I was going to lead this edition of the monthly news roundup on Colpilot Cowork moving to general availability, but it felt so familiar; I had to go back and look at the June roundup.

Sure enough, it’s familiar because the same thoughts applied to the announcement of Scout.

I suspect many organizations have no idea how to budget for AI token usage.

Cowork, is also a pay-as-you-go feature.

Once again, we see a situation where organizations will have to make guesses about how much they will depend on a tool and budget accordingly. Yuck. I don’t envy many of you as you approach next year's budget decisions.

Copilot News:

In other Copilot news:

• Speaking of Scout - there are identified risks - Microsoft Scout Exposed: What This AI Security Analyst Is Really Thinking About Your Cloud – And How To Stop It

• It’s not just Scout - Why Microsoft 365 Copilot is a Massive Security Risk

• From gathering to learning: the new Copilot Notebooks features in Frontier

• Where Do Your Uploaded Documents Actually Go in Copilot Notebooks?

• Before You Buy Microsoft 365 Copilot, Clean Up Your Tenant First - rolling out Copilot is a sure way to find all the insecure M365 locations very, very quickly, in potentially embarrassing ways.

Non-Copilot News:

Worth Reading - Record Teams Membership Snapshots Easily with PowerShell

Related - Identify Inactive Channels in Your Teams Deployment

Also - How to Create and Use Change History Reports in SharePoint

Both of these are valuable for anyone with an interest in eDiscovery or compliance in M365, you need to know where things are stored:

• OneDrive Storage in Microsoft 365: Which Workloads Store Data There and Where It Lives

• What Microsoft 365 workloads actually store data in Exchange Online mailboxes

Some good Purview resources:

• Microsoft Purview Insider Risk Management Gets Unified Alert Experience

• Building a Data Protection Framework with Microsoft Purview

• Stop Misunderstanding Purview Sensitive Info Types (SIT’s)

This could be interesting. Working in a law firm, we talk a lot about the confidentiality of information discussed during Teams meetings and whether external note-takers should be allowed. - Introducing smarter bot protection in Microsoft Teams meetings

SharePoint embedded has been a bit of a governance nightmare. This helps a little - Finally, We Can Properly Handle SharePoint Embedded During Offboarding

Finally, because we all love a good log:

Stop Guessing: The Ultimate Guide to Microsoft 365 Logs

What news from the M365 are you watching closely?

Leave a comment

In last week’s newsletter, I discovered Microsoft documentation stating that Puview eDiscovery didn’t support collecting linked files from shared channel conversations. I tested it and didn’t find that at all.

I also mentioned some other items from that same document that were allegedly not supported regarding linked attachments. Alex was kind enough to add his own testing results in the comments:

Re: shared channel cloud attachments, I agree I have not seen any issues for a long time. Running a quick test, uploading an attachment to a post in a shared channel (thus a link to the file pointing to shared channel URL) adding the parent team mailbox only (not SPO site) and searching Kind:MicrosoftTeams AND Date:today, a promotion to review set brings in the shared channel post AND cloud attachment with no issues. With respect to encryption, I am not sure what issue is being articulated specifically. What I do know is about a known issue (MSFT is working on it) with cloud attachments that were automatically encrypted via a SIT (manually encrypted is fine) not being pulled into review set.

I wasn’t able to create an auto-labeling policy that recreated what he described in time for this newsletter, but I wonder if anyone has done that testing and can confirm that this is a known issue and what it looks like in a Premium eDiscovery Review Set. I’m legitimately serious.

I was, however, curious about the manually encrypted items, since the documentation doesn’t differentiate:

In my test, that simply wasn’t true. I sent a link in an email, labeled the email Highly Confidential” which applied encryption, and it was collected using Purview. The email and attachment were both collected and decrypted:

I also got curious about another thing on the list of unsupported items, OneNote Notebooks.

Again, I created a link to a notebook and sent it in Teams:

I also copied the link to a single page in a notebook, since the documentation text might lead you to believe that could work:

Cloud attachment collection doesn’t collect folder links or OneNote notebooks. It processes links to individual files only. It doesn’t resolve or collect links to folders, document libraries, or OneNote notebooks stored as folders in SharePoint. If a user shares a link to a OneNote notebook in an email or Teams message, cloud attachment collection doesn’t collect notebook content. To collect OneNote content, add the SharePoint site that contains the notebook as a search location. The system indexes individual OneNote section files (.one), and makes them searchable.

As it turns out, collecting the channel conversations did not bring in any OneNote files. This is good to know if someone is sharing links to OneNote data. There’s a good chance this data will not be collected as linked attachments. You’ll need to collect it from the location where the Notebook lives.

Then again, how many people are sending links to OneNote? Maybe it’s common where you are, but I haven’t seen it much.

Leave a comment

As I’ve said over my years of working with Microsoft and eDiscovery, this is why we test everything. One, because things change, constantly. Second, because sometimes, even Microsoft’s own documentation can lead you down an incorrect path.

For reasons I’m not going to get into today, I was reviewing the limitations on collecting cloud attachments with Purview eDiscovery Premium when I came across one I hadn’t seen before.

Teams shared channel messages and posts don’t support modern attachment link extraction. Users need to include the shared channel site and include the file manually as part of their collection.

In all my years of testing cloud attachments, I had never heard or seen this before, but I also knew that changes to shared and private channel messages may have affected things over the last year, so maybe I had missed it.

By the way, there are also some other interesting limitations listed there that may be worth knowing before you run into them in a real-world scenario. For me, the other key ones were these, but you might have others:

Encrypted emails and messages don’t support modern attachment extraction.

Advanced indexing isn’t applied to cloud attachment files referenced within emails or messages. This limitation means the content of the cloud attachment file itself isn’t processed by advanced indexing or OCR.

Cloud attachment collection doesn’t collect folder links or OneNote notebooks.

But, as you’ll see, I’m not 100% convinced of anything in this list now, because my experiment with a shared Teams channel collected the cloud attachments just fine.

I only ran the query against the Teams mailbox, and I tried three variations of linked attachments: uploading a file from my device, using the “add cloud files” option to copy a file from OneDrive, and copying/pasting a OneDrive link in the post body.

All three were collected using the Add to Review Set option.

I would think that contradicts the clear language from this documentation above, right?

Here are the details:

Read more

Microsoft Build happened, and Microsoft made more announcements about new Copilot agents and features, and naturally, AI “experts” told us how this changes everything, again, for like the third (fourth?) time in 2026.

I’m sorry, did that seem cynical? I wouldn’t want to give anyone the impression that I’m cynical about AI.

Let’s skip straight to one of the bigger announcements - Microsoft Scout.

• Microsoft Scout Explained: How always-on, autonomous agents are redefining the future of AI

• Microsoft Scout and the Agentic Upgrade Coming to Teams and M365

Like many of the recent announcements from Microsoft about agents, though, the real question is how much is this going to cost?

That’s the unanswerable question for many of us.

Scout seems to be based on a Copilot for M365 license, a Github Copilot license, and usage costs.

I suspect there are a lot of organizations with no idea how to budget for AI token usage. They are still trying to figure out exactly what people use it for, and now we are being asked to predict exactly how much usage it will get for the next year, while it also change multiple times during that same year?

Good luck with that.

Leave a comment

Copilot News:

Of course, Scout wasn’t the only Copilot news:

They changed the interface, again - Introducing a new design for Microsoft 365 Copilot

I wrote about memories a couple of weeks ago so I was interested in this as well:

Intranet from the Trenches

Complete Guide to Microsoft 365 Copilot Memory for Admins and Users

Reading this article will give you a clear understanding of what Memory in Microsoft 365 Copilot really means, how it works today from both user and admin perspectives, practical ways to interact with it, and the governance controls we need in the trenches to keep things secure and aligned with company needs…

Read more

a month ago · 1 like · Jaime López

They never released the item from the Roadmap but you can create a psuedo version - Copilot prompt libraries for your tenant.

This seems interesting. Has anyone built a skill yet?

The New Way to Automate Without Power Automate: Skills in AI in SharePoint

Non-Copilot News:

Well, this would be the not specifically about Copilot Security and DLP section of the newsletter anyway:

• How To Govern Shadow AI Using Microsoft Purview, Defender And DSPM

• DLP and Sensitivity Labels for SMBs: A Practical Copilot Readiness Playbook

• Deploy Microsoft Purview DLP For Copilot Security

• Microsoft Purview data governance best practices

• Microsoft Extends Purview With Visibility and Control of Anthropic Claude

Of course, not everything is AI, there are always other security risks in the M365 environment:

• FBI warns Kali365 phishing kit is stealing Microsoft OAuth tokens at scale

This might impact some of your applications - Outlook Calendar Sharing Moves from MAPI to REST

Intune and CAP can be difficult to get right. I’ve seen the struggle. - Intune compliance policies + Conditional Access integration.

That’s it for what I’ve been reading and bookmarking over the last month. I’m taking an honest-to-goodness vacation next week, but I will be back in your inboxes with more M365 testing results in a couple of weeks.

I’ve been investigating some of the new Copilot features for the blog and my day job recently, and I came across something I've been wondering about in the eDiscovery space.

Copilot Cowork is the new Frontier agent that is Microsoft’s answer to Claude Cowork, in that it can create and send emails on your behalf, write summaries or meeting recaps, and create documents or even set up follow-up meetings.

I have tried doing a few basic tests with it, things like asking it to make suggestions for managing my calendar next week, where it went ahead and offered to block off time for me to finish up some tasks at the end of the week, and suggesting which meetings I could most likely skip. (Spoiler alert - while I understood the reasoning, it was a meeting scheduled by my boss, so maybe not.)

One thing I found a little interesting, though, was that the interaction with the agent did not follow the typical pattern of every other agent in the Copilot environment.

Typically, the prompt and response would appear in the user's mailbox as a Copilot Activity, but in this case, they did not. The email was in the mailbox twice, once as a sent item and then again in the inbox, because Cowork used my email account to send it to myself.

But there was no corresponding Copilot interaction.

Why?

Read more

If you haven’t opened a review set in Purview eDiscovery lately, it might be a good time to take a look. I noticed a couple of new (Preview) tabs a few weeks back and made a note to go take a deeper look at them later.

The Advanced Review Set Explorer caught my eye first.

First, let me state the obvious. I was dumbfounded by the interface. Perhaps because I’m not a huge KQL expert, I didn’t really know what I was looking at.

It’s a little overwhelming.

But the link to learn more about KQL started to help me understand where this could be very powerful in the right hands:

Specifically, it got me thinking of this not as an advanced query builder but as an advanced report writer.

The Advanced review set explorer (preview) in Microsoft Purview eDiscovery lets reviewers run real-time big data analytics on review set content by using a defined subset of Kusto Query Language (KQL). With the Advanced review set explorer (preview), you can query, filter, and visualize review set data directly in the Microsoft Purview portal without modifying the underlying content. Queries run against the full set of indexed items and return either tabular results or chart visualizations.

I was struggling to consider how much more advanced I would want to get when querying a review set, but when I consider the one thing I hear complaints about the most in Purview eDiscovery - the lack of reporting - I realized that this may be Microsoft’s answer to that common complaint.

It’s only a partial answer though.

Let’s take a pretty simple example from the documentation. This query:

ReviewSetTable

| where SubjectTitle has “Day”

| mv-expand Participants

| summarize count() by tostring(Participants)

This runs a query for the word “Day” in the title of the items. In my test I collected a mailbox so it’s most emails. Then, it reports on the count of participants among those query results. This would be a nice little reporting tool to analyze search results.

Or, at least it would be a nice little report if you could export the list that appears in the interface in response to the query:

As it stands, you can see the count of each participant, but sharing it with any one outside of this interface seems to be impossible.

There are commands to render it as a barchart or piechart but those also render in the same interface with no apparent export option.

Maybe once this comes out of preview, this will be an actual reporting tool with the option to export these reports?

Has anyone heard any information on whether that is in the plan?

Leave a comment

The other tab, the Dashboard preview, seems to be a better interface for simple reporting and charts than the current one that displays under the Analytics menu.

This one is easier to read and has more information, but still suffers from the same limitation - it only exists in the eDiscovery interface.

In short, kudos to Microsoft for trying to provide more insight into the data collected in a review set, but don’t rest on your laurels yet, most lawyers aren’t getting in here to look at this analytics, we need a way to get them out!

Well, this is embarrassing.

I tested Copilot memories a while back and concluded that they were not stored in Exchange or collectible in any way, because my collection of Copilot interactions from a mailbox didn’t turn up any.

You enter them as a prompt in Copilot that begins with the magic phrase “Remember that.” Why would I think they were anything but a Copilot prompt?

Turns out, that’s not what they are.

This post showed me something I hadn’t considered, because, frankly, who comes up with these things?

Copilot Memories (personalized saved information Copilot “remembers”)

Exchange Online: Hidden CopilotMemory subfolder within the user’s mailbox contacts. Stored as contact entries separate from prompts and responses.

IPM.Contact

Each memory item appears as a contact card within Exchange, which is distinct from the message-based item classes used for prompts/responses.

1. Add the user’s Exchange mailbox as a data source to the search.

2. In the condition builder you can optionally filter the search to only return Contacts by adding a condition of “Item class contains any of Contacts”.

Notes:

· Copilot memories will not be preserved under a legal hold or retention policy.

· This will return both Copilot memories stored in contacts as well as traditional contacts from the user’s Exchange mailbox.

This seems bizarre to me. So much so that I complained about it to my wife, who has worked in various fund-raising capactities. She had a different take - memories are contact reports on yourself, the way you’d enter a contact report in Salesforce ot some other CRM.

That tracks with what is stored in the mailbox.

It also anwsers the question about whether a retention policy would impact memories. No, because they are not Copilot interactions. They are contact reports.

To really see what Copilot is remembering, capturing these contacts in a Review Set, is helpful. See how in the chart, above.

Read more

A frequent point I make about M365 tools is that they might not always be the best of breed, but since you’ve already bought them to use Exchange, they are often good enough given the price point of a different tool.

Not always, but often.

That’s why this comparison of Claude and Microsoft’s Cowork agents made me chuckle:

Claude Cowork vs Copilot Cowork: why the Microsoft answer wins for SMB

Claude Cowork lives on your desktop. You mount a folder, drop your files in, and Claude runs in a sandbox on your machine. It doesn’t see your inbox. It doesn’t see your calendar. It doesn’t see your Teams chats unless you’ve copy-pasted them in. You bring the data to the model.

Copilot Cowork is the inverse. It already lives inside Microsoft 365, grounded in your Outlook, Teams, SharePoint, OneDrive, and calendar through Work IQ. You don’t mount anything. The model is already where your data lives.

I kind of agree, Copilot might not be the first choice of AI tools, but it is already connected to all your stuff, and the interactions live inside the tenant. That’s a lot when you’re trying to just do stuff with AI related to your work, which already lives in your tenant. Is it enough for every small-to-mid-sized business? I don’t know, but it will be enough for many of them.

Subscribe now

Copilot News:

More info on Cowork - Copilot Cowork: From conversation to action across skills, integrations, and devices.

I haven’t seen this agent yet, but I’ll be interested to test it out when I do - Microsoft Legal Agent: Why Playbooks Beat Prompts for Real AI Workflows.

Speaking of agents - Microsoft Agent 365 Hits General Availability With Local AI Agent Controls.

More model choice - Available today: GPT-5.5 Instant in Microsoft 365 Copilot

An interesting question:

Intranet from the Trenches

Does Copilot Need Claude to Provide Good Answers?

Hello, guys…

Read more

2 months ago · 1 like · 1 comment · Jaime López

Finally, some learning material - Microsoft 365 Copilot app learning series: Real‑world scenarios for your workday.

Under the not entirely non-Copilot section:

• If You Manage Entra Permissions, Watch This Before Deploying Agents

• DLP Policy for Copilot Can Block Web Searches

• Operationalising Responsible AI: What Microsoft Purview Actually Enables and How to Use It Well

Non-Copilot News:

Is anyone going to miss this?

Together Mode for Teams Meetings to Retire in June 2026

This has been all over the news recently, and I’ve seen a number of them across our industry, too:

Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook.

Prepare yourselves.

I’m hopeful that this is as easy for users as Alerts were. We’ll see. - The New SharePoint Workflows Button.

Worth a read - Microsoft Purview Data Loss Prevention Diagnostics Explained

I cannot handle that they named this series of articles about updates to Defender and Security In the Loop, when there’s an actual product called Loop that is not related to this at all.

Please make it stop.

That’s all for this month’s roundup. What new stuff are you most excited about?

Leave a comment

I was recently working on an outline for an upcoming presentation I’m going to be doing, and realized that I hadn’t created a case in eDiscovery without checking the checkbox for using Premium features in a very long time.

There was a time when, if I had a question about what you could do with an e3 license versus an e5, I would go look in Standard eDiscovery, but that’s been gone a long time, so instead I created a new case and unchecked the box to block myself from using Premium features.

I quickly created a new search and let it show me the statistics, which don’t change at all when this checkbox is disabled.

Naturally, the button to add the results to a review set was grayed out. I expected that. Review Sets have always been a Premium feature.

I hadn’t looked at the options available on the Export, though, and that’s where you really notice the difference.

First, you have fewer options for collecting versions from SharePoint and OneDrive. It’s either the current version or all versions.

Again, that makes sense.

You also have far fewer options for conversations and linked documents.

• No list attachments.

• No collecting the conversation

• No HTML transcripts

• No cloud attachments.

This may seem a bit painful, but it also makes sense. All of these tools process the data when it is added to the review set. Without a review set, processing of those links and related data doesn’t occur.

It can also mean things are quite difficult for an eDiscovery professional.

Read more

If you follow Microsoft news closely, you may have seen this new online feature for Word, Excel, and PowerPoint that lets you “Publish to Web.”

When I first heard about it, I assumed it was an easy button for taking a document that you were working on locally and sharing a copy, a published version, if you will, to OneDrive.

It turns out that’s not it at all.

https://support.microsoft.com/en-us/office/how-to-publish-to-web-in-microsoft-excel-word-or-powerpoint-9a7fb15e-f0bd-430f-85c1-054cb4826f5d

It actually only applies to documents in SharePoint. Which seemed weird. I would have assumed to copy a document to OneDrive, but my view may be influenced by the fact that I tend not to think of SharePoint as a public space like the internet. In my world, you use SharePoint to collaborate with internal and external parties. If you want to share a document for collaboration, it’s just as easy to use OneDrive, but it’s never shared with everyone.

However, as I went through the steps to see what happened when I used the feature, a use case began to take shape.

So, what does the feature do?

To test it, I opened a document online and went to the File → Share menu, where I found the option.

I tried this in Excel and Word, and after publishing, my immediate question was, " What did I create, and where is it?

I stumbled around a bit before realizing that this process had created a PDF version of each document that I “published” to the Web.

But, the PDF didn’t exist in the same Document Library; it was saved to the SiteAssets location:

I also realized that if you went back to the original document and tried to publish to the web again, you could either unpublish or republish, but you could not publish another version, which did make my little Info Governance heart happy.

That was when the use case hit me, because it’s something I do all the time with documentation. You have a Word document or PowerPoint, but you share the PDF version to prevent anyone from making changes or using it as their own.

This is that, with one click.

As far as the eDiscovery issues, it is another copy of the same document, in another location, but as I mentioned, it’s only one copy, and this is something most of us do all the time, so I don’t see it as being any worse than emailing multiple copies and updates 15 times while working on a document.

If anything, this is a little neater. You have your working, living document and the latest published version on the same SharePoint site.

Now, could Microsoft give us something similar for OneDrive or to use across SharePoint sites? That would be something.

Have you looked at using this? Does it seem useful in your workflow, or would making it more widely available make it even better for you?

Share Mike McBride on M365

I kid.

Also, it’s 81 today. Tomorrow it may be higher or lower. Things change quickly across the Microsoft universe. Details below.

Copilot News:

If you haven’t seen some of the updates coming or already here, here are some links for you:

• Copilot Cowork: Now available in Frontier

• Microsoft Copilot adds a multi-model AI research system

• Worth Reading - Microsoft backtracks on Copilot Chat access in M365 apps

• Planner Agent Delivers AI Help for Tasks

• Bringing AI assistance to basic plans in Microsoft Planner

• Copilot in Outlook: New agentic experiences for email and calendar

I also came across these two use cases that might be of interest. The first is targeted for my friends in the legal world:

Copilot Notebooks: Save Billable Hours

The second is for everyone dealing with filing expenses:

Researcher Agent: Extract Receipts Data

Have you heard someone talk about WorkIQ? I bet you have. - A closer look at Work IQ

Finally, just because I’m impressed that someone did this, and I mentioned it in the subtitle:

How many products does Microsoft have named ‘Copilot’?

The count is at 81 as of the time I’m writing this. EIGHTY - FREAKING - ONE!

And counting….

Non-Copilot News:

Before we get completely away from Copilot, this is related - Secure agentic AI for your Frontier Transformation

Here are some thorough references for you:

The Ultimate Guide to Data Governance with Microsoft Purview

GRC in a Nutshell – And How Microsoft 365 Actually Makes It Practical

This seems like an important thing to know: Company-wide sharing links have expiration limits in SPO.

For your next Purview presentation deck - Microsoft Purview Referential Architecture Diagrams

I might attempt something similar when I get some time:

I’ve been part of a massive rollout at work this week. The number of times I’ve been interrupted by urgent Teams messages while trying to communicate information in a Teams chat has been incalculable. This might have become my favorite new Teams feature, if you missed it a few weeks ago:

This wording seems excessive, but it’s pretty clear what they thought of M365 - GCC High - Federal cyber experts called Microsoft’s cloud a “pile of shit,” approved it anyway.

The fact that it got approved anyway seems like an accurate metaphor for the government and tech industry in 2026.

It also seems like the perfect place to end this issue.

What new stuff have you got your eyes on

Leave a comment

?

Maybe you’re normal, and you don’t see a new feature like chat inside of a Planner task and immediately wonder where that data lives and if it’s discoverable.

We all know by now that I’m not wired like that.

I saw it and had to test it. So, when I created a couple of messages in the task chat for a given Planner task, could I find them?

The short answer is yes. They exist in the Exchange mailbox substrate of the group where the plan is shared. The longer answer is that there might also be other data available if you @-mention another user, because that will create an email notification. This is similar to the email notification you would get when someone else assigns a task to you, versus when you assign it yourself.

This likely doesn’t surprise many of you, but if you’re interested in the details, here you go:

Read more

Have you seen this feature in your tenant yet?

Microsoft Teams Finally Makes Draft Messages Easy to Find

If you have, you may have noticed that if you start typing a message in Teams, get distracted, click on a different chat, go to a meeting chat, and hours later remember that you started typing a Teams message somewhere, you can easily find it in the Quick View Drafts location.

It works really well.

It’s simple.

I am very happy about it.

Of course, new data also gives me another newsletter topic! The question is, where are those drafts? Is it like email, where we can collect them from a “Draft” folder in the mailbox? (Or the Teams equivalent of such a folder in the same Substrate area where Teams messages are stored?)

Not so much.

They may, in fact, be saved locally in the Teams app and not accessible for eDiscovery at all. Maybe that’s not a big deal, but if you’re expecting draft Teams messages to show up in the same way that draft email messages show up, you’re going to be disappointed.

Let’s look at the details:

Read more

First off, let me put this out there. I do not see the option to share a Loop page with external users in every tenant I have access to, but I do see it in one.

Most tenants show me a screen that permits me to share with anyone inside the organization when I try to share from Loop:

But this one shows me the option to share inside or outside of my tenant.

This is a feature that I find interesting. One, because external collaboration is the final frontier for Loop adoption. Every time I’ve talked about Loop or given a demonstration of the tool, it’s one of the first questions: “Can I share with people outside of my tenant?”

The answer has been no for a long time. That’s changing. This is exciting.

It’s also a little scary because the most interesting thing about Loop is how easy it is to use Loop without knowing you’re using it. For example, with Teams meeting agendas.

As of now, the agenda/Notes from a Teams meeting are shared with all internal participants, but outside folks can’t see them. I know a few people who depend on it working that way. They keep notes or use Copilot Facilitator to take notes that shouldn’t be seen by the external parties in the meeting.

That was the test I wanted to run first: are external users now getting access to the notes/agenda from a Teams meeting? The answer seemed to be yes, sort of. My external user didn’t see them in the Meeting, but they did have access if they had a link to access them outside the meeting.

It all felt a little unfinished. Honestly, I think it may change as this moves through the preview process into production.

Here are the details of the testing:

Read more

Copilot News:

The big news -

Microsoft 365 E7: A New Agent-Centered Subscription Plan Expected Soon

What do you think about this? Does it make sense for most users to move to E7? I’m not sold that it’s going to move the needle. If we consider the potential to price E5 + Copilot at $90/month, but this new e7 is reportedly $99/month, is there value for the average user here?

Microsoft published more information yesterday - There is a lot to digest. https://blogs.microsoft.com/blog/2026/03/09/introducing-the-first-frontier-suite-built-on-intelligence-trust/

From the blog:

Worth Reading - 4 obstacles impede paid Microsoft 365 Copilot adoption

Speaking of knowing the differences, for security and compliance, this is a good resource - INFO: References for Microsoft 365 Copilot & Copilot Chat Security & Privacy.

Other Copilot things:

• New Security Dashboard for AI is Now in Public Preview

• Start here: essential Microsoft Copilot hubs for employees

• How to Deploy Microsoft Copilot Safely Using SharePoint Advanced Management

• AB-900, AB-100, AB-730, AB-731: Making Sense of Microsoft’s New Copilot Certifications

• Copilot can reschedule conflicting events in Outlook

• Copilot Cowork: A new way of getting work done - what kinds of artifacts will this create that become eDiscovery issues?

Non-Copilot News:

I’ll admit, this upcoming change has me concerned. Not because guest accounts are a huge danger, but because many of us use Conditional Access Policies that will break the ability for users to share files from OneDrive and SharePoint without them. It’s going to be a lift to figure out how to reconfigure those. At least, I think it will. I’m not feeling clear about what I’ve read so far.

Guest Accounts Now Used for SPO External Access to Files

Setting aside the not-so-subtle advertising in this post, this is an eDiscovery challenge for many larger organizations:

Managing Multiple eDiscovery Cases in Purview: Where Things Go Wrong

This is a security feature to be aware of with compromised accounts:

Other Microsoft things:

• Microsoft 365 – New SharePoint experience! - I haven’t had it long enough to have an opinion. How about you?

• Planner’s Newly Redesigned Interface

• Microsoft adds powerful image editor to PowerPoint

• Microsoft Is Auto-Enabling Passkeys in March 2026

• Microsoft introduces new security tool for IT admins managing AI infrastructure

• Microsoft delays enterprise Outlook switchover to 2027 - I think we all know that “new” Outlook is not ready for the enterprise. Maybe next year.

That’s what I’ve got for this month. I’m going to be doing some initial testing with Loop components and the new ability to share them externally before the next issue. I’m nervous about whether users will end up sharing Meeting Notes, etc. with external users that used to be internal only. It’s one thing to purposefully copy a Loop link into an external chat, where you mean to share it. It’s quite another to just use the Notes feature in a meeting and not realize that permission changed.

We’ll see if that’s what is happening with it. Loop has always had a tremendous collaborative potential, and that only grows with the ability to share the content externally now. Governance, however, just got a little more complicated, I fear.

Like it always does. ;-)

Before we get lost in the deep recesses of my mind, I wanted to share a small update to my last article about Outlook reactions.

Because this showed up in my email shortly after sending that issue out:

Yes, a daily digest email showing me reactions to my previous-day email messages. I’ve never seen that before. It hasn’t shown up in other environments when someone reacted to my email before, and I’m not sure it reliably exists. But, there it was.

Color me even more confused.

Later this week, I’m presenting to a local group about the many ways users can collaborate in M365, even when they may not even know they’re using the tool. Loop is, of course, the center of the presentation, because it shows up in so many places, even if you never open the Loop app or know it exists.

Every time I give a presentation like this, I’m always thoughtful about the governance side of Loop Workspaces, Pages, and Embedded Containers, because, frankly, it can be a bit overwhelming to consider.

It also reminds me that, during testing, I was able to search for and collect Loop content in the SharePoint embedded space, but only because my tenant is small enough that running a tenant-wide search for a keyword is not unreasonable.

For many of you, running a search like that may be a non-starter. I’ve talked to folks from large orgs with tens of thousands of users who will never run a search like that; thus, content in embedded containers is essentially uncollectable. (Not to mention the need to know what key terms to use with your search to begin with!)

Of course, it’s not just Loop. It’s also the difficulties in collecting Copilot interactions, chat message metadata, shared files across different channel types, linked chat, SharePoint versions, Planner tasks, and audit logs. That list doesn’t even include the various policies that may be in place and impact collection, such as short retention schedules, priority deletions, and other compliance rules.

My point is that collecting data from complex ecosystems like this is a multi-disciplined role. You’re not just the eDiscovery professional, you’re also the technical expert on how all of these tools work and store data, the security expert who identifies who has access to the relevant data, and the information governance expert who understands the lifecycle of data in the environment.

Frankly, that’s asking a lot. I don’t think it's sustainable. What is sustainable is a partnership, working with the people who are experts in those other areas, and with the custodians, to identify where they were working and creating data.

The question I have for small to mid-sized organizations, though, is whether those experts exist. Is there someone who understands where Copilot Pages are stored, where Teams data is stored, or what a Copilot interaction looks like in the Exchange mailbox? What about those custodians? When they say “I saw that in Teams,” do they know the difference between chat, channel posts, a shared file, meeting notes, etc.? Because it matters. Collecting every possible location related to a user in Teams because they can’t tell you where in Teams they saw that super relevant message.

It’s daunting to me to think about how I could build the most exhaustive custodian interview process, connect with every other IT and related expert in my organization, and still not have enough knowledge to properly collect relevant data for litigation.

If it were you, where would you direct them to find that expertise? Who out there is equipped to assist these organizations with eDiscovery collections fully?

And if those resources aren’t realistic, what should the courts consider reasonable?

These are the things I think about. It’s entirely possible that I’m not normal, and now you get to see inside the madness that drives me to do this testing and write this newsletter, because we all need to know more.

If you want to help in this journey, share the newsletter. Also, sign up for the Teams channel and join the conversation there. Let’s build a community that helps folks overcome some of these hurdles!

Share Mike McBride on M365

A few weeks ago, I dug into Outlook reactions since it came up in an email group that I am part of:

Mike McBride on M365

Quick Test - Outlook Reactions

An email hit my inbox a couple of weeks ago from a mailing list dedicated to Information Governance about Outlook reactions, questioning what kind of “record” they might be considered…

Read more

5 months ago · 1 like · Mike McBride

After I posted that, my good friend, Maureen Holland, and I chatted and decided to do some further testing, but it didn’t work. She and I exchanged emails from our respective work accounts and “liked” each other's messages, but those likes never appeared in the sent message.

I made a mental note because when I tested the feature, I was working with two accounts in the same tenant. Maybe it worked differently across tenants.

Before I could set aside time for that testing, I awoke one morning to an actual email notification on my work account: someone external had “loved” the email I'd sent the day before.

Which was weird, given what I saw everywhere else.

This week, I tried to send myself an email across two tenants I have access to that are not owned by the law firm where I work, for obvious reasons, and I got a third set of results.

This time, I could see the reaction, but there was no email notification.

Why were things so different? I don’t know. At first, I theorized that one of the work tenants was blocking reactions from being shared across tenants, but then I got on with someone else. It’s still possible that was the case. But then we get into why, in one set of circumstances, an email notification appeared, while in the other, only a reaction notification appeared in Outlook.

Why, Microsoft, why?

What configuration option is creating this? I don’t believe I’ve changed anything that would block reactions, but then again, I don’t recall ever seeing an option like that documented. Is this a result of another option I’ve misinterpreted as something else, or is it pulling this in with that option?

I’m not sure, but it creates an interesting collection problem. I’m not sure you can count on capturing reactions as things stand. It’s too confusing.

Speaking of reactions, another thought occurred to me while I was thinking so much about reactions. For Teams, the reaction is “burned in”, for lack of a better term, when the HTML transcript is created using that option in the Review Set. What happens if you don’t choose that option?

More confusion.

Read more

Case in point:

Microsoft 365: Change Meeting Organizer via PowerShell Cmdlet in Exchange Online

Allows the administrator of an Exchange Online tenant to change the organizer of an existing meeting or meeting series via a PowerShell cmdlet. This can be used, for example, to maintain continuity and history of a long-running meeting series in cases where the meeting organizer has a new role, is on leave, or during the offboarding process. Once the meeting is transferred, the new organizer will be able to maintain all properties of the event including meeting time and recurrence, attendees, and description. Meeting attendees within the Exchange Online tenant will not need to re-RSVP and the existing event on their calendar will be silently updated with the new meeting organizer information.A subsequent feature will enable users to to change the organizer via Modern Calendar in OWA, New Outlook, and Teams. For user-initiated transfers the new organizer must accept the meeting before the transfer completes.

GA date: May CY2026

How many meeting series have had to be erased and recreated when someone on your team left the organization? IYKYK. 😏

Copilot News:

Here’s a resource you may want to keep handy:

Deploying Microsoft 365 Copilot in five chapters

This is true, it’ll find stuff you didn’t know you had access to:

The 365 Edge

Copilot Won’t Fix Your M365—It Will Expose It: 8 Pre-Go-Live Repairs for IT Leaders

“Copilot only accesses data that an individual user is authorized to access… Copilot can’t access data that the user doesn’t have permission to access…

Read more

5 months ago · Brad Holt

File both of these under “But how well do they work” for now:

• Create Agents in One-Click from your OneDrive

• Introducing M365 Copilot Agents in Office Apps

I like the idea of blocking individual SharePoint sites from Copilot. I haven’t been able to get it to work yet, but I’m troubleshooting. Has anyone else had a similar issue where you change the setting, but Copilot and Search still locate the documents anyway?

Non-Copilot News:

There were a number of educational articles about both existing and new features, especially in Purview, that I have seen over the last few weeks:

• Ediscovery for Teams Chat: The Complete Guide

• Deploying Purview Data Loss Prevention for Microsoft 365

• Protect your Sensitive Information in Remote Desktop Sessions

• Purview Auto-apply Retention Labels and SharePoint Autofill

• General Availability of Microsoft Purview eDiscovery Graph API for E3 Customers

This is a very interesting idea - a snapshot of your tenant configuration that you could rollback to?

Entra.News - Your weekly dose of Microsoft Entra

Automating Governance: The New Standard for Microsoft 365 Tenant Snapshots and Remediation

Governance in Microsoft 365 has always been hard. Not because the tools didn’t exist, but because scale, complexity, and change made consistency almost impossible. As tenants grow, so do the challenges of configuration drift, manual admin changes, and inconsistent environments…

Listen now

5 months ago · 8 likes · Merill Fernando

This is also interesting. Viva Engage is one of those tools I occasionally look at with interest because its functionality isn't exactly the same as Teams', but it’s similar enough that I'm fairly certain I won’t be able to get users to use both. But what happens when communities can show up in Teams in the same Chat tab?

Introducing communities in Teams: Unifying company communication and connection

Also, pay attention to this:

EdTech IRL

M365 Compromised Account Triage: OAuth Persistence

I’ve been working on an article on what I do when I encounter a potentially compromised account in Microsoft 365. It’s one I’ve stopped and started several times over the past year, and one of the main reasons for stoppage is because when I got to the Refresh Token section, it kept growing and growing. So, I’ve decided to pull it out into it’s own artic…

Read more

5 months ago · 2 likes · 1 comment · Andy Lombardo

What M365 news is catching your attention this month?

Leave a comment

Would you be interested in meeting via a Teams channel to discuss M365, eDiscovery, and related topics with other subscribers? Perhaps even schedule some chats from time to time? (Paid subscribers, I’ve got some ideas just for you as well.) If you are interested, sign up here. Our small, but merry, band is starting up today. Will you join us?

Before I get into this, I had a handful of people sign up. Not many, but I’m going to send invites this week to the brave few who want to start this and see how it goes. Do you wish to join us?

Would you be interested in meeting via a Teams channel to discuss M365, eDiscovery, and related topics with other subscribers? Perhaps even schedule some chats on occasion? (Paid subscribers, I’ve got some ideas just for you as well.) If you are interested, sign up here. If there’s enough interest, we will definitely get this going in the next few weeks.)

Leave a comment

My eDiscovery Spidey sense started tingling when I saw a reference to this Message Center item:

Microsoft Teams: Automatic removal of EXIF data from shared images

Summary

Microsoft Teams will automatically remove EXIF metadata from images shared in chats and channels starting early 2026, enhancing privacy by hiding location and device info. The image itself remains unchanged, no admin action is needed, and users can share EXIF data via OneDrive links if required.

Is this summary helpful?

Introduction

Microsoft Teams will soon automatically remove hidden metadata (EXIF) from images shared in chats and channels. This helps protect sensitive details such as photo location and device information from being shared without user awareness, improving privacy and security.

This message applies to Teams for Windows desktop, Teams for Mac desktop, and Teams for the web and is associated with Microsoft 365 Roadmap ID 542795.

When this will happen:

• Targeted Release: Rollout begins in late January 2026 and completes by early February 2026.

• Worldwide and GCC: Rollout begins in mid-February 2026 and completes by early March 2026.

• GCC High: Rollout begins in late February 2026 and completes by mid-March 2026.

• DoD: Rollout begins in early March 2026 and completes by late March 2026.

How this affects your organization:

• Who is affected: All users sharing images in Microsoft Teams chats and channels.

• What will happen:

  • EXIF metadata (e.g., GPS location, camera model, manufacturer info) will be automatically removed from images shared in Teams conversations.

  • The visible image content remains unchanged.

  • No admin action is required; this feature is enabled by default.

  • If users need to retain EXIF data, they can upload images to OneDrive and share a link via Teams.

What you can do to prepare:

• Inform end users, security, and compliance stakeholders that EXIF data will no longer be available in Teams-shared images.

• Update internal documentation or training that references sharing metadata via images.

• Review workflows, diagnostics, or integrations that rely on EXIF data and plan alternatives.

Compliance considerations:

No compliance considerations identified, review as appropriate for your organization.

From a security and privacy perspective, I think this is a good idea. There’s no reason not to protect users from themselves when it comes to photo data they may not be aware of.

On the eDiscovery side, I couldn’t help but wonder how often EXIF data comes into play. I can think of only a handful of cases where the location and time of a photo were relevant, but when they were, they were highly relevant. I’ve worked with enough forensic examiners to know how important this is when doing cell phone examinations.

But much of that is from cell phone data, not from photos shared in Teams. It might not be a major issue, but it may be worth starting a conversation with legal teams.

What about you? Has EXIF data been an issue worth worrying about? Will you miss it when collecting data from Teams?

An email hit my inbox a couple of weeks ago from a mailing list dedicated to Information Governance about Outlook reactions, questioning what kind of “record” they might be considered.

I had previously tested reactions in Teams but hadn’t given much thought to what the eDiscovery tools would do when someone clicked “like” on an email in Outlook. So, I sent my demo user an email and used that account to click “like".

Then I collected the email and looked for any indication that someone had liked it.

It was obvious, looking at the Source document in the review set, that the like was noted in the ReactionsSummary section of the email header:

What was a little more complicated was the metadata, because there was no indication that any reactions existed in the metadata visible in the review set.

There was no metadata item for ReactionsSummary in the review set or in the export item list.

That was only the first complication. The second came from exports. I exported the message as a .msg file and then opened it in Outlook. The like appeared in the message; however, there was a catch.

My Outlook was connected to the M365 tenant when I opened the exported MSG file. When I moved over to a different machine where Outlook did not have my tenant account set up and opened the email, the reaction was not visible.

I assume it needs a connection to the Graph API to read and display reactions; once the message is removed from that connection, they are no longer available.

I imagine this would mean the data is lost when exported from M365 to a PST and then ingested into a review platform, but without a review platform available, I can’t confirm that.

Does anyone else want to do that test and let us know? I would imagine it is possible that a different eDiscovery processing tool may extract the metadata that Microsoft does not. I’ve seen that before, when Teams first introduced reactions. There was a long JSON metadata field in the Exchange item that showed the reactions, but that field wasn’t available in the M365 exports; you needed access to the original PST export from Exchange and some sophisticated processing tools. (In our case, Nuix.)

My assumption is also based on what happens when we export Teams messages where the reactions are added to the HTML file:

This doesn’t appear to happen with the email reactions, though, while reviewing it in the M365 environment, they are displayed.

The only workaround would be to download a PDF version of each relevant reaction whenever a reaction is relevant to the case. That won’t scale well, and it will create an issue tying the PDF back to the correct message metadata. Yuck.

Leave a comment

Latest posts on the Blog:

• The New Teams Calendar is Coming – Complete with a bug with Loop agendas

• Worth Reading – Nobody knows how large software products work

• Worth Reading – How to Prevent Microsoft Teams Sprawl

• Worth Reading – Carvana and the New Hyperlink Fight: “Contemporaneous” Isn’t Automatic—It’s Earned

• Any interest in chatting about M365 and eDiscovery?