In this episode I cover the latest Microsoft news, including Office moving into the new Copilot app, the new Copilot with Home, Code and Autopilot, usage-based Copilot billing for partners starting 1 December (initially not available in Australia), new partner margin and a Business Premium security promotion, Entra ID blocking script injection at sign-in, Outlook blocking MSIX attachments, deepfake detection coming to Teams, an Exchange Server security update, the 2027 Windows Update certificate expiry and the Microsoft Digital Defense Report 2026.
In my editorial I look at agent autopilots like Grok Bot, Microsoft Autopilot (formerly Scout) and Meta Muse, and how I’m using a team of Grok Bot bots to post to social media, monitor my Microsoft 365 tenant with a read-only global admin reader, make phone calls and even produce the intro and news segment of this episode in a clone of my voice. Did you notice? Love your feedback.
Brought to you by www.ciaopspatron.com
you can listen directly to this episode at:
https://ciaops.podbean.com/e/episode-371/
Subscribe via iTunes at:
https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2
or Spotify:
https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb
Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show
Resources
CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS
X – https://www.twitter.com/directorcia
director@ciaops.com
Join my Teams Shared Channel – CIAOPS
CIAOPS Merch store – CIAOPS
Become a CIAOPS Patron
CIAOPS weekly news update – CIA Brief – CIAOPS
CIAOPS Labs – The Special Activities Division of the CIAOPS
Get your M365 questions answered via email
A special thanks to the CIAOPS Patron community for making this podcast possible. You can find the benefits of a subscription to the community and become a member at https://www.ciaopspatron.com
Updates
Copilot
Introducing Office in the new Microsoft Copilot app Microsoft is bringing Word, Excel and PowerPoint into the Copilot app so you can create, edit and collaborate on documents without leaving Chat or Cowork. It is rolling out to Frontier customers from 9 October, so think pilots rather than mass rollout. https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/introducing-office-in-the-new-microsoft-copilot-app/4561230
Microsoft 365 Copilot release notes The latest release notes, covering 22 September to 6 October, show Copilot Search now embeds chat so users can search and then ask follow-up questions in the same place.https://learn.microsoft.com/en-us/microsoft-365/copilot/release-notes
Introducing the new Copilot with Home, Code and Autopilot Microsoft’s 25 September announcement of the new Copilot: Home brings Chat and Cowork together, Code lets people build small apps and automations in a sandbox hosted in your tenant, and Autopilot (previously Scout) is a persistent agent with its own identity, in private preview. Also covers the plugin registry, Copilot Managed Runtime and spend controls in Agent 365. https://blogs.microsoft.com/blog/2026/09/25/introducing-the-new-copilot-with-home-code-and-autopilot/
Money and partners
Partner Center announcements: October 2026 Usage-based billing becomes default-on for new Microsoft 365 Copilot Business licences bought through CSP from 1 December 2026, with a default cap of 4,000 Copilot Credits per user per month. It is initially not available in Australia. Also from 1 October, a 7.5% promotional pricing offer on Defender Suite and Purview Suite for Business Premium (customers under 300 seats) and new growth margin for Copilot, Microsoft 365 E5/E7, Defender Suite, Purview Suite and Windows 365 Enterprise. Link: https://learn.microsoft.com/en-us/partner-center/announcements/2026-october
Security and admin changes
Microsoft to block Entra ID script injection attacks starting in October Entra ID browser sign-in will enforce a Content Security Policy so only scripts from trusted Microsoft CDN domains run on the sign-in page. Rolling out mid to late October, on by default. Some browser extensions and helper tools that inject code may stop working, so test now. Link: https://www.bleepingcomputer.com/news/security/microsoft-to-block-entra-id-script-injection-attacks-starting-october/
Microsoft Outlook to block MSIX attachments used in attacks MSIX and MSIXBUNDLE attachments are being added to the blocked file types in OWA mailbox policies, starting early November. Admins can allow them via the AllowedFileTypes property if needed. https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachments-used-in-attacks/
Microsoft Teams to add third-party deepfake detection and impersonation protection New Microsoft 365 Roadmap entries show Teams integrating third-party deepfake detection signals and impersonation protection that warns about suspicious meeting organisers or participants, targeted for November. Roadmap dates can shift and third-party providers may mean extra cost. https://www.bleepingcomputer.com/news/security/microsoft-teams-to-add-third-party-deepfake-detection-impersonation-protection/
MSRC October 2026 security update release notes (CVE-2026-96940) On-premises Exchange Server security update released 5 October for CVE-2026-96940, CVSS 8.8, rated Exploitation More Likely, with no workarounds listed. Read the CVE page for impact details before briefing customers. https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct
Exchange Server SE security update KB5129955 The fix is in Exchange Server SE security update KB5129955 (SU10 V2). If you still run on-premises or hybrid Exchange, patch promptly.
https://support.microsoft.com/en-us/servicing/exchange/server/update/2026/5129955
Microsoft: Outdated Windows devices will lose security protection next year Certificates used to connect to Windows Update expire on 17 May 2027 and 19 June 2027. Devices on unsupported Windows versions will lose Windows Update services, so audit old PCs and servers now.
Threat landscape
Insights from the 2026 Microsoft Digital Defense Report Microsoft’s 2026 report says threat actors are using AI across reconnaissance, social engineering, malware development and post-compromise activity, mostly within existing attack workflows. The fundamentals still apply: identity, least privilege and monitoring. https://www.microsoft.com/en-us/security/blog/2026/10/01/insights-from-the-2026-microsoft-digital-defense-report/
Editorial: agent autopilots
Grok Bot overview The agent platform I use for my bots: persistent cloud computer per user, skills and routines. https://docs.x.ai/grok-bot/overview Introducing Muse, Meta’s personal AI agent Meta’s consumer personal agent announced in September 2026. https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/
