Microsoft

Microsoft Teams will automatically enhance messaging security in January 2026, enabling protections against malicious content for tenants with default settings. Key features include blocking dangerous file types, detecting malicious URLs, and allowing false positive reporting. Admins should review settings before the January 12 activation date to maintain custom configurations. This update is part of Microsoft’s broader initiative to improve cybersecurity measures in response to increasing threats.

https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-strengthens-messaging-security-by-default-in-january/

TLDR: MS Teams' guest access may compromise security, allowing users to bypass Microsoft Defender protections when joining external tenants. This vulnerability could let attackers create “protection-free zones,” using low-cost licenses to exploit unprotected environments, leading to phishing attacks. Organizations should restrict guest invites to trusted domains and enhance security measures.

https://thehackernews.com/2025/11/ms-teams-guest-access-can-remove.html

Microsoft includes Security Copilot AI in M365 E5 subscriptions at no extra cost to address a cybersecurity workforce shortage. Rollout began on November 18, 2025, with features automating tasks and improving investigations. Customers receive up to 10,000 Security Compute Units monthly, access more than 40 new agents, and can build custom agents. The initiative aims to enhance cybersecurity operations and transform IT with advanced AI capabilities.

https://idm.net.au/blog/0015440-microsoft-embeds-ai-defenders-m365-e5-suite

Microsoft will improve Entra ID security against script injection attacks by implementing a new Content Security Policy by October 2026, restricting scripts to trusted domains to prevent unauthorized access.

https://www.bleepingcomputer.com/news/microsoft/microsoft-to-secure-entra-id-sign-ins-from-external-script-injection-attacks/