Week of 29 June 2026

Passkey policy now gets dedicated 20KB allocation, Platform SSO automated on macOS Entra join, new Global Secure Access Operations Guide, and MFA registration campaign improvements.

Microsoft is enforcing stricter CA policy evaluation for resource-specific exclusions. Policies that previously bypassed Entra ID Protection risk signals via exclusion filters will face breaking changes starting late July 2026.

After June 30, any CA policy using only "Require approved client app" stops enforcing. MSPs on Business Basic without Intune are most exposed. Migration paths to Compliant Device or Auth Strength covered.

4sysops June 2026 Entra roundup: CA policies now enforce during Windows Hello and macOS Platform SSO credential registration (July 6 deadline), phishing-resistant MFA for Linux, and expanded passkey support on Windows.

26H2 ships as a small enablement package (eKB) expected in early October 2026. Start validating Insider Experimental Channel builds, plan rollout rings, and test deployment tools now.

Optional preview for Win 11 24H2/25H2/26H1. Key new features: flexible point-in-time restore rollback, 35-day update pause calendar in Settings, NPU usage column in Task Manager. Test in pilot rings before July 8.

Hands-on: Low Latency Profile CPU burst for faster Start menu, Multi-App Camera support, new Task Manager privilege columns, Secure Boot 2023 cert migration. What breaks on older hardware and what does not.

The six headline changes from KB5094126: Low Latency Profile, Multi-App Camera, Secure Boot cert upgrade, NPU monitoring, Task Manager privilege columns, and recovery improvements. IT admin impact explained for each.

26H1 is hardware-scoped only, not offered via Windows Update to existing devices. Track known issues, driver compatibility blocks, and safeguard holds for affected new silicon devices here.

Full coverage of June 9 Patch Tuesday: OS builds, what is fixed, known issues (Secure Boot cert-related reboots on older hardware), and rollout timeline for all supported Windows 11 versions.

Biggest W365 release yet: preconfigured dev Cloud PCs, Autopilot Device Preparation for W365 now GA, Azure Compute Gallery GA, and 50 free hours of W365 for Agents Cloud PC via Copilot Studio.

W365 Business price cut 20%, Frontline rebranded to Flex, RDP Multipath now GA across 39 Azure regions, and Windows Cloud Keyboard Input Protection in preview. Full summary of all access-expanding changes.

AVD Hybrid extends the cloud-managed VDI service to on-premises hardware via Azure Arc. Run session hosts on your own infrastructure while keeping cloud management, licensing, and policy from Azure.

June highlights: RDP Multipath GA, TURN relay infrastructure expanded to 39 regions (51.5.0.0/16), Conditional Access token protection for Windows sign-in tokens, and AVD Classic retirement September 2026.

Copilot Cowork reached GA June 16: multi-step background tasks, 13 built-in skills, off by default. Admins must enable per tenant, set spending limits, and configure usage-based billing before the July 1 price update.

Copilot promo ($18/user/mo) expires June 30 — full price $30 from July 1. Teams adds AI meeting recaps without saving a recording. GPT-5.5 Instant now in M365 Copilot. Admins: review licence assignments today.

SharePoint Copilot moves to opt-out preview mid-June (audit permissions now), Teams Meeting Chats section, Teams organiser can delete recap content permanently, and new cross-tenant group synchronisation.

Microsoft Threat Intelligence: multi-stage campaign using photo-themed ZIP archives targeting hospitality firms in Europe and Asia. Application allowlisting and Defender for M365 detections covered.

Microsoft scores highest in current offering and strategy categories. Intune, Defender for Endpoint, and the unified Security portal cited as differentiators. Full wave report breakdown.

Exchange Web Services retirement enters final phase. New EWSAllowedAppIDs control lets admins manage which apps retain EWS access while you migrate remaining integrations to Microsoft Graph.

Agent 365 gives IT and security teams unified visibility over all Copilot agents: what each can access, actions taken, and whether authorised. Entra network controls now extend to Copilot Studio agents and local AI agents.

Defender now discovers Claude Code, GitHub Copilot CLI, ChatGPT Desktop, Cursor, Kiro IDE, and other local AI agents on Windows devices. Intune policies can block common agent execution paths via the new Shadow AI page.

Agentic phishing triage identifies 6.5x more malicious alerts than human analysts. St. Luke’s Health Network saves 200+ analyst hours per month. Security Analyst Agent now in Defender after RSA 2026.

Defender AI model scanning (preview) detects compromised models in registries and CI/CD pipelines. GitHub Copilot Autofix now generates, assigns, and validates vulnerability remediations autonomously.

AI model capabilities now have real political consequences. The White House asked OpenAI to slow-roll GPT-5.6. The industry is moving toward collective governance rather than individual lab competition.

OpenAI’s report on enterprise agent adoption: most common workflows, where agents outperform humans vs. where they fail, and governance patterns the fastest-moving companies are using.