Last week, I started seeing folks at Microsoft talk about AI Archives for Teams meetings, and it obviously got my attention.

You can read more about it in the official documentation.

As an AI use case, I’m kind of excited about how this works. Keeping an AI archive of that meeting that includes a condensed summary of what was said, what was decided, etc., and then making that available to Copilot to use with the next meeting on the topic seems like a great idea.

I can see how this could make Facilitator-created meeting notes for recurring meetings much more useful if the note-taker can refer to previous events in the meeting series. Or, if Copilot Chat could refer to the AI summaries of previous meetings when creating documents or drafting emails. There’s a lot of stuff that happens in meetings that we don’t easily use as a reference when using Copilot in other areas.

As a user, this makes sense, and I like it.

I also like that if a meeting goes a bit off the rails and I don’t want to include that summary in any future AI interactions, I can go back to the meeting and delete it:

The meeting organizer can delete the AI archive by deleting the meeting recap. First, navigate to the meeting recap. Then, open the … menu, and select Delete recap content.

What I don’t love is that I can’t actually see it:

Content in the meeting archive is only accessible through Copilot, Facilitator, and other Microsoft AI tools. Users can’t open or view the archive file directly.

If AI uses a meeting archive to generate a response, the response includes a citation that links to the meeting recap or meeting invite.

AI archive files are indexed for search. Opening an archive file from a search point redirects the user to the meeting recap page or meeting invite.

The archive file can’t be moved, renamed, or modified.

Facilitator, Copilot, and other AI never shares insights from a meeting with users who don’t have access to the meeting.

Still, I get the concept; the archive is a summary meant only for AI to reference.

This is where the eDiscovery part of my brain has an issue.

How do we show the content Copilot used to create the context for a decision if that decision ever becomes relevant in litigation?

Is there a file to review?

Read more

That’s because there’s no metadata in the eDiscovery review set about who modified the notes, just the original author.

Today, I want to talk more about collecting meeting notes because recurring meetings create a number of issues.

One of the known issues with recurring meetings, of course, is that there is only one meeting item that can be collected from Exchange, from the first meeting in the series. If you’re trying to recreate someone’s calendar for a day by collecting meetings where the start and end date of the meeting was that day, recurring meetings that started before that day won't show up. Because, in a sense, they aren’t there. The item you see on the calendar is a figment of your imagination, the ghost of the original meeting. Not a meeting unto itself.

That’s often frustrating enough, but Teams meeting notes throw another wrench in the works.

Let me give you an example. I send out a standing meeting with another user in my environment for a weekly meeting for the month. I set it to start the day after Labor Day, Sept. 8. Subsequent events are Sept. 15, 22, and 29.

I create an agenda before sending out the invite in the Teams calendar.

One .loop file gets created. I like to call it the agenda template for the series. It’s named simply Standing_Meeting.loop.

It is in my OneDrive, as the meeting organizer, inside a “Meetings” folder.

I invite Adele.

On Sept. 8, Adele is the first one to join the meeting. The notes for that event in the series are created based on the template when the meeting starts.

This file is named Standing_Meeting_9-8-2026.loop.

It lives in Adele’s OneDrive. She created it when she started the meeting. She is the author and the custodian.

On Sept. 15, I started the meeting.

The Standing_Meeting_9-15-2026.loop file gets created in my OneDrive.

On Sept. 22, Adele was the first to join the meeting.

The Standing_Meeting_9-22-2026 file gets created in Adele’s OneDrive

During the meeting on the 22nd, we agreed to revisit a topic at our next meeting. I open the Teams calendar item for Sept. 29 and add it to the agenda.

The Standing_Meeting_09-29-2026 file gets created as soon as I open the agenda for the upcoming meeting. It’s in my OneDrive. It doesn’t matter who arrives first to the meeting on Sept. 29; the notes already exist.

This might not seem like a very big deal in my test example, because there are only two possible locations. How many of your recurring meetings only have two attendees, though?

Imagine a team meeting with 12 people every week, where the organizer has set it up for Copilot Facilitator to take notes automatically.

For eDiscovery purposes, I need to collect notes from twelve different OneDrive accounts to locate all possible notes from this recurring meeting. Any one of those twelve could have been the first one to join a particular event in the series and be the custodian of the notes.

I think we might be better off just hoping we never have litigation where meeting notes become a relevant issue. I can’t imagine that would never happen, though.

Share Mike McBride on M365

I was doing some testing over the weekend (Yeah, I know, not the most exciting holiday weekend, but keeping up with this stuff takes time) with meeting notes and external users, because Microsoft has been sharing meeting notes with external users, but I had yet to see them appear in the meeting as an external user.

This is changing, and I can see the notes in the meeting in one tenant. More on that in an upcoming blog post.

It got me thinking, though, about whether, during the eDiscovery process, you could tell that an external user had added to the notes during a meeting.

I couldn’t find any evidence.

The next obvious question, of course, was whether you could tell who took notes during any meeting.

After digging and experimenting with collecting all of the versions of the Loop file, etc., the answer was still no. Only one author was listed, one custodian, one file path to the meeting organizer's OneDrive, and no indication that someone else may have taken the notes.

The only time I could tell another user had added anything to the notes was if they assigned a task; then the notification would tell me who assigned it. The notes file by itself did not.

I’m not sure whether this matters in the eDiscovery world; we often have only one author listed on Word documents edited by many people, for example. It would require a much deeper dive to try and piece together who edited it over time. Meeting notes, however, are an interesting entry point to the larger discussion about collaborative environments because they live in the meeting, where agents, organizers, and attendees may add bullet points or create tasks. In many ways, they are the perfect example of a document where no one knows who wrote it.

Which begs the question of whether you should base any kind of litigation strategy on the contents of something that a group of people quickly wrote down during a meeting, but that’s something to discuss with your legal team. 😏

Let me show you the details:

Read more

While we’re on the subject, though. This outage was a pretty big deal. I wonder how many companies couldn’t do anything because email was unavailable. For all the talk about AI and fast-changing technology, when you can’t keep the email flowing, I’ve got to wonder how much organizations can trust you.

Then again, if you’ve been using Exchange long enough, how much pain is moving going to be?

Speaking of Microsoft and AI, though. There was also this last week:

Who thought renaming the M365 Roadmap was a good idea?

The "AI at Work Roadmap"

Which just begs this response, doesn’t it? - Microsoft’s latest rebrand proves that it just wants to shoehorn AI everywhere

We’ve known that for a while now, Microsoft. You don’t have to keep reminding us.

Leave a comment

Copilot News:

This is a pretty good overview of what’s new.

What’s New in Microsoft Copilot | August 2026

I will admit that there are a few new things I’m looking forward to, including integrating OneNote and Copilot Notebooks as a more project-focused tool. I think there’s some real potential there.

There are also connectors that may interest those of us in the legal world.

This may also be of interest to the heavy PowerPoint users - Use custom skills with Copilot in PowerPoint

If you haven’t tried this, you should. There’s a lot of potential here as well - Copilot Pages: Work side by side with AI

This is a good take. Copilot needs to be more than something that helps you draft better emails - Copilot Has to Earn Its Seat

Non-Copilot News:

Patch Tuesday keeps getting larger and larger, and still, the bad guys are ahead:

Anthropic’s New AI Model Can Identify More Software Bugs Than Ever. Microsoft Is Struggling to Fix Them Fast Enough.

This is also an AI-related risk: Block Prompt Injection Emails with Microsoft Defender.

At the ILTA Conference last week, I noticed how often any session or conversation about AI came back to governance.

• AI-First and Microsoft 365: How to Adapt AI Governance for the Copilot Era

• What my WorkIQ Persona Sketch taught me about Data Governance

Coming soon - Microsoft confirms rollout of redesigned Planner UI is happening soon.

You might be surprised to learn what you don’t know - Everything your IT team needs to know about Microsoft 365 shared mailboxes

This could be interesting - Microsoft Teams Introduces Communicator App for Targeted Announcements

Of course, I couldn’t leave you without some Purview education:

• Close the gaps: layered data protection with Microsoft Purview across endpoint, browser, and network

• A Contrast and Comparison of Retention and Sensitivity Labels

Were you impacted by the latest outage? Did it give you time to do some focused work without having email notifications popping up every five minutes?

Here’s hoping September doesn’t come in with any more surprises in store.

Reader Alex sent me a link to this article, updated in July by Microsoft, about the danger of deletion for an unlicensed OneDrive account:

https://learn.microsoft.com/en-us/sharepoint/unlicensed-onedrive-accounts

I took a quick look at it while traveling and added it to the list of things I wanted to write about.

Yesterday, during the ILTACON session we were doing with Loop, I talked a bit about the upcoming change that I wrote about in the last edition of the newsletter:

The change, of course, is that Copilot Pages will start being stored in OneDrive very soon, instead of being embedded in SharePoint, which seems like a good thing for eDiscovery practitioners but does create something to think about when applying various policies to OneDrive.

Someone came up to me afterward and asked how we're handling unlicensed OneDrive accounts going forward. Referencing the same change.

I don’t think it’s a coincidence. I think there is a lot of confusion about what is happening with unlicensed OneDrive accounts.

Let’s try to understand the issue.

According to the article above, the important factor is whether you deleted the user account or just removed the license. If you only removed the license:

Unlicensed OneDrive accounts linked to a user account that has not been deleted in Entra ID. These accounts are archived on their 93rd unlicensed day. If the account remains unlicensed and unlicensed account billing isn't enabled, it's subject to the cumulative 365-day nonpayment clock for deletion.

Versus deleting the account:

Once you delete the unlicensed account, both the OneDrive account and its files are moved to the recycle bin. After 93 days in the recycle bin, it will be permanently deleted, and the user is no longer able to sign in to their work or school account.

So this is pretty straightforward: if you delete the account, the 93-day recycle bin process starts. If you unlicense the account but leave it in Entra, OneDrive data is archived after 93 days.

The scary part about archiving is that the data is no longer available to be viewed. An Admin can’t assign rights to the OneDrive data; the only way to access it is through an eDiscovery collection.

That remains true even if the OneDrive account is on hold or subject to a retention policy. A hold would not stop the archiving process; it would stop deletion at 365 days, but the data would not be viewable until you created a billing account for unlicensed OneDrive storage or licensed the account again.

It would remain subject to eDiscovery, but that would be the only way to access it, and if it hits the retention date, it’s gone.

So, from a workflow perspective, we’re looking at how we offboard users. Do we delete them when they leave? Then, barring a hold or other retention policy, the data gets deleted 93 days later.

If we unlicense the account but leave it hanging around in Entra “just in case,” we need to know that without a billing account for unlicensed OneDrive storage, that data will be archived after 93 days, limiting our ability to access it.

If that’s been your practice, this chart should find its way into your brain:

This also underscores the importance of placing holds or retention policies that make sense for your business. If you’ve got people using OneDrive often, is 93 days long enough to review and copy important data from an exiting user’s OneDrive? If it’s not, you may need to reconsider how you unlicense the account, copy the data to another location, or rely on an eDiscovery collection after crossing the 93-day threshold.

Like most things in the eDiscovery world, it’s all about knowing what’s coming and planning for it. Like most Microsoft-related things, it’s also about staying flexible when things change.

Most importantly, given the change to Copilot Page storage, before you make decisions about this process, do you understand everything being stored in OneDrive automatically? (Meeting notes, meeting recordings, uploaded files to Teams chat and Copilot chat, Copilot-created documents, etc.) It’s always important to understand what data you have before you start planning how to deal with it as part of compliance.

I am curious, though. How do you offboard users and handle OneDrive data?

Leave a comment

New Copilot Pages will be stored in OneDrive for Business

Look, I’ve spent a lot of words writing about the need to consider how you'd handle the eDiscovery workflow if you needed to collect Copilot Pages or Copilot Notebook artifacts, so I’m pretty happy they are moving newly created ones to OneDrive.

Subscribe now

I’m even happy that this new announcement perfectly illustrates one of the points I’m planning to make during my presentation at the ILTA conference about Loop and the need to watch for changes when it comes to governance.

So kudos to Microsoft for recognizing the difficulty of governing pages that sit inside a SharePoint embedded container.

On the other hand, Copilot Pages and Notebooks are now part of OneDrive and will default to whatever your policies are within that container.

Those policies might be significantly different than the ones you’d like to apply to Copilot Pages, so it’s time for many of us to get to work on identifying what this change means in terms of retention, eDiscovery, Records Management, Security, etc.

It also means it just got a lot easier for those Copilot Pages to be shared externally as Loop pages, thanks to that recent change.

It never ends…

How is this going to impact your governance strategy?

Leave a comment

There was a lot of noise about the announcement of a planned Copilot super-app.

There weren't many details about how it would work, how it would be licensed, or anything else.

Subscribe now

During an earnings call, Nadella confirmed that the app, first tipped by Fortune in May, would include access to Copilot tools like Autopilots, Cowork, and Code, alongside its chatbot functionality, all in software designed to span "both consumer and commercial experiences."

What does that mean for businesses with Copilot for M365 seats? I have no idea, and neither do most of the people writing about it.

Like most things Microsoft, we’ll just have to see what it looks like when it rolls out. I’m not holding my breath that it’s going to be anywhere near as glamorous as Satya says it will be. Then again, we all know I’m a skeptic by now, right?

What do you think about it?

Leave a comment

Copilot News:

Other than the super-app, there were some other things of note about Copilot:

There are some changes coming for Facilitator - Updates to Facilitator in Microsoft Teams meetings.

How much do your agents cost? Users can’t tell.

OpenAI as Copilot Subprocessor

Related - The next wave of Copilot is here: Why the new OpenAI Subprocessor setting matters

You can get all your Copilot-generated recaps in one place soon - Microsoft Teams just added an app to help you skip meetings

This might also be helpful when thinking about that super-app and all the various Copilot tools:

Non-Copilot News:

You may not have any idea how often this has been needed, but previously unavailable. - Change Meeting Organizer in Microsoft 365 Via PowerShell.

If you travel for work, here’s something to think about - Hotel Wi-Fi Gateways Weaponized to Steal Microsoft 365 Logins: MFA Bypassed

Intranet from the Trenches

Tenant Storage in Microsoft 365: Before vs After SharePoint Embedded

Reading this article will give you a clear understanding of how tenant storage worked before SharePoint Embedded, the impact of new tools like Loop, Designer, and Copilot Agents, why storage still matters for admins, and practical ways to keep things under control without the usual headaches…

Read more

3 months ago · 1 like · Jaime López

Purview Things:

• New DLP Rule to Block Copilot from Processing External Email

• Securing AI in Microsoft Purview: Data Governance for Generative AI – Classification, Labeling, and Risk Assessment for AI-Generated Content

• DLP Move to Quarantine Action Available for SharePoint

• Microsoft Purview Records Management: When Data Becomes Something You Cannot Change

• Microsoft Purview Data Lifecycle Management: Knowing When Data Should No Longer Exist

• Microsoft Purview Communication Compliance: When the Risk Is in the Conversation

Those last three links all come from a blog I recently came across written by Victoria Holt. Obviously, she writes quite frequently about various pieces of the Purview environment. That might be worth a follow for some of you.

Last week, I did some testing to recall a message from within my tenant because the recent announcement that cross-tenant recall would be available later this Summer had me curious.

Alex rightly pointed out that some metadata indicating that a message sitting in the Purges folder was recalled, not deleted by the user, would be helpful. A

Alas, a quick look at the metadata for the recalled message didn’t show me anything.

This week, I dug a little deeper.

I not only analyzed the available data in the review set for the copy of the message that was recalled, but also the one that was sent. The hope was that somewhere in this exchange there would be some metadata to show that a message was recalled.

The news was not good on that front.

As mentioned last week, the recalled message was collected from the Purges folder, so it was not visible to the recipient in Outlook at all, which is what you’d want from a message recall. That was also the ony hint that it had been recalled.

The sent one was worse. It was still showing in the Sent Items folder of the sender. There was no metadata to suggest that it had been recalled. In fact, the metadata was not updated on the sent item at all.

What’s even worse was that my keyword search based on the email subject did also collect the email sent to the sender about the recall, but whether it was sucessful or not did not show in the email. There’s a link to get the report from Exchange:

In case you can’t read it, that last line is also very important:

• Access to this report will expire after 7 days.

Let’s break this down. One week after a message is recalled, there will be evidence that an attempt was made to recall it, but not proof.

• The recipient’s copy will go through the purge process, or remail in that hidden Exchange folder if there’s a retention policy or hold places.

• The senders copy will sit in the Sent Items folder - as any sent item would.

• The email with the link to the recall report will remain subject to being deleted by the user.

• The report will have expired and be unavailable.

As I said last week, for an internal situation where the sender and recipents are all inisde your tenant, maybe none of this matters. If you’re recalling emails across tenants, that may be a different question. Or, maybe it will never matter that you can’t prove a message was recalled.

It’s not like I can point to a single case where this was an issue, maybe it never will be. It made for some interesting testing, though, and that’s what this newsletter is all about.

What do you think, will it ever matter? Are there indicators of a message being recalled with other forensic tools that exposed more metadata than Purview eDiscovery does?

Leave a comment

I saw this recent announcement, and of course, started thinking about the eDiscovery impacts.

Cross-Tenant Message Recall in Exchange Online

With Cross-Tenant Message Recall, a tenant admin can add other Microsoft 365 tenants to an allow list. Once a tenant is on the list, senders from those allow-listed tenants can recall messages they’ve sent to recipients in the receiving tenant – just as they would for an intra-tenant recall.

Control sits with the receiving tenant – the organization whose users received the messages. A cross-tenant recall is only honored when the receiving tenant’s admin has explicitly allow-listed the sender’s tenant. This keeps the receiving organization in full control of which external tenants are permitted to recall messages from its users’ mailboxes. The feature is disabled by default; no cross-tenant recall occurs until an admin adds at least one tenant to the allow list.

When I was considering how this would work in terms of how a mailbox on hold would treat the recalled message, or whether recalled messages would go through the deletion process, etc. I realized something. Since the release of cloud-based message recall in 2023, I had never tested what happened in the recipient mailbox when a message was recalled.

Before I considered the possible implications on cross-tenant recalls when this rolls out - which I may or may not be able to test; that’s a little complicated to test as an individual - I wanted to see what happened with an internal message recall.

What I found wasn’t that surprising. After a successful recall, the message was not visible to the recipient in Outlook, but the eDiscovery tool was able to get a copy of it from the hidden areas of the Exchange mailbox.

Let’s look at the details:

Read more

I was going to lead this edition of the monthly news roundup on Colpilot Cowork moving to general availability, but it felt so familiar; I had to go back and look at the June roundup.

Sure enough, it’s familiar because the same thoughts applied to the announcement of Scout.

I suspect many organizations have no idea how to budget for AI token usage.

Cowork, is also a pay-as-you-go feature.

Once again, we see a situation where organizations will have to make guesses about how much they will depend on a tool and budget accordingly. Yuck. I don’t envy many of you as you approach next year's budget decisions.

Copilot News:

In other Copilot news:

• Speaking of Scout - there are identified risks - Microsoft Scout Exposed: What This AI Security Analyst Is Really Thinking About Your Cloud – And How To Stop It

• It’s not just Scout - Why Microsoft 365 Copilot is a Massive Security Risk

• From gathering to learning: the new Copilot Notebooks features in Frontier

• Where Do Your Uploaded Documents Actually Go in Copilot Notebooks?

• Before You Buy Microsoft 365 Copilot, Clean Up Your Tenant First - rolling out Copilot is a sure way to find all the insecure M365 locations very, very quickly, in potentially embarrassing ways.

Non-Copilot News:

Worth Reading - Record Teams Membership Snapshots Easily with PowerShell

Related - Identify Inactive Channels in Your Teams Deployment

Also - How to Create and Use Change History Reports in SharePoint

Both of these are valuable for anyone with an interest in eDiscovery or compliance in M365, you need to know where things are stored:

• OneDrive Storage in Microsoft 365: Which Workloads Store Data There and Where It Lives

• What Microsoft 365 workloads actually store data in Exchange Online mailboxes

Some good Purview resources:

• Microsoft Purview Insider Risk Management Gets Unified Alert Experience

• Building a Data Protection Framework with Microsoft Purview

• Stop Misunderstanding Purview Sensitive Info Types (SIT’s)

This could be interesting. Working in a law firm, we talk a lot about the confidentiality of information discussed during Teams meetings and whether external note-takers should be allowed. - Introducing smarter bot protection in Microsoft Teams meetings

SharePoint embedded has been a bit of a governance nightmare. This helps a little - Finally, We Can Properly Handle SharePoint Embedded During Offboarding

Finally, because we all love a good log:

Stop Guessing: The Ultimate Guide to Microsoft 365 Logs

What news from the M365 are you watching closely?

Leave a comment

In last week’s newsletter, I discovered Microsoft documentation stating that Puview eDiscovery didn’t support collecting linked files from shared channel conversations. I tested it and didn’t find that at all.

I also mentioned some other items from that same document that were allegedly not supported regarding linked attachments. Alex was kind enough to add his own testing results in the comments:

Re: shared channel cloud attachments, I agree I have not seen any issues for a long time. Running a quick test, uploading an attachment to a post in a shared channel (thus a link to the file pointing to shared channel URL) adding the parent team mailbox only (not SPO site) and searching Kind:MicrosoftTeams AND Date:today, a promotion to review set brings in the shared channel post AND cloud attachment with no issues. With respect to encryption, I am not sure what issue is being articulated specifically. What I do know is about a known issue (MSFT is working on it) with cloud attachments that were automatically encrypted via a SIT (manually encrypted is fine) not being pulled into review set.

I wasn’t able to create an auto-labeling policy that recreated what he described in time for this newsletter, but I wonder if anyone has done that testing and can confirm that this is a known issue and what it looks like in a Premium eDiscovery Review Set. I’m legitimately serious.

I was, however, curious about the manually encrypted items, since the documentation doesn’t differentiate:

In my test, that simply wasn’t true. I sent a link in an email, labeled the email Highly Confidential” which applied encryption, and it was collected using Purview. The email and attachment were both collected and decrypted:

I also got curious about another thing on the list of unsupported items, OneNote Notebooks.

Again, I created a link to a notebook and sent it in Teams:

I also copied the link to a single page in a notebook, since the documentation text might lead you to believe that could work:

Cloud attachment collection doesn’t collect folder links or OneNote notebooks. It processes links to individual files only. It doesn’t resolve or collect links to folders, document libraries, or OneNote notebooks stored as folders in SharePoint. If a user shares a link to a OneNote notebook in an email or Teams message, cloud attachment collection doesn’t collect notebook content. To collect OneNote content, add the SharePoint site that contains the notebook as a search location. The system indexes individual OneNote section files (.one), and makes them searchable.

As it turns out, collecting the channel conversations did not bring in any OneNote files. This is good to know if someone is sharing links to OneNote data. There’s a good chance this data will not be collected as linked attachments. You’ll need to collect it from the location where the Notebook lives.

Then again, how many people are sending links to OneNote? Maybe it’s common where you are, but I haven’t seen it much.

Leave a comment

As I’ve said over my years of working with Microsoft and eDiscovery, this is why we test everything. One, because things change, constantly. Second, because sometimes, even Microsoft’s own documentation can lead you down an incorrect path.

For reasons I’m not going to get into today, I was reviewing the limitations on collecting cloud attachments with Purview eDiscovery Premium when I came across one I hadn’t seen before.

Teams shared channel messages and posts don’t support modern attachment link extraction. Users need to include the shared channel site and include the file manually as part of their collection.

In all my years of testing cloud attachments, I had never heard or seen this before, but I also knew that changes to shared and private channel messages may have affected things over the last year, so maybe I had missed it.

By the way, there are also some other interesting limitations listed there that may be worth knowing before you run into them in a real-world scenario. For me, the other key ones were these, but you might have others:

Encrypted emails and messages don’t support modern attachment extraction.

Advanced indexing isn’t applied to cloud attachment files referenced within emails or messages. This limitation means the content of the cloud attachment file itself isn’t processed by advanced indexing or OCR.

Cloud attachment collection doesn’t collect folder links or OneNote notebooks.

But, as you’ll see, I’m not 100% convinced of anything in this list now, because my experiment with a shared Teams channel collected the cloud attachments just fine.

I only ran the query against the Teams mailbox, and I tried three variations of linked attachments: uploading a file from my device, using the “add cloud files” option to copy a file from OneDrive, and copying/pasting a OneDrive link in the post body.

All three were collected using the Add to Review Set option.

I would think that contradicts the clear language from this documentation above, right?

Here are the details:

Read more

Microsoft Build happened, and Microsoft made more announcements about new Copilot agents and features, and naturally, AI “experts” told us how this changes everything, again, for like the third (fourth?) time in 2026.

I’m sorry, did that seem cynical? I wouldn’t want to give anyone the impression that I’m cynical about AI.

Let’s skip straight to one of the bigger announcements - Microsoft Scout.

• Microsoft Scout Explained: How always-on, autonomous agents are redefining the future of AI

• Microsoft Scout and the Agentic Upgrade Coming to Teams and M365

Like many of the recent announcements from Microsoft about agents, though, the real question is how much is this going to cost?

That’s the unanswerable question for many of us.

Scout seems to be based on a Copilot for M365 license, a Github Copilot license, and usage costs.

I suspect there are a lot of organizations with no idea how to budget for AI token usage. They are still trying to figure out exactly what people use it for, and now we are being asked to predict exactly how much usage it will get for the next year, while it also change multiple times during that same year?

Good luck with that.

Leave a comment

Copilot News:

Of course, Scout wasn’t the only Copilot news:

They changed the interface, again - Introducing a new design for Microsoft 365 Copilot

I wrote about memories a couple of weeks ago so I was interested in this as well:

Intranet from the Trenches

Complete Guide to Microsoft 365 Copilot Memory for Admins and Users

Reading this article will give you a clear understanding of what Memory in Microsoft 365 Copilot really means, how it works today from both user and admin perspectives, practical ways to interact with it, and the governance controls we need in the trenches to keep things secure and aligned with company needs…

Read more

4 months ago · 1 like · Jaime López

They never released the item from the Roadmap but you can create a psuedo version - Copilot prompt libraries for your tenant.

This seems interesting. Has anyone built a skill yet?

The New Way to Automate Without Power Automate: Skills in AI in SharePoint

Non-Copilot News:

Well, this would be the not specifically about Copilot Security and DLP section of the newsletter anyway:

• How To Govern Shadow AI Using Microsoft Purview, Defender And DSPM

• DLP and Sensitivity Labels for SMBs: A Practical Copilot Readiness Playbook

• Deploy Microsoft Purview DLP For Copilot Security

• Microsoft Purview data governance best practices

• Microsoft Extends Purview With Visibility and Control of Anthropic Claude

Of course, not everything is AI, there are always other security risks in the M365 environment:

• FBI warns Kali365 phishing kit is stealing Microsoft OAuth tokens at scale

This might impact some of your applications - Outlook Calendar Sharing Moves from MAPI to REST

Intune and CAP can be difficult to get right. I’ve seen the struggle. - Intune compliance policies + Conditional Access integration.

That’s it for what I’ve been reading and bookmarking over the last month. I’m taking an honest-to-goodness vacation next week, but I will be back in your inboxes with more M365 testing results in a couple of weeks.

I’ve been investigating some of the new Copilot features for the blog and my day job recently, and I came across something I've been wondering about in the eDiscovery space.

Copilot Cowork is the new Frontier agent that is Microsoft’s answer to Claude Cowork, in that it can create and send emails on your behalf, write summaries or meeting recaps, and create documents or even set up follow-up meetings.

I have tried doing a few basic tests with it, things like asking it to make suggestions for managing my calendar next week, where it went ahead and offered to block off time for me to finish up some tasks at the end of the week, and suggesting which meetings I could most likely skip. (Spoiler alert - while I understood the reasoning, it was a meeting scheduled by my boss, so maybe not.)

One thing I found a little interesting, though, was that the interaction with the agent did not follow the typical pattern of every other agent in the Copilot environment.

Typically, the prompt and response would appear in the user's mailbox as a Copilot Activity, but in this case, they did not. The email was in the mailbox twice, once as a sent item and then again in the inbox, because Cowork used my email account to send it to myself.

But there was no corresponding Copilot interaction.

Why?

Read more

If you haven’t opened a review set in Purview eDiscovery lately, it might be a good time to take a look. I noticed a couple of new (Preview) tabs a few weeks back and made a note to go take a deeper look at them later.

The Advanced Review Set Explorer caught my eye first.

First, let me state the obvious. I was dumbfounded by the interface. Perhaps because I’m not a huge KQL expert, I didn’t really know what I was looking at.

It’s a little overwhelming.

But the link to learn more about KQL started to help me understand where this could be very powerful in the right hands:

Specifically, it got me thinking of this not as an advanced query builder but as an advanced report writer.

The Advanced review set explorer (preview) in Microsoft Purview eDiscovery lets reviewers run real-time big data analytics on review set content by using a defined subset of Kusto Query Language (KQL). With the Advanced review set explorer (preview), you can query, filter, and visualize review set data directly in the Microsoft Purview portal without modifying the underlying content. Queries run against the full set of indexed items and return either tabular results or chart visualizations.

I was struggling to consider how much more advanced I would want to get when querying a review set, but when I consider the one thing I hear complaints about the most in Purview eDiscovery - the lack of reporting - I realized that this may be Microsoft’s answer to that common complaint.

It’s only a partial answer though.

Let’s take a pretty simple example from the documentation. This query:

ReviewSetTable

| where SubjectTitle has “Day”

| mv-expand Participants

| summarize count() by tostring(Participants)

This runs a query for the word “Day” in the title of the items. In my test I collected a mailbox so it’s most emails. Then, it reports on the count of participants among those query results. This would be a nice little reporting tool to analyze search results.

Or, at least it would be a nice little report if you could export the list that appears in the interface in response to the query:

As it stands, you can see the count of each participant, but sharing it with any one outside of this interface seems to be impossible.

There are commands to render it as a barchart or piechart but those also render in the same interface with no apparent export option.

Maybe once this comes out of preview, this will be an actual reporting tool with the option to export these reports?

Has anyone heard any information on whether that is in the plan?

Leave a comment

The other tab, the Dashboard preview, seems to be a better interface for simple reporting and charts than the current one that displays under the Analytics menu.

This one is easier to read and has more information, but still suffers from the same limitation - it only exists in the eDiscovery interface.

In short, kudos to Microsoft for trying to provide more insight into the data collected in a review set, but don’t rest on your laurels yet, most lawyers aren’t getting in here to look at this analytics, we need a way to get them out!

Well, this is embarrassing.

I tested Copilot memories a while back and concluded that they were not stored in Exchange or collectible in any way, because my collection of Copilot interactions from a mailbox didn’t turn up any.

You enter them as a prompt in Copilot that begins with the magic phrase “Remember that.” Why would I think they were anything but a Copilot prompt?

Turns out, that’s not what they are.

This post showed me something I hadn’t considered, because, frankly, who comes up with these things?

Copilot Memories (personalized saved information Copilot “remembers”)

Exchange Online: Hidden CopilotMemory subfolder within the user’s mailbox contacts. Stored as contact entries separate from prompts and responses.

IPM.Contact

Each memory item appears as a contact card within Exchange, which is distinct from the message-based item classes used for prompts/responses.

1. Add the user’s Exchange mailbox as a data source to the search.

2. In the condition builder you can optionally filter the search to only return Contacts by adding a condition of “Item class contains any of Contacts”.

Notes:

· Copilot memories will not be preserved under a legal hold or retention policy.

· This will return both Copilot memories stored in contacts as well as traditional contacts from the user’s Exchange mailbox.

This seems bizarre to me. So much so that I complained about it to my wife, who has worked in various fund-raising capactities. She had a different take - memories are contact reports on yourself, the way you’d enter a contact report in Salesforce ot some other CRM.

That tracks with what is stored in the mailbox.

It also anwsers the question about whether a retention policy would impact memories. No, because they are not Copilot interactions. They are contact reports.

To really see what Copilot is remembering, capturing these contacts in a Review Set, is helpful. See how in the chart, above.

Read more

A frequent point I make about M365 tools is that they might not always be the best of breed, but since you’ve already bought them to use Exchange, they are often good enough given the price point of a different tool.

Not always, but often.

That’s why this comparison of Claude and Microsoft’s Cowork agents made me chuckle:

Claude Cowork vs Copilot Cowork: why the Microsoft answer wins for SMB

Claude Cowork lives on your desktop. You mount a folder, drop your files in, and Claude runs in a sandbox on your machine. It doesn’t see your inbox. It doesn’t see your calendar. It doesn’t see your Teams chats unless you’ve copy-pasted them in. You bring the data to the model.

Copilot Cowork is the inverse. It already lives inside Microsoft 365, grounded in your Outlook, Teams, SharePoint, OneDrive, and calendar through Work IQ. You don’t mount anything. The model is already where your data lives.

I kind of agree, Copilot might not be the first choice of AI tools, but it is already connected to all your stuff, and the interactions live inside the tenant. That’s a lot when you’re trying to just do stuff with AI related to your work, which already lives in your tenant. Is it enough for every small-to-mid-sized business? I don’t know, but it will be enough for many of them.

Subscribe now

Copilot News:

More info on Cowork - Copilot Cowork: From conversation to action across skills, integrations, and devices.

I haven’t seen this agent yet, but I’ll be interested to test it out when I do - Microsoft Legal Agent: Why Playbooks Beat Prompts for Real AI Workflows.

Speaking of agents - Microsoft Agent 365 Hits General Availability With Local AI Agent Controls.

More model choice - Available today: GPT-5.5 Instant in Microsoft 365 Copilot

An interesting question:

Intranet from the Trenches

Does Copilot Need Claude to Provide Good Answers?

Hello, guys…

Read more

5 months ago · 1 like · 1 comment · Jaime López

Finally, some learning material - Microsoft 365 Copilot app learning series: Real‑world scenarios for your workday.

Under the not entirely non-Copilot section:

• If You Manage Entra Permissions, Watch This Before Deploying Agents

• DLP Policy for Copilot Can Block Web Searches

• Operationalising Responsible AI: What Microsoft Purview Actually Enables and How to Use It Well

Non-Copilot News:

Is anyone going to miss this?

Together Mode for Teams Meetings to Retire in June 2026

This has been all over the news recently, and I’ve seen a number of them across our industry, too:

Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook.

Prepare yourselves.

I’m hopeful that this is as easy for users as Alerts were. We’ll see. - The New SharePoint Workflows Button.

Worth a read - Microsoft Purview Data Loss Prevention Diagnostics Explained

I cannot handle that they named this series of articles about updates to Defender and Security In the Loop, when there’s an actual product called Loop that is not related to this at all.

Please make it stop.

That’s all for this month’s roundup. What new stuff are you most excited about?

Leave a comment

I was recently working on an outline for an upcoming presentation I’m going to be doing, and realized that I hadn’t created a case in eDiscovery without checking the checkbox for using Premium features in a very long time.

There was a time when, if I had a question about what you could do with an e3 license versus an e5, I would go look in Standard eDiscovery, but that’s been gone a long time, so instead I created a new case and unchecked the box to block myself from using Premium features.

I quickly created a new search and let it show me the statistics, which don’t change at all when this checkbox is disabled.

Naturally, the button to add the results to a review set was grayed out. I expected that. Review Sets have always been a Premium feature.

I hadn’t looked at the options available on the Export, though, and that’s where you really notice the difference.

First, you have fewer options for collecting versions from SharePoint and OneDrive. It’s either the current version or all versions.

Again, that makes sense.

You also have far fewer options for conversations and linked documents.

• No list attachments.

• No collecting the conversation

• No HTML transcripts

• No cloud attachments.

This may seem a bit painful, but it also makes sense. All of these tools process the data when it is added to the review set. Without a review set, processing of those links and related data doesn’t occur.

It can also mean things are quite difficult for an eDiscovery professional.

Read more

If you follow Microsoft news closely, you may have seen this new online feature for Word, Excel, and PowerPoint that lets you “Publish to Web.”

When I first heard about it, I assumed it was an easy button for taking a document that you were working on locally and sharing a copy, a published version, if you will, to OneDrive.

It turns out that’s not it at all.

https://support.microsoft.com/en-us/office/how-to-publish-to-web-in-microsoft-excel-word-or-powerpoint-9a7fb15e-f0bd-430f-85c1-054cb4826f5d

It actually only applies to documents in SharePoint. Which seemed weird. I would have assumed to copy a document to OneDrive, but my view may be influenced by the fact that I tend not to think of SharePoint as a public space like the internet. In my world, you use SharePoint to collaborate with internal and external parties. If you want to share a document for collaboration, it’s just as easy to use OneDrive, but it’s never shared with everyone.

However, as I went through the steps to see what happened when I used the feature, a use case began to take shape.

So, what does the feature do?

To test it, I opened a document online and went to the File → Share menu, where I found the option.

I tried this in Excel and Word, and after publishing, my immediate question was, " What did I create, and where is it?

I stumbled around a bit before realizing that this process had created a PDF version of each document that I “published” to the Web.

But, the PDF didn’t exist in the same Document Library; it was saved to the SiteAssets location:

I also realized that if you went back to the original document and tried to publish to the web again, you could either unpublish or republish, but you could not publish another version, which did make my little Info Governance heart happy.

That was when the use case hit me, because it’s something I do all the time with documentation. You have a Word document or PowerPoint, but you share the PDF version to prevent anyone from making changes or using it as their own.

This is that, with one click.

As far as the eDiscovery issues, it is another copy of the same document, in another location, but as I mentioned, it’s only one copy, and this is something most of us do all the time, so I don’t see it as being any worse than emailing multiple copies and updates 15 times while working on a document.

If anything, this is a little neater. You have your working, living document and the latest published version on the same SharePoint site.

Now, could Microsoft give us something similar for OneDrive or to use across SharePoint sites? That would be something.

Have you looked at using this? Does it seem useful in your workflow, or would making it more widely available make it even better for you?

Share Mike McBride on M365

I kid.

Also, it’s 81 today. Tomorrow it may be higher or lower. Things change quickly across the Microsoft universe. Details below.

Copilot News:

If you haven’t seen some of the updates coming or already here, here are some links for you:

• Copilot Cowork: Now available in Frontier

• Microsoft Copilot adds a multi-model AI research system

• Worth Reading - Microsoft backtracks on Copilot Chat access in M365 apps

• Planner Agent Delivers AI Help for Tasks

• Bringing AI assistance to basic plans in Microsoft Planner

• Copilot in Outlook: New agentic experiences for email and calendar

I also came across these two use cases that might be of interest. The first is targeted for my friends in the legal world:

Copilot Notebooks: Save Billable Hours

The second is for everyone dealing with filing expenses:

Researcher Agent: Extract Receipts Data

Have you heard someone talk about WorkIQ? I bet you have. - A closer look at Work IQ

Finally, just because I’m impressed that someone did this, and I mentioned it in the subtitle:

How many products does Microsoft have named ‘Copilot’?

The count is at 81 as of the time I’m writing this. EIGHTY - FREAKING - ONE!

And counting….

Non-Copilot News:

Before we get completely away from Copilot, this is related - Secure agentic AI for your Frontier Transformation

Here are some thorough references for you:

The Ultimate Guide to Data Governance with Microsoft Purview

GRC in a Nutshell – And How Microsoft 365 Actually Makes It Practical

This seems like an important thing to know: Company-wide sharing links have expiration limits in SPO.

For your next Purview presentation deck - Microsoft Purview Referential Architecture Diagrams

I might attempt something similar when I get some time:

I’ve been part of a massive rollout at work this week. The number of times I’ve been interrupted by urgent Teams messages while trying to communicate information in a Teams chat has been incalculable. This might have become my favorite new Teams feature, if you missed it a few weeks ago:

This wording seems excessive, but it’s pretty clear what they thought of M365 - GCC High - Federal cyber experts called Microsoft’s cloud a “pile of shit,” approved it anyway.

The fact that it got approved anyway seems like an accurate metaphor for the government and tech industry in 2026.

It also seems like the perfect place to end this issue.

What new stuff have you got your eyes on

Leave a comment

?