Microsoft 365 changes every month. Most of it won’t affect you — here we write about what will.
A customer questionnaire is now the most common reason clients call us
Cyber security was long seen as a topic for banks and utilities. That has changed. The European directive widened the set of regulated sectors and Slovakia wrote it into its cyber security act.
A firm under fifty people outside the listed sectors is usually not directly affected. That holds only until it supplies a hospital, a manufacturer or a public body. Regulated organisations have to manage the security of their supply chain, and they pass the requirements on.
In practice it arrives quietly. An email with an attachment, a table of dozens of questions and a two-week deadline. The questions are technical: do you enforce multi-factor authentication, who holds admin rights, how long do you keep sign-in logs, how do you handle former employees.
The worst answer is not "no". The worst is "we do not know". The customer concludes the supplier has no grip on its own environment, which is exactly what supply-chain risk management looks for. Being able to answer with evidence is an advantage competitors do not have.
An assessment of a Microsoft 365 environment is not a statutory audit and does not replace documentation, risk analysis or incident procedures. It does answer the technical part of the questionnaire and provides evidence of the state at a point in time. The rest belongs to your IT partner or adviser, and it is fair to say so up front.
The printer that stops sending scans in January
At the end of December 2026 Microsoft will switch off, by default in existing tenants, mail submission over SMTP AUTH with basic authentication — a plain username and password.
It affects devices and applications that send email through a Microsoft 365 mailbox: multifunction printers with scan-to-email, older invoicing and accounting systems, alarms, cameras, scripts. People notice only when a scan never arrives or an invoice never goes out.
Admins will be able to turn basic authentication back on for now. That is only a postponement — Microsoft has said it will announce the final end date in the second half of 2027. New tenants from January 2027 do not have the option at all.
Now is a good time to list everything in the company that sends mail and check, device by device, whether it supports modern authentication. Where it does not, there are other routes — sending through a connector, for example. While you are at it, check SPF too, so mail from those devices does not end up in spam.
Exchange Web Services starts switching off on 1 October
From 1 October 2026 Microsoft is disabling the EWS interface in Exchange Online by default, tenant by tenant. On 1 April 2027 it ends completely, and Microsoft has said up front there will be no extension.
EWS is an old interface third-party applications use to reach mail, calendars and contacts. An ordinary user in Outlook will notice nothing. What can stop working are things nobody realises depend on mail: older backup tools, CRM calendar sync, booking systems, in-house scripts.
The deadline for excluding a tenant from the October switch-off passed at the end of August. Anyone who missed it can still set a temporary exception for specific applications — but only until April.
The first step is simple: the Microsoft 365 admin centre has an EWS usage report. It shows which applications still use the interface, and for each one you need to find out whether the vendor has moved to Microsoft Graph.
Microsoft is retiring Restricted SharePoint Search
As of 31 July 2026 the feature can no longer be newly enabled. Restricted Content Discovery replaces it.
The important part is different: existing configurations do not migrate automatically. If a company relies on it and nobody acts, content that was excluded from search can become discoverable again — with no warning.
It affects companies that limited organisational search so staff would not find content that was technically available to them but shouldn’t have been. Typically payroll or board material.
The real fix is correcting permissions. Limiting discoverability is a postponement — whoever could reach the content before still can.
What Copilot will find in your SharePoint
The usual worry about Copilot is that it will reach data it shouldn’t. It doesn’t — Copilot honours permissions exactly as configured.
The problem is the opposite: Copilot surfaces permissions that sat there for years and nobody knew about.
An employee who has had access to the payroll library for five years — because somebody once shared it with everyone — never went there, because they didn’t know it existed. With Copilot on, one question finds it.
Before switching it on, go through where the “Everyone except external users” group is used and check access to sites holding sensitive content.
Why anyone can send an invoice in your name
Most companies have DMARC set to p=none. A spoofed email is not blocked — you only learn about it if somebody reads the reports.
The attack looks like this: an email arrives that appears to come from the managing director. Your customer receives an invoice with someone else’s account number and pays it.
Tightening it requires first knowing everyone who sends in your name — the billing system, the shop, the newsletter. Tighten too early and legitimate mail starts failing. That is why most setups stop at p=none.
You can check your own domain — it takes seconds and runs in your browser. Domain check.
A question about any of this?
Get in touch. If it touches your environment, we’ll tell you how to check.