Microsoft Roadmap, messagecenter and blogs updates from 18-11-2025

Updated November 17, 2025: We have updated the timeline. Thank you for your patience.

Introduction

We’re introducing a new integration between Microsoft Teams and Microsoft Defender for Office 365 that enables security admins to manage blocked external domains in Teams using the Tenant Allow/Block List (TABL) in the Microsoft Defender portal. This feature enhances security by allowing organizations to centrally manage domain blocks across Microsoft 365 services.

This capability is available to customers with Microsoft Defender for Office 365 Plan 1 or Plan 2 and Microsoft Teams.

This message is associated with Microsoft 365 Roadmap ID 492985.

When this will happen

Targeted Release: We will begin rolling out late August 2025 and expect to complete by early September 2025.

General Availability (Worldwide): We will begin rolling out early January 2026 (previously late September 2025) and expect to complete by end of January 2026 (previously early October 2025).

How this affects your organization

Security admins, with permission from Teams admins, will be able to:

• Add, delete, and view blocked external domains in Microsoft Teams using the Microsoft Defender portal.
• Prevent incoming communications (chats, channels, meetings, and calls) from blocked domains.
• Automatically delete existing communications from users in blocked domains.
• Track actions taken to block domains in audit logs, supporting compliance monitoring and reporting.

View and manage blocked domains for Teams in the Microsoft Defender portal:

This change does not affect existing federation configurations or domain blocks set in the Teams admin center.

• Entry limit: Up to 4,000 blocked domains can be configured for Teams.
• Client impact: Applies to all Teams clients and the Defender XDR web portal.

What you can do to prepare

To enable this feature – 

• Ensure that external access in the Teams admin center is set to either:
  • Block only specific external domains, or
  • Allow all external domains
• Teams admins must enable the setting “Allow my security team to manage blocked domains” in the Teams admin center. This setting is off by default.

Enable security team access to manage blocked domains in the Teams admin center:

Learn more: Block domains in Microsoft Teams using the Tenant Allow/Block List | Microsoft Defender for Office 365 | Microsoft Defender | Microsoft Learn

Compliance considerations

Updated September 9, 2025: We have updated the timeline. Thank you for your patience.

[Introduction]

To enhance detection capabilities in Insider Risk Management (IRM), we’re adding two new email indicators as triggers for data exfiltration activities. These indicators help identify potential data leaks when users send business-sensitive attachments to personal or public email domains. This update supports stronger data protection and aligns with customer feedback requesting broader coverage of email-based risks.

This message is associated with Microsoft 365 Roadmap ID 496149.

General Availability (Worldwide, GCC, GCC High, GCC DoD): Rollout will begin in early December 2025 (previously early September) and is expected to complete by late December 2025 (previously late September).

• Who is affected: Admins managing Insider Risk Management policies.
• What will happen:
  • Two new email triggers will be available:
    • Sending email with attachments to free public domains.
    • Sending email with attachments to self (personal email).
  • These indicators can be enabled from the IRM settings page.
  • Sequence detections will now include these indicators as exfiltration activities.
  • IRM quick policy templates will be updated:
    • Email exfiltration: These two indicators will be set as default triggers and indicators. Sending email with attachments to external recipients will not be enabled by default.
    • Data leaks: Both indicators will be added to triggers and indicators, with no changes to existing ones.
    • Data theft by users leaving your org: Indicators will be added; existing triggers and indicators remain unchanged.
    • Critical asset protection: Both indicators will be added to triggers and indicators, with no changes to existing ones.
  • Existing policies created from quick templates will not be affected.

• No action is required. The new triggers will automatically become available for configuration in the IRM policy wizard.

No compliance considerations identified, review as appropriate for your organization.

Updated November 17, 2025: The rollout of “Report incorrect security detection in Microsoft teams is expected to finish by the end of November 2025 for General Availability (Worldwide). The previously announced update to make “Report incorrect security detections” settings in Messaging settings in Teams admin center On by default has been postponed to early 2026. A separate communication will be issued detailing the roll out schedule for the default-on change in advance.

Thank you for your patience.

Introduction

Microsoft Teams now enables users to report messages they believe were incorrectly flagged as security threats in chats and channels. This capability is available to organizations with Microsoft Defender for Office 365 Plan 2 or Microsoft Defender XDR. It empowers users to provide feedback on false positives, helping improve detection accuracy and strengthen organizational security.

This feature will be available across Microsoft Teams on Android, Desktop (Windows), iOS, Mac, and Web platforms, ensuring broad accessibility for users regardless of device.

This feature is associated with Microsoft 365 Roadmap ID 501202.

When this will happen

Targeted Release (Worldwide): Begins in early September 2025; expected completion by mid-September 2025.

General Availability (Worldwide): Begins in early November 2025; expected completion by end of November 2025 (previously mid-November).

How this affects your organization

Users will be able to report messages they believe contain URLs that were incorrectly flagged as malicious:

• During Targeted Release, the feature is off by default in Teams.
• At General Availability, the feature will be on by default in Teams. Admin settings saved during Targeted Release will remain unchanged.
• In the Microsoft Defender portal, the setting is on by default for new tenants. Existing tenants must enable it manually.

What you can do to prepare

To enable this feature and ensure reported messages appear in the User reported tab in Submissions:

• In the Teams admin center, go to Messaging settings > Messaging safety and turn on Report incorrect security detections.



• In the Microsoft Defender portal, ensure the corresponding setting is enabled.

  

Both settings must be turned on for full functionality.

Learn more: [Updated documentation to be made available on Microsoft Learn in the second week of September 2025.]

Compliance considerations

Updated November 17, 2025: The rollout of Malicious URL Protection in Microsoft Teams is expected to finish before the end of November 2025 for General Availability (Worldwide). The previously announced update to make Malicious URL protection setting in Messaging settings ON by default has been postponed to early 2026. A separate communication will be issued detailing the roll out schedule for the default-on change in advance.

Thank you for your patience.  

Introduction

Microsoft Teams is introducing enhanced protection against phishing attacks by detecting and warning users about malicious URLs shared in Teams chats and channels. This feature helps users make safer decisions before clicking potentially harmful links. This message applies to Teams for Windows desktop, Teams for Mac desktop, Teams for the web, and Teams for iOS/Android.

This message is associated with Roadmap ID 499893.

When this will happen

• Targeted Release (Worldwide): Rollout begins early September 2025 and is expected to complete by mid-September 2025.
• General Availability (Worldwide): Rollout begins early November 2025 and is expected to complete by end of November 2025 (previously mid-November).

How this affects your organization

When a malicious link is detected, Teams will automatically display a warning to both the sender and recipient. This helps reduce the risk of phishing attacks.

• Targeted Release: Link protection is applied only when all participants in the conversation have the feature enabled.
• General Availability: Link protection is enforced if at least one participant in the conversation has the feature enabled.

Targeted release vs. General Availability behavior:

• Targeted release: Link protection is applied only when all organizations in the conversation have the feature enabled. This feature is off by default and requires admin activation.
• General Availability: Link protection is applied if at least one participant has the feature enabled. This feature is on by default. Admin settings saved during Targeted Release will remain unchanged. 

What you can do to prepare

During Public Preview, administrators must manually enable the feature:

1. Go to the Teams Admin Center
2. Navigate to Messaging Settings
3. Enable the setting: Scan messages for unsafe URLs

This setting is also available via Set-CsTeamsMessagingConfiguration PowerShell cmdlet –UrlReputationCheck parameter.

No action is required once the feature reaches General Availability, as it will be turned on by default.

Learn more: Malicious URL Protection in Microsoft Teams

Compliance considerations

Reminder:

Updated November 17, 2025: The rollout of Weaponizable file type protection in Microsoft Teams is expected to finish before the end of November 2025 for General Availability (Worldwide). The previously announced update to make Weaponizable file protection setting in Messaging settings ON by default has been postponed to early 2026. A separate communication will be issued detailing the roll out schedule for the default-on change in advance.

Thank you for your patience.

Introduction

Microsoft Teams is introducing a new protection feature that blocks messages containing weaponizable file types—such as executables—in chats and channels. This helps reduce the risk of malware and file-based attacks by preventing unsafe content from being shared. This message applies to Teams for Windows desktop, Teams for Mac desktop, Teams for the web, and Teams for iOS/Android.

This message is associated with Roadmap ID 499892.

When this will happen

General Availability begins November 3 and will complete by end of November. At GA, “Scan messages for file types that are not allowed” will default to ON, and protection will apply if any participant in a conversation has it enabled.

To use a different setting, go to Teams admin center → Messaging settings → Scan messages for file types that are not allowed, select your preference, and click Save before GA.

Note: Simply viewing the page without saving will not override the default, but settings already saved during Targeted Release will persist.

• Targeted release (Worldwide): Starts early September 2025; expected to complete by mid-September 2025.
• General Availability (Worldwide): Starts early November 2025; expected to complete by end of November 2025 (previously mid-November).

How this affects your organization

Once enabled, Teams will automatically block messages that include weaponizable file types. This applies to both internal and external conversations.

• Recipients will see a notification that a message was blocked but cannot access the content.
• Senders will receive a notification and can edit and resend the message without the unsafe file.

Targeted release vs. General Availability behavior:

• Targeted release: Protection is enforced only when all organizations in the conversation have the feature enabled. This feature is off by default and requires admin activation.
• General Availability: Protection is enforced if at least one participant has the feature enabled. This feature is on by default. Admin settings saved during Targeted Release will remain unchanged.

What you can do to prepare

Admins can enable this protection in the Teams Admin Center:

1. Go to the Teams Admin Center
2. Navigate to Messaging Settings
3. Turn on the setting: Scan messages for file types that are not allowed

Alternatively, use PowerShell with the -FileTypeCheck parameter.

Once enabled, all users in your tenant will begin seeing file protection applied in their messages.

Blocked file types include:

ace, ani, apk, app, appx, arj, bat, cab, cmd, com, deb, dex, dll, docm, elf, exe, hta, img, iso, jar, jnlp, kext, lha, lib, library, lnk, lzh, macho, msc, msi, msix, msp, mst, pif, ppa, ppam, reg, rev, scf, scr, sct, sys, uif, vb, vbe, vbs, vxd, wsc, wsf, wsh, xll, xz, z

Learn more: 

• Weaponizable File Protection in Microsoft Teams

Compliance considerations

Updated November 17, 2025: We have updated the timeline. Thank you for your patience.

[Introduction]

To enhance transparency and user control, Microsoft Teams is expanding the Explicit Recording Consent feature to include 1:1 Teams calls. This update ensures that participants must provide explicit consent before their media (audio, video, and content sharing) is included in any recording or transcription initiated by another user. This change supports privacy compliance and aligns with customer feedback requesting more granular consent controls.

This message is associated with Roadmap ID 503295.

• Targeted Release: Begins early December 2025, completes mid-December 2025.
• General Availability (Worldwide, GCC): Begins mid-December 2025, completes mid-January 2026.
• General Availability (GCC High): Begins late January 2026 (previously mid-January), completes early February 2026 (previously late January).
• General Availability (DoD): Begins late January 2026, completes mid-February 2026 (previously mid-February).

Who is affected:

• Microsoft Teams administrators managing calling policies.
• Users participating in 1:1 Teams VoIP calls where recording or transcription is initiated.
• Public Switched Telephone Network (PSTN) endpoints will be auto consented. Explicit consent support for PSTN will be included in a future release.

What will happen:

• This feature applies to Microsoft Teams desktop apps on Windows and macOS.
• By default, Explicit Recording Consent is OFF and must be enabled by administrators.
• When enabled:
  • Users initiating recording or transcription in 1:1 calls will trigger a consent prompt for the other VoIP participant.
  • Until consent is granted, the participant’s audio, video, and screen/content sharing will be disabled, and as a result, excluded from the recording.
  • PSTN users will be auto-consented. Learn more at Manage Teams recording policies | Auto consent endpoints and platforms
• Administrators can apply this policy tenant-wide or to specific users.

• Update training materials to reflect that Explicit Recording Consent now applies to 1:1 calls (PSTN and Teams VoIP).
• Inform users that consent is required before recording or transcription can begin in 1:1 calls.
• Administrators can manage this feature via PowerShell or the Microsoft Teams admin center.

PowerShell commands:

Set-CsTeamsCallingPolicy -Identity Global -ExplicitRecordingConsent "Enabled"
Set-CsTeamsCallingPolicy -Identity Global -ExplicitRecordingConsent "Disabled"

Learn more: Set-CsTeamsCallingPolicy documentation

[Compliance considerations:]

Updated November 17, 2025: We have updated the timeline. Thank you for your patience. 

Custom engine agents (CEA) are specialized agentic solutions that can be built using any large language model (LLM), toolchain, or orchestration framework, and are tailored to specific domain or tenant workflows. These agents can be created using either Microsoft Copilot Studio or the Agents Toolkit. File upload support is already available in Microsoft 365 Copilot Business Chat.

We’re now extending this capability to Custom engine agents, enabling users to upload files stored locally or in OneDrive directly to agents. Once uploaded, agents can access the file for a short duration and respond to user queries based on its contents. This update aligns with customer feedback requesting more flexible input options for agent interactions.

[When this will happen:]

General Availability (Worldwide): Rollout will begin in mid-December 2025 (previously early November) and is expected to complete by late December 2025 (previously late November).

[How this affects your organization:]

• Who is affected: All users of Custom engine agents, whether built using Copilot Studio or the Agents Toolkit. This includes users on free, metered, and paid Copilot plans.
• What will happen:
  • Users will be able to upload files directly to Custom engine agents.
  • Supported file types will match those supported by Copilot.
  • Image file support will be added in a future update.
  • The feature will be ON by default once available.
  • No changes to existing admin policies are required.

[What you can do to prepare:]

• Communicate this change to helpdesk staff.
• Update internal documentation if you reference CEA capabilities.
• Review the documentation for details on agent configuration and supported capabilities.

Learn more: Custom engine agents for Microsoft 365 overview | Microsoft Learn

[Compliance considerations:]

Question	Answer	Explanation
Does this change store new customer data, and if so, where is it stored and is the data cached or permanently stored?	Yes	Uploaded files are temporarily accessible to the agent for a few minutes
Does this change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data?	Yes	Custom engine agents will be able to access uploaded files and respond to user queries based on the file contents.
Does this change provide end users any new way of interacting with generative AI, and if so, how?	Yes	Users can now upload files to agents, expanding interaction beyond text input.

Updated November 17, 2025: We have updated the timeline. Thank you for your patience.

[Introduction:]

We are expanding inline protections for uploads in Microsoft Edge for Business to cover more unmanaged consumer generative AI (GenAI) apps. With this update, admins can apply Microsoft Purview collection policies and Purview Data Loss Prevention (DLP) policies to detect and prevent sensitive data sharing in the Edge browser when users interact with these additional unmanaged app locations. Inline protections are built directly into Edge for Business and work for users on Intune-managed Windows devices. This enhancement complements existing capabilities, giving organizations greater flexibility to enforce data security controls across a broader set of GenAI apps.

This message is associated with Microsoft 365 Roadmap ID 518643.

[When this will happen:]

• Public Preview: Begins late November 2025 (previously mid-November), expected to complete by early December 2025.
• General Availability (Worldwide): Begins in late November 2025 (previously early December) and is expected to complete by end of December 2025.

[How this affects your organization:]

Who is affected:

• Admins managing Microsoft Purview DLP and collection policies for Edge for Business
• Users on Intune-managed Windows devices using Edge for Business

• Admins can extend current Purview collection and DLP policies to include new unmanaged GenAI app locations for inline protection.
• No additional deployment steps are required.
• Inline protections are built directly into Edge for Business.
• Automated behaviors will block use of unprotected browsers for users included in policies that block activities in unmanaged GenAI apps.

[What you can do to prepare:]

No action is required to enable this feature. To learn more or update your policies, review the following resources:

• Cloud apps detection – Collection policy reference | Microsoft Learn
• Data Loss Prevention policy reference | Microsoft Learn
• Learn about Data Loss Prevention for Cloud Apps in Edge for Business | Microsoft Learn

[Compliance considerations:]

Updated November 17, 2025: We have updated the timeline. Thank you for your patience.

[Introduction:]

We are introducing inline file upload protection for Microsoft Edge for Business to help prevent data leakage when users upload files to consumer generative AI (GenAI) apps in the browser. This complements the existing text upload protections available today for unmanaged GenAI apps and can be layered with Endpoint DLP protections. With this update, admins can detect and enforce inline protections on file uploads in Edge for Business. Policies can target file-specific conditions such as file size, file type, and sensitive information types, enabling organizations to audit or block activities for users on Intune-managed Windows devices.

This message is associated with Microsoft 365 Roadmap ID 518642.

[When this will happen:]

• Public Preview: Begins late November 2025 (previously mid-November); expected to complete by early December 2025.
• General Availability (Worldwide): Begins late November 2025 (previously early December); expected to complete by late December 2025.

[How this affects your organization:]

• Who is affected: Admins managing Microsoft Purview DLP policies and Edge for Business on Intune-managed Windows devices.
• What will happen:
  • Admins can extend existing Purview collection and DLP policies to include file upload protection for unmanaged GenAI apps.
  • Inline protections are built directly into Edge for Business.
  • Automated behaviors will block use of unprotected browsers for users included in blocking policies.
  • Policies can be configured based on file size, type, and sensitivity.

[What you can do to prepare:]

• No action is required before rollout.
• Review your current collection and DLP policies.
• Update policies to include file upload conditions if needed.
• Inform your Security and Edge admins about this enhancement.

Learn more:

• Collection policy reference – Collection policies | Microsoft Purview | Microsoft Learn
• Data Loss Prevention for Cloud Apps in Edge for Business | Microsoft Purview | Microsoft Learn
• Data Loss Prevention policy reference | Microsoft Purview | Microsoft Learn
• Help prevent sharing via Microsoft Edge for Business to unmanaged AI apps from managed devices | Microsoft Purview | Microsoft Learn

[Compliance considerations:]

[Introduction]

Starting November 17, 2025, agents created in Copilot Studio lite within Microsoft 365 Copilot will be able to generate Word, Excel, and PowerPoint content. This capability is part of the “Generate documents, charts, and code” skillset (formerly known as Code Interpreter), designed to help users complete common tasks more efficiently. These skills were first introduced in Microsoft 365 Copilot in October and are now extending to agents—bringing the same powerful creation tools into custom workflows.

This message is associated with Roadmap ID 506753.

[When this will happen:]

General Availability (Worldwide): Rollout begins mid-November 2025 and is expected to complete by early December 2025.

[How this will affect your organization:]

Who is affected:

• Microsoft 365 Copilot users with access to Copilot Studio.

What will happen:

• Users can generate Word, Excel, and PowerPoint documents by chatting with agents created in the embedded Copilot Studio lite experience.
• This capability is part of the “Generate documents, charts, and code” skillset (formerly known as Code Interpreter).
• No changes to existing admin policies.
• No admin action is required; this is for awareness only.

[What you can do to prepare:]

• Communicate this enhancement to helpdesk staff or internal champions.
• Remind users that this capability already exists in Copilot and is now extended to agent interactions in the embedded Copilot Studio lite experience.
• Learn more: Use Copilot Studio to build declarative agents

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

• Governance Model:
  • An enhanced governance experience within Power Platform Admin Center to manage Dataverse MCP server. With the new governance framework, only Microsoft Copilot Studio will be enabled by default for existing Dataverse MCP Server users.
• Configuration Management:
  • Settings available to enable additional clients like Visual Studio GitHub Copilot or Claude.
• Connecting to Visual Studio GitHub Copilot:
  • A simplified experience to interact with Dataverse MCP server in Visual Studio Code.
• Billing and Licensing:
  • Effective December 15, 2025, usage of the Dataverse MCP Server will be subject to updated Billing Policies.