Microsoft 365 Message Center
Announcements
Notable Microsoft 365 changes, flagged and explained: what it is, and what it means for your tenant.
-
Entra Connect Sync needs version 2.6.84.0 and application-based authentication by April 7, 2027
From April 7, 2027, Entra Connect Sync servers must run 2.6.84.0 or later and use application-based authentication, or synchronization fails. Here is how to check, switch and keep the new certificate rotating.
-
SSPR stops accepting directory-sourced contact info on November 7
MC1325414: SSPR stops accepting directory-sourced phone numbers and emails on November 7, 2026. Authenticator + OATH count as one method, FIDO2 doesn't count at all, SMS/voice is retiring in 2027.
-
Intune adds deployment plans for staged app and policy rollouts (Preview)
Intune can now roll out a Win32 app, Settings catalog profile, or endpoint security policy in timed rings instead of all at once. Useful, but pausing or cancelling doesn't roll anything back, and the payload isn't locked while the rollout runs.
-
Intune adds client-driven compliance evaluation for Windows (Preview)
Seven specific compliance signals on Windows devices now trigger a re-evaluation in near real time instead of waiting for the next scheduled check-in. Everything else still runs on the old cycle, and there's built-in throttling most write-ups have missed.
-
User.ReadBasic.All loses access to app roles and license data this month
User.ReadBasic.All has quietly exposed app role assignments and license details since it shipped. That access closes in a rollout completing late September 2026. What breaks, and one discrepancy in Microsoft's own migration guidance worth checking before you act on it.
-
Require approved client app is retired on June 30: migrate now
Require approved client app is deprecated June 30. After that date, existing policies stop enforcing. Here is what to configure before the deadline.
-
Intune multiple managed accounts: what admins need to know
Intune's MMA feature, rolling out in June 2026, lets users hold multiple MAM accounts in one app. Here's what admins managing external access need to know.
-
Conditional Access enforcement changes June 15: check your exceptions now
Apps could bypass Conditional Access by requesting minimal sign-in scopes. Non-excluded apps slipped through silently for years. Starting June 15, that stops.