Microsoft Is Retiring Its SMS and Voice MFA: What the Dates Actually Mean

IT professional weighing an old mobile phone against a modern smartphone in a dim office

Microsoft is retiring the SMS and voice MFA it delivers itself, and I’ve already seen plenty of confusion about what actually happens and when. Message Center post MC1519855 has a few dates in it, and they’re easy to squash together. So here’s how they fit, quoted straight from Microsoft’s documentation.

The short version: Microsoft stops sending the texts and making the calls, but you can keep using SMS and voice MFA after that by bringing your own telephony provider. Nothing has to be done by 30 October or 1 November. That said, the clock is definitely ticking.

What each date means

  • 30 October 2026: the third-party provider option becomes available. Nothing is turned off. The Message Center post says: “Starting October 30, 2026, Microsoft Entra ID will make Choose Your Own Telephony Provider (CYOT) generally available.” and “organizations can choose to configure a supported telephony provider.” It’s something you opt into, not a deadline. Microsoft-provided SMS and voice keep working as they do now.
  • 1 February 2027: Microsoft stops providing SMS and voice for most users. Microsoft Learn says: “From February 1, 2027, Microsoft-provided telephony delivery for SMS and voice will be retired for all users except Global Administrators and external users.” Internal guest users are included in this date.
  • 1 July 2027: the same retirement applies to Global Administrators and external users.
  • Already happening, since 1 September 2026: users enabled for SMS or voice “are auto-enabled and nudged for Passkey registration upon MFA sign-in.” That’s why your users may already be seeing passkey prompts.

One wrinkle worth knowing. The Message Center says the provider option is generally available from 30 October, but at the time of writing the Learn page on telephony providers still describes it as a private preview. I expect the documentation to catch up, but don’t be surprised if what you read on Learn and in the admin centre don’t quite line up for a while.

What users see after their retirement date

If a user’s only MFA method is SMS or voice and the tenant hasn’t set up a provider, they’re “required to register a passkey during sign-in to continue accessing their account. This prompt is blocking.” Microsoft adds: “There is no opt out.”

Picture the Monday morning helpdesk queue at a 30-seat business where half the staff never moved off text codes. Users who already have Authenticator, a passkey, Windows Hello or another method aren’t blocked, although they may still be nudged to register a passkey. Everyone else hits a wall.

Keeping SMS and voice after February

Yes, you can. Microsoft Learn says the option “lets organizations continue using SMS or voice authentication with a supported telephony provider.” Here’s what that involves:

  • Where you buy it: you choose the provider through Microsoft Security Store, and “manage their commercial relationship directly with the provider.” The provider bills you, not Microsoft.
  • Which providers: “Soprano and Telesign are the initial telephony providers” in the private preview, with “more providers” by general availability. Soprano offers per-user or per-transaction pricing.
  • What you need to buy it: “an Azure billing subscription and resource group, plus the appropriate Azure subscription role.” Microsoft also says to review “provider pricing and expected Azure infrastructure charges,” and links a cost calculator, so expect some Azure hosting cost on top of the provider’s fees.
  • Who does what: Entra “continues to enforce your authentication method policies,” and the provider just delivers the texts and calls. You’re responsible for “reviewing its regional coverage and terms, completing the provider agreement, configuring the provider… and monitoring the service.”
  • Microsoft’s own advice: use a provider “only for user populations that have a business, regulatory, or technical requirement for telephony-based authentication.”

I couldn’t find Australian pricing or confirmation of Australian coverage in what’s been published so far, so check those with the provider directly before you promise anything to a client.

What MSPs should be doing now

  1. Find out who uses SMS or voice in every tenant. Microsoft provides a PowerShell script for this, which needs Global Reader, Authentication Policy Administrator or Security Reader.
  2. Move those users to Authenticator or passkeys well before 1 February, and get Global Admins done before 1 July. Admins shouldn’t be on SMS anyway.
  3. Tighten the policies behind it. Once users are off text codes, make sure Conditional Access actually requires the stronger methods. I covered why that matters in Your Conditional Access Is Stuck in 2018.
  4. Only consider a provider for the genuine edge cases, such as shared phones, sites where phones aren’t allowed, or a regulatory requirement, and budget for the provider’s fees plus the Azure costs.

Like everything else in security, this is a shared job. Microsoft is giving us passkey defaults and a provider option. It’s up to us to get users across before the dates arrive, rather than letting a blocking prompt do it for us.

Microsoft sources

How to Use Grok Bot to Monitor MSP News and Security Updates

Two professionals reviewing a morning news and security brief on a laptop and monitor

Most MSP owners I talk to already “keep an eye on the news”. In practice that is newsletters, a few vendor blogs, and whatever appears before the first ticket of the day. The useful items — an exploited vulnerability, an ACSC alert, a Microsoft 365 change that will hit your SMB tenants — sit in the same pile as marketing.

I wanted a brief that arrives in the morning, is filtered for an Australian MSP, cites its sources, and is sitting in chat so I can ask a follow-up. I run a dedicated News bot for this: a morning brief on Microsoft 365, Copilot and security, with an SMB lens, from official and reputable sources only. This post is how to set that up, with the chat prompts I would use, and a fair look at where this beats RSS, alerts or a generic chatbot — and where it does not.

Why MSPs need a monitoring system

MSPs sit in the middle of three streams that do not wait for a quiet week: Microsoft 365 and Copilot changes, security advisories, and channel news that affects how you explain those changes to clients.

If you miss a critical advisory, you may need to tell a client the same day. If you only read US sources, you can miss Australian Cyber Security Centre (ACSC) guidance your local customers will ask about. Manual checking does not scale, especially after a long weekend.

A monitoring system is not another inbox. It is a short, repeatable brief with a clear lens, source links, and a way to turn one item into a client note when it matters.

Step-by-step configuration

Everything below is done in chat, except for two verified places in the app: the per-agent info pane, and Settings for timezone. I am not going to invent extra menus.

1. Pick a bot and give it a clear role

I use a dedicated News bot so the brief is not mixed with other work. You can do the same, or add the routines to a bot you already use. A bot can have its own name, title and description, and it can remember your preferences.

To set the persona in the app, click the agent’s name in the chat header (or use Cmd+Shift+I) to open the per-agent info pane. The gear beside the X opens the per-agent Settings for avatar, name, title and description.

You can also do it in chat:

Set this bot’s name to News and set the description to: You prepare a morning brief of Microsoft 365, Copilot, MSP industry and security news for an Australian MSP audience. Use official and reputable sources only. Filter for SMB and MSP impact. Always include source links. Skip rumour and marketing fluff.

2. Choose your sources

Be specific about where the bot should look. These are public pages I have checked. Microsoft 365 Message Center is not on the list: it lives in the Microsoft 365 admin centre and needs tenant access, so it is not a public source for an unattended routine. For product changes without a tenant sign-in, use the public Microsoft 365 roadmap, which Microsoft now presents as the AI at Work roadmap.

For news and security monitoring, use these sources when they are relevant. Prefer official pages over secondary write-ups, and always cite the URL:
- Microsoft 365 roadmap: https://www.microsoft.com/microsoft-365/roadmap
- Microsoft Security Response Center blog: https://msrc.microsoft.com/blog/
- Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide
- CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- ACSC alerts and advisories: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories
- Microsoft Tech Community: https://techcommunity.microsoft.com/
- Channel Dive: https://www.channeldive.com/
- CRN: https://www.crn.com/
- ChannelE2E: https://www.channele2e.com/
- MSSP Alert: https://www.msspalert.com/
- ConnectWise Trust Center: https://www.connectwise.com/company/trust
- Kaseya Information Security: https://www.kaseya.com/trust-center/information-security/

Add or remove vendor pages to match the tools you actually deploy.

Grok Bot can search and fetch public pages on its own. If you want official Microsoft documentation as a follow-up, add the Microsoft Learn connector — I walked through that in How to Set Up MCP Connectors in Grok Bot with Microsoft Learn. Optional extras are Outlook, Gmail or Teams for later drafting, and public reads on X. Add those in chat, for example: “Add the Microsoft Learn MCP server at https://learn.microsoft.com/api/mcp.”

3. Set the filters

A source list without filters still produces noise. Save the lens in the same chat:

Apply these filters to every brief. MSP and SMB lens — explain why an item matters to a managed service provider or a small business tenant. Severity first — put actively exploited or critical security items at the top. Australian relevance when it exists, including ACSC guidance and Microsoft 365 changes that affect Australian tenants. Official or reputable sources only. Every item needs a source link. Ignore vendor marketing, partner-program noise and generic consumer tech news.

4. Create two routines

A routine in Grok Bot is a saved prompt plus a trigger. The useful trigger here is a schedule in your local time. It runs while you are away, and the result is posted to this bot’s chat unless you name another destination. When you ask the bot to create a routine, you may see a confirmation card before it is saved.

You can review saved routines in the same per-agent info pane, under the computer preview. Check your timezone under Settings, in the General tab, opened from the sidebar account button at the bottom-left, or with Cmd+,. Routines usually start within a few minutes either side of the time you set. If the run must start right on the minute, say “exactly” or “sharp”.

Create the news brief first:

Create a routine called Morning MSP news brief. Every weekday at 7:12am Sydney time, check the Microsoft 365 roadmap, Microsoft Tech Community, ACSC alerts, Channel Dive, CRN, ChannelE2E and MSSP Alert for new items since the last run that matter to an Australian MSP. Summarise each item in a few sentences, say why it matters for an MSP or SMB tenant, and include the source link. Official and reputable sources only. If nothing material has changed, say so in this chat and stop. Deliver the brief to me in this chat.

Then a separate security routine, so a quiet news day does not bury a vulnerability:

Create a separate routine called Security alert watch. Every weekday at 8:12am Sydney time, check the CISA Known Exploited Vulnerabilities catalog, the MSRC blog and Security Update Guide, ACSC alerts and advisories, and the ConnectWise Trust Center and Kaseya information security pages for new or updated items. Flag anything that is actively exploited, critical, or affects common MSP tools. Include the official link and a short note on what I should check. If nothing new is relevant, tell me that in this chat and stop. Deliver the result to me in this chat.

Keep both prompts as intent, not a rigid script, so the bot looks up current pages each run.

5. Test it, then tune the schedule

Do not wait until tomorrow to find out the brief is too long or too vague:

Run the Morning MSP news brief once now, as a test. Do not change the schedule.

Read the result the way you would read a junior analyst’s draft. If it buries the important item, missed ACSC, or cited a weak source, say so and ask the bot to tighten the saved prompt.

To change frequency, be direct:

Change the Security alert watch to Monday, Wednesday and Friday at 8:12am Sydney time.
Pause the Morning MSP news brief while I am on leave, then resume it on the following Monday.

Start with a weekday morning cadence. Hourly checks are rarely worth the usage.

I have written before about Grok Bot taking on recurring MSP work in What Happens to MSPs When Grok Bot Can Do the Work?. A news brief is a smaller version of the same idea: the bot does the first pass, and you decide what to do with it.

Example prompts you can copy

Paste these as-is, then tighten them for your stack and clients.

Daily digest

  1. Give me this morning’s MSP news brief using my saved sources and filters. Include why each item matters and the source URL. If nothing material changed, say so.
  2. What has changed since yesterday in Microsoft 365, Copilot and MSP industry news that would affect an Australian SMB tenant? Cite links.

Security and CVE watch

  1. Check the CISA Known Exploited Vulnerabilities catalog for entries added or updated in the last seven days. Flag anything relevant to Microsoft 365, Windows, common MSP remote tools or vendors I named. Include the official CISA link.
  2. Check the MSRC blog, the Security Update Guide and ACSC alerts and advisories for anything new today. Summarise only what an Australian MSP should act on, with links.
  3. Urgent only: if there is a new actively exploited or critical advisory in my security sources that affects tools I deploy, summarise it with the official link and what I should check. If there is nothing in that category, reply with one line and stop.

Vendor watch

  1. Check the ConnectWise Trust Center and Kaseya information security pages for new advisories or security bulletins. Summarise only what is new, with links.
  2. Look for new security advisories that affect [your RMM, PSA or backup vendor]. Prefer the vendor’s own trust or security page, and cite the URL.

Microsoft 365 changes

  1. Check the public Microsoft 365 roadmap and Microsoft Tech Community for recent Copilot or Microsoft 365 changes that affect Business Premium or other SMB plans. Ignore items that are enterprise-only unless they will still land in a typical customer tenant.
  2. For this Microsoft 365 change, use Microsoft Learn to pull the official guidance and any admin steps. Include the Learn URL. Do not change any tenant.

Weekly client summaries, advisories and drafts

  1. Turn this week’s brief into a one-page client-facing summary I can send on Friday. Plain language, no hype, and a link for every item I include.
  2. Turn this story into a short client advisory. Audience: a 40-seat Australian professional services firm on Microsoft 365 Business Premium. Include what changed, who is affected, what we recommend, and the official source.
  3. Draft a short blog post or LinkedIn update from this item, in my usual practical tone, with the source link. Do not publish it.
  4. From this week’s items, what should I mention in my standing client update, and what can wait? Give a short recommended list with links.

Follow-up

  1. I have a signed-in Outlook connector. Draft an email to my internal ops list from this advisory. Do not send it until I confirm.
  2. What should I verify in a typical SMB Microsoft 365 tenant before I act on this item? Give a checklist, and cite official documentation where you can.

Benefits compared with other options

I still use newsletters, and I still open official pages when something is urgent. The question is what does the first pass for you.

An RSS reader gives you everything a site publishes, in the order it arrives. It will not apply an MSP lens or answer a follow-up. Keyword alerts are useful for a named product, but they match words, not severity or audience, so the noise is high. Newsletters arrive on someone else’s cadence and judgement. That can be excellent, and it is still not tuned to your stack or ready for a “turn this into a client advisory” request. A generic chatbot can summarise a link you paste, but it will not run unattended every weekday unless you set that up. Manual checking works until you are busy.

What Grok Bot does well here is more specific than a vague promise about AI. Scheduled routines run while you are away. The brief can be filtered to an MSP and SMB lens, including Australian relevance. You can insist on source links. One run can combine official pages, trade press and, if you have added them, connectors such as Microsoft Learn. The bot can remember your preferences. The result lands in chat, where you can ask a follow-up, request a client advisory, or draft a message for Outlook or Teams.

Limits and tips

This is a first pass, not a decision. Verify anything you might act on — a patch, a client email or a configuration change — against the official page. Trade press is often useful and sometimes paywalled; if the bot cannot read the full article, it should say so and fall back to the official source.

Ask for links every time. If a brief arrives without URLs, treat it as unverified and tell the bot to retry with citations. Keep the routines lean: two weekday morning runs are enough for most MSPs. Tightening the schedule “just in case” consumes usage.

Do not expect a public routine to read Microsoft 365 Message Center. That is tenant-scoped. Use the public roadmap for unattended product-change watching, and treat Message Center as a separate, signed-in admin task.

Closing

Monitoring fails when it depends on a quiet morning and a good memory. A Grok Bot routine will not replace your judgement, but it will do the first read, apply a consistent filter, and leave the result in chat with the links attached.

Give a news bot a clear role, name your sources and filters, then create two weekday routines — one for industry and Microsoft 365 news, one for security. Test them with a “run it once now” prompt, tighten what you get, and leave the schedule alone until you have a reason to change it. The value is not more information. It is a shorter, sourced brief you can actually use.

How to Set Up MCP Connectors in Grok Bot with Microsoft Learn

Two professionals reviewing documentation on dual monitors in a teal-and-amber lit office

I get asked a lot how Grok Bot stays current on Microsoft 365. The short answer is connectors. In the Grok Bot app, those connectors are MCP servers — Model Context Protocol endpoints that give the bot live tools, not just whatever it remembered during training.

This post is a step-by-step walkthrough using Microsoft’s official Microsoft Learn MCP server. It needs no tenant sign-in, it is free, and it is useful on day one for MSPs and smart businesses.

What MCP is, in plain words

MCP is an open standard for connecting AI agents to external tools and data. Think of it as a USB plug for AI: the host (Grok Bot) talks to a server over a shared protocol, and the server exposes named tools the agent can call while answering you.

Without MCP, an agent guesses from training data or browses the public web and hopes for the best. With MCP, it can search a trusted source, fetch a full page, or pull a code sample, then ground the answer in that content.

Microsoft publishes a remote Learn MCP server at https://learn.microsoft.com/api/mcp. Official overview: Microsoft Learn MCP Server overview. No authentication is required. There is no charge to use it. It exposes public Learn documentation only — not training records, not your tenant, not your profile.

I covered the broader idea of MCP for smaller organisations earlier in Small Business, Big AI Impact: Understanding the AI MCP Server. This post is the Grok Bot how-to.

Why Microsoft Learn makes a good first connector

Three practical reasons:

  1. No sign-in. You do not need Microsoft 365 admin consent to add it. That removes the usual “which account?” friction.
  2. Trusted content. Answers can cite official Learn pages instead of a random blog from 2021.
  3. MSP-shaped tools. The server exposes three tools: search docs, fetch a full article as markdown, and search code samples. That covers Conditional Access, Intune, Graph PowerShell and Copilot licensing.

If you have used Learn inside Copilot Studio before, this is the same family of idea. I walked through that path in Integrating Microsoft Learn Docs with Copilot Studio using MCP. Here we are wiring Learn into Grok Bot itself.

Step-by-step setup in Grok Bot

In Grok Bot, MCP servers show up as connectors. The reliable way to add one is to ask the bot in chat.

1. Open a chat with Grok Bot

Start a normal conversation with the agent that should use the connector.

2. Ask it to add Microsoft Learn

Paste:

Add the Microsoft Learn MCP server at https://learn.microsoft.com/api/mcp

That is enough. Grok Bot can search the connector catalog for a match, or add a remote MCP endpoint by URL when you give it one. Microsoft Learn’s public endpoint needs no auth token and no tenant access.

If the bot shows a connector confirmation card, approve it. For Learn there is nothing to sign in to — Microsoft’s docs state authentication is not required.

3. Wait for confirmation

When it is connected, the bot should tell you Microsoft Learn is available. On my account it appears as a connected HTTP connector with three tools:

  • microsoft_docs_search
  • microsoft_docs_fetch
  • microsoft_code_sample_search

4. Optional: add other connectors the same way

Once Learn works, add signed-in connectors (Outlook, Teams, OneDrive, Azure and so on) by naming the service in chat — for example, “add the Outlook connector” — and completing any sign-in card. Start with Learn so you see the pattern without a login wall.

Checking that it works

Do not assume the connector is live until you ask a real question:

Using Microsoft Learn, summarise how to create a Conditional Access policy that requires MFA for all users. Include the official Learn link.

A healthy reply will pull current Entra admin centre steps (Conditional Access → Policies, report-only first, exclude break-glass accounts), include a learn.microsoft.com URL, and avoid invented clicks.

I ran that live while writing this. It returned Microsoft’s “Require multifactor authentication for all users” guidance, including the authentication strength grant and the report-only recommendation.

Second check — force a code sample:

Using Microsoft Learn, give me a Graph PowerShell sample that lists users with Get-MgUser. Include the Learn source link.

Live result: samples such as Import-Module Microsoft.Graph.Users then Get-MgUser -Top 5, plus Connect-MgGraph -Scopes "User.Read.All" patterns, each with a Learn URL.

If the bot answers from memory with no Learn links, say: “Use the Microsoft Learn connector and cite the page.”

Example prompts you can copy

Paste these as-is, then tighten them for your tenant or client.

Quick answers

  1. Using Microsoft Learn, what are the eligible prerequisite licences for Microsoft 365 Copilot? Summarise the commercial table and link the page.
  2. Using Microsoft Learn, what does an Intune Windows compliance policy check for firewall, BitLocker and Defender? Bullet list with the Learn link.
  3. Using Microsoft Learn, explain the difference between Require multifactor authentication and authentication strength in Conditional Access. Cite the docs.

Live Copilot check: Learn returned the licence options page — Copilot as an add-on on qualifying Microsoft 365 / Office 365 / Business plans, with Copilot Business aimed at organisations up to 300 users — plus the requirements page covering identity and mailbox prerequisites.

Step-by-step admin guides

  1. Using Microsoft Learn, walk me through creating a Conditional Access policy that requires MFA for all users. Start in report-only. Exclude break-glass accounts. List every click path from the Entra admin centre and include the official URL.
  2. Using Microsoft Learn, give me the steps to create a Windows device compliance policy in Intune that requires Secure Boot, BitLocker and Microsoft Defender real-time protection. Include prerequisites and the Learn link.
  3. Using Microsoft Learn, how do I assign Microsoft Copilot licences in the Microsoft 365 admin centre after purchase? Include the assign-licences doc link.

PowerShell and Graph code samples

  1. Using Microsoft Learn code samples, show Graph PowerShell to connect with Connect-MgGraph and list the first 50 users (DisplayName, Id). Include the source page.
  2. Using Microsoft Learn, find a PowerShell sample that disables a user with Get-MgUser and Update-MgUser. Warn me about hybrid implications and cite Learn.
  3. Using Microsoft Learn, search for PowerShell samples to work with Conditional Access policies. Prefer official samples and link them.

Comparing options

  1. Using Microsoft Learn, compare Microsoft Copilot Chat vs Microsoft 365 Copilot licensing requirements for a 40-seat Business Premium tenant. Table format, with source links.
  2. Using Microsoft Learn, compare requiring MFA for all users vs requiring MFA only for directory roles. When would Microsoft recommend each? Cite the policy pages.

Client docs, checklists and routines

  1. Using Microsoft Learn, draft a one-page checklist for an MSP onboarding a new Microsoft 365 client: MFA baseline, Intune compliance for Windows, and Copilot licence prerequisites. Every checklist item must include a Learn URL.
  2. Every Monday, use Microsoft Learn to check whether Conditional Access MFA baseline guidance has changed this week. Summarise any material change and link the pages. Do not change my tenant.
  3. Read the latest ticket in Outlook about Intune compliance failures, then use Microsoft Learn to pull the matching Windows compliance settings and suggest what to verify. Do not change policies until I confirm.

Those last two prompts are where Grok Bot gets useful for MSP work, not just another chatbot. One runs on a weekly schedule, and the other combines tenant evidence from a signed-in connector with public guidance from Learn.

Tips and limits

  • Public docs only. Learn MCP does not see your tenant, users, licences or policies.
  • Content refresh. Microsoft says the knowledge service refreshes incrementally and does a full refresh about once a day, so brand-new articles can lag briefly.
  • Ask for sources. Tell the bot to include Learn URLs. If it cannot cite one, treat the answer as unverified.
  • Verify before you run scripts. Test Graph and PowerShell samples in a lab, check scopes, and confirm the Microsoft Graph PowerShell SDK modules.
  • Report-only first. When Learn returns Conditional Access steps, keep Microsoft’s advice: create in report-only, review impact, then enable.
  • Terms of use. Using the Learn MCP server means you agree to the Microsoft Learn Terms of Use.

Closing

MCP connectors are how Grok Bot stops guessing and starts working from live tools. Microsoft Learn is the easiest first connector because it is public, free and immediately useful for Microsoft 365 work.

Add it with one chat prompt, test it with a Conditional Access or Copilot licensing question, then keep a short list of copy-paste prompts next to your admin checklist. From there you can layer signed-in connectors for mail, calendar, files and tenants — with Learn sitting underneath as the shared source of truth for “what does Microsoft say right now?”

Official starting point: https://learn.microsoft.com/en-us/training/support/mcp

Want to Know Where You’re Heading? Look Back

A business owner standing on a long highway at dusk, looking back at the road he has travelled

Nobody can tell you exactly where your business will be in two years. I certainly can’t. But I’ve found a surprisingly reliable way to get a preview, and it doesn’t involve forecasts, vision boards or a strategy offsite. It involves turning around.

Instead of staring at the horizon, look at the road behind you. Specifically, the last 90 days.

The honest 90-day review

Ask yourself a few plain questions. Are you making more money than you were three months ago? Are you spending more of your week on work you actually enjoy? Do you have more freedom, or less? Are you enjoying your life, or just getting through it?

The answers are usually one of three: yes, no or sorta. Most MSP owners I speak with land on sorta. Revenue is fine. The team is busy. Tickets get closed. Yet the owner is still the escalation point for everything, still writing proposals at 10pm and still promising themselves that next quarter will be different.

Here’s the uncomfortable part. Sorta is not a resting place. It’s a direction.

Your trajectory is already set

The easiest way to see where you’ll end up is to take what you did over the last 90 days and extend the line. Picture repeating the same actions, and just as importantly the same inactions, every single day for the next two years.

The Copilot licence you bought but never rolled out properly. The SharePoint clean-up you keep deferring. The documentation that lives in one tech’s head. The pricing review you haven’t had time for. None of these feel urgent today. Multiply them by 730 days and they become the shape of your business.

So where does that line take you? Somewhere great? Somewhere not so great? Or just okay? Be honest, because okay compounds too.

Use the tools to read the road

This is one place where I find Microsoft 365 Copilot genuinely useful, not as a magic fix but as a mirror. Your last 90 days are already sitting in Outlook, Teams, Planner and your Excel reports. Picture asking Copilot to summarise what consumed your calendar this quarter, which client conversations kept recurring, or what you committed to in meetings and never followed up. The patterns are often obvious once someone lays them out in front of you.

Then do the same for your team. Where are the repeated questions? Which processes in your PSA or SharePoint keep generating rework? A short, honest review like this tells you more about your future than any five-year plan.

Small changes in direction matter more than big declarations. I wrote earlier about how worthwhile change accumulates in Give It Time to Become Something, and that applies here. Shift the daily habits and the two-year destination moves with them.

If you’re already heading somewhere great

Maybe your review comes back as a clear yes. More revenue, better clients, more freedom. Brilliant. Keep doing what’s working.

But between you and me, I reckon there’s a way to get you there faster. It usually comes from removing the busywork that still drags on your best people, rather than adding more effort. Automate the repetitive reporting with Power Automate. Let Copilot draft the first pass of the QBR deck. And as I said in Stop Acting Like the Business You Have Not Built Yet, stop carrying overhead you don’t need yet.

Take an hour this week. Look back at the last 90 days, then extend the line. If you don’t like where it ends, today is the cheapest day to change the angle.

MSP Summer School 2027: The AI MSP Make the Successful Transition

image

For a number of years I’ve run an MSP Summer School during January.

For January 2027, I want to tackle what I believe is one of the biggest changes the MSP industry has faced:

The transition to becoming an AI-enabled MSP.

AI isn’t simply another product that MSPs need to understand so they can sell it to customers.

I think the change is much bigger than that.

For the past 20 years, MSPs have helped customers navigate major technology transitions. We’ve moved customers from servers to cloud, perpetual licensing to subscriptions, on-premises infrastructure to Microsoft 365 and traditional security models towards Zero Trust.

This time, the MSP itself needs to make the transition.

That’s what the 2027 MSP Summer School will be about.

The AI MSP: Make the Successful Transition

The plan is to run four live online sessions during January:

DateTime
Wednesday, 6 January 202710:00 am–12:00 pm AEDT
Wednesday, 13 January 202710:00 am–12:00 pm AEDT
Wednesday, 20 January 202710:00 am–12:00 pm AEDT
Wednesday, 27 January 202710:00 am–12:00 pm AEDT

That’s eight hours across four Wednesday mornings, with a week between sessions to take what we discuss, try it inside your MSP and come back with the results.

The program will follow a simple progression:

Understand → Build → Sell → Operate

This won’t be eight hours of AI theory.

The objective is to help you start building the AI-enabled version of your MSP.

Week 1: The AI MSP

What does an MSP need to become?

We’ll begin with the strategic question.

What does AI actually mean for the MSP business model?

We’ll look at areas including:

  • how AI changes the way an MSP operates
  • where existing MSP revenue may come under pressure
  • what customers will increasingly expect from their technology provider
  • AI-enabled service delivery
  • Microsoft 365 Copilot, agents and automation
  • opportunities for new recurring services
  • moving towards managed business outcomes
  • Shadow AI, security and governance
  • assessing your current AI maturity

The objective will be to start creating an AI MSP Transition Map for your business.

Week 2: Build the AI-enabled MSP

Use it yourself before you try to sell it

I strongly believe MSPs need to start using AI internally before attempting to advise customers on their own AI transformation.

We’ll therefore get practical.

We’ll look at opportunities across:

  • service desk
  • technical documentation
  • sales
  • marketing
  • proposals
  • account management
  • customer reporting
  • project delivery
  • security
  • administration
  • knowledge management
  • business process automation

We’ll also explore technologies such as Microsoft 365 Copilot, Copilot Chat, Copilot Studio, agents, Power Automate, Azure AI, RAG, private/local AI and MCP.

One question will feature heavily:

Would I currently pay an employee to do this manually?

If the answer is yes, we should at least investigate whether AI can assist, accelerate or automate some of that work.

The objective will be for each participant to identify at least 10 processes inside the MSP that could potentially be redesigned using AI.

Week 3: Selling AI

How do we turn this into revenue?

Using AI internally is only half of the opportunity.

The next challenge is turning AI knowledge and experience into something customers will actually buy.

I don’t think simply offering “AI consulting” or “prompt engineering” is enough.

We need packaged outcomes.

For example:

  1. AI Readiness Assessment
  2. AI Governance Foundation
  3. Microsoft 365 Copilot Readiness and Deployment
  4. AI Productivity Workshop
  5. Business Process Automation
  6. Custom AI Agents
  7. Managed AI Services

We’ll work through customer discovery, demonstrations, packaging, pricing, ROI and the increasingly common objection:

“We’re already using ChatGPT.”

The goal will be for every MSP to leave this session with the foundations of three AI services that could be taken to customers.

Week 4: Operating the AI MSP

Turn the ideas into action

The final week brings everything together.

We’ll explore areas including:

  • AI governance
  • customer data protection
  • identity and access
  • Microsoft Purview
  • DLP
  • Shadow AI
  • agent governance
  • human oversight
  • AI acceptable-use policies
  • quality assurance
  • measuring AI ROI
  • developing staff skills
  • internal AI champions
  • continuous improvement

Most importantly, every MSP should finish January with a:

90-Day AI MSP Transition Plan

That could look something like this.

Days 1–30: Adopt

Start internal AI adoption, establish governance, train staff and identify repeatable use cases.

Days 31–60: Build

Package offerings, create demonstrations, establish pricing and identify pilot customers.

Days 61–90: Sell

Deliver pilots, measure results, capture case studies and start converting successful projects into managed services.

The question at the end of Summer School will be very simple:

What is your MSP going to do differently on Monday morning?

Constant Recording. Constant Iteration.

There’s another idea I want to explore throughout Summer School.

Record → Analyse → Improve → Repeat

Subject to appropriate privacy, consent and governance, MSPs generate enormous amounts of useful information every day:

  • customer questions
  • support interactions
  • meetings
  • sales conversations
  • customer objections
  • procedures
  • documentation
  • repetitive tasks
  • successful prompts
  • failed approaches
  • automation opportunities

Historically much of that information disappeared as soon as the conversation or interaction ended.

AI potentially changes that.

Activity can become knowledge.

Knowledge can produce insight.

Insight can drive automation.

Automation can produce better processes.

That leads to a principle I want to explore throughout Summer School:

Constant recording. Constant iteration. Constant improvement.

You’ll be doing, not just watching

I don’t want this to be four webinars where everyone watches presentations for two hours.

Each session will combine:

  • current AI developments
  • key concepts
  • live demonstrations
  • MSP-specific examples
  • practical workshops
  • group discussion
  • take-home challenges

There will also be work between sessions.

After Week 1

Identify 20 repetitive activities inside your MSP.

After Week 2

Select five and experiment with AI.

After Week 3

Have an AI-focused conversation with three customers.

After Week 4

Choose one AI service to launch.

The goal isn’t simply to attend Summer School.

It’s to start building your AI MSP during Summer School.

What will it cost?

I’m proposing to price Summer School per MSP rather than per person.

That’s deliberate.

I’d much rather an MSP owner bring a technical lead, service manager or salesperson along so that multiple people inside the business understand what needs to change.

Each registration will therefore cover up to three people from the same MSP.

Proposed pricing
RegistrationPrice + GSTSaving
StandardA$895–
Patron memberA$795A$100
AI Dojo memberA$745A$150
Patron + AI Dojo memberA$645A$250

For those who are members of both Patron and AI Dojo, you’ll receive the special combined-member price rather than having to work out multiple overlapping discounts.

Member prices won’t stack with other promotional offers.

I’m also considering an additional post-Summer School implementation clinic for people who are members of both Patron and AI Dojo.

What’s included?

My current plan is for registration to include:

  • four live two-hour sessions
  • up to three participants from the same MSP
  • session recordings
  • practical worksheets
  • templates
  • AI MSP planning resources
  • AI service development frameworks
  • exercises to complete inside your MSP
  • your own 90-Day AI MSP Transition Plan

The emphasis throughout will be firmly on practical outcomes rather than AI theory.

Who is Summer School for?

I’m designing this primarily for:

  • MSP owners and principals
  • practice managers
  • technical leaders
  • service managers
  • sales and business development leaders

You certainly don’t need to be an AI expert.

In fact, that’s rather the point.

If you’re asking questions such as:

What does AI actually mean for my MSP?

Where should I start?

How should we use AI internally?

What AI services should I take to customers?

How can we make money from this?

How do we manage the security and governance risks?

How do I stop AI becoming another technology distraction?

then this is exactly the sort of program I’m planning.

Interested? Register your interest now

At this stage I’m asking MSPs to register their interest.

There’s no commitment simply from expressing interest. It will help me gauge demand for the January program and keep interested people informed as the final agenda, registration arrangements and supporting material are confirmed.

Register your interest in MSP Summer School 2027

If you’re considering joining me in January, register your interest now so I can keep you updated as the program takes shape.

The goal

I’m not going to promise that eight hours of Summer School will magically transform an MSP.

I think there’s a much more useful objective.

By the end of January, I want participating MSPs to understand:

Where they are now.

Where AI could take their business.

What they should use internally.

What they could sell to customers.

What they shouldn’t do.

And, most importantly:

What they are going to do next.

Because the basic premise behind Summer School 2027 is straightforward:

MSPs have spent the last 20 years helping customers make successful technology transitions.

Now it’s our turn.

MSP Summer School 2027

The AI MSP: Make the Successful Transition

6, 13, 20 and 27 January 2027
10:00 am–12:00 pm AEDT
Live online

Standard: A$895 + GST per MSP
Patron: A$795 + GST
AI Dojo: A$745 + GST
Patron + AI Dojo: A$645 + GST

Up to three attendees from the same MSP.

Register your interest

Your Market Needs a Mayor. Why Not You?

A professional standing confidently in a busy town square at golden hour as people turn to them for guidance

Most MSPs I talk to want to be seen as the leader in their patch. They want the referrals, the respect and the clients who call them first. Then they try to get there by being louder. More ads, more logos on more slides, more posts about how great they are. I think that misses the point. Leading a market isn’t a title you claim. It’s a job you do. Think of it as being the mayor of your town, and the mayor’s real job has never been prestige. It’s service. Whoever is most useful gets the role.

Usefulness beats volume

Your clients are drowning in noise right now. Copilot keeps changing. Every week brings a new security scare. Microsoft licensing still confuses people who have bought it for a decade. Nobody needs another voice shouting. They need someone calm who makes sense of it all.

I wrote earlier about how to make your business easier to buy. This is the same idea seen from the other side. When you’re consistently the person who explains things clearly, buying from you stops feeling like a risk. People already trust your judgement before they ever see a quote.

Three jobs every mayor takes on

The way I see it, the work comes down to three habits.

  • Turn fear into confidence. When a scary phishing story hits the news, don’t wait for panicked emails. Send clients a short note covering what it means for them, what you’ve already checked in Entra and Defender, and the one thing they should do.
  • Turn uncertainty into clarity. Picture running a twenty-minute monthly Copilot briefing in Teams. Show what changed, what’s worth trying in Outlook or Word, and what to ignore. No pitch, just clarity.
  • Answer before they ask. If Microsoft is about to change something in Teams or Outlook, you already know the question your clients will raise. Put a plain-English explainer in their inbox first. When licensing shifts again, give them a one-page summary in SharePoint showing what it means for their seats and their budget.

None of this needs a marketing department. It needs attention and a willingness to share what you already know. Copilot can even help you draft these updates faster, as long as the judgement in them is yours.

The rewards follow the service

Here’s what I’ve seen over many years. Status, influence and revenue rarely go to the loudest operator in town. They drift towards the person everyone already relies on. When people know you’ll tell them the truth, they bring you their problems. That’s a far stronger position than any campaign can buy.

It also changes how you sell, or rather how little you need to. In Stop Selling. Start Letting People Decide. I argued that pressure drives good clients away. Being genuinely useful is the opposite of pressure. You give first, consistently, and let people come to you when they’re ready.

Being useful also compounds. Every clear explanation makes the next one more trusted. Every early warning makes clients a little more likely to forward your notes to a colleague. Over time you’re no longer one provider among many. You’re the person the town turns to.

Take the job

So here’s my challenge. Pick your market, whether that’s a suburb, an industry or a niche within Microsoft 365. Then commit to being the most useful person in it. Start this month with one briefing, one explainer or one early warning. Nobody is going to hand you the mayor’s chain. You earn it by showing up and serving. The job is open. Take it today.

Need to Know podcast – Episode 373

In this episode, I look ahead to Microsoft Ignite and the continuing evolution of Copilot, Work IQ, AI agents and cybersecurity, before exploring a bigger question: is AI actually making businesses better, or simply helping them do more things faster? AI isn’t magic pixie dust that can fix broken processes. Before automating, businesses need to identify bottlenecks, simplify and document processes, establish measurable outcomes and decide where AI genuinely adds value. The real opportunity isn’t generating more emails, documents and automation, but using AI to create better outcomes, reclaim valuable time and continuously improve the way the business operates.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-373-effectiveness/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

Resources

CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS

X – https://www.twitter.com/directorcia

director@ciaops.com

CIAOPS Blog

Join my Teams Shared Channel – CIAOPS

CIAOPS Merch store – CIAOPS

Become a CIAOPS Patron

CIAOPS AI Dojo

CIAOPS weekly news update – CIA Brief – CIAOPS

CIAOPS Labs – The Special Activities Division of the CIAOPS

Support CIAOPS

Get your M365 questions answered via email

Join my email list

A special thanks to the CIAOPS Patron community for making this podcast possible. You can find the benefits of a subscription to the community and become a member at https://www.ciaopspatron.com

Copilot & AI

Security

Microsoft 365 & Partners

From CIAOPS

Who Owns the Agent When the Employee Walks Out the Door?

A professional leaving an office tower at dusk, glowing threads trailing from her briefcase back to the building

Here’s a question I don’t think many businesses have asked yet. When you hire your next person, will they be allowed to bring their own agents with them? And when someone leaves, will you let the agents they built in your business walk out the door too?

For years we’ve treated a worker’s toolkit as personal. Their know-how, their shortcuts, their way of working. Agents blur that line badly. An agent can hold skill, but it can also hold memory, data and relationships. That makes the answer far less obvious than it first appears.

The toolkit versus the tenant

I think the cleanest way to start is to split an agent into two parts.

The first part is the pattern. The prompts, the instructions, the way someone has learned to break a job down and hand it to AI. That’s skill. It lives in their head as much as anywhere, and I don’t believe a business can or should claim it. A good tech who has learned how to direct agents well will carry that ability to their next role, the same way they carry their troubleshooting instincts.

The second part is the data. An agent built in Copilot Studio inside your Microsoft 365 tenant, grounded on your SharePoint libraries and connected to your systems, belongs to the tenant. So does what Copilot remembers about how a person works. Microsoft stores Copilot memory in a hidden folder in the user’s Exchange mailbox, inside your tenant, and admins can find it with Purview eDiscovery. That’s a pretty strong hint about where ownership sits.

I wrote recently about the mystery of personal SharePoint skills, which end up stored in a user’s OneDrive. Personal in name, but still sitting in the company’s tenant. Expect a lot more of that.

Memory is where it gets messy

Picture a consultant who has spent two years working with an agent. It knows her clients, their quirks, which contracts are touchy and which projects ran late. Now she moves to a competitor. Should that memory go with her?

My view is no, and not because the business is being greedy. That memory is tangled up with client data, confidentiality obligations and, in many cases, data residency requirements. You can’t neatly pull “how she works” out of “what she knows about our customers”. Until the tools can genuinely separate the two, the memory has to stay.

Treat BYO agents like BYOD

Bringing your own agent in the other direction feels a lot like the early days of bring-your-own-device. The answer then wasn’t a flat yes or no. It was policy, identity and control. Agents need the same treatment. Whose identity does it run under? What data can it reach? Where does what it learns end up? If you can’t answer those, the agent shouldn’t touch your tenant.

What I’d do now

None of this is legal advice, and your lawyer will have views. But there are practical steps any SMB or MSP can take today:

  • Write a simple agent policy covering who can build, bring and share agents.
  • Keep an inventory of every agent, with a named human owner.
  • Add agents and AI memory to your offboarding checklist, right next to mailbox and device handover.
  • Update employment contracts to say what’s portable and what stays.
  • Decide upfront that skills and prompt patterns travel, while data and memory stay put.

The people who learn to work well with agents will be worth more wherever they go. That’s fine. Let them take the skill. Keep the data. Just make sure you’ve written down which is which before someone hands in their notice.