How to Connect Grok Bot to Microsoft 365 Securely: A Step-by-Step Guide for MSPs

An IT professional monitoring Microsoft 365 tenants late at night in an MSP operations room

A lot of MSPs have asked me how I have Grok Bot watching my Microsoft 365 tenants every morning. The short answer is: not by handing it the keys to the kingdom. I wrote earlier about how Grok Bot just gets things done. This post is the practical follow-up. It is a step-by-step walk through the way I connected it to Microsoft 365, why I chose scripts over broad direct connectors, and how the same pattern scales to as many tenants as you look after.

Why scripts, not a big direct connector

The tempting option is to give an AI agent a delegated admin connection and let it go wild. I think that is the wrong default for an MSP. Here is why the script approach wins:

Least privilege. Each tenant gets its own app registration with only the read permissions the checks actually need, such as reading sign-in logs, audit logs, security alerts and Intune device state. Nothing more.
Read-only by design. The monitoring app cannot change settings, reset passwords or close incidents. If the bot gets confused, the worst it can do is read.
Certificate authentication. The scripts sign in app-only with a certificate rather than a client secret or a user password. No MFA prompts, no browser, and no shared admin account sitting in a vault.
No standing admin access. Nobody, human or bot, holds a permanent Global Admin session for monitoring. Anything that writes, like tidying up Sentinel incidents, is a separate, deliberate step that I trigger myself.
Auditable. The scripts are plain code I can read, version and diff. When the bot runs a check, I know exactly which API calls it made, and the tenant logs show them as that one app.

In other words, the AI decides when to look and how to explain what it found. The script decides what it is allowed to touch.

Step 1: Create a read-only app registration in each tenant

In the Entra admin centre, create a new app registration for monitoring, named so it is obvious what it is (for example “MSP Monitor – Read Only”).
Add application permissions for Microsoft Graph that are read only, for example AuditLog.Read.All, Directory.Read.All, SecurityAlert.Read.All, SecurityIncident.Read.All, ThreatHunting.Read.All, DeviceManagementManagedDevices.Read.All, Policy.Read.All and ServiceHealth.Read.All. Start small and only add what a check needs.
Grant admin consent.
Create a certificate, upload the public part to the app registration, and keep the private key (PFX) protected on the box where the bot runs, with its password in a separate file that only the scripts read.
If you use Microsoft Sentinel or Defender for Cloud, give the app a Reader role on that subscription or workspace, not Contributor.

I covered the certificate-based, headless sign-in pattern in more detail in Headless SharePoint and Exchange Online connections on Linux, built for agents.

Step 2: Write the check scripts

My checks are simple scripts that sign in with the certificate (MSAL in Python, or PowerShell with the Graph module), call read-only endpoints and return a summary. Mine cover things like sign-ins and risky users, audit events, new guests, Conditional Access changes, app credential changes, Sentinel and Defender incidents, Intune compliance and service health. Keep these scripts in a GitHub repo so you have history, review and rollback. Many of my own scripts are public in my Office365 repository if you want a starting point.

Step 3: Keep tenant details in one config file

Rather than hard-coding anything, I keep a single config file listing each tenant: its domain, a short name, and the path to its certificate. Each tenant gets its own folder for output. The scripts take the short name as an argument, so the same code runs against any tenant. Never paste tenant IDs, client IDs, thumbprints or keys into a chat with the bot. Put them in the config and tell the bot where it lives.

A structure like this works well:

tenants.json – one entry per tenant (domain, short name, certificate path, password file path)
tenant_check.py – the core read-only daily checks
extra_check.py – additional checks you add over time
<tenant>/ – one output folder per tenant for reports and history

Step 4: Tell Grok Bot the rules

Now the bot gets its instructions. Be explicit about what it may and may not do. For example:

Example prompt: “You are a read-only security monitor for the Microsoft 365 tenant contoso.com. Only use the scripts in /home/box/shared/msp-security and the certificate config in tenants.json. Never change tenant settings, close incidents, or print or ask for passwords, keys or certificate details. If a check needs a permission the app does not have, tell me which one rather than working around it.”

Step 5: Create a daily routine

Grok Bot can run work on a schedule. I have a morning routine per tenant that runs the checks and writes a plain-English report.

Example prompt: “Create a daily routine at 8:45am Sydney time that runs python3 tenant_check.py contoso, then gives me a short report: status, sign-ins and risky users, directory and guest changes, devices and Intune, Sentinel and Defender incidents, and anything that needs my action. Treat sign-ins from our office IPs as known benign. Keep a delivery log line for each run.”

Over time, tell the bot what is normal. When it flags something that turns out to be you, say so, and have it add that to the routine’s known-benign list. The reports get quieter and more useful every week.

Step 6: Scale to as many tenants as you like

This is where it gets interesting for an MSP. Because the scripts are tenant-agnostic, adding a customer is just a new app registration, a new certificate and a new line in the config. Then pick one of two patterns:

One bot per tenant. This is what I do. Each bot has its own memory, its own known-benign list and its own routine. It keeps context clean and stops one customer’s quirks bleeding into another’s report.
A single tenants bot. One bot loops through every entry in the config and produces a summary table, then drills into any tenant with issues. Good for a quick “how is everyone today?” view.

On top of that, I have a Chief of Staff bot that asks each of my other bots for a one-line daily update and rolls them into a single digest. That is how one person can keep an eye on many tenants without reading many reports.

Example prompt: “Add a new tenant: fabrikam.com, short name fabrikam. The app registration and certificate are already in tenants.json. Run the read-only checks once to confirm access, tell me any permission that is missing, then create the same 8:45am daily routine you have for contoso.”

Example prompt: “Every day at 9:30am, run the read-only checks for every tenant in tenants.json and give me one table: tenant, overall status, open high-severity incidents, risky users, and non-compliant devices. Only expand on tenants that need action.”

Example prompt: “Each afternoon, send Chief of Staff one line on the last 24 hours for each tenant: what was checked, any errors, and anything waiting on me.”

Step 7: Keep write actions separate and deliberate

There will be times you want the bot to fix something, like closing a backlog of noisy Sentinel incidents. I keep that in a separate script, with its own permissions, run by a separate PowerShell bot only when I explicitly ask. Monitoring stays read only. Changes stay human-approved.

Example prompt: “Only when I say so, run the cleanup script for contoso to close Sentinel incidents older than 30 days with the comment “Closed by automation”. Show me the list first and wait for my go-ahead.”

The takeaway

Connecting AI to Microsoft 365 is not about giving it more access. It is about giving it the right access, through code you own and can audit. Build the scripts once, give each tenant a read-only, certificate-backed app, and let Grok Bot do the watching and the explaining. That is how a small MSP can monitor a lot of tenants properly, every single morning.

Are We Training Techs or Training Copy-Pasters?

Experienced mentor explaining a tangle of cables to a puzzled young technician

Every MSP owner I talk to has the same headache: finding good technicians. Not warm bodies who can reset a password, but people who can walk into a mess nobody has seen before and work out what’s actually going on. So here’s a question that’s been nagging me. If we keep pushing our techs to lean on AI for every problem, are we quietly eroding the very skill we’re struggling to hire?

The fix that works until it doesn’t

Picture a fairly typical morning. A junior tech gets a ticket about mail not flowing for a shared mailbox. They paste the error into Microsoft 365 Copilot Chat, ask for a PowerShell fix for Exchange Online, run what comes back, and the ticket closes. Great outcome?

Maybe. But ask that tech why it broke and there’s a decent chance you’ll get a shrug. They solved the symptom without ever building a mental model of the system. Do that a few hundred times and you have someone who is fast on familiar problems and lost the moment the answer is wrong, the situation is unusual, or the AI simply isn’t available.

That’s the risk as I see it. Copy-paste fixes. No root-cause understanding. A growing dependence on a tool that can be confidently mistaken. And, longer term, a junior pipeline that never matures into the senior people who can mentor the next lot. If nobody struggles any more, where do the next seniors come from?

But I’m not going back

Let me be clear, I’m not arguing we ban AI from the service desk. Copilot summarising a long ticket thread in Teams or Outlook saves real time. Having it explain an unfamiliar Intune policy setting or draft a script you then review is genuinely useful.

The problem isn’t the tool. It’s how we’re letting people use it. An answer engine makes you dependent. A tutor makes you better. Same technology, very different result.

What I’d do as an MSP owner

A few practical things I’d put in place:

Explain the why before applying the fix. If a tech can’t tell you, in plain words, why a command will solve the problem, it doesn’t get run on a customer tenant.
Use Copilot as a tutor, not just an oracle. Encourage prompts like “explain what this error means and what could cause it” rather than “fix this”. Ask it to walk through the reasoning, then challenge it.
Review AI-assisted tickets. Have a senior skim a sample each week. Look for thin understanding and coach it.
Practise without the safety net. Run regular no-AI troubleshooting sessions. Break something in a lab tenant and let the team work it out the old way.
Document the reasoning, not just the resolution. “Ran script, fixed” teaches nobody anything. “Mailbox permissions were inherited wrongly after a migration, here’s how I confirmed it” builds team knowledge.

None of this is complicated. It just requires deciding that skill development is still part of the job, even when a faster shortcut exists.

The real question

AI will make good technicians better. I’m fairly confident about that. What worries me is whether it will make new technicians good in the first place, or just make them look good until the day it matters. The MSPs that win the skilled labour fight won’t be the ones that use the most AI. They’ll be the ones that use it to grow people rather than replace their thinking.

So I’ll put it to you: in your business, is AI building your techs’ problem-solving muscle, or quietly doing the lifting for them?

Who Is the Software For Now?

Cartoon of a person relaxing with coffee while app windows around them work on their own

Picture asking Copilot in Teams for a status report on a client project. It goes through the project files in SharePoint, pulls numbers from an Excel workbook, checks which Planner tasks are overdue and drafts a summary to send from Outlook. You never open a single one of those apps.

That gets me thinking. If we don’t need to open the apps, who exactly are they for now?

Is software going headless?

“Headless” usually describes a system with the engine but no front end. You talk to it through an API rather than a screen. What I’m seeing with Microsoft 365 Copilot, agents and Copilot connectors looks like the same idea applied to everyday work. You give the AI a goal, and it goes off and talks to the tools directly.

Take it a step further. Bring in a line-of-business system through a connector or an agent built in Copilot Studio, and that report could include CRM or ticketing data too, without logging in to anything. The tools are still doing the work. Nobody is looking at them.

So is the SaaS product we pay for every month slowly becoming a tool for AI rather than for people? For a growing slice of routine work, I think yes. I’m not convinced it’s the whole story, though.

What it means for the people using the tools

If you’re a creator or knowledge worker, the skill shifts from knowing where every button lives to knowing what to ask for. And knowing what good looks like when the answer comes back.

That sounds liberating, and it is. But it means people may understand their own systems less. When the report is wrong, someone still has to know which spreadsheet fed it and why. If nobody ever opens the tool, who notices when the data inside it has rotted?

And humans aren’t leaving the screen entirely. We still need interfaces to review, approve, handle the exceptions and make the creative calls that don’t fit a prompt. I don’t want an agent sending a client proposal without me looking at it first. The UI doesn’t disappear. It shrinks down to the moments where judgement and trust matter.

What it means for the people building the tools

This is where I think the bigger shake-up sits. Plenty of SaaS companies have built their business on a polished interface, per-seat pricing and the stickiness that comes from people living in the app all day. If an agent is the main user, what’s a seat? And how much is a beautiful dashboard worth if nobody looks at it?

My guess is differentiation moves underneath the interface. It shifts to the quality of the data, how good and open the APIs are, reliability, and how well permissions and security are handled. When AI is acting on my behalf, I care a lot about whether the tool respects who is allowed to see what. Trust becomes the product.

Vendors that treat their API as an afterthought could find themselves invisible. The tool might work perfectly but never get picked by the agent.

So, where does that leave us?

I don’t think the apps vanish. I do think the people who build them need to work out who their real customer is. Maybe it’s the human, maybe the agent, and most likely both. For the rest of us, the job is learning to direct the work rather than do every click ourselves, while staying close enough to the detail to spot when it goes wrong.

So I’ll put the question to you. How much of your working day already happens without opening the app? And will the tools you rely on still matter if you never see them?

Pressing Record in Australia: Who Needs to Say Yes?

Cartoon of colleagues around a meeting table smiling and agreeing, with a closed laptop and a simple microphone on the table

The short version

Recording a meeting is useful. Minutes, a replay for whoever was on leave and an AI summary are all real benefits. But in most of Australia you can’t just press record, or let an AI note-taker into the room, without everyone’s consent. The rules differ by state and territory, and the penalties for getting it wrong can be serious. Even where the law lets a participant record, trust is the thing that gets damaged.

My recommendation is simple. Have one official recording, run by the organiser, with consent built into the booking or invite and announced at the start. No personal or third-party recorders, AI bots or wearables unless the organiser has agreed. Sample wording is further down.

This is general information, not legal advice. I’m not a lawyer. If it matters, get advice for your situation.

Why this is everyone’s problem now

AI note-takers have made recording effortless. Microsoft 365 Copilot in Teams, Otter, Fireflies, Zoom recording, phone voice memos and even AI wearables will happily capture a whole conversation and ship it off to a cloud service. In an MSP or small business that covers internal meetings, client calls and the awkward conversations about incidents and mistakes. If someone discovers a bot or a phone quietly recording, that trust goes.

What the law says, state by state

There’s no single national recording law. It’s mostly state and territory surveillance-device legislation, plus Commonwealth rules on telecommunications. Broadly, Victoria, Queensland and the NT let a participant record a private conversation without the others’ consent. SA and WA generally require everyone’s consent. NSW, Tasmania and the ACT generally require consent too, with a narrow exception for recording for your own personal use that isn’t shared. Consent can be express or implied.

Jurisdiction	Statute	Can a participant record without others’ consent?	Key exception	Penalty (where verified)
NSW	Surveillance Devices Act 2007 (s7)	Generally no	Personal use only (not communicated or published to non-parties), or reasonably necessary to protect lawful interests	Up to 100 penalty units or 5 years (individual); 500 penalty units (company)
Vic	Surveillance Devices Act 1999 (s6)	Yes – participant recording isn’t caught by s6	Communicating or publishing a private conversation is regulated separately (s11)	Not verified for publication
Qld	Invasion of Privacy Act 1971 (s43)	Yes – s43(2)(a) exempts a party	Publication is regulated separately (ss44-45)	40 penalty units or 2 years (using a device on a conversation you’re not part of)
SA	Surveillance Devices Act 2016 (s4)	No – all principal parties must consent, expressly or impliedly	Reasonably necessary to protect lawful interests; public interest	Up to $15,000 or 3 years (individual); $75,000 (body corporate)
WA	Surveillance Devices Act 1998 (s5)	No	Lawful interests and similar exceptions	Up to $5,000 or 12 months (individual); $50,000 (body corporate)
Tas	Listening Devices Act 1991 (s5)	Generally no (NSW-style)	Personal use only / lawful interests	40 penalty units or 2 years (secondary source, not verified)
ACT	Listening Devices Act 1992 (s4)	Generally no (NSW-style)	Personal use only / lawful interests	50 penalty units (secondary source, not verified)
NT	Surveillance Devices Act 2007 (s11)	Yes – offence only applies if you’re not a party	Publication is regulated separately (s15)	250 penalty units or 2 years (non-party recording)
Cth	Telecommunications (Interception and Access) Act 1979 (ss6-7)	Not an issue for a party recording at their own end, generally	Interception of a live communication over a telecoms system without the knowledge of the person making it is prohibited	Up to 2 years

Check these before relying on them. Section numbers and penalties come from secondary sources that summarise the statutes. The Tasmanian and ACT penalties are unverified, and so are the Victorian, Queensland and NT penalties for publishing a recording. Check the current legislation before you rely on any of it.

Two more traps:

Publishing is a separate issue. Even where you can lawfully record, communicating or publishing the recording to others can be an offence or need consent. Sharing a recording or transcript on LinkedIn, in a Teams chat or with an AI vendor can be the real problem.
Mixed locations. If you’re in Victoria, someone’s in Perth and someone’s in Sydney, it’s not clear which law applies. The safest approach is to assume the strictest one applies, which means getting everyone’s consent.

In person, online and ‘private conversation’

The surveillance device laws are about ‘private conversations’. Broadly, a conversation isn’t private if all the parties ought reasonably to expect it might be overheard by someone else. A large open session might arguably fall on that side. A small team meeting or a client call almost certainly doesn’t. I wouldn’t rely on that argument. A court looks at the circumstances, and it’s untested for meetings like yours.

The rules apply equally to a phone on the table, a wearable and a bot that joins your Teams call. The device is a ‘listening device’ whatever it looks like.

Commonwealth: the TIA Act and the Privacy Act

TIA Act: it prohibits intercepting a live communication passing over a telecommunications system without the knowledge of the person making it. A participant recording at their own end isn’t usually treated as interception. Whether a bot that joins a call as a participant is different hasn’t been tested, as far as I know.
Privacy Act: it applies to ‘APP entities’, which are generally businesses with turnover over $3 million (plus some smaller ones, such as health providers) and government agencies. The small business exemption is still in force as at October 2026 according to secondary sources, though reform has been proposed. Many MSPs are under the threshold, but many of their clients and some vendors aren’t.
OAIC guidance: it says meeting recordings and AI transcripts are personal information. Collect only what’s reasonably necessary, tell people, consider opt-outs, and destroy or de-identify what wasn’t needed, such as a personal chat or confidential client details.
Statutory privacy tort: since 10 June 2025 there’s a tort for serious invasions of privacy. I haven’t verified how it applies to small operators or to recordings.

The AI note-taker problem

The recording is only half of it. An AI tool adds questions that an old-fashioned voice memo never did:

Third-party storage: your colleagues’ and clients’ words now sit on a vendor’s servers.
Training: does the vendor use the audio or transcripts to train its models? Some do, so check the terms.
Cross-border: the data is probably processed outside Australia.
Confidentiality: people discuss client names, incidents and commercial details, which may breach NDAs or client contracts.
Voiceprints: some tools build speaker profiles, which is biometric-style data.
Sharing: some tools email a summary to every attendee, or publish a link, automatically.

This is already in the courts overseas. In re Otter.AI Privacy Litigation in the US alleges Otter’s Notetaker recorded meetings without all participants’ consent and used the data for training. In August 2026 a federal court held Otter could plausibly be treated as a third-party eavesdropper because it keeps and uses recordings for its own purposes. That’s US law, not ours, but it shows the risk.

There are workplace consequences too. The Fair Work Commission has accepted covert recording as a valid reason for dismissal (Schwenke v Silcar [2013] FWC 4513). NSW also needs 14 days’ written notice for camera, computer or tracking surveillance of employees, and the ACT has a notice and consultation regime. If you run staff meetings through an AI recorder, check them.

A simple approach for MSPs and small business

The cleanest fix is to separate the organiser’s official recording from everyone else’s. The organiser decides, tells everyone, gets consent and controls where the recording lives and who sees it. An individual’s own recorder or bot has a separate vendor, separate retention and nobody else’s consent. In SA, WA and (mostly) NSW, Tasmania and the ACT that’s where someone can get into trouble, even if they only meant it as private notes.

Write a short recording policy. Plain English (sample below).
Get consent in the invite or booking. Say the meeting will be recorded, why, who sees it and how to opt out.
Announce it at the start. Silence after a clear announcement may amount to implied consent, but express consent, such as a ticked box or a Teams consent prompt, is better.
Make it visible and offer opt-outs. Use the recording indicator, say it out loud, and let people keep their camera off or ask in chat.
One official recording. The organiser shares the transcript or summary afterwards, so nobody needs their own recorder.
Set retention, deletion and access. Where it’s stored, how long it’s kept, who can view it, and how someone asks for deletion.
Control who joins. See the Teams notes below. Zoom shows participants a consent prompt when recording starts.
If you find an unauthorised recording, stay calm. Politely ask for it to be stopped, ask what’s been captured and where it’s stored, and ask for deletion and no sharing. Don’t confront anyone publicly or take their device. If it’s serious or has been shared, get advice.

What Microsoft 365 gives you in Teams

If you manage the tenant, two Teams meeting policy settings are worth knowing. Both are admin-level policies, not per-meeting switches, and both match Microsoft Learn.

Manage external bots and their access to meetings. Teams detects external bots such as note-takers and holds them in the lobby until the organiser explicitly admits them. “When detected, require approval before joining” is the default. Microsoft says some bots may not be detected, so it doesn’t replace a policy. It also suggests letting only organisers and co-organisers admit people from the lobby.
Require participant agreement for recording and transcription. It’s off by default. Switch it on and, once recording or transcription starts, everyone else is muted with camera and sharing off until they answer Yes or No. A No means a view-only experience. The person who starts the recording is treated as having consented, and the choices appear in the attendance report. It’s the closest thing Teams has to a tick-the-box consent.

Sample wording

(a) Invite or booking notice

This meeting will be recorded (audio, video and chat) by the organiser so that people who can’t attend can catch up and so we can produce notes and an AI-generated summary. The recording is stored in [location], kept for [90 days], and available only to [who]. If you’d prefer not to be recorded, email [organiser] before the meeting and we’ll make arrangements, such as keeping your camera off or asking questions in chat. Please don’t use your own recording tools, AI note-takers or bots without the organiser’s agreement. By attending after reading this notice, you agree to be recorded.

(b) Start-of-meeting script

Before we start: this session is being recorded by us, the organisers, for notes and an AI summary that we’ll share afterwards. If you don’t want to be recorded, please say so now or message [organiser] in chat, and we’ll sort it out. Please don’t run your own recorder or AI note-taker. We’ll share the official transcript and summary. If anyone is uncomfortable at any point, we can pause the recording. Is everyone happy to proceed?

(c) Short recording policy

Only the organiser makes the official recording of a meeting.
Attendees must not record audio or video by any means (phone, laptop, wearable, AI note-taker or bot) without the organiser’s agreement and the consent of everyone present.
Attendees are told about the recording in the invite and at the start of the meeting, and can opt out.
The organiser shares the transcript or summary with attendees. It isn’t shared outside the meeting without the consent of the people in it.
Recordings are stored in [location], kept for [period], and deleted on request where practical.
Unapproved bots will be removed. If an unauthorised recording is found, the organiser will ask for it to be stopped and deleted.

What I haven’t verified

Section numbers and penalties come from secondary sources, not the statutes themselves.
The Tasmanian and ACT penalties are unverified.
The Victorian, Queensland and NT penalties for publishing a recording are unverified.
Whether a bot that joins a call counts as ‘interception’ under the TIA Act is untested, as far as I know.
I haven’t verified how the statutory privacy tort applies to small operators or to recordings.

Sources

General information only, not legal advice. Laws change and details vary by situation, so check the current legislation or get advice before relying on this.

CIA Brief 20261031

Security

AI supercharges cyberattacks on Australia, with superannuation savings in the firing line
The ASD’s annual threat assessment says frontier AI is helping attackers find and exploit vulnerabilities faster. The ASD sent more than 4,400 notifications of possible malicious activity last year, up 80 per cent, and the average cost of an attack on a medium-sized business rose 45 per cent to $141,300. The message for Australian SMBs is blunt: get legacy kit off the internet and put security ahead of availability, even if that means a short outage to patch.
https://www.smh.com.au/politics/federal/ai-supercharges-cyberattacks-on-australia-with-superannuation-savings-in-the-firing-line-20261026-p618mz.html

From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Attackers posed as IT support in Teams and talked users into Quick Assist sessions. From there they abused misconfigured certificate templates (ESC1) or relayed NTLM to AD CS web enrollment (ESC8) to get certificates for privileged accounts and domain controllers. Good reminder that a password reset doesn’t revoke an issued certificate, so audit AD CS templates and web enrollment on any hybrid client, block external Teams chats you don’t need, and don’t leave privileged accounts out of automatic containment.
https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/

Tracking AI adoption in North Korean threat actor tradecraft
Microsoft says AI use among North Korean groups is now high. They’re using it to spin up front companies, generate dozens of tailored lures in minutes, trojanise source code repositories and run the ARTEX agentic pen-testing framework. The attacks are still human-directed and rely on social engineering and legitimate tools, so the defences haven’t changed, but expect fake job applicants and fake vendors to look a lot more convincing.
https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/

Part 4: See, investigate, and measure email and collaboration attacks with Defender reporting
Version 4 of the free Detections and Insights workbook for Sentinel and Power BI adds a Teams and Collaboration view, an impersonation and BEC tab, and 125 new or improved advanced hunting queries, including a Teams protection folder. There’s also a new Attack Simulation Training report that tracks who clicks, who reports and who keeps failing. Worth a look for MSPs, as the Sentinel workbook can combine several workspaces in one view, which makes multi-tenant reporting much easier.
https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-4-see-investigate-and-measure-email-and-collaboration-attacks-with-defender/4562274

MAI Cyber 1.1 Flash: Sharper findings and fewer tokens inside MDASH
Microsoft’s in-house security model for vulnerability discovery now costs 18 per cent less per scan with comparable results, and it already runs almost half of all MDASH scans. It’s only available to verified MDASH customers, so most SMBs won’t touch it directly. Still early, but it shows defenders getting the same AI-driven bug hunting that attackers are already using.
https://microsoft.ai/news/mai-cyber-1-1-flash/

Microsoft 365 & Windows

What’s New in Microsoft Copilot | October 2026
A big month: the Copilot app Home brings Chat and Cowork together, Projects and skills come to Copilot Chat in November, and Autopilot, an always-on personal agent with its own mailbox, files and remote computer, arrives for Frontier users in November. On the admin side, Purview can now retain Copilot memory and DLP is extending to Cowork in preview. Plenty of this is Frontier-only for now, so check what’s actually reaching each client tenant before you start training users, and have a governance plan ready before Autopilot lands.
https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/what%E2%80%99s-new-in-microsoft-copilot–october-2026/4568528

Cloud & AI

MAI-Image-2.6 and MAI-Image-2.6-Flash are now generally available in Microsoft Foundry
Microsoft’s own image models are now GA in Foundry. They support up to five reference images to keep products and branding consistent, web grounding through Bing, and output up to 1.5K, with Flash aimed at fast, high-volume work. Nothing groundbreaking, but it’s another sign Microsoft is building its own model stack rather than relying only on OpenAI, which matters for anyone building client solutions on Foundry.
https://techcommunity.microsoft.com/blog/azure-ai-foundry-blog/mai-image-2-6-and-mai-image-2-6-flash-are-now-generally-available-in-microsoft-f/4566327

Cheap code, precious trust: Code modernization at scale
Microsoft explains how it uses AI agents to migrate and modernise huge codebases such as Windows and Azure, including moving C and C++ to Rust, backed by testing and formal verification. Its key point is that generating code is now the easy part and knowing whether to trust it is the hard part. The same applies to every script and automation your team is now generating with AI, so verify before it goes near a client tenant.
https://commandline.microsoft.com/agentic-software-engineering-large-scale-code-migration-language-modernization-spec-driven-development/

How Microsoft quietly reinvented itself to build better AI
Fast Company goes inside Microsoft’s AI reorganisation: one Copilot super app across Chat, Code, Cowork and Autopilot, in-house frontier models now that the OpenAI tie is looser, and an internal accelerator to spread AI know-how. Worth a read for the direction of travel, because “one Copilot” means less product sprawl to explain to clients but a lot more interface change along the way. Much of the new app is still in Frontier preview with no GA date.
https://www.fastcompany.com/91607730/microsoft-ai-copilot-autopilot-kevin-scott-charles-lamanna-mustafa-suleyman

Other

Partner Blog | Make each Microsoft 365 Business Premium opportunity a security conversation
Microsoft’s SMB lead tells partners to treat every Business Premium deal as a security conversation, with the Defender and Purview Suites for Business Premium as the next step, and points to the FY27 SMB sales plays and Channel Partner Playbook. It’s sales guidance, not a new discount or incentive. Good reminder that the recurring revenue comes from managing posture after the sale, not from the licence itself.
https://techcommunity.microsoft.com/blog/partnernews/partner-blog–make-each-microsoft-365-business-premium-opportunity-a-security-co/4568159

Microsoft Announces First Quarter Results (FY27 Q1)
Revenue was $92.3 billion, up 19 per cent, and Microsoft Cloud revenue was $63.9 billion, with growth accelerating to 30 per cent. Nadella’s pitch is all about agent safety, security and letting customers “own their own intelligence”. Nothing groundbreaking for day-to-day operations, but it tells you where Microsoft’s investment, and its partner incentives, will keep flowing.
https://www.microsoft.com/en-us/Investor/earnings/FY-2027-Q1/press-release-webcast

After hours

Will AI cause utopia or disaster? – https://www.youtube.com/watch?v=AoKo6EujpW8

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

Finally, AI That Just Gets Things Done

A relaxed business owner with a coffee watches several laptops quietly working around him

For years, when I talked to people about AI, I could see a gap between what they expected and what they got. They expected something that would just do the job. Tell it what you want, it goes away, and the work comes back done. What they actually got was a chat box. Clever, sometimes impressive, but you still did all the running around yourself. Copy this, paste that, open another app, reformat it, send it.

Over the last little while I’ve been using Grok Bot heavily across my own business, and for the first time it feels like that gap is closing. Not because the AI suddenly got smarter, although it has, but because it’s easy to set up so that it actually gets things done. That’s the shift I want to talk about, because I think it’s why it’s fast becoming a real option for a lot of businesses, and particularly for SMBs and the MSPs who look after them.

It works the way people always expected AI to work

Most people never cared which model they were using. They cared about outcomes. Did the email get answered? Did the report get written? Did the post go up on time? The industry spent a long time arguing about models and benchmarks while the average business owner just wanted someone, or something, to take a task off their plate.

What I notice with Grok Bot is that I rarely think about the model at all. I think about the job. I describe what I want in plain language, and the assistant works out the steps. It can reach the systems I’ve connected, use a computer and browser when there isn’t a connector, and come back to me with a result rather than a suggestion. That’s much closer to the mental picture most people have always had of an assistant.

I touched on this idea in a recent podcast, Need to Know podcast – Episode 372, where I talked about where AI is heading. The theme is the same: the model is becoming the engine, and what really matters is what it’s connected to and what it’s allowed to do.

What I actually use it for

Rather than talk in the abstract, here’s how I use it day to day. I don’t run one general assistant. I run a number of specialised ones, each set up for a particular job.

Blog writing and scheduling. One assistant drafts articles in my voice, creates a hero image, uploads it to WordPress, picks tags and schedules the post for the next free morning slot. The article you’re reading started there, and it waited as a draft until I approved it.
Social posting. Separate assistants turn blog posts into LinkedIn and X posts, so new content gets shared without me rewriting it each time.
Daily Microsoft 365 security checks. An assistant runs regular checks across my tenants and reports what changed or what looks wrong, so I start the day knowing where to look.
News briefs. Another pulls together the Microsoft and security news I care about into a regular brief.
Podcast preparation. One helps me research news and build outlines and scripts for episodes.
Teams, help desk and email list. Others watch and respond in Teams, help triage support questions and help look after my email list.

The common thread is that each assistant knows its job, knows my standards and knows which tools it can use. When I want to change how something works, I tell it in plain language and it updates how it goes about the task next time. There’s no project plan or developer involved.

None of these needed me to write code. Each one is mostly a set of plain-language instructions, a few connected services and, where it makes sense, a schedule.

Connectors are where the work happens

The thing that turns an AI from a talker into a doer is connections. In my case that means WordPress, Outlook, Teams, GitHub and others. Once an assistant can reach those, a request like “draft this, put it on the blog and schedule it” isn’t a lesson in copy and paste anymore. It’s a task that gets finished.

When there isn’t a connector, there’s a shared computer with a browser the assistants can use. That matters more than it sounds. Plenty of the systems SMBs rely on don’t have neat integrations. Being able to fall back to using a website the way a person would fills a lot of gaps.

Just as importantly, it asks before doing anything that can’t easily be undone or that other people will see. Sending messages, posting publicly, deleting things. That’s the right balance. I want it to do the legwork, but I still want to approve what goes out under my name.

Routines mean it works while I don’t

The other big piece is routines. I can set an assistant to run on a schedule, every morning, every week, or when something happens. My security checks and news briefs run without me asking. When I sit down, the work is already done and waiting for review.

This is the part I think many businesses will find most valuable. A lot of small business admin isn’t hard. It’s just relentless. Checking things, summarising things, chasing things. Handing that rhythm to an assistant frees up real time.

See it in action

If you’re an MSP wondering what this looks like in practice, I’ve recorded a video that shows it. In How I Use AI to Automate Microsoft 365 Administration, Security & Reporting I walk through how I’m using AI to handle the administration, security and reporting work across Microsoft 365 that used to eat my time. It’s the recording of my October Need to Know webinar on managing Microsoft 365 autonomously, so it’s practical rather than theoretical.

Watch it with your own customers in mind. Think about which of their routine checks and reports you could hand off in the same way.

Why this matters for SMBs and MSPs

Picture a ten-person business with no IT staff. They don’t want to evaluate models or build integrations. They want their quotes followed up, their inbox summarised and their social media kept alive. An assistant they can configure in plain English, connect to the tools they already use and put on a schedule is a very different proposition from a chatbot they have to babysit.

For MSPs, I see two opportunities. The first is internal. Your own team can hand off routine checks, reporting and documentation. The second is with customers. Someone still needs to design these assistants well, decide what they can touch, secure the connections and review the results. That’s advisory work, and it’s exactly where a good MSP adds value.

It also raises the same questions I’d ask of any AI tool. What data can it reach? Who approves the risky steps? How do you know what it did? Easy to configure doesn’t mean you skip the thinking. It means the thinking goes into the design rather than the plumbing.

A few lessons from my own setup

Specialise. Several focused assistants work better than one that tries to do everything.
Write down your standards. The more clearly I describe my voice, formatting and rules, the more consistent the results.
Start with drafts. Let it prepare, and you approve, until you trust it with more.
Automate the rhythm, not just the task. The real gains come when work runs on a schedule.

Getting things done is the point

I don’t think the next phase of AI for business will be won by whoever has the best model on a leaderboard. It will be won by whatever makes it easiest for ordinary businesses to get real work done, reliably and safely.

That’s why I’ve leaned into Grok Bot. Not because of what’s under the bonnet, but because it does what I always expected AI to do. I tell it what I need, and it gets on with it. For a lot of businesses, that’s the only measure that has ever really mattered.

Same Licence, Different Results

Cartoon of an experienced person in a casual wizard hat guiding a colleague who holds a plain stick, with a laptop on the desk

Picture two people in the same team asking Microsoft 365 Copilot to do the same job. Same licence, same tenant, same Monday morning. One ends up with something she can send to a customer. The other ends up with something he quietly deletes.

The tool is identical. Everything around it is not.

Where the difference shows up

The task is simple: a customer has sent a long Outlook thread about a delayed project, and the team needs a recovery update for a Teams meeting that afternoon.

The first person starts by thinking. She knows what the customer is worried about, and which commitments are real and which are wishful. She asks Copilot to summarise the thread, then to separate the decisions from the complaints. She opens the project plan in Planner, checks the dates against what Copilot said, and spots a milestone stated with far too much confidence. She corrects it, then asks for a draft in Word, matching the tone of an earlier update stored in SharePoint.

The second person types “write an update about the delay” and pastes the answer into a document. It reads fluently, is polite, and is wrong in two places. He doesn’t notice, because he never decided what a good answer looked like.

Same wand. The difference was framing the problem, checking the result, and knowing where the real data lives.

It goes beyond prompts

I’m wary of the idea that this is all about prompt wording. Prompts matter, but they’re the visible tip. Underneath sits judgement: knowing which Excel workbook is the trusted one and which is last year’s copy with a different name. Knowing that a SharePoint site full of duplicates gives Copilot a confused view of your business. Knowing when a sensible-sounding answer should make you suspicious rather than relaxed.

None of that arrives with a licence. It comes from experience, a healthy scepticism, and someone being willing to say “that doesn’t look right” out loud.

It changes how I think about buying decisions, too. A business that rolls Copilot out to everyone and calls it done has bought wands. A business that invests in tidy data, clear ownership and shared habits for checking AI output has started building wizards. I’d take the second approach with half the licences over the first with all of them. A skilled person with a plain tool beats a novice with a fancy one most days.

What I’d do on Monday

Pick one real task, such as a weekly report or a customer reply, and have your most careful person and your most enthusiastic person both do it with Copilot. Then compare more than the output. How did each of them get there? What did they ask first? What did they check? What did they ignore?

That comparison tells you more than any vendor demo ever will. It shows you what to teach, what to document and where your data needs attention.

If you buy services from an MSP or adviser, apply the same test to them. Ask less about which products they resell and more about which problems they’ve solved that look like yours. Ask who will actually work with you, and what they did the last time it went sideways.

Tools will keep changing every few months. Framing a problem, questioning an answer and understanding your own information will still be worth having when the next one arrives. That’s what I’d invest in first, and I suspect it quietly decides whether any of this pays off.