Download Visual Assets
A man and a woman on the left collaborating on computing devices; a woman on the right holding a mobile device; all on a background of colorful shapes
Microsoft Ignite

BOOK OF NEWS

November 18 - 21, 2025

Introduction

Foreword from Frank X. Shaw

Welcome to Microsoft Ignite, the annual event that showcases the updates and creations that empower customers, partners and developers to utilize the full potential of Microsoft technology and change the way people and organizations tackle work.

This year’s Microsoft Ignite will focus on exploring the complete lifecycle of AI, creating tools and solutions to drive the next generation of digital transformation as organizations push themselves to unlock creativity and innovation.

More than 200,000 people have registered to join us at Ignite this year, with more than 20,000 in attendance at our events in San Francisco. Attendees can choose from more than 400 sessions, demos and expert-led labs from Microsoft and our partners. Much of the Ignite content will be available on demand for those unable to attend live.

The Book of News is your handy guide to our announcements, crafted to highlight our most current updates and deliver key insights into the topics you find most compelling. Please feel free to share your feedback as we want to ensure you receive the information and context you seek from this event.

fxs

What is the Book of News?

The Microsoft Ignite 2025 Book of News is your guide to key news items that we are announcing at Microsoft Ignite. The interactive Table of Contents gives you the option to select the items you are interested in, and the translation capabilities make the Book of News more accessible globally (just click the Translate button below the Table of Contents to enable translations).

We pulled together a folder of imagery related to a few of the news items – please take a look at the imagery here. To watch keynotes and sessions related to news items, we have links below many of the news items to give you quick access to upcoming sessions and on-demand videos.

We hope the Book of News provides all the information, executive insight and context you need. If you have any questions or feedback regarding content in the Book of News, please email [email protected].

If you are interested in speaking with an industry analyst about news announcements at Microsoft Ignite or Microsoft’s broader strategy and product offerings, please contact [email protected].

Two men look at a tablet PC together, on a background of colorful shapes.

1. AI Business Solutions 1.1. Microsoft Agent 365

1.1.1. Introducing Microsoft Agent 365, the control plane for agents

As agents get added to every workflow and become more capable, IT leaders are facing a dilemma of how to accelerate innovation without introducing risk or rebuilding their entire infrastructure. Microsoft Agent 365 will extend the infrastructure for managing users to agents — helping organizations govern agents responsibly and at scale. Agent 365 is available now in Microsoft 365 admin center with the Frontier program, Microsoft’s early access program for the latest AI innovations.

Agent 365 includes Microsoft’s leading security and productivity solutions: Microsoft Defender, Microsoft Entra and Microsoft Purview to protect and govern agents; Microsoft 365 apps such as Word, Excel, Outlook and Work IQ to provide work context and accelerate productivity; and Microsoft 365 admin center to manage agents.

Here are the core capabilities of Agent 365:

  • Registry: Get the complete view of all agents in your organization, including agents with agent ID, agents you register yourself and shadow agents.
  • Access control: Bring agents under management and limit their access only to resources they need. Prevent agent compromise with risk-based conditional access policies.
  • Visualization: Explore connections between agents, people and data, and monitor agent behavior and performance in real time to assess their impact on your organization.
  • Interoperability: Equip agents with apps and data to simplify human-agent workflows. Connect them to Work IQ to provide context of work to onboard into business processes.
  • Security: Protect agents from threats and vulnerabilities; detect, investigate and remediate attacks that target agents. Protect data that agents create and use from oversharing, leaks and risky agent behavior.

Additional resources:

1.2. Agents

1.2.1. Sales Development Agent now in Frontier preview

To help sales teams scale their selling capacity, Microsoft is introducing the Sales Development Agent, now available through the Frontier program. It’s a fully autonomous sales agent that will research, qualify and engage leads during and after business hours to drive revenue growth. Features include:

  • Revenue and pipeline growth: The agent will research prospects, craft personalized outreach and automatically follow up to ensure no lead is left behind.
  • Scalability: The agent will be able to work independently, with the ability to hand off leads to human sellers if needed.
  • Security and governance: Built on Microsoft’s trusted security and compliance foundation, the Sales Development Agent will come ready to use with the security, governance and productivity tools in Agent 365 right out of the box.

Additional resources:

1.2.2. Agents in Microsoft Teams channels now work with other agents and apps

Agents in Microsoft Teams channels can now work with third-party apps and agents via Model Context Protocol (MCP) servers, such as GitHub, Asana and Atlassian (Jira). This update is available in preview. For example, a user can ask the agent in a channel about blockers and mitigation plans for an upcoming product launch, and the agent will pull risks directly from Jira and then schedule a meeting with the team to discuss a mitigation plan. By connecting with other apps and agents, agents in Teams channels will enable human-agent teamwork and collaboration.

Additional resources:

1.2.3. Workforce Insights, People and Learning Agents now available

Three new agents — Workforce Insights, People and Learning Agents, all powered by Work IQ — are now available to help redefine the employee experience. Work IQ is the intelligence layer powering Microsoft 365 Copilot and agents. Together, these agents will help simplify workforce management, strengthen employee connections and accelerate upskilling across the organization. They are:

  • Workforce Insights Agent: This agent will give leaders and delegates a real-time, comprehensive view of their organization across roles, tenure, location and other attributes, supporting faster, data-driven workforce decisions.
  • People Agent: This agent will help users find people in their organization based on role, function or skill and offer tailored suggestions on how to connect with colleagues based on previous interactions.
  • Learning Agent: This agent will deliver personalized microlearning experiences, tailored tips and curated courses to help employees build role-specific and AI skills, with content sources configurable to team goals.

These agents are available in the Frontier program.

Additional resources:

1.2.4. Teams Admin Agent in Teams admin center helps streamline tasks

The Teams Admin Agent in the Microsoft Teams admin center, now in preview, allows IT admins to automate and streamline administrative tasks. This agent can autonomously and securely execute workflows like meeting monitoring and user provisioning. By automating recurring or complex tasks, this agent allows IT admins to provide faster, more consistent support without additional time burdens and with fewer user issues. With uniform application of policies and strengthened compliance, agent delegation also helps minimize compliance risks.

Additional resources:

1.2.5. SharePoint Admin Agent supports IT admins

The SharePoint Admin Agent, now in preview, in the SharePoint admin center uses AI-driven insights and automation to help IT admins maintain a secure, compliant and cost-efficient environment. It assists in monitoring inactive or ownerless sites, overshared content and permissions sprawl, then applies policies or automated actions such as archiving or access adjustments. The agent also provides visibility into sites with the highest agentic (AI-driven) activity, enabling proactive governance as Microsoft Copilot adoption grows. By automating manual tasks, it reduces operational overhead, mitigates security and compliance risks, and optimizes storage costs, delivering governance that scales with the organization.

Additional resources:

1.2.6. New Copilot Chat value for users without a Microsoft 365 Copilot license

In preview by March 2026, Copilot Chat will provide even more value in Outlook, Word, Excel and PowerPoint for users without a Microsoft 365 Copilot license.

Copilot Chat in Outlook will be content aware across a user’s entire inbox, calendar and meetings, instead of only individual email threads. Users will be able to triage their inbox, schedule and prepare for upcoming meetings, and surface insights and actions across their inbox and calendar to stay ahead.

Agent Mode in Word, Excel and PowerPoint will also be available with standard access. Users will be able to work iteratively with Copilot as it helps orchestrate multistep tasks to deliver high-quality documents, spreadsheets and presentations. Agent Mode in Copilot Chat will use web data and referenced files to help users create and refine content in their apps.

Additional resources:

1.3. Microsoft 365 Copilot

1.3.1. Introducing Word, Excel and PowerPoint Agents in Microsoft 365 Copilot

Microsoft 365 Copilot will feature dedicated Word, Excel and PowerPoint Agents — available through the Frontier program — that can create high-quality Office content directly from Microsoft 365 Copilot Chat. Simply type a prompt, and these agents will ask targeted follow-up questions to tailor the output to a user’s goals in creating documents, spreadsheets and presentations. The agents will be able to handle tasks like research, formatting and layout design.

Users will be able to iterate through multiturn conversations or easily transition to the apps to continue editing with Copilot. Each agent will be grounded in web data for broad knowledge. Word and PowerPoint Agents will include Work IQ, enabling advanced reasoning across files, meetings, emails and organizational knowledge for high-quality, relevant results. Agent capabilities will include:

  • Excel Agent: Turns data into charts, summaries and insights using built-in formulas and logic — helpful for forecasts, project plans and decision-making tools.
  • Word Agent: Organizes complex information into clear, well-written documents — ideal for strategic plans, policy write-ups and technical papers.
  • PowerPoint Agent: Builds presentations with storytelling and visual structure — helpful for executive decks, strategic updates and market overviews.

Early access is available through the Frontier program for Microsoft 365 Copilot licensed customers and will be coming soon to Frontier for Microsoft 365 Personal, Family and Premium subscribers.

Additional resources:

1.3.2. Agent Mode added to PowerPoint, Excel and Word

Agent Mode was recently introduced in Excel and Word, enabling Copilot to iteratively create, edit and format content directly within the apps. This capability has now been expanded to PowerPoint, and existing Agent Mode features in Excel and Word have been enhanced for more powerful in-app collaboration.

Early access to Agent Mode in PowerPoint, available through the Frontier program, will bring co-creating to an app many users rely on to design and deliver presentations. Working natively in PowerPoint, Agent Mode will be able to update existing decks using an organization’s branded template. Users will be able to iterate with Agent Mode to create new slides, rewrite and format text, insert and style tables, add images and rearrange content. Agent Mode will also be able to draw context from work data — files, meetings and emails — and combine it with web sources to create presentations. Agent Mode in PowerPoint is available through the Frontier program on the Insiders Beta Channel for Windows.

Agent Mode in Excel is also now available through the Frontier program across web and desktop platforms including Windows and Mac. Users will be able to easily bring external data into workbooks with an integrated web search capability. Users will also be able to choose between Anthropic and OpenAI reasoning models, offering flexible output generation. Agent Mode in Excel is available through the Frontier program for Microsoft 365 Copilot licensed customers and Microsoft Personal and Premium subscribers.

Agent Mode in Word, now generally available for Microsoft 365 Copilot and Microsoft 365 Premium subscribers, can now use Work IQ to automatically select relevant sources like files, emails and meetings, ensuring documents reflect the latest and contextually accurate information. The capability is available for both web and desktop apps, including Mac.

Additional resources:

1.3.3. Updates to Copilot in Outlook help streamline emailing, scheduling

Microsoft 365 Copilot in Outlook has several new updates that will support users in their work, including emailing and scheduling meetings.

Copilot in Outlook mobile now offers an interactive voice experience that summarizes unread emails and guides users through actions like drafting replies, deleting, archiving, pinning and flagging — all hands-free. Early access is available for iOS and Android users via Apple’s TestFlight program and Google Play’s Beta testing program.

Copilot in Outlook is making it easier to catch up and perform tasks using one-tap prompts. Copilot surfaces relevant actions that make it easier to get work done on the go, such as “Triage my inbox,” “What needs my reply?” and “Summarize and reply,” and guides the user through drafting a response step by step. One-tap prompts are generally available for Outlook for Windows, web, iOS, Android and classic Outlook.

Users now can schedule meetings directly from chat. Ask Copilot to schedule a meeting with colleagues and it will find available times, book rooms, draft agendas and send invites, all through chat. This feature is generally available in Copilot Chat across all endpoints for users with a Microsoft 365 Copilot license.

Copilot will also be able to help resolve scheduling conflicts for 1:1s and personal events. Users can set preferences for which meetings are flexible and Copilot will automatically reschedule when double-booked, notifying users of changes. Early access to this feature is available in Outlook for Windows and web for tenants that have enabled Targeted Release.

Additional resources:

1.3.4. Work IQ adds Copilot, SharePoint enhancements

Work IQ, the intelligence layer powering Microsoft 365 Copilot and agents, has new enhancements in Microsoft 365 Copilot and SharePoint. Work IQ is designed to understand your work inside and out. Built on data, memory and inference, Work IQ connects to organizational and personal data such as files, emails, meetings and more while building memory from your preferences, habits and workflows. Through inference, Copilot delivers insights, anticipates your needs, proactively executes tasks and can be fine-tuned to reflect your company’s unique knowledge. Enhancements to Work IQ include:

  • Conversational memory in Microsoft 365 Copilot will allow Copilot to retain context and specific details across sessions. By combining explicit signals — such as work profile, custom instructions and saved preferences — with insights from previous chats and contextual awareness based on Work IQ, Copilot will offer more relevant, personalized and useful responses. Users will have full control over their data and conversational memories can be reviewed, updated or deleted at any time. This is available via the Frontier program.
  • Reasoning over structured metadata in SharePoint document libraries, now generally available, enables more accurate, context-aware and precise answers when a prompt is grounded in SharePoint content. Populating SharePoint document libraries with metadata can be done manually or automatically with Knowledge Agent. For example, a Copilot prompt grounded on a SharePoint library of vehicle spec sheets with metadata such as make, model and engine size delivers answers that are more accurate, complete and relevant. While connectors provide access to SharePoint content, Copilot goes further with a rich understanding of SharePoint. In addition to the new metadata understanding, this includes images embedded in PowerPoint decks, SharePoint intranet site page content and files encrypted with sensitivity labels.

Additional resources:

1.3.5. Voice in Microsoft 365 Copilot available for commercial customers

Voice in Microsoft 365 Copilot, now generally available for commercial customers, makes interacting with Copilot more natural than ever. Users can speak to Copilot, interrupt it and easily move from voice to text on both mobile and desktop. Just tap, “Start a new voice chat” or say, “Hey, Copilot” to get instant, personalized insights, powered by Work IQ and surfacing top priorities and key information from meetings, emails and files. This capability will first roll out to Word, Excel and PowerPoint agents with availability in Microsoft 365 Copilot app, Word, PowerPoint, Outlook and more apps to follow.

Additional resources:

 

1.3.6. Copilot Notebooks enhancements improve collaboration

Copilot Notebooks has added several enhancements to improve collaboration, all available through the Frontier program, including a new overview page, Video Overview feature and the ability to share Notebooks.

Getting started is simple: Copilot will proactively recommend new Notebook topics based on recent activity and priorities, helping users capture ideas and begin projects with confidence.

Within each Notebook, Copilot will suggest relevant references to ensure the project has the most current content. To help users stay on track and up to date, the new overview page will surface live updates and insights as content changes. Alongside Audio Overview, the new Video Overview feature will provide quick, AI-generated summaries for any Notebook — making it easy to catch up. When it’s time to collaborate, users will be able to share Notebooks across an organization for convenient co-authoring and contribution across the team. These new experiences are available through the Frontier program for Microsoft 365 Copilot licensed customers.

Additional resources:

1.3.7. Microsoft 365 Copilot Chat can now create Pages

Microsoft 365 Copilot Chat now creates Copilot Pages based on user intent, making it easy to turn ideas into interactive content. Using the latest reasoning models, Copilot now can write code directly onto a page, letting users create interactive reports, visualize concepts and prototype new ideas. Users can continue to iterate with Copilot using chat or directly on the page and share it with others. Copilot can also turn the page into a PowerPoint presentation. This is generally available.

Additional resources:

1.3.8. Sora 2 will let users bring AI-powered video creation into Copilot

Microsoft 365 Copilot will bring OpenAI’s Sora 2 video model into the Create experience. Users will be able to generate short AI-generated video clips from natural language prompts or swap out stock footage with AI-generated content within their video projects. Video projects will have built-in tools for voiceover, music and brand kits to ensure that content is consistent. Sora 2 in Create is available for commercial users in the Frontier program.

Additional resources:

1.3.9. SharePoint page and list creation coming to Copilot Chat

Users in the Frontier enterprise program can now create SharePoint pages and lists directly from Microsoft 365 Copilot Chat. These new features will allow users to generate structured content quickly and intuitively using natural language prompts without leaving their current workflow. Examples include:

  • “@SharePoint list agent create a list of my top-selling products by geography”
  • “@SharePoint page agent create a page for our Q4 marketing campaign”

Additional resources:

1.3.10. New Microsoft 365 Copilot Business designed to help businesses scale

Microsoft 365 Copilot Business is a new offering created for small and midsize businesses (SMBs) with fewer than 300 users. Built on the Microsoft 365 foundation, Copilot is designed to help SMBs scale without complexity. For $21 per user monthly, Copilot will automate everyday tasks such as summarizing emails, drafting documents, analyzing data and capturing meeting notes — so teams can focus on customers and strategic growth. Businesses will be able to add agents to Copilot to handle tasks and processes and free up time for the business. Microsoft 365 Copilot Business will be generally available in December.

Additional resources:

 

 

1.4. Power Platform and Copilot Studio

1.4.1. Power Platform updates empower makers to more easily build and govern apps

Microsoft Power Apps is introducing several major updates to its core capabilities that will make it easier for makers to build and govern apps.

The new maker workspace in Power Apps, now in preview, will combine what a maker needs — planning, data modeling and app building — into one intelligent, AI-powered canvas.

It will be an agent-powered experience enabling makers to generate modern, multipage, business-ready apps by chatting with Microsoft 365 Copilot and refining them with point-and-click editing. The workspace will intelligently connect design, data and logic, allowing makers to visualize and modify in real time, with changes synced instantly across the app and no more switching between tools or views. It will be a faster, smarter and more intuitive way to go from idea to working solution.

The new Power Apps Model Context Protocol (MCP) Server, in preview, will connect AI agents to the logic and data already defined within the Power App. MCP services will act as an intermediary layer that standardizes communication between agents and app services, removing the need for custom integrations. Through MCP, agents will be able to call capabilities built into apps — such as submitting approvals, filling out forms, retrieving records or requesting user input — using a consistent protocol. For makers, Power Apps MCP will provide a structured framework to expose app functionality to agents, turning apps into reusable components of an enterprise’s AI ecosystem.

The Power Apps MCP Server now powers the updated agent feed, currently in preview. The agent feed will give makers greater control over tasks surfaced to users, support richer experiences for users, enable task assignment and provide agent performance metrics.

Starting Dec. 17, Power Apps customers will have the opportunity to preview the unified Copilot Chat experience in the model-driven apps in early release environments. This will go beyond basic Q&A and actions on app data. Copilot Chat will travel with users, carrying context from productivity apps into business apps. This will reduce context switching, helping users get things done more efficiently.

Additional resources:

1.4.2. Maker and admin improvements in Copilot Studio

Microsoft Copilot Studio has several new enhancements to give makers and admins greater confidence, flexibility and control when building and managing agents. These updates will make it easier to create high-performing, secure and enterprise-ready agents while unlocking new capabilities for automation and governance. Highlights include:

  • Agent evaluations: Agent evaluations are automated tests that measure an agent’s performance against a set of predefined scenarios and criteria. The agent is run through many test queries and its responses are automatically graded against expected outcomes. This will provide objective metrics to monitor the agent’s performance, catch regressions early and even compare different agent versions side by side. This feature is in preview.
  • Computer use in Copilot Studio now enables two new, secure experiences powered by Windows 365 for Agents: using a hosted browser to quickly access the internet and using Cloud PC pools to deploy cloud-based PCs managed by the organization. Computer use in Copilot Studio will enable agents to automate tasks across nearly any app or website by interacting directly with user interfaces via a virtual machine. This is in preview.
  • Real-time monitoring during agent runs: Microsoft Copilot Studio security capabilities have been extended with the ability to integrate trusted real-time monitoring solutions, either internal and external, during agent runs. Admins can opt to run Microsoft Defender, third-party security platforms or custom tools. This ability helps organizations harness the full potential of Copilot Studio while safeguarding against threats like prompt injection attacks using their preferred security infrastructure. This feature is generally available.
  • Microsoft Entra Agent ID: Agents built in Copilot Studio will now get a Microsoft Entra Agent ID. Microsoft Entra Agent ID enables organizations to discover and manage their entire fleet of AI agents, including shadow agents, by assigning unique identities and maintaining a complete inventory. It also means that Agent 365-equipped agents built in Copilot Studio can be built leveraging tools like Agent 365 MCP servers. Lifecycle governance helps ensure agents are created, sponsored and deactivated according to enterprise policies, including automated controls to prevent orphaned or overprivileged agents. These enterprise identities and access controls give organizations the visibility and oversight needed to keep agents secure.

Additional resources:

1.4.3. Copilot Studio in Microsoft 365 adds file creation, context access

Agents created in Microsoft 365 Copilot now support document generation using natural language. Agents can create Word, Excel and PowerPoint files. This capability simplifies content creation and encourages secure, centralized storage within Microsoft 365.

Agents also have access to a broadened set of Microsoft 365 knowledge sources, enabling more context-rich interactions. Scoped access includes Teams meetings and calendar data, and organizational directory information via People, OneNote and shared mailboxes. This update is generally available.

Additional resources:

1.4.4. Dataverse powers data connectivity across more apps, agentic workflow

Microsoft Dataverse, the data platform for Microsoft Dynamics 365, Microsoft Power Platform and Microsoft Copilot Studio, is introducing new updates to unlock integration between AI and data. This includes Dataverse SDK for Python and Dataverse MCP.

Data scientists and agent developers will be able to use the Dataverse SDK for Python, now in preview, to build agentic process workflows and perform data science using Python.

Dataverse Model Context Protocol (MCP) Server, now generally available, unlocks a new level of integration between AI and data, whether a user is building with Copilot Studio or GitHub Copilot in VS Code. New features include:

  • Unified AI-to-data access: MCP standardizes how large language machines like Copilot Studio agents and GitHub Copilot interact with Dataverse. This means that enterprise data is now fully extensible and platform agnostic.
  • Natural language interface: Users can ask questions and get real-time responses from the Dataverse environment. Under the hood, MCP clients translate these natural language requests and execute one or more built-in tools in Dataverse.
  • Powerful tooling: Dataverse MCP tools currently support built-in tools that allow users to insert or update data in tables, view tables and their descriptions, read data from a table, search knowledge and view and execute prompts available in the environment.

Additional resources:

1.5. Dynamics 365

1.5.1. Dynamics 365 ERP adds dynamic and analytics Model Context Protocol servers

Microsoft is modernizing the foundation that connects AI agents with enterprise resource planning (ERP) systems. The Dynamics 365 ERP Model Context Protocol (MCP) server — first introduced at Microsoft Build 2025 — is evolving from a static implementation to a dynamic framework, and a new MCP server for analytics is being added. Together, these updates, both in preview, will advance how ERP systems, data and AI agents connect — unlocking agentic ERP, AI-powered insights and extensibility at enterprise scale. The updates will help organizations move from disconnected automation efforts to a unified model in which business logic, data and AI operate through a common protocol — reducing integration complexity and accelerating time to value.

The Dynamics 365 ERP MCP server is evolving from a fixed catalog of tools to a dynamic, configurable framework that will adapt as business needs change. This evolution will simplify how developers and partners extend ERP capabilities using agentic AI, allowing new actions or APIs to be registered and updated dynamically instead of through code rewrites. As a result, organizations will be able to automate finance and supply chain processes faster, connect AI agents directly to live business logic and evolve systems, while maintaining compliance and control.

The new Dynamics 365 ERP Analytics MCP server will apply the same model-context principles to business reporting, analytics and insights. It will provide governed access to ERP analytics data, including metrics, dimensions and semantic models, so agents can reason over consistent, trusted information. Agents that generate analytics or insights will be able to surface them in the apps people use every day, including Copilot experiences, helping decision makers act on trends and forecasts more quickly and with context. This will close the loop between operational data and business performance management, enabling continuous planning and more responsive forecasting inside the same governed environment.

By evolving the existing MCP server and introducing the analytics server, Dynamics 365 ERP is building a connective layer that will be able to unify data, actions and insights. These advancements lay the groundwork for a new generation of adaptive, agentic ERP systems that not only record transactions but act on them.

Additional resources:

1.6. Manage and Secure Copilot

1.6.1. Baseline Security Mode helps organizations secure environments

Microsoft Baseline Security Mode, now generally available, helps organizations secure their Microsoft 365 environment with recommended configurations in just a few clicks. Through a guided admin experience, IT and security teams can identify gaps, simulate changes and deploy protections across Office, SharePoint, Microsoft Teams, Microsoft Entra and more. These configurations help organizations reduce risk from known vulnerabilities and build resilience against emerging threats, with minimal disruption.

Additional resources:

1.6.2. Agent Dashboard provides centralized agent reporting

Agent Dashboard, available in preview, will provide a centralized report on agent usage and adoption across the organization. IT and leadership teams will be able to view trends, adoption by group and agent highlights, supporting better governance and maximizing impact.

Additional resources:

1.6.3. Updates to Microsoft Purview address key security issues

Microsoft Purview Data Loss Prevention (DLP) for Microsoft 365 Copilot will help ensure sensitive information stays protected. If a prompt includes confidential data such as credit card numbers or personal details, Microsoft Purview DLP for Copilot prompts, now in preview, will block Copilot and agents from responding, so that the sensitive information will not be used for grounding in Microsoft 365 or through a web search.

Overshared link remediation, now in preview in Microsoft Purview Data Security Posture Management (DSPM) for SharePoint, will enable admins to identify and fix overshared links at scale, reducing exposure and strengthening compliance. Microsoft Purview AI Observability in DSPM, now in preview, will provide full visibility into all agents, helping security teams make informed decisions and proactively manage risk. These features are available in preview.

These features are designed to help organizations deploy, monitor and secure AI agents at scale, ensuring compliance, reducing risk and providing clear insights into agent activity across Microsoft 365.

Additional resources:

 

A man sits on a chair with a tablet computer in one hand and a stylus in another, on a background of colorful shapes.

2. AI Opportunities 2.1. Investments in AI

2.1.1. Global study reveals how Frontier firms are transforming business with AI

To better understand how AI can be used to transform businesses across industries, Microsoft commissioned a global study with the International Data Corporation (IDC) of more than 4,000 business leaders responsible for AI decisions. The findings reveal 68% of these companies are using AI today, but the real difference lies in how they’re using it. In the study, Frontier firms, the ones leading AI transformation, report they are achieving returns that are three times higher than slow adopters. IDC categorized businesses based on their AI usage and found that 22% are Frontier firms, 39% are categorized as neutral and 39% are slow adopters.

Frontier firms’ success goes beyond efficiency and productivity at scale. They are driving growth, expansion and industry leadership in a new AI-powered economy. Based on the IDC study, Microsoft has identified five key lessons on how organizations can transform their businesses with AI.

  • Expanding AI impact across every business function: On average, Frontier firms are using AI across seven business functions.
  • Unlocking industry-specific value: 67% of Frontier firms are monetizing industry-specific AI use cases to boost revenue. Leaders in this trend include financial services, healthcare and manufacturing.
  • Building custom AI solutions for competitive advantage: 58% of Frontier firms are using custom AI solutions today; IDC estimates that number will jump to 77% in the next 24 months.
  • Agentic AI is the new differentiator for business leaders: In the next two years, IDC estimates the number of companies using agentic AI will triple.
  • AI budgets are growing and so is the team behind them: 71% of respondents plan to increase their AI budgets, with funding coming from IT and non-IT sources.

Among organizations surveyed, many are navigating challenges around security, privacy, governance and cost, as well as ethical considerations, integration complexity and scaling from pilot to production.

The message is clear: Businesses that embrace AI benefit from momentum in efficiency, customer experience and innovation. To stay competitive, leaders should act now and embrace AI not as an experiment but as a strategic imperative for growth.

Additional resources:

 

A man at a keyboard, on a background of colorful shapes.

3. Azure 3.1. Microsoft Foundry

3.1.1. Microsoft Foundry adds unified MCP tools for securing and customizing agents

New Microsoft Foundry updates in preview will enable developers to enrich agents with real-time business context, multimodal capabilities and custom business logic through a unified catalog of Model Context Protocol (MCP) tools built with security and governance in mind. The catalog includes:

  • Unified tool discovery: Developers will be able to find, connect and manage public or private MCP tools for agents from a single, secure interface in Microsoft Foundry.
  • Deep business integration: Logic Apps connectors will provide access to more than 1,400 systems like SAP, Salesforce and HubSpot that will be exposed as MCP tools. This will enable agents to be quickly integrated with core business services and act on real-time business data and events.
  • New tools for prebuilt AI services: New tools will provide out-of-the-box capabilities for transcription, translation, voice and intelligent document processing, and be available as MCP servers.
  • Custom tool extensibility: Developers will be able to securely expose any API or function as an MCP tool through API management, enabling them to reuse existing business logic.

Additional resources:

3.1.2. Model router in Microsoft Foundry now generally available

A model router that automatically selects the best model for the task is now generally available in Microsoft Foundry. It can help developers balance cost, performance and complexity by simplifying model selection and deployment while allowing developers to use a single endpoint for optimized AI workflows. By continuously learning from usage patterns, it delivers up to 40% faster responses and 50% lower costs in early customer deployments — all without code changes or loss in quality.

The model router selects the most suitable language model for each prompt based on factors like query complexity, cost and latency. This dynamic routing helps ensure high-quality results while reducing operational costs, eliminating the need for manual model evaluation or switching.

The model router now includes access to 12 models, including the GPT-4.1 family, GPT-5 family, gpt-oss-120b, DeepSeek-v3.1, Llama-4-Maverick-17B-128E-Instruct-FP8, Llama-3.3-70B-Instruct, Grok 4 and Grok 4 Fast. The model router capability is also available in preview in Foundry Agent Service.

Additional resources:

3.1.3. Foundry Agent Service adds hosted agents, memory, multi-agent workflows

Foundry Agent Service is introducing hosted agents, built-in memory and multi-agent workflows, all in preview, to give organizations a managed, interoperable way to run and coordinate agents with enterprise identity, autoscaling, governance and observability.

Whether teams use the Microsoft Agent Framework or frameworks such as LangGraph, CrewAI or OpenAI Agents SDK, Foundry Agent Service provides a fully managed, enterprise-grade runtime to host, scale and govern agents — accelerating the path from pilot to production. New features, all in preview, include:

  • Microsoft 365 and Agent 365 integration will enable developers to instantly deploy agents from Microsoft Foundry to Microsoft productivity apps — making it simple to reach users directly within the Microsoft 365 ecosystem while leveraging Agent 365 for secure orchestration, governance and enterprise-grade deployment.
  • Hosted agents will simplify runtime management and provide an easy path from local prototyping to secure, production-grade deployment. Developers will be able to deploy custom-code agents built with frameworks like Microsoft Agent Framework, LangGraph or CrewAI without managing containers or infrastructure. Microsoft Foundry handles autoscaling, observability and identity integration, enabling teams to focus on agent logic while running multi-agent systems in a governed, enterprise environment.
  • Multi-agent workflows will be able to coordinate specialized agents to execute multistep business processes — such as onboarding, financial approvals or supply-chain automation — using either a visual designer or a code-first API. Workflows will enable long-running, stateful collaboration with built-in recovery and debugging.
  • Memory will allow agents to retain context, preferences and conversation history across sessions with secure, persistent recall integrated into the agent runtime. This will reduce external data-store complexity and enable more personalized, context-aware interactions out of the box. Memory will be available in preview in Foundry Agent Service later this year.
  • Microsoft Agent Framework, an open-source SDK, will unify Microsoft’s prior work from Semantic Kernel and AutoGen into a single developer toolkit and share the same runtime foundation as Foundry Agent Service. It will also add durable execution, helping developers build resilient agents that recover automatically from timeouts and system faults.

Additional resources:

3.1.4. Microsoft unlocks intelligence for agents, unifying context across platforms

Microsoft is introducing a new, universal context layer that combines intelligence across Work IQ from Microsoft 365 Copilot, Fabric IQ and Foundry IQ. This will enable AI agents to understand what users are doing, what business data means and where and how to find the information to make decisions with AI. Fabric IQ, now in preview, extends the unified semantic layer already provided by Power BI across 20 million models to business operations. Foundry IQ, also in preview, will be the next generation of retrieval-augmented generation (RAG), offering a smarter way to connect agents with data from a single knowledge base.

Fabric IQ will unify all data with operational systems under a semantic model of business entities and their relationships — providing a live, connected view of the enterprise. This holistic view of the enterprise will empower teams and AI agents to understand and act on live, context-rich insights, driving smarter decisions and better business outcomes. Teams will be able to define this model once and reuse it everywhere across analytics, apps and agents, improving reasoning quality while preserving governance and lineage. Since all the data resides in OneLake, either natively or through shortcuts and mirroring, organizations will be able to realize these benefits regardless of whether the data is on premises, hybrid or in multicloud environments.

Foundry IQ is a fully managed knowledge system designed to ground AI agents. Agents will be able to connect to one knowledge base running a knowledge retrieval engine over multiple data sources — indexed or federated — including Azure data services, Microsoft 365 SharePoint, Fabric IQ and the web. Built on Azure AI Search, Foundry IQ will automate RAG data pipelines for multimodal data and perform agentic retrieval (query planning, iterative search, reflection and synthesis) across knowledge sources to maximize context while respecting user permissions. Integration with Microsoft Purview will also support compliance, data security and governance.

Additional resources:

3.1.5. Foundry Control Plane helps developers manage and defend agents

Foundry Control Plane, available in preview, will extend Agent 365 for developers to have visibility, security and control of agents operating in the Microsoft Cloud. Foundry Control Plane will bring observability, behavioral guardrails and lifecycle management into one environment where teams can monitor agent health, performance and cost, plus apply policies and take action in real time. Built on Microsoft Entra Agent ID for verified identity, with Microsoft Defender securing runtime activity and Microsoft Purview protecting data flow, Foundry Control Plane will help developers operate safe, efficient and high-performing AI systems at scale.

Key features include:

  • Fleetwide visibility: Unified view to observe, control and govern 100% of an organization’s agents across Microsoft Foundry, Microsoft Entra, Copilot Studio and external platforms. This is in preview.
  • Connects development and operations: Enables easy movement between development and operations, so teams can build robust safety into agents, evaluate performance and alerts once deployed, and easily act on insights to optimize them. This is in preview.
  • Observability: Enables real-time tracing, continuous monitoring, evaluations and red teaming to measure and improve quality, safety and efficiency across the entire agent lifecycle. This capability also features a wide range of quality, risk, safety and agent evaluators, and the ability to run evaluations in the cloud and through an AI Red Teaming Agent. This is generally available.
  • Agent controls: Defines and enforces policies that govern agent inputs and outputs, tools, calls and responses to prevent unsafe or misaligned behavior. This is in preview.
  • Identity and access: Entra Agent ID assigns each agent a verifiable identity to establish ownership, lineage and access control across environments. This is in preview.
  • Security: Defender integration provides runtime threat detection and posture insights, while Microsoft Purview integration helps safeguard sensitive data and information flow throughout agent operations. This is in preview.
  • Cost and usage management: AI Gateway provides centralized usage limits and cost controls for models, agents and MCP tools. This is in preview.
  • New integrations: An integration with Palo Alto Networks is coming soon to help extend security and governance capabilities across multicloud and enterprise environments. An integration with Zenity is also coming soon.

Additional resources:

3.2. Database and Analytics

3.2.1. Microsoft Azure DocumentDB now generally available

Microsoft Azure DocumentDB, the first managed service built on the open-source DocumentDB standard, is generally available. Now governed by the Linux Foundation, DocumentDB delivers an open and community-driven MongoDB-compatible engine with multicloud flexibility, running consistently across Azure, other clouds and on premises. This gives organizations freedom from proprietary lock-in and the ability to standardize on open source while operating at a global scale.

Azure DocumentDB provides AI-ready vector and hybrid search, instant autoscale and independent compute and storage scaling for optimizing performance and costs. It also has Microsoft Entra ID authentication, customer-managed keys and up to 99.995% service-level agreement availability for enterprise-grade reliability, plus 35-day backups included at no additional cost.

Azure DocumentDB was previously known as Azure Cosmos DB for MongoDB (vCore).

Additional resources:

3.2.2. Microsoft SQL Server 2025 now generally available

Microsoft SQL Server 2025, with built-in AI and developer-first enhancements, is now generally available. The platform enables customers to securely use data they already have and work in the familiar T-SQL language. It provides:

  • A way to access AI models of choice, hosted locally or in the cloud, and to securely use data to best fit business needs.
  • Simplified data processing with native JSON support, built-in REST APIs and change event streaming.
  • Near real-time analytics by replicating SQL Server data to Microsoft OneLake with database mirroring in Microsoft Fabric.
  • Increased workload performance, uptime and concurrency for SQL Server apps with enhanced query optimization, optimized locking and improved failover reliability.
  • Improved credential management and fewer potential vulnerabilities with Microsoft Entra ID for authentication through Microsoft Azure Arc.
  • GitHub Copilot integration in Visual Studio Code and SQL Server Management Studio 22 for better productivity.
  • A new Microsoft Python driver for SQL Server (mssql-python) for a fast and developer-friendly experience in Windows, macOS and Linux.

Additional resources:

3.2.3. Azure HorizonDB, a new PostgreSQL database, in private preview

Microsoft Azure HorizonDB, a new PostgreSQL cloud database service for building or modernizing mission-critical apps, is now in private preview. Integrated with Microsoft Foundry, Microsoft Fabric, Visual Studio Code and more, Azure HorizonDB streamlines development with the following features:

  • Transactions and vector search up to three times faster than open-source PostgreSQL, based upon internal benchmarking.
  • Scale-out compute to 15 replicas with 192 vCores each.
  • Auto-scaling storage up to 128 TB.
  • Advanced DiskANN vector indexing for AI workloads and native semantic operators.
  • AI-readiness with pre-provisioned models.

Organizations can right-size consumption to their workloads’ needs and save capacity for future requirements by independently scaling compute and storage scale. Modern authentication with Microsoft Entra ID and security features like Microsoft Defender and private endpoints support enterprise-grade protection.

Additional resources:

3.2.4. Microsoft Fabric databases are generally available

Microsoft Fabric databases, now generally available, bring together SQL database and Cosmos DB in a new, unified software-as-a-service (SaaS) experience for organizations to manage, analyze and activate their data. Fabric databases provide instant provisioning, autonomous architecture, enterprise-grade security and native AI integration — including support for vector data and retrieval-augmented generation (RAG) patterns — to help teams build intelligent, real-time apps.

Additional resources:

3.3. Azure App Service

3.3.1. Managed Instance on Azure App Service in preview for .NET app modernization

Now in preview, Managed Instance on Azure App Service will enable organizations to move web apps to the cloud with just a few configuration changes, saving the time and effort of rewriting code. Whether .NET web apps are running on premises or in virtual machines, customers will be able to modernize them into a fully managed platform-as-a-service (PaaS) environment and future-proof their infrastructure.

Many companies rely on older .NET apps for critical tasks like billing and HR, often depending on Windows-specific features and custom tools, which makes rewriting them expensive and risky. With Managed Instance on Azure App Service, they can keep operating with critical dependencies on local Windows services, third-party vendor libraries and custom runtimes without requiring any code changes. The result is faster app modernization with lower overhead and access to cloud-native scalability, built-in security and Azure’s AI capabilities. 

Additional resources:

3.4. Infra

3.4.1. Updated Azure Copilot with specialized agents available in private preview

The next phase of Azure Copilot, with agents built directly into the Azure portal, PowerShell and Command Line Interface (CLI), is available in private preview. The new, specialized agents will be able to help customers migrate, operate and continuously modernize workloads running anywhere for efficient end-to-end lifecycle management.

Azure Copilot will evolve chat into an immersive, full-screen command center powered by GPT-5 reasoning, artifact generation and Azure Resource Manager (ARM)-driven scenarios. Customers will be able to invoke Copilot in existing workflows with contextual and personalized experiences, including chat history and inline actions across the Azure portal.

Azure Copilot and its agentic capabilities fully respect all existing role-based access controls, Azure Policy and compliance frameworks, and it asks for explicit confirmation before making any changes. Enterprise-grade safeguards will also allow central IT teams to enforce compliance, policy and transparency across operations.

Capabilities in the new Azure Copilot agents will include:

  • Deployment to help users streamline infrastructure planning and deployment based on Well-Architected Framework (WAF) best practices.
  • Migration for accelerating cloud migration and modernization with intelligent capabilities that automate discovery and generate AI-powered infrastructure-as-a-service (IaaS) and platform-as-a-service (Paas) recommendations. This capability will also integrate with GitHub Copilot to help modernize .NET and Java apps and turn inventory into actionable development blueprints.
  • Optimization for surfacing high-impact, cost-saving actions; comparing financial and carbon outcomes for sustainable decisions; and validating recommendations with evidence. This capability will also streamline execution through guided, agentic workflows that reduce effort and build confidence.
  • Observability that uses metric, traces and log data from Azure Monitor application insights or Service Groups with health models. This will help users investigate and diagnose complex, full-stack apps across app and infrastructure layers, and provide recommended mitigation steps.
  • Resiliency to help users improve business continuity with zonal resiliency recommendations, auto-remediation scripts, Recovery Point Objective/Recovery Time Objective goal orchestration and built-in compliance and ransomware protection. Customers will be able to plan, validate and sustain resilient environments through Copilot-guided smart summaries, configurations and inline insights.
  • Troubleshooting with user-initiated issue resolution support, root causes and mitigation suggestions for several resource types, including virtual machines, Kubernetes and databases. Copilot will also auto-create support tickets when further escalations are required.

Additional resources:

3.4.2. Azure Boost now features improved remote storage, network throughput

The latest generation of Azure Boost, now in preview, supports remote storage throughput of up to 20 Gbps, up to 1 million remote storage IOPS and network bandwidth of up to 400 Gbps, enabling significant performance improvements for the latest Azure virtual machine series.

Azure Boost is a server subsystem designed by Microsoft consisting of purpose-built software and hardware that offloads server virtualization processes traditionally performed by the hypervisor and host OS. Various storage- and network-intensive workloads will benefit the most from these new performance specifications.

In addition to increased storage and network bandwidth, Azure Boost can help enhance virtual machine security and isolation by providing a physical boundary and memory isolation between the Boost infrastructure and customer workloads to help protect user workloads from attacks at the host level. By providing a hardware-based root of trust, Boost can help ensure only trusted firmware and software can run on Boost-powered hosts, enhancing overall server security.

Additional resources:

3.4.3. Azure Cobalt 200 is the next-generation Cobalt CPU

Azure Cobalt 200, now in preview, is the next-generation Cobalt CPU designed to power cloud-native apps on Azure.

Cobalt 200 will advance Microsoft’s systems approach to infrastructure, integrating the latest silicon technology with infrastructure enhancements, including Azure Boost and the Azure-integrated hardware security module (HSM). Features on Cobalt 200 include:

  • Performance: Up to 50% higher performance than Cobalt 100.
  • Advanced architecture: More cores, larger cache and faster memory, all built on the latest Arm architecture and 3nm TSMC process technology.
  • Advanced infrastructure: Integrates the current generation of Azure Boost and Azure-integrated HSM for enhanced efficiency and security.
  • Power efficiency: Azure’s most power-efficient compute platform, reducing energy consumption while accelerating workloads.

Additional resources:

3.5. Marketplace

3.5.1. Reimagined Microsoft Marketplace is now globally available

Microsoft Marketplace — the destination for cloud solutions, AI apps and agents — is now globally available following its U.S. launch in September. Featuring the industry’s largest catalog of AI apps and agents, Marketplace extends the Microsoft Cloud, helping customers accelerate their AI-first transformation with vetted solutions from tens of thousands of partners. These solutions integrate easily with Microsoft products, delivering faster time-to-value.

Marketplace powers Microsoft’s ecosystem of more than 500,000 partners to support commercial customers worldwide. To enable more channel-led opportunities, resale-enabled offers are also now available in nearly all regions supported by Marketplace, allowing software companies to empower their channel partners to manage listings and drive scale. Channel partners can now lead customers’ AI transformation while benefiting from Marketplace capabilities.

Additional resources:

A woman holds a tablet computer, on a background of colorful shapes.

4. Edge 4.1. Edge for Business

4.1.1. Edge for Business introduces Copilot Mode

Microsoft Edge for Business, the first AI browser to securely combine public web data with organizational data, is introducing Copilot Mode in private preview, turning the browser into a proactive, agentic partner.

AI browsing is set to boost productivity, but until now, organizations have been asked to drop their bar on enterprise-grade security to benefit from it. Microsoft aims to change this by transforming the secure enterprise browser into a secure enterprise AI browser, making AI-assisted browsing safe for workplaces.

With the addition of Copilot Mode, Edge for Business now delivers agentic, proactive and contextual intelligence, helping users streamline workflows, stay on task and connect the dots across data silos while ensuring that unique work context is integrated. Edge for Business aligns with Microsoft’s commitment to security, controls and enterprise data protection.

When IT admins enable Copilot Mode, it will initially include the following features:

  • Agent Mode: Makes the browser capable of taking actions on a user’s behalf with multistep workflows on IT-approved websites. Users will be able to set the direction and receive visual cues for transparency and prompts for oversight at critical junctions, all to help streamline tasks. A Microsoft 365 Copilot license will be required.
  • Copilot-inspired new tab page: Combines search and chat in one intelligent box, with easy access to files, personalized Copilot prompt suggestions and more. A Microsoft 365 Copilot license is required.
  • Daily Briefing: Delivers curated highlights of meetings, tasks and priorities using Microsoft Graph and browser history, so users can focus on the right things at the right time. A Microsoft 365 Copilot license will be required.

Other new AI features are also available in private preview outside of Copilot Mode, leveraging context to make browsing smarter. They include:

  • Multitab reasoning will provide answers based on all open tabs, across organizational and web content.
  • Intelligent browser history will retrieve pages from the past three months using natural language with no need to remember exact titles.
  • YouTube video summarization gives quick summaries and answers questions about YouTube content, bringing the efficiency of webpage summarization to video.

Agent Mode and multitab reasoning will respect existing data protection policies, like data loss prevention. Agent Mode won’t access passwords, payment methods and other sensitive info stored in the Edge wallet. It will require explicit user permission for any action it considers sensitive.

All new features are in private preview now, with broader availability coming in February.

Additional resources:

 

4.1.2. Edge for Business to enable secure access for contractor-managed devices

Microsoft Edge for Business is introducing a cost-effective solution that enables secure access to work resources on contractor-managed devices. Admins can currently support Bring Your Own Device (BYOD) scenarios on Edge for Business by using Intune Mobile Application Management (MAM). With this update, coming to preview beginning in January, those Intune MAM protections will extend to devices managed by other organizations. 

Admins will be able to set up a MAM profile on an externally managed device, creating a controlled browser environment in Edge for Business. Previously, files downloaded onto an agency-controlled device would typically be stored on a local drive, increasing the risk of data leaks to the contractor’s agency. With the new Intune MAM protections, IT admins will be able to safely direct file downloads to a OneDrive for Business location associated with the managed Edge for Business profile. Admins will also be able to enforce copy/paste restrictions, ensuring that copied data remains within the organization’s tenant, so proprietary data doesn’t leave the managed boundary.

Edge for Business with Intune MAM protections for agency-managed devices is expected to be in preview beginning in January.

Additional resources:

4.1.3. Edge for Business introduces new features to simplify browser management

Microsoft Edge for Business is rolling out two updates, both in preview beginning later this month, to significantly simplify browser management for IT admins.

With new cross-platform security policies, admins will be able to use the Edge management service in the Microsoft 365 admin center to easily set and enforce Edge browser policies across macOS, iOS and Android. Admins will be able to select checkboxes for the additional platforms to manage. Whether configuring policies broadly or adjusting individual settings, everything will happen in one place.

Edge for Business is also introducing a simpler, more flexible approach to test pre-release Edge builds. Enterprise preview will enable admins to deliver Beta builds directly inside the Stable Edge app with no extra installs for admins and no switching apps for users. With the Edge management service and Intune, admins will be able to set policies to designate who gets preview builds and whether users can roll back to Stable at any time. The rollback option will give users a safety net to keep work moving and admins more flexibility to crowdsource validation. With everything in one app instead of multiple app instances, testing will become a natural part of browser workflow, giving admins more control and coverage, while reducing the compromise between security and productivity.

The updates will empower IT teams with simple, unified capabilities to manage and test Edge across platforms, builds and their organizations.

Additional resources:

4.1.4. Watermarking and clipboard controls available in preview in Edge for Business

Microsoft Edge for Business is introducing the preview of watermarking and clipboard controls to help protect sensitive data without slowing productivity, giving admins more precision to guide user behavior and reduce risk.

Employees often struggle to recognize which files are safe to share and which are not. Edge for Business is making it easier to distinguish sensitive data with a watermarking overlay — a persistent, visual reminder that will prompt users to pause and think before sharing confidential content. Admins will be able to enable watermarking with a simple toggle in the Edge management service. Once turned on, the overlay will appear on sensitive files and sites based on sensitivity labels or data loss prevention (DLP) policies.

Another new feature addresses the “all or nothing” dilemma common in data protection: Admins can either block all copy/paste actions or allow users to copy/paste freely and risk data leaks. Protected clipboard in Edge for Business will enable admins to define trusted boundaries across managed web apps. Data from inside the boundary can’t be pasted outside, while data from outside can enter the boundary if needed. Users will get a clear warning if they try to paste outside the trusted zone, keeping data safe without breaking workflows.

These features are available in preview beginning later this month.

Additional resources:

A woman works on a tablet computer with a stylus, on a background of colorful shapes.

5. Security 5.1. Defender

5.1.1. Integration of Defender for Cloud and GitHub protects apps across lifecycle

Native integration of Microsoft Defender for Cloud and GitHub Advanced Security is now available in preview. With this integration, users will be able to protect cloud-native apps across the full app lifecycle. The rise in sophisticated software supply chain attacks demands this more comprehensive approach to security, from code to runtime.

The natively integrated solution introduces runtime context as the most effective measure for prioritizing security risk, with powerful insights that will allow teams to focus on what matters most and fix issues faster with AI-powered remediation. Features include:

  • Real-time visibility across the app lifecycle to empower developer and security teams to collaborate in tools they use every day. Security teams will be able to ask for vulnerability remediation by having a security campaign alert GitHub owners, as well as opening a GitHub issue directly from Defender for Cloud and tracking the status of the vulnerability.
  • Critical alert prioritization: By connecting runtime context to code, developer teams will be able to prioritize exploitable issues and map them back to the code. Security teams will be able to understand the traceability of the artifact from code to runtime and trace runtime threats directly to the code in GitHub. As a result, the most critical alerts will be fixed first.
  • Remediation time reduction: AI-suggested fixes with Copilot Autofix and GitHub Copilot coding agent will automatically be generated, making it faster for developers to resolve security issues with confidence.

Additional resources:

5.1.2. Microsoft Defender for Cloud extends posture management to serverless resources

Posture management for serverless resources is coming at the end of November in preview in Microsoft Defender for Cloud (MDC). As cloud and AI technologies advance, more organizations are moving away from traditional infrastructure as a service (IaaS) and adopting serverless solutions across multicloud environments. This introduces new and expanded entry points, simplifies lateral movement and leaves serverless resources increasingly vulnerable to risk.

With the new serverless coverage in MDC, customers will gain greater visibility into serverless compute environments and application platforms. Integrating serverless posture insights into the attack path will strengthen end-to-end security with comprehensive protection across workloads and services. The preview will enable organizations to get cloud security posture management insights for serverless resources including Azure Functions, Azure Web Apps and AWS Lambda.

IT and security teams will also be able to identify and visualize risk, analyze serverless attack paths, continuously monitor and detect misconfigurations, and find vulnerable serverless resources — further strengthening the security posture across the modern application lifecycle.

Additional resources:

5.1.3. Unified posture management, threat protection for AI agents in Microsoft Defender

Unified posture management and threat protection for AI agents in Microsoft Defender are now available in preview as a part of Microsoft Agent 365.

As organizations adopt agentic AI apps across pro-code, low-code and no-code platforms, the complexity and attack surface of their digital estate expands dramatically. AI developers and security administrators need a unified view of agentic AI assets to manage security posture and reduce risk, while security operations analysts need AI security signals correlated with contextual alerts to speed up remediation. The new tools in Defender will empower customers in three areas:

  • Comprehensive posture visibility for AI agents: The new unified agent posture and threat management experience will provide comprehensive visibility, posture management and threat protection across pro-code, low-code and no-code platforms, helping to reduce shadow agents and agent sprawl.
  • Risk reduction for AI agents: Defender proactively enhances the security posture of agentic AI apps with security recommendations and attack path analyses, allowing organizations to detect and address agentic AI vulnerabilities before potential breaches.
  • Threat protection for AI agents: Defender enables security analysts to detect, investigate and respond to threats against agentic AI services, such as prompt injections, sensitive data exposure and malicious tool misuse, across AI models, agents and cloud apps. New AI agent-related detections will be contextualized with threat intelligence to provide a comprehensive picture of alerts.

What distinguishes the security for AI in Defender is its build-to-runtime approach and unified protection for AI models, agents, software-as-a-service (SaaS) apps and cloud infrastructure.

Additional resources:

5.1.4. Microsoft Defender offers unified cloud security across all environments

Unified security posture management is available in preview for existing Microsoft Defender for Cloud (MDC) customers.

Security teams today face a growing challenge in managing risk across sprawling hybrid and multicloud environments. Fragmented signals, siloed tools and disjointed views slow down detection and response, making it harder for security operations centers (SOCs) to stay ahead of threats.

MDC will be deeply integrated into the Defender portal for security personas. This native integration will eliminate silos so security teams can see and act on threats across all environments from one place. This integration will offer:

  • A cloud security dashboard that will bring together posture management and threat protection in one place, giving security teams a complete view of their cloud environment.
  • Unified cloud posture capabilities within Exposure Management, so security teams will be able to see assets, vulnerabilities, attack paths, secure scores and prioritized recommendations in one view.
  • A centralized asset inventory that will provide a consolidated view of code and cloud resources across Azure, Amazon Web Services and Google Cloud Platform. It will enable posture validation and logical segmentation, helping teams align visibility and actionable data with operational needs.

To complement this integration, granular role-based access control (RBAC) will reduce operational risk and simplify compliance across multicloud environments. With threat protection already deeply embedded into the Defender portal, this expansion will add posture management, bringing together a complete cloud security solution in one unified experience.

The Azure portal remains important for Defender for Cloud personas beyond security teams such as DevOps, so adding security for new resources will continue to remain in the Azure portal.

Additional resources:

5.1.5. New Microsoft Defender capabilities include proactive mid-attack action

Microsoft Defender is introducing several innovations, in preview, that will strengthen its ability to detect and thwart attacks. Capabilities will include:

  • Predictive Shielding, a component of automatic attack disruption, will be able to anticipate attacker movement and proactively harden pathways to critical assets. Once a compromised asset is contained, Predictive Shielding will use threat intelligence and graph insights to forecast where attackers are likely to pivot and apply targeted, just-in-time hardening actions — such as Group Policy Object changes or disabling Safe Boot. This coordinated response will reduce tens of thousands of potential attack paths to just a handful, optimizing business continuity while minimizing risk.
  • Third-party attack disruption for AWS, Proofpoint and Okta: Automatic attack disruption is a capability that identifies sophisticated attacks, such as ransomware and adversary-in-the-middle attacks, with high confidence and contains compromised assets like devices and identities within minutes to limit impact. Microsoft is expanding this capability, which previously exclusively worked on top of Defender solutions, to AWS, Proofpoint and Okta, when the signal is ingested via Microsoft Sentinel. This will enable real-time detection and containment of threats like phishing and identity compromise across federated accounts and cloud boundaries.
  • A Threat-Hunting Agent that will orchestrate full threat-hunting sessions through natural language. Analysts will be able to ask questions like, “Which devices communicated with this domain in the last 24 hours?” and receive summarized answers, underlying KQL queries and dynamic follow-up suggestions — all within a chat interface. The agent will also provide contextual insights and visualizations like timelines, making advanced hunting accessible even to those without query expertise.

Additional resources:

5.2. Entra

5.2.1. Microsoft Entra expands secure identity and access for agentic AI era

Microsoft Entra is introducing secure access for AI agents, agentic workflows for identity and security professionals, enhanced protections for employees using generative AI apps and web resources, and expanded passwordless authentication. Microsoft Entra Agent ID is now in preview via Microsoft Agent 365. An enterprise-grade solution for preventing agent sprawl and protecting AI agent identities and their access to resources, Agent ID will enable organizations to:

  • Register and manage AI agents through a complete inventory of the agent fleet, and ensure new agents are created with a built-in identity and automatically protected by organizational policies.
  • Govern agent identities and lifecycle with lifecycle management and IT-defined guardrails for both agents and the people creating and managing them.
  • Protect agent access to resources to reduce risk of breaches, block risky agents and prevent agent access to malicious resources with conditional access and traffic inspection.

At preview, agents developed in Microsoft Copilot Studio, Microsoft Foundry and Security Copilot will have built-in Entra Agent ID features. Developers will be able to adopt Entra Agent ID for agents built through Microsoft Agent Framework, Microsoft Agent 365 SDK or Microsoft Agent ID SDK.

New AI-powered Security Copilot agents are also available in Entra for organizations to automate identity and access security tasks with more accuracy and efficiency. Entra Agent ID will support each agent with a unique, governed identity. The agents include:

  • A Conditional Access Optimization Agent for ensuring the right protections are applied to the right users. This is generally available, with new features in preview.
  • An Identity Risk Management Agent for investigating and remediating risky users with intelligent insights and recommendations. This is in preview.
  • An App Lifecycle Management Agent for automating discovery, onboarding, monitoring and remediation of apps across the environment. This is in preview.
  • An Access Review Agent for streamlining user access and permissions reviews and quickly acting on recommendations with AI-powered insights. This is in preview.

Microsoft Entra Internet Access has new capabilities, in preview, for securing access and usage of generative AI on a network level. The AI-centric capabilities include:

  • Real-time protection against prompt injection attacks across all generative AI apps — sanctioned, unsanctioned or custom.
  • Expanded visibility into network traffic to uncover unsanctioned AI usage, including custom apps.
  • Integration of network file filtering with Microsoft Purview to discover and block sensitive content in files sent to generative AI and software-as-a-service (SaaS) apps.

New Microsoft Entra ID features, in preview, will strengthen identity protection and reduce the risk of phishing and impersonation attacks, while providing a user-friendly experience and self-service options. The features will include:

  • Support for synced passkeys from Apple, Google and other third-party providers, and passkey profiles for easier management.
  • Expanded risk remediation and detection to help identity admins respond faster and enhance security operations center collaboration with Microsoft Defender.
  • Secure, self-service account recovery for users to regain access with Verified ID Face Check and a government-issued ID if their device is lost or stolen.

Additional resources:

5.3. Intune

5.3.1. Intune empowers IT teams with new Copilot agents and enhanced actions

Microsoft Intune has new features, all in preview or coming soon to preview, that will help IT teams secure, manage and recover endpoints more efficiently. They are new Security Copilot agents, admin controls and expanded Copilot support.

The new Security Copilot agents, all in preview, are:

  • A Change Review Agent — This agent will analyze change requests in context, checking for risks, conflicts and compliance. It will provide detailed insights and clear recommendations, so IT admins can move forward with confidence knowing their decision is informed. Initially, the Change Review Agent will handle Multi-Admin Approval script requests, with additional types of change requests added over time.
  • A Policy Configuration Agent — This agent will accelerate policy creation by capturing intent from uploaded documents or natural language requirements, mapping them to recommended settings, and enabling admins to review, discuss and refine configurations before deployment.
  • A Device Offboarding Agent — This agent will use activity signals to suggest which devices should be removed and provides a simple way to offboard them from the environment, improving efficiency and strengthening the security of the digital estate.

Intune is also introducing remote Windows recovery at scale, an industry first, to enable the remote management of Windows Recovery Environment (WinRE) at scale in Intune. IT admins will be able to recover Windows devices remotely — even if the device is unable to boot or the user is not present. This is in preview.

New admin controls will help deliver new levels of precision, combined with the security and agility of the cloud. These will include:

  • Admin tasks: A centralized, prioritized task list that will help IT teams identify and act on what matters most — accelerating vulnerability remediation and simplifying daily management. This is in preview.
  • Maintenance windows: A unified way to schedule and orchestrate updates, minimize disruption and improve patch compliance. This is expected to be in preview in January 2026.
  • Deployments thatcan be controlled with pause and resume options to reduce risk and create a pathway for future AI-driven automation. This is expected to be in preview in January 2026.

Copilot in Intune will unlock even more Intune data for natural language exploration, including Autopilot, Endpoint Privilege Management and Advanced Analytics. Admins will be able to accelerate their work in these areas by using natural language to ask questions, navigating custom data views and creating new groups or adding to existing ones directly from query results. This is generally available.

Additional resources:

5.4. Microsoft Purview

5.4.1. Microsoft Purview enables AI-powered data security across the data estate

Microsoft Purview is introducing significant advancements, reinforcing its role as a comprehensive solution for enterprise data security and governance.

Keeping data secure is more complicated than ever, as organizations face persistent challenges: managing fragmented security tools, ensuring compliance across business units and regions, protecting sensitive data without compromising user experience and addressing a shortage of skilled cybersecurity professionals. These Microsoft Purview updates will help address those challenges:

  • Enhanced Microsoft Purview Data Security Posture Management (DSPM): AI and agents at the center of this new, centralized, AI-powered DSPM experience will help simplify data security posture and stitch together the scenarios and goals that customers have for their data. The experience will combine the depth of Microsoft Purview visibility and controls with the breadth of external signals and agentic activities, all powered by Security Copilot, to provide a strong, proactive DSPM experience. This is in preview.
  • Data security and compliance capabilities for agents, including agents via Microsoft Agent 365: As organizations adopt more autonomous agents, new risks emerge. In response, Microsoft Purview is expanding its industry-leading data security and compliance capabilities to protect all agents through new agent-focused detections and risk analyses, with extended visibility into and control of agent actions. This is in preview.
  • New visibility, controls and experience improvements in Microsoft Purview in Data Loss Prevention, Information Protection, Insider Risk Management and Data Security Investigations. This will include DLP for Microsoft 365 Copilot to safeguard prompts containing sensitive data. The real-time control will help organizations mitigate data leakage and oversharing risks by preventing Microsoft 365 Copilot, Copilot Chat and Microsoft 365 Copilot agents from returning a response when prompts contain sensitive data. It will also prevent the agents from using that sensitive data for grounding in Microsoft 365 and the web. This is in preview.
  • New Security Copilot agents: The Data Security Posture Agent, now in preview, will help admins proactively manage risk by discovering sensitive content, assessing posture gaps and improving policy hygiene. The Data Security Alert Triage Agent, now generally available, enables analysts to triage, prioritize and remediate critical alerts, automating incident response and surfacing the threats that matter most. Together, these agents allow organizations to scale operations, reduce manual workloads and stay ahead of emerging threats and compliance demands.

Additional resources:

5.4.2. Microsoft Purview expands data security and compliance capabilities

Microsoft Purview is expanding its data security and compliance capabilities to protect agents across Microsoft 365 Copilot, Microsoft Copilot Studio, Microsoft Foundry and third-party platforms.

As organizations adopt more autonomous agents, including those managed through Microsoft Agent 365, new risks emerge, such as unsupervised data access, cascading agent interactions and unclear accountability.

Key advancements in Microsoft Purview, designed to help mitigate these risks, include:

  • Agent observability and posture management: Microsoft Purview’s Data Security Posture Management (DSPM) will provide inventory of all agents across an organization, including third-party agents, as well as an assessment of risks, assigned risk level and guided remediation for agents on Microsoft 365 Copilot, Copilot Studio and Foundry. This will be in preview within the next month.
  • Extension of Microsoft Purview protection: Established security and governance policies within Microsoft 365 now extend to agents acting autonomously, allowing them to inherit the same protections and organizational policies as users. For instance, DLP policies for Teams, SharePoint, Exchange and endpoint devices can be scoped to behaviors such as attempting to send an email with sensitive data outside of the organization or sending a Teams message containing credentials. These controls will help prevent oversharing and unauthorized processing without requiring separate policy frameworks, delivering consistent protection for both people and agents. This is in preview.
  • IRM for Agents: Dedicated indicators and behavioral analytics in Insider Risk Management (IRM) will be able to flag risky agent activities, enabling proactive investigation and policy enforcement. Insider risk capabilities will be extended to AI-powered agents, ensuring organizations can adopt automation without compromising data security. As agents built in Microsoft 365 Copilot, Copilot Studio or Foundry gain access to sensitive data and execute tasks autonomously, they introduce unique risks such as unsupervised access, prompt injection and chained actions. IRM for Agents will address these challenges by delivering agent-aware policies, unified investigation workflows and customizable risk scoring that will incorporate agent-specific signals and activities. With built-in guardrails and strong auditability, organizations will gain visibility into agent behavior across human and digital workforces, helping security teams reduce noise, prioritize critical risks and confidently enable secure AI adoption. This will be in preview within the next couple of weeks.
  • Extended governance: Communication Compliance, Data Lifecycle Management, Audit and eDiscovery tools have been extended to more agent interactions, supporting responsible use, secure retention and full agentic accountability. This is generally available.

Additional resources:

 

5.5. Security Copilot

5.5.1. New Security Copilot agents embedded into workflows for smarter defense

Twelve new Security Copilot agents built into Microsoft Defender, Microsoft Entra, Microsoft Intune and Microsoft Purview are now available in preview. Additionally, more than 30 new agents from partners are available to provide end-to-end protection. These agents will be woven into the user’s workflow to streamline high-volume tasks, surface threat intelligence and assist with identity risk management, sensitive data remediation and endpoint compliance. The agents will offer the following capabilities across these teams:

  • Security operations center (SOC) teams: New agents in Defender will automate alert triage, surface prioritized threat intelligence, enable natural-language threat hunting and dynamically detect missed threats, closing visibility gaps and accelerating response.
  • Identity teams: Agents in Entra will help manage risky users, optimize conditional access policies, streamline access reviews and govern the application lifecycle.
  • Data security teams: Agents in Purview will help strengthen data protection and compliance by discovering, analyzing and remediating sensitive data exposure, providing contextual insights on data risk and enabling proactive remediation at scale.
  • IT teams: New agents in Intune will help turn requirements into policies, assess changes before they impact productivity and identify devices for removal — for smarter decisions, better compliance and reduced risk.

To help security teams get started with agents more quickly, Security Copilot will be available to all Microsoft 365 E5 customers. Rollout starts now for Frontier Security Copilot customers with Microsoft 365 E5 and will continue in the upcoming months for all Microsoft 365 E5 customers. Customers will receive advanced notice before activation of Security Copilot into Microsoft 365.

The interactive agent experience, now in preview, will help security teams engage in scoped, focused chats tailored to each agent’s expertise.

To truly empower agents, context and data are key: Security Copilot taps into Microsoft’s unmatched threat intelligence — informed by over 100 trillion daily signals — and leverages unified data in Microsoft Sentinel. With Enterprise Knowledge Integration, now in preview, agents will also be able to reason over an organization’s internal data, from runbooks to historical incidents, delivering contextually relevant insights and recommendations.

Additional resources:

5.6. Security Store

5.6.1. Microsoft Security Store now generally available to help organizations find security solutions

Microsoft Security Store is now generally available with powerful new capabilities to make it easier for organizations to discover, purchase and deploy trusted security solutions and AI agents that integrate easily with Microsoft Security products.

There are three major enhancements to the Store:

  • Embedded where you work: The Store is now built into Microsoft Defender, featuring SOC-focused agents, and into Microsoft Entra for Verified ID and External ID scenarios like fraud protection. By bringing these capabilities into familiar workflows, organizations can combine Microsoft and partner innovation to strengthen security operations and outcomes.
  • Expanded catalog: The Store now offers more than 100 third-party solutions, including advanced fraud prevention, forensic analysis and threat intelligence agents.
  • Security services available: Partners can now list and sell services such as managed detection and response and threat hunting directly through the Store.

Additional resources:

5.7. Security for AI

5.7.1. Security Dashboard for AI designed for security and AI risk leaders

Security Dashboard for AI is a new, unified dashboard in preview designed for chief information security officers and AI risk leaders. It will aggregate and surface real-time AI posture and risk insights — spanning proactive governance and reactive threat protection across Microsoft Security solutions, all in a single, integrated view.

This experience will enable users to:

  • Unlock complete discovery and observability by aggregating risk signals from Microsoft Defender, Microsoft Purview and Microsoft Entra for unified AI asset visibility.
  • See a consolidated AI risk profile by connecting security and data posture insights across configurations, data, models and threats.
  • Accelerate AI risk mitigation with AI-powered recommendations and Security Copilot skills, delivering actionable guidance directly within familiar Microsoft tools.

With Security Dashboard for AI, security and risk leaders will gain a clear, consolidated view of AI risks across agents, apps and platforms — eliminating fragmented visibility, disconnected posture insights and governance gaps as AI adoption scales.

Additional resources:

5.8. Sentinel

5.8.1. Microsoft Sentinel now has updated SIEM and platform capabilities

Microsoft Sentinel has updated capabilities, now in preview, to the data lake, graph and model complex protocol (MCP) server, which will expand use cases across first- and third-party security scenarios. The updates will support such tasks as creating custom graphs, adding threat intelligence to the data lake and searching and accessing data on the MCP server.

Sentinel has evolved into both a security information and event management (SIEM) system and an AI-ready platform. As part of Sentinel SIEM, user and entity behavior analytics (UEBA)  offer valuable insights into entities when their behavior deviates from the norm.

Additional resources:

A man and woman standing looking at a laptop that the woman is holding, on a background of colorful shapes.

6. Windows 6.1. Windows

6.1.1. Windows introduces MCP on Windows, Agent connectors and Agent workspace

Windows is evolving to enhance productivity with the preview of native support for Model Context Protocol (MCP) on Windows, including new built-in agent connectors and agent workspace.

MCP on Windows, now in preview, is a standardized framework for AI agents to connect with line-of-business apps and tools to automate routine scenarios and perform tasks for enterprise users. Developers will be able to make their apps discoverable to local agents through agent connectors, which can be registered in the Windows on-device registry. Developers building agents will also be able to leverage MCP on Windows to access agent connectors to complete tasks for end users. End users will be able to configure which apps can be accessed by agents on their device through the new agent connectors settings page.

The new built-in agent connectors, also in preview, include:

  • File explorer connector: This will enable secure access to local user files on the system so agents can act more efficiently and perform desired file operations, all with user consent. Agents will be able to use this connector to perform a wide range of operations on local files on users’ devices, including searching, reading, writing and editing. The file search capabilities will support natural language queries, allowing agents to find files based on descriptions, content, metadata and, for images, enhanced search based on image classification.
  • System Settings connector: This will help agents handle complex setting operations by modifying a user’s device settings such as Bluetooth, network and more.

Agent workspace, now in private preview, offers an isolated, policy-controlled and auditable environment where agents can interact with software much like humans do — performing tasks on behalf of end users in parallel without disrupting a user’s primary session. All agentic interactions involving MCP and computer-using agents will run in Agent workspace, setting a new standard in enterprise security.

Windows provides enterprise-grade security and governance, ensuring every agent runs in a contained, compliant and auditable way. IT admins can also manage basic policies for agent connectors and agent workspaces in Microsoft Intune, Microsoft Entra and Group Policy.

This architecture represents a material improvement over native app experiences, offering enterprises enhanced protection, transparency and governance.

Additional resources:

6.1.2. Windows introduces new features for accessing, managing AI agents

Windows is transforming how users access and manage AI agents across the operating system, with new features in preview:

  • Ask Copilot on the Windows taskbar is a new composer experience in Windows, designed to unify how users interact with Copilot and other AI agents across apps, workflows and devices. It will act as a shell-integrated control that enables easy invocation of Copilot and Microsoft 365 Copilot from anywhere in the OS — via the taskbar and the Start menu. Users will also be able to start AI agents directly from the composer by using the Tools menu or typing ‘@’.
  • Agents on the Windows taskbar reimagines Windows as a platform where AI agents — like agents in Microsoft 365 Copilot, troubleshooting agents and third-party assistants — can be invoked, monitored and managed directly from the Windows taskbar. This will unify how users invoke and manage AI agents across the OS and make them easily accessible and interactive.

Additional resources:

6.1.3. Windows adds new Copilot and AI features

Windows has added new Microsoft Copilot and AI features, all in preview. With these new features, Windows is continuing to transform how users interact with AI by delivering a simple, personalized and multimodal experience. The new features are:

  • Ask Microsoft 365 Copilot is an action in Click to Do that will allow a user to take any text or image recognized by Click to Do and send it to Copilot without needing to switch context.
  • Ask Microsoft 365 Copilot in File Explorer Home will allow users to click on any file and interact with Copilot for assistance or insights, all within File Explorer. Additionally, users will be able to hover over a document in File Explorer to have it enhanced by AI models.
  • Improved Windows search with Microsoft 365 federation will let users describe the content they’re looking for to find files. Microsoft 365 Copilot customers with Copilot+ PCs will be able to search local and cloud documents semantically.
  • Writing Assistance will give users built-in access to rewriting and proofreading help, plus offline support on Copilot+ PCs, enabling fast, flexible writing anywhere on Windows.
  • “Hey Copilot” in Windows and the Copilot key (or Win+C shortcut for devices with a Copilot key) will allow users to engage with voice in Microsoft 365 Copilot without the interruption of switching apps or windows.

Other new and improved features designed to enhance accessibility include:

  • Fluid dictation is an AI-powered feature in Windows 11 Copilot+ PCs that will make voice typing fast, accurate and natural — turning speech into text with minimal effort. As part of the Voice Access suite, the feature will streamline input and reduce manual corrections. This is in preview.
  • Narrator and Magnifier now deliver a more natural and lifelike reading experience powered by Azure’s latest on-device text-to-speech models. These high-definition voices, built on advanced generative AI, adapt tone and pace contextually to make interactions feel intuitive and engaging. This is generally available.

Additional resources:

6.1.4. Windows 365 Link getting updates and expanded availability

Windows 365 Link, the first Cloud PC device purpose-built for Windows 365, will expand availability starting in February 2026 to Belgium, Finland, Ireland, Italy, Poland, Singapore and Spain. As organizations shift more workloads to the cloud for enhanced security, flexibility and scalability, streamlined access to Cloud PCs becomes crucial for productivity, and Microsoft introduced Windows 365 Link for this purpose. The simple, secure device is currently available in 13 countries.

Cloud PC devices receive monthly updates. Key updates in the first quarter of 2026 will include support for pairing Bluetooth devices during the out-of-box experience; support for tenant branding, including setting a custom wallpaper, logo and name on the sign-in screen; and the ability for IT to recover a device using a bare metal recovery image.

Additional resources:

6.1.5. New Windows AI APIs to help simplify building powerful apps

Windows is providing developers with new Windows AI APIs that will simplify building powerful apps. The APIs will enable local AI features on Copilot+ PCs, offering reduced latency, better privacy and lower costs without relying on cloud computing. The new APIs are:

  • Local AI enhanced video streaming: Video Super Resolution (VSR) is now available as an API. VSR is an AI-powered enhancement that upscales low-resolution video streams, restoring clarity and detail for better video calls, streaming and playback. This is in preview as part of WinAppSDK 2.0 Experimental 3.
  • High-quality image generation: The Stable Diffusion XL (SDXL) API is a powerful text-to-image generative AI model that developers will be able to run locally on Copilot+ PCs, enabling high-quality image generation directly on device without relying on cloud services. This is in preview as part of WinAppSDK 2.0 Experimental 3.
  • Phi Silica moves to stable release: Phi Silica is an NPU-optimized language model that runs locally on Copilot+ PCs for efficient text generation and summarization without using the cloud. The API for this model will require a Limited Access Feature (LAF) token for developers to ship into production. Developers will also see up to a 40% boost in performance in Phi Silica as it moves to general availability in WinAppSDK 1.8 stable.

Additional resources:

6.1.6. Autopatch update readiness helps IT streamline Windows updates, identify issues

Autopatch update readiness is a new feature, now in preview, marking a significant innovation to the Windows update process, with capabilities that will make update readiness more transparent, predictable and manageable. It’s designed to help IT administrators gain real-time visibility into the entire device estate, showing exactly which devices are ready for updates or need attention and why. Instead of guessing or waiting for problems to surface, organizations will be able to see the full picture — from fully compliant devices to ones at risk due to policy conflicts, missing telemetry and other blockers.

As organizations grow and adapt to new ways of working, the number of devices across an enterprise climbs, presenting challenges in keeping devices secure, compliant and updated.

Autopatch update readiness will surface actionable insights, provide clear guidance on remediation and help prevent issues before they disrupt work. IT teams will be able to use a unified dashboard in Microsoft Intune to identify devices that might fail updates, understand why and immediately remediate issues within Windows Autopatch. This shift from reactive troubleshooting to proactive management will mean less time chasing and patching problems and more time on strategic priorities.

Autopatch update readiness will also address common pain points in the update process. For example, devices that are out of compliance or missing critical signals will be flagged early, enabling timely intervention. Policy conflicts that could block updates will be identified and explained, making it easier to maintain alignment across management layers. Detailed telemetry will help ensure that every device provides the data needed for update readiness and compliance tracking.

Additional resources:

6.1.7. Windows 11 adds new recovery features to help combat system disruptions

Windows 11 is adding additional modern recovery capabilities designed to minimize downtime and simplify remediation. System disruptions, whether from flawed updates, configuration errors or outages, can cost organizations valuable time and productivity. Microsoft introduced quick machine recovery as a tool that allows recovery of Windows PC impacted by a global incident, and these new tools help recover individual machines as well as groups of devices that are impacted. The updates, which will be in preview in the first half of 2026, include:

  • Microsoft Intune will serve as a unified, scalable management platform for recovery tools, enabling remote control of Windows Recovery Environment (WinRE) on Intune-managed clients. IT professionals can select appropriate recovery tools and coordinate endpoint recovery strategies. Intune will support sending recovery scripts to devices or triggering recovery actions directly.
  • Point-in-time restore (PITR) will help PC users and IT professionals recover a device or group of devices without needing technical expertise or lengthy troubleshooting. It will offer comprehensive rollback within minutes to the exact state of a system before a problem emerged, restoring the OS, apps, settings and local files.
  • Cloud rebuild will enable IT professionals to completely rebuild an existing PC that is experiencing erratic behavior or has become inoperative. Cloud rebuild will reinstall a completely new Windows 11 OS with the appropriate drivers, so the device becomes reliable. In combination with Microsoft Intune, Windows Autopilot, Windows Backup for organizations and OneDrive, the user will also get their data, apps and PC settings restored.

These tools are part of the broader Windows Resiliency Initiative (WRI) focused on preventing, managing and recovering from incidents.

Additional resources:

6.1.8. Windows 365 for Agents, Windows 365 AI-enabled Cloud PCs unlock new capabilities

New Windows 365 features will support Frontier firms that prioritize intelligent work by combining AI-powered workflows, secure cloud delivery and flexibility to scale across devices and environments. These features, now in preview, are Windows 365 for Agents and Windows 365 AI-enabled Cloud PCs.

Windows 365 for Agents will extend agentic capabilities to the Microsoft Cloud. Agent makers will have a trusted platform with modular UI controls, enterprise-grade security and flexibility to run on Windows or Linux. That means they will be able to build and deploy agents that open apps, process data and automate tasks on a Cloud PC.

  • Windows 365 for Agents is the backbone of some of the most advanced Microsoft AI initiatives and partner solutions.It serves as the execution platform for agents built into Microsoft Copilot Studio computer use — the Microsoft toolkit for building custom Copilot AI agents to automate web tasks right from a prompt. Here, Windows 365 unlocks an easy, secure automation experience with no machine setup required.
  • Researcher uses Windows 365 for Agents to spin up Cloud PCs running a Linux environment to enable a fully fledged web browser and a command line terminal for more advanced code-driven execution scenarios.

Agent makers, enterprise leaders or developers interested in being among the first to try Windows 365 for Agents should join the waiting list today.

Windows 365 AI-enabled Cloud PCs are transforming the way businesses operate by unlocking advanced AI capabilities within select, existing Windows 365 Cloud PC configurations. AI-enabled Cloud PCs will deliver improved Windows search that finds files faster with AI by understanding user intent, not just keywords, as well as Click to Do functionality, so employees can take actions directly on images, videos, tables or text on-screen without needing to switch apps.

Additional resources:

6.1.9. Windows 365 introduces new productivity capabilities for resilience, flexibility

Windows 365 is introducing new capabilities designed to help organizations stay productive and agile. They are:

Windows 365 Reserve, now generally available, offers a simple, secure and cost-effective temporary Cloud PC solution, enabling IT teams to quickly provide a Reserve Cloud PC pre-installed with organizational apps, as well as settings and security policies via Microsoft Intune. The capability is ideal for such scenarios as device delays, loss, theft, ransomware attacks, hardware/software failures and short-term access needs. Users can securely connect from any device anywhere, and access can be easily revoked when no longer needed, maintaining IT flexibility and control.

Windows 365 Cloud Apps allow administrators to give users access to specific apps delivered from the cloud instead of a full Cloud PC. This is ideal for organizations that want to streamline app delivery, reduce overhead and modernize their virtual desktop infrastructure (VDI) environments. Windows 365 Cloud Apps run on Windows 365 Frontline Cloud PCs in shared mode, streaming apps like Outlook, Word or an organization’s custom apps published via Microsoft Intune — all without loading a full desktop experience. This feature is generally available.

Windows 365 Frontline has added User experience sync in shared mode deployments, enabling persistent app settings and user configurations across sessions and devices. Backed by Microsoft-managed cloud storage and scoped to the same provisioning policy, this feature ensures a consistent experience for users sharing Cloud PCs. When paired with Windows 365 Cloud Apps, it allows administrators to easily provision individual apps to users from a non-personalized Cloud PC image, while still retaining application settings and configurations for each user. User experience sync is now generally available.

These updates come as new Windows in the cloud research by sustainability analyst WSP USA has found that Windows 365 and Azure Virtual Desktop can reduce carbon emissions by extending the lifecycle of physical endpoints. The study compared four business-as-usual scenarios with a cloud-first approach. Modeling showed that modernizing endpoints with Windows cloud solutions can deliver significant emissions reductions — all while maintaining productivity and reducing costs.

Additional resources:

 

6.1.10. Windows 365 and Azure Virtual Desktop gain advanced security features

Windows 365 and Azure Virtual Desktop have new features that add protections and controls to meet evolving security needs. These new features are:

  • External identities: Windows 365 and Azure Virtual Desktop can now use external identities to log into Windows 365 Cloud PCs or Azure Virtual Desktop virtual machines, expanding the opportunity for organizations to use B2B login capabilities for Bring Your Own Device (BYOD), contractor or external user scenarios. External identity (B2B) capabilities are generally available.
  • Windows Cloud I/O Protection provides keyboard input and output protection for Cloud PCs. These capabilities help IT admins defend against keylogger malware and keystroke injection attacks. This is in preview.

Additional resources:

6.1.11. Windows Endpoint Security Platform API now in preview

Windows Endpoint Security Platform API is now available in preview to Microsoft Virus Initiative partners, who are helping Microsoft make the API generally available in 2026. Partners need a solid platform to start development of their security tools for Windows 11 outside of kernel mode. Microsoft is focusing on early boot components of the security solutions, as they are easy for security partners to remove from kernel mode. Helping partners with new APIs to develop their security tools to run in user mode will greatly impact stability and reliability of Windows systems.

Additionally, Microsoft is working with more than 4,000 partners who are developing other drivers, such as audio and networking. The company is raising requirements for partners and vendors when it comes to drivers, with the goal of future machines only acquiring current drivers from Windows Update.

Additional resources:

6.1.12. Security updates for Windows now generally available

A series of security updates for Windows users are now generally available. These include:

Sysmon functionality in Windows: Sysinternals Sysmon is a popular free security event logging tool from Microsoft, and it can now be included in updates to Windows 11 and Windows Server 2025. Prior to release, customers had been responsible for deploying, updating and configuring Sysmon. This provides better visibility for proactive threat hunting with reduced operational overhead for IT admins.

  • Post Quantum Cryptography (PQC) API: PQC allows organizations to use cryptographic algorithms to be secured against attacks from quantum computers. Early action helps ensure compliance with the Commercial National Security Algorithm Suite and other global standards, while reducing exposure to “harvest now, decrypt later” threats.
  • Zero Trust DNS: This enforces zero trust at the DNS layer by controlling outbound name resolutions using encrypted DNS with approved DNS servers, complying with National Institute of Standards and Technology guidelines.
  • Hardware-accelerated BitLocker: In new devices with supported hardware, BitLocker now utilizes capabilities of modern SoC (system on a chip) and CPUs. It can also now offload bulk cryptographic operations for storage I/O from the main CPU cores to a dedicated crypto engine to improve performance. Bitlocker can also now use hardware-protected keys, reducing their exposure to CPU and memory issues, to increase security.
  • Passkey sync: Windows 11 now has passkey manager integration with Windows Hello, allowing users to select their passkey manager of choice. Passkey managers can integrate into Windows Hello to smoothly and securely use passkeys. Passkeys bring multifactor authentication to much of the web, so users get the benefit of simple, quick and secure sign-in.

Additional resources: