured learning experiences embedded directly into Microsoft 365 tools. These experiences include personalized task-based Copilot tips to augment workflows, learning recommendations tailored to user skills, curated learning paths, and interactive role-play exercises powered by LinkedIn Learning.

This message is associated with Roadmap ID 490154.

About Frontier

The Frontier program gives customers early, hands-on access to experimental Microsoft 365 Copilot innovations in their own environment. The agents and AI features designated as “Frontier” are previews, built for evaluation and feedback purposes. As these features are still in development, their availability and capabilities may change at any time.

[When this will happen:]

Frontier Availability (Worldwide): Available now.

[How this affects your organization:]

• Who is affected: Customers with Microsoft 365 Copilot and the Microsoft 365 Copilot in Productivity Apps service plan (excluding faculty and student SKUs).
• What will happen:
  • Learning agent (Frontier) will be available to deploy in the Copilot Control Center within Microsoft 365 admin center.
  • Users will be able to install and use the Learning agent within Microsoft 365 Copilot or Teams.
  • Admins have controls to manage deployment, including install, restrict, or remove the agent.
  • Feature is opt-in; admins must deploy or allow access.

[What you can do to prepare:]

• Ensure People Skills is set up in your tenant: People Skills Overview
• Confirm licensing: Users must have an active Microsoft 365 Copilot license.
• Approve or deny access at tenant or user level in Microsoft Admin Center under Copilot > Settings.
• Review admin controls for agents: Settings for Agents

Frontier features are experimental and subject to change. Participation in the Frontier program is optional.

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

Updated December 8, 2025: We have updated the content. Thank you for your patience. 

[Introduction]

The new Designer editor integration in PowerPoint introduces a modern, intuitive image editing experience directly within your slides—eliminating the need to switch apps or interrupt your workflow. Whether you’re refining visuals for a pitch deck, enhancing marketing assets, or simply making your slides more engaging, the Designer editor enables fast, seamless image enhancements powered by AI.

Screenshot 1: Designer editor is now built into PowerPoint, so you can edit pictures without leaving the app. To get started, select a picture and then select Picture Format > Edit Picture, or right-click it and select Edit Picture.

Screenshot 2: Transform your visuals using AI-powered tools like Remove background, Auto enhance, and more—right from the canvas.

This message is associated with Microsoft 365 Roadmap ID 508530.

[When this will happen:]

• General Availability (Worldwide): Rollout will begin in mid-December 2025 (previously early December) and is expected to complete in January 2026 (previously mid-December 2025).

[How this affects your organization:]

• Who is affected: All users of PowerPoint in Microsoft 365 across commercial and education tenants.
• What will happen:
  • Users will gain access to a new AI-powered image editing experience within PowerPoint.
  • The Designer editor will be available directly in the PowerPoint interface.
  • The following capabilities will be included:
    • Generative Erase:  Remove unwanted elements from images.
    • Generative Move: Reposition objects within an image.
    • Add Text: Insert text directly onto images.
    • Edit Text: Recognize existing text in an image and edit it.
    • Upscale: Improve image resolution for sharper visuals.
    • Background Removal: Remove backgrounds for clean designs.
    • Auto Enhance (Color Adjustment): Automatically improve color balance and vibrancy.
    • Effects: Apply creative filters and styles.
  • This feature cannot be turned off individually.
  • No changes to existing admin policies are required unless your organization chooses to manage availability.
  • AI usage limits for this feature:
    • Commercial users:
      • Copilot users have fair use access to all generative AI features.
      • Starter users have capacity-limited access; in-product messaging will notify users when limits are reached.
    • Consumer users:
      • Free and Basic MSA accounts: 15 credits/month for generative AI features.
      • Personal and Family subscribers: 60 credits/month.
      • Microsoft 365 Premium and Copilot Pro (while supported): fair use access.

[What you can do to prepare:]

• No action is required to enable the feature.
• Review internal documentation if you provide guidance on PowerPoint features.
• Communicate this change to helpdesk and support teams to prepare for potential user questions.
• If your organization wishes to manage availability:
  • Configure access through policy or permissions as needed.
• Be aware:
  • This feature uses AI capabilities to edit and enhance images in PowerPoint.
  • AI usage disclaimers are included within the editor interface for end users.

[Compliance considerations:]

Updated December 8, 2025: We have updated the timeline. Thank you for your patience. 

We’re introducing a new capability that enhances Microsoft Copilot by integrating historical Copilot conversations into Microsoft Search. This update allows users to retrieve past interactions—including chats from notebooks, agents, and the main Copilot chat interface—directly within the search results page (SERP). A new “Copilot Chats” data source will also appear in the right rail, enabling users to scope their search specifically to Copilot-generated content.

A Microsoft 365 Copilot license is required to access this feature.

This message is associated with Microsoft 365 Roadmap ID 506751.

• Public Preview (Worldwide): Rolling out early November 2025; expected completion by mid-November 2025.
• Targeted Release (Worldwide): Rolling out mid-November 2025; expected completion by early December 2025 (previously late November).
• General Availability (Worldwide): Rolling out mid-December 2025 (previously late November); expected completion by late December 2025 (previously early December).

• Who is affected: All users of Microsoft Copilot in Microsoft 365.
• What will happen:
  • Users will be able to search and retrieve historical Copilot conversations from:
    • Notebooks
    • Agents
    • The main Copilot chat interface
  • A new “Copilot Chats” data source will appear in the right rail of the search results page: 

  

  • Users can scope their search to only include Copilot-generated content.
  • Each user will only have access to their own Copilot conversations.
  • No changes to tenant-wide settings or permissions are required.

• No action is required from tenant admins at this time.
• You may wish to inform your users about this new search capability to help them take full advantage of Copilot.

Updated December 8, 2025: We have updated the title. Thank you for your patience. 

[Introduction]

We’re adding more customization to your communities in the Viva Engage app for Microsoft Teams in iOS. Soon, as a community admin, you’ll be able to update your communities’ cover photos directly from the Teams iOS app. This feature is already available on Teams for Windows desktop, Teams for Mac desktop, Teams for the web, and Teams for Android, and supports a consistent and personalized experience across platforms.

Screenshot 1: A community’s cover photo, with options to Take a photo or Upload a picture.

This message is associated with Roadmap ID 526783.

[When this will happen:]

General Availability (Worldwide): We will begin rolling out in late December 2025 and expect to complete by early January 2026.

[How this will affect your organization:]

Who is affected: All Viva Engage community admins using the Viva Engage app in Microsoft Teams.

What will happen:

• Users will be able to update community cover photos directly from the Teams iOS app.
• This feature is enabled by default and does not require admin configuration.
• There is no change to existing admin policies or controls.

[What you can do to prepare:]

• Update any internal documentation that references community customization.
• No admin action is required to enable this feature.

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

Updated December 8, 2025: We have updated the timeline. Thank you for your patience. 

[Introduction]

We’re introducing a new capability in Microsoft 365 Copilot chat that allows users to RSVP to meetings directly within the chat experience. This enhancement simplifies meeting management by enabling quick responses such as Accept, Decline, Tentative, Follow, or Remove canceled meetings—all without leaving Copilot chat.

General Availability (Worldwide, GCC and DoD): Rollout will begin mid-December 2025 (previously early December) and is expected to complete by late December 2025.

• Who is affected: Users with a Microsoft 365 Copilot license.
• What will happen:
  • Users can RSVP to meetings directly from Copilot chat:

  

  • Supported actions include Accept, Decline, Tentative, Follow, and Remove canceled meetings: 

  

  • This feature will be ON by default for all tenants.
  • No admin configuration is required; existing policies remain unchanged.

• No action is required from admins.
• Communicate this new capability to your helpdesk or end users if needed.

No compliance considerations identified, review as appropriate for your organization.

[Introduction:]

In September, Anthropic models became available in certain Copilot experiences through an opt-in setting, where use was subject to Anthropic’s commercial terms and data processing agreement. On January 7, 2026, Anthropic models will be enabled by default for many customers and now offered under the Microsoft Product Terms and Data Protection Addendum. To enable this change, Anthropic has been onboarded as a Microsoft subprocessor. This transition extends Microsoft’s contractual commitments and data protection standards to the use of Anthropic models in Copilot experiences.

[How this affects your organization:]

Who is affected:

• Admins managing Microsoft 365 Copilot and Microsoft Copilot Studio.
• Microsoft 365 Copilot licensed customers participating in select Frontier features such as Word, Excel, PowerPoint, and Researcher agents, as well as Agent Mode in Excel.

Key changes

• Dec 8, 2025: New admin toggle for Anthropic models appears in the Microsoft 365 admin center (MAC). For most commerical cloud customers, it will be enabled ON by default (except customers in EU/EFTA and UK will be OFF by default). See “customer and region exclusions” section below for more details.
• January 7, 2026: Anthropic as a Microsoft subprocessor becomes enabled on your tenant; the legacy admin toggle to opt-in to Anthropic’s commercial terms and data processing agreement is deprecated.
  • If you previously opted in to the legacy Anthropic toggle, and you’re in an excluded region, you would need to opt in to the new subprocessor toggle.
• Admins can opt out in MAC now – no need to wait until January.

Some features are only available when Anthropic models are enabled. If you turn off this option, certain features may no longer be accessible.

Customer and region exclusions:

The following customers and regions will not have the toggle set to default on:

• Customer tenants in EU/EFTA and UK: The toggle will be set to default off. You will need to opt in to use Anthropic models as a subprocessor.
• Government clouds (GCC, GCC High, DoD) or sovereign clouds: Anthropic models are not yet available in government or sovereign clouds. No toggle will be present for those clouds.

What does it mean that Anthropic is now a Microsoft subprocessor?

As a subprocessor for Copilot experiences, Anthropic will operate under Microsoft’s direction and contractual safeguards. This includes coverage under the Microsoft Data Protection Addendum (DPA) and Product Terms. In addition, use of Anthropic models in Microsoft 365 Copilot falls under our Enterprise Data Protection as described here. Note that Anthropic models are currently excluded from EU Data Boundary and when applicable, in-country processing commitments. 

Learn more:

• Integrate and manage Anthropic’s AI models in Microsoft 365 Copilot
• Enterprise data protection in Microsoft 365 Copilot and Microsoft 365 Copilot Chat
• Use Claude with Researcher in Microsoft 365 Copilot
• Get started with Word, Excel, and PowerPoint Agents (Frontier) in Microsoft 365 Copilot
• Choose an external model as the primary AI model – Microsoft Copilot Studio

• Configure Microsoft Update Managed Opt-In 
• Configure High-Confidence Opt-Out 
• Enable SecureBoot Certificate Updates 

1. Under Devices > Manage devices, select Configuration. 
2. Select Create and select New Policy. 
3. Select Create a profile in the right-hand pane. 
4. Fill in Platform with Windows 10 and later. 
5. Select the Settings Catalog under the Profile Type. ​​​​​ 
6. Begin creating a profile by giving the profile a name. Press Next.​​​​​​ 
7. Under Configuration settings, select Add settings. In the Settings picker, search for Secure Boot. There should be three settings in the Secure Boot category. 
8. Select the desired settings for your organization: Configure Microsoft Update Managed Opt-In, Configure High-Confidence Opt-Out, and Enable SecureBoot Certificate Updates (preselected for you). 
9. Finish the profile for the devices that will use these settings. 

• Read complete guidance at Microsoft Intune method of Secure Boot for Windows devices with IT-managed updates. 
• Compare this method to Registry key updates for Secure Boot: Windows devices with IT-managed updates.  
• Compare this method to Group Policy Objects (GPO) method of Secure Boot for Windows devices with IT-managed updates. 
• See how these methods work together in Secure Boot playbook for certificates expiring in 2026.