Need to Know podcast–Episode 370

In this episode I ask the question about whether privacy is becoming and optional and take a deep dive into creating better data structures in places like SharePoint and Teams that help users and AI generate better results. There is also the usual look at recent cloud news from Microsoft and thoughts on how even all this is become about AI. Love your feedback.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-370-structure/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

Resources

CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS

X – https://www.twitter.com/directorcia

director@ciaops.com

CIAOPS Blog

Join my Teams Shared Channel – CIAOPS

CIAOPS Merch store – CIAOPS

Become a CIAOPS Patron

CIAOPS AI Dojo

CIAOPS weekly news update – CIA Brief – CIAOPS

CIAOPS Labs – The Special Activities Division of the CIAOPS

Support CIAOPS

Get your M365 questions answered via email

Join my email list

A special thanks to the CIAOPS Patron community for making this podcast possible. You can find the benefits of a subscription to the community and become a member at https://www.ciaopspatron.com

Updates

Take control of your EWSAllowedAppIDs list before EWS access changes

Microsoft is changing how Exchange Web Services (EWS) access is managed. Organizations should review and manage their EWSAllowedAppIDs list now to ensure approved applications retain access and to avoid disruptions when the new controls take effect.

Link: https://techcommunity.microsoft.com/blog/exchange/take-control-of-your-ewsallowedappids-list-before-ews-access-changes/4553534

Understanding the new 100 GB mailbox entitlement for Microsoft 365 Business suites

Microsoft explains the introduction of 100 GB mailbox storage for eligible Microsoft 365 Business plans, outlining entitlement requirements and how organizations can benefit from increased mailbox capacity.

Link: https://techcommunity.microsoft.com/blog/exchange/understanding-the-new-100-gb-mailbox-entitlement-for-microsoft-365-business-suit/4548243

AI

Available today: OpenAI GPT-6 Astra in Microsoft Copilot

Microsoft has added OpenAI’s GPT-6 Astra model to Copilot, giving users access to an advanced foundation model designed to improve reasoning, content generation, and productivity experiences across Microsoft 365.

Link: https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/available-today-openai-gpt-6-astra-in-microsoft-copilot/4552808

Available today: Anthropic Claude Fable 5.1 in Microsoft Copilot

Anthropic’s Claude Fable 5.1 model is now available in Microsoft Copilot, expanding the range of AI models users can leverage for research, analysis, content creation, and complex business tasks.

Link: https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/available-today-anthropic-claude-fable-5-1-in-microsoft-copilot/4551974

Expanding model choice in Copilot with Grok

Access to Grok models is rolling out through the Microsoft Frontier Program in Microsoft Word, Excel, and PowerPoint. We are starting with a focused release to gather customer feedback and learn how customers use the model across common productivity scenarios.

https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/expanding-model-choice-in-copilot-with-grok/4555749

What’s New in Microsoft Copilot | August 2026

A monthly roundup of new Copilot capabilities, including model updates, workflow enhancements, productivity improvements, and new AI-powered features designed to help users work more effectively.

Link: https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/what%25E2%2580%2599s-new-in-microsoft-copilot–august-2026/4551960

Security

What’s new in Microsoft Security: August 2026

Microsoft’s monthly security update covering new capabilities across Defender, Sentinel, Entra, Security Copilot, and other security products, along with recent security announcements and enhancements.

Link: https://www.microsoft.com/en-us/security/blog/2026/08/27/whats-new-in-microsoft-security-august-2026/

Passkey-themed social engineering leads to identity and cloud compromise

Microsoft details a campaign where attackers used passkey-related social engineering techniques to trick users into compromising credentials and cloud identities, while also providing mitigation guidance.

Link: https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/

Protecting organizations from AI-assisted executive impersonation and invoice fraud

This security guidance examines how attackers are using AI to impersonate executives and conduct invoice fraud, alongside recommendations to help organizations detect and prevent these attacks.

Link: https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft analyzes how attackers impersonate IT support staff to gain remote access and expand their foothold within organizations, highlighting attack techniques and defensive measures.

Link: https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/

From CIAOPS

Image Model Comparison

A practical comparison of image generation models, reviewing differences in output quality, style, and effectiveness to help users evaluate which AI image generation model best suits their needs.

Link: https://directorcia.github.io/Office365/image-comparison.html

September webinar – local AI

https://blog.ciaops.com/2026/09/10/ciaops-need-to-know-microsoft-365-webinar-september-5/

Will Our Favourite Tools Outlive Us as Their Users?

image

I was holding a hammer recently and caught myself thinking about how little it has changed. A handle. A weighted head. A simple tool that turns a human movement into a useful result. Email feels more sophisticated, but the basic relationship is similar. I decide what I want to do, then I operate the tool.

I am starting to wonder whether that relationship is about to reverse.

The tool may stay while the user changes

I do not think hammers, spreadsheets, inboxes or project boards are disappearing. I think the interesting possibility is that humans may stop being their main operators.

A robot on a building site may still use something recognisable as a drill because the drill is already an efficient way to apply rotational force. An AI agent may still use email because email remains a widely accepted way for organisations to exchange requests, approvals and records. The tool survives because the surrounding world already understands it.

What changes is who, or what, sits at the controls.

That matters because many of our tools were designed around human limitations. Email gives me time to compose a thought, send it, wait and respond later. A spreadsheet lets me arrange information into rows and columns because that is a structure I can inspect. Menus, buttons, folders and dashboards exist partly because I need visible handles for complicated systems.

AI does not necessarily need those handles. It may use the underlying service directly, faster and more consistently than I can. Yet it may continue producing emails, documents and spreadsheets because people, businesses and compliance processes still expect them.

Outlook may become a machine workspace

I can already see the early shape of this in Microsoft 365 Copilot. Today, I might ask Copilot in Outlook to summarise a long thread and draft a reply. I am still the operator. I read the summary, check the wording and press Send.

The next step is not difficult to imagine. An agent monitors the inbox, recognises a routine supplier request, checks the relevant SharePoint record, prepares the response and routes only the exception to me. Email remains. Outlook remains. SharePoint remains. But my role moves from operating every tool to supervising the work performed through them.

For me, this is a more useful way to think about AI than asking whether it will replace a particular application. A familiar tool can remain everywhere while becoming almost invisible to its former human users.

Efficiency is not the only measure

I do not believe the most efficient operator should automatically make every decision. A machine may swing a hammer more accurately or process an inbox more quickly, but speed is not judgement. Context, responsibility and consequences still matter.

If an AI sends the wrong email, approves the wrong variation or updates the wrong customer record, someone still owns the outcome. That means I expect the valuable human skill to shift. Knowing where to click will matter less. Knowing what should happen, what must never happen and when an exception needs attention will matter more.

The practical question for every business is not simply, “Which tools can AI use?” I think it is, “What authority are we prepared to give it, and how will we know when it is wrong?”

I suspect many tools I love will survive for decades. I may just use them less directly. The hammer, inbox and spreadsheet could become part of a machine-operated layer beneath my work.

I will not miss every click. But I do want to remain accountable for where the work lands.

The Ambition Has to Start With You

image

I have noticed something uncomfortable about ambition. People are often happy to encourage a plan once it looks sensible, funded and likely to work. Very few will stand beside you when it is still just a rough idea that sounds too large for your current position.

That is not cruelty. Most people are busy carrying their own doubts, deadlines and responsibilities. They cannot see the picture in your head. If I wait for someone else to give my idea permission, I may be waiting forever.

Other people see the risk first

When I describe a bold goal, the first response is often practical. Who will pay for it? Where will the time come from? What happens if it fails?

But practicality can become a hiding place. It is easy to keep refining a modest plan because it attracts less criticism. It is harder to admit that the smaller plan does not really interest me.

I see this with business owners considering AI. They start by asking how Microsoft 365 Copilot can save a few minutes writing an email. That is useful, but it is rarely the biggest opportunity. The larger question is what the organisation could become if its people had more time to think, decide and serve customers well.

A bigger vision might involve redesigning how work moves through the business. I might use Copilot in Outlook to identify the recurring questions filling an inbox, then bring the themes into a Word document and map a better process with the team. The technology helps me examine the work. It does not choose the destination for me.

Start before the applause

The early stage of any worthwhile idea is usually quiet. There is no audience, no case study and no reassuring success story. There may only be a notebook, a half-built plan and a nagging sense that I should keep going.

That is where personal responsibility matters. I have to make the first version. I have to block out time. I have to test the idea while it is still easy for others to dismiss.

Copilot can help turn that private ambition into something I can work with. I can ask it to challenge assumptions in a business plan, summarise competing options, or turn scattered notes into a draft proposal. I can use Teams to bring the right people into the conversation once the idea has enough shape to discuss. None of that replaces courage. It simply reduces the friction between thinking and doing.

Build evidence, not permission

I do not need everyone to believe at the beginning. I need enough evidence to justify the next step.

That may be one customer conversation, one working prototype or one improved internal process. Small proof points matter because they change the discussion. A vague ambition becomes an observable result. People who could not picture the idea can finally see part of it.

This is also how I avoid confusing ambition with fantasy. A large goal still needs discipline. I can think expansively while testing carefully. I can hold onto the destination without pretending I already know the entire route.

The important thing is that I remain responsible for the direction. Advisers can sharpen it. Colleagues can strengthen it. Copilot can help me explore it. But none of them can want it on my behalf.

If there is an idea I cannot stop thinking about, I take that seriously. I write it down, give it structure and take one real step towards it. Support may come later. Momentum may attract people who could not see it at first.

But the first belief has to be mine.

Is Privacy Becoming Optional?

image

The other day I was sitting in a meeting and noticed something that would have seemed unusual only a few years ago.

One person had their phone on the table. Another was wearing a smartwatch capable of recording conversations. Someone else was using a dedicated note-taking device. Around the room were laptops running Microsoft Teams. The meeting itself was being transcribed by Copilot.

Nobody mentioned it.

Nobody asked if recording was okay.

Nobody even seemed to think it was remarkable.

That’s when it struck me. We may have quietly crossed a line where recording has become the default and privacy has become the exception.

The New Reality: Everything Can Be Captured

For most of my career, recording a meeting was a deliberate act.

You would ask permission. Someone would set up a recorder. People knew the session was being captured.

Today that friction has largely disappeared.

Your phone can do it. Your watch can do it. Dedicated devices like Plaud can do it. Teams can do it. Copilot can summarise discussions automatically. Even people who never intended to create a permanent record can end up generating one simply because the technology is there.

The barrier isn’t technical anymore.

It’s social.

And I’m not convinced we’ve caught up.

The Assumption Problem

What concerns me most isn’t the technology itself.

Recording conversations can be incredibly valuable. I use Microsoft 365 Copilot regularly to help summarise meetings, identify action items and make sure important decisions aren’t forgotten. Used properly, it improves productivity and reduces misunderstandings.

The concern is the growing assumption that everyone knows they’re being recorded and therefore automatically consents.

That’s a dangerous assumption.

If someone joins a Teams meeting and sees the recording banner, they’ve been informed.

If you’re sitting in a café, a boardroom, an airport lounge or even having a casual conversation after an event, the situation is much less clear.

Was that discussion recorded?

Who owns the recording?

Where is it stored?

Will it be used for training an AI model?

Will it be shared with others?

Most people simply don’t know.

Privacy Was Built Around Visibility

Historically, privacy worked because recording was visible.

A camera was obvious.

A tape recorder was obvious.

Even someone taking detailed notes was obvious.

Now many recording devices are effectively invisible. A phone sitting face down on a table doesn’t attract attention. A smartwatch on someone’s wrist looks completely normal. A small dedicated recorder clipped to a shirt can disappear into the background.

The social cues that once helped us understand when a conversation was becoming permanent are disappearing.

That’s a much bigger shift than most organisations realise.

The Microsoft 365 Angle

What makes this even more interesting is that Microsoft 365 Copilot is accelerating the value of captured information.

A meeting recording today isn’t just a recording.

It’s searchable.

It’s summarised.

It’s transformed into action items.

It’s available weeks later through natural language questions.

Ask Copilot what was agreed in a meeting three months ago and it can often find the answer in seconds.

That’s incredibly useful.

But it also means recordings have become far more valuable than they were in the past. The incentive to capture everything continues to increase because the return from that captured information keeps growing.

In many organisations, the question is no longer “Should we record this?”

It’s becoming “Why wouldn’t we?”

Can You Opt Out Anymore?

Here’s the uncomfortable question.

How do you avoid being recorded if everyone else is recording?

You can choose not to use recording tools yourself.

You can refuse to record meetings.

You can leave your phone in your pocket.

None of that stops someone else from creating a record.

In some environments, avoiding recording may soon become almost impossible.

That doesn’t necessarily mean privacy is dead.

But it does mean privacy increasingly depends on transparency, trust and governance rather than technology limitations.

The old protection was that recording was difficult.

The new protection has to be that people are honest about what they’re capturing and why.

What I’m Watching Next

I don’t think we’re heading towards a world with no privacy. I do think we’re heading towards a world where we need new social rules.

Technology has moved faster than our expectations and etiquette.

We need clearer conversations about consent. We need organisations to establish recording policies that people actually understand. And we need individuals to think more carefully before assuming that because they can record something, they should.

The irony is that as tools like Copilot become better at helping us remember everything, trust may become more important than ever.

Because the real question isn’t whether everything can be recorded.

It’s whether we’ll still know when it is.

Better Is a Direction, Not a Starting Point

image

I have made plenty of decisions that looked sensible at the time and less impressive a year later. Usually, I was working with the experience, evidence and tools I had then. The real test is not whether I got everything right on day one. The test is what I changed after new information arrived.

That distinction matters because hindsight can become a very comfortable hiding place. I can criticise an old process without doing anything differently today. Reflection only becomes useful when it alters the next action.

Progress needs some humility

In technology, yesterday’s good practice can become today’s unnecessary friction. A workflow built around emailed spreadsheets may once have been the most practical answer. Later, a shared file in SharePoint may remove version confusion. Then a well-designed process using Teams, Planner or Power Automate may make the work clearer again.

I do not think that means every earlier choice was a failure. It means the environment changed, the team learned and better options became available.

This is where humility matters. I need enough confidence to make a decision with incomplete information, but not so much confidence that I defend it forever. Experience should sharpen my judgement, not harden my position.

Copilot makes the learning visible

Microsoft 365 Copilot gives me a practical way to shorten this learning loop.

Imagine I have been preparing a weekly client update by opening several emails, reviewing Teams messages and rebuilding the same summary in Word. I may have done that for months because it worked. It was familiar and reliable.

Then I try a different approach. I ask Copilot in Outlook to summarise the relevant thread. I use Copilot in Teams to identify decisions and unresolved actions from a meeting. I bring the material into Word and ask for a first draft organised around progress, risks and next steps. I still review every line, because responsibility remains with me, but I have changed the process based on what I now know.

The first prompt may be average. The summary may miss context. My instructions may be too vague. That is not evidence that the whole idea is useless. It is feedback. I can refine the prompt, provide a better reference file, correct the structure and save the improved version for next week.

Getting value from Copilot is rarely one brilliant prompt. It is repeated adjustment inside real work.

Improvement is a behaviour

I often see businesses delay change because they are waiting for certainty. They want the perfect governance model, the perfect use case and the perfect training plan before anyone begins. I understand the caution, especially where client data, security and accuracy are involved. Some boundaries must be established first.

But perfection can also become an excuse. A small, governed trial with a real workflow can teach more than another month of abstract discussion. Use a low-risk task. Check the output. Note what failed. Update the instructions. Share the lesson in Teams. Repeat.

It is about creating a culture where changing your method after learning something new is considered sound judgement, not an admission of weakness.

I cannot demand flawless foresight from my earlier self, my team or my clients. I can demand honesty about what the evidence now shows. I can keep what still works, replace what does not and document why the change was made.

That is how useful progress happens. Not through shame about the past, and not through blind loyalty to it. I act responsibly with what I understand today, then make tomorrow’s work better when experience gives me a clearer view.

CIA Brief 20260912

image

Here’s a quick roundup of the latest Microsoft, security and AI news I’ve been tracking this week. As always, I’ve skipped the noise and focused on what actually matters for MSPs and SMBs.

Security
Microsoft 365 & Windows
Cloud & AI

As always, the challenge isn’t finding information — it’s focusing on what actually matters.

After hours

HOT OR COLD? BRAD PITT, 16 DOGS & PERFETTO COFFEE https://www.youtube.com/watch?v=7K13bjG_kJ4

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

Curiosity Is a Professional Strength

image

I have sat in plenty of meetings where everyone seemed to understand a term except me. A new acronym appeared on a slide, heads nodded around the room, and the conversation moved on. For years, the temptation was to stay quiet and work it out later. I did not want to be the person who slowed things down.

Now I see that moment differently. If I do not understand something, there is a fair chance somebody else is equally lost. The difference is that nobody wants to say so.

Questions expose the real work

I have learned that a simple question can be more useful than an impressive answer. “What does that mean in practice?” can uncover assumptions, vague thinking and risks that polished language has hidden.

This matters even more with AI. The vocabulary is arriving faster than most people can absorb it. Agents, grounding, orchestration and retrieval are discussed as if they have always been part of ordinary business conversation. They have not. Pretending otherwise does not make anyone more capable. It only makes the room less honest.

When I am working with Microsoft 365 Copilot, I treat uncertainty as a starting point. If I receive a long technical email in Outlook, I can ask Copilot to explain the unfamiliar concepts in plain language, identify what decisions are being requested and suggest questions I should take back to the sender. That does not replace my judgement. It gives my curiosity somewhere productive to go.

The same approach works in Teams. After a meeting, I might ask Copilot what terms were used without explanation, where the discussion relied on assumptions, or which points need clarification. The value is not in looking clever. The value is in leaving the meeting with fewer gaps hidden behind polite nodding.

Expertise is not knowing everything

The longer I work in technology, the less impressed I am by people who always need to appear certain. Technology is too broad, and it changes too quickly, for anyone to know everything. Real expertise is often visible in the quality of the questions someone asks and in how quickly they can turn an unknown into something useful.

I would rather work with a person who says, “I have not come across that before. Show me how it works,” than someone who fills the silence with confident guesses. The first response creates progress. The second creates risk.

For MSPs, this is especially important. Clients do not need us to perform certainty. They need us to investigate carefully, explain clearly and be honest about what we know. A technician who raises a hand early can prevent hours of rework. A business owner who asks what a Copilot proposal will actually change in the client’s day can stop a shiny but pointless project before it starts.

Curiosity needs practice

I do not think curiosity is a personality trait reserved for naturally inquisitive people. I think it is a professional habit. I can practise it by keeping a short list of things I did not understand during the week, then using Copilot in Word or Loop to explore them, organise my notes and identify what deserves deeper learning.

The goal is not to remove every gap. That is impossible. The goal is to become comfortable enough with the gap to examine it openly.

I no longer see “I don’t know” as an admission of weakness. I see it as the first accurate statement in a useful conversation. What matters is what I do next: ask, test, read, listen and come back with a clearer view.

Knowledge has limits. Curiosity keeps moving.

Is the Next Franchise a Fleet of Humanoid Robots or Robotaxis?

image

I have been thinking about what a franchise might look like ten years from now.

For the past century, the formula has been familiar. You buy the right to operate under an established brand. You lease premises, employ people, follow documented processes and pay the franchisor a fee. The local owner supplies capital and management. The franchise supplies the system.

But what happens when the system no longer needs a shopfront or a large human workforce?

The next franchise may not sell hamburgers, clean offices or deliver parcels. It may involve owning and operating a fleet of humanoid robots or Robotaxis.

From employing people to deploying capacity

Consider the basic economics of a Robotaxi fleet. The owner provides capital, maintains the vehicles, arranges charging, manages insurance and keeps the service operating. The platform provides the software, customer demand, navigation, payments and brand.

That already sounds remarkably like a franchise.

Humanoid robots potentially extend the idea beyond transport. A local operator might own a fleet performing cleaning, warehousing, simple maintenance, stock movement or after-hours inspection. The robots could work across multiple customer sites while the owner manages utilisation, maintenance and service quality.

The valuable asset is no longer necessarily the location. It is the available productive capacity.

I can imagine a future business owner asking, “How many robots should I add this quarter?” in much the same way a transport operator currently considers another vehicle or a traditional franchisee considers opening another location.

Ownership will not mean independence

There is an important catch.

Owning the physical machine does not mean owning the business. The platform controlling bookings, software, identity, updates, safety rules and customer access may hold considerably more power than the fleet owner.

This is where the comparison with today’s digital platforms becomes uncomfortable. You may own the asset, but someone else can change the commercial rules through a software update.

That makes governance critical.

A robot fleet will require more than mechanical maintenance. Every machine will need an identity, permissions, operating boundaries, audit history and a clearly accountable human owner. Organisations will need to know what each machine is authorised to do, what information it can access and when it must stop and ask for approval.

The same questions already apply to AI agents.

The control room will be in Microsoft 365

I suspect much of the day-to-day management will look more familiar than people expect.

A fleet operator might begin the morning by asking Copilot to summarise overnight incidents from Outlook, maintenance reports stored in SharePoint and exceptions discussed in Teams. Planner could surface required inspections. Power Automate could route failures to the appropriate supplier, while Power BI shows utilisation, revenue and downtime across the fleet.

The physical work may be performed by machines, but the management layer will still revolve around information, identity, risk and decisions.

For MSPs, this points to a new type of managed service. Clients may not only need their users, devices and Microsoft 365 environment managed. They may need someone to govern fleets of agents, robots and autonomous vehicles as one connected operational system.

The franchise is becoming a platform relationship

I do not know whether humanoid robots or Robotaxis will become the dominant version first. The technology, regulation and economics still have plenty to prove.

However, I believe the direction is worth watching.

The future small-business owner may employ fewer people directly while controlling far more productive capacity. Their competitive advantage will come from choosing the right platform, managing risk, maintaining utilisation and protecting customer trust.

The franchise of the future may not have a counter, a uniform or even a front door.

It may have a charging depot, a Microsoft 365 tenant and a dashboard full of machines waiting for their next job.

The transition from labour-priced services towards automated capacity, governance and outcome-based offerings also aligns with the strategic direction examined in 20260902-Cowork-Fable-51.