The October 2026 Entra release brings device signals into Universal Continuous Access Evaluation (CAE) for Global Secure Access and adds mTLS proof-of-possession token binding for workloads. A guided migration utility shifts Entra Connect Sync to Cloud Sync, and Microsoft-managed certificates let you run TLS inspection without operating your own PKI. Additional updates touch token protection device registration, ServiceNow access requests, B2B guest access, and SAP SuccessFactors provisioning. Microsoft now buckets announcements under "outcomes" like "trusted and resilient," which rarely explains what each capability actually does, so the following sections stick to the technical substance in the docs.

Source

Microsoft has shipped fresh Windows 11 Insider Preview builds to the Beta and Experimental channels, covering the 26H1 and Future Platforms tracks. On Experimental, Windows Search has been rebuilt on WinUI 3 and adds inline actions so you can change system settings straight from the search box. Beta picks up Cloud rebuild, a WinRE recovery path that reinstalls Windows from Windows Update. The Experimental channel also enables IAKerb by default to reduce NTLM fallback. Widgets, Task Manager, Narrator, and File Explorer see smaller updates.

Source

Microsoft made sending from email aliases generally available for Exchange Online on 7 October 2026, after a public preview that began in January 2022. An alias, also called a proxy address, is an extra SMTP address on the same mailbox. With the organization setting enabled, Exchange Online keeps that alias as the sender instead of rewriting outbound mail to the primary SMTP address. The setting stays off until you enable it for the tenant, and it applies only to mailboxes hosted in Exchange Online. Client, hybrid, and compliance limits still apply.

Source

Microsoft Execution Containers (MXC) are generally available as a policy-driven execution layer for untrusted or model-generated workloads, including AI agents, plugins, and tools. You declare the files, network destinations, commands, and desktop access a workload may use, and MXC enforces that boundary on Windows 11, macOS, or Linux. The policy sits outside the workload, so generated code cannot add permissions the policy left out. Intune policy for MXC process containers, and Entra attribution that separates agent activity from the signed-in user, are still described as coming soon. This article covers the Windows backends and the JSON policy.

Source

Microsoft has declared remote PC connections in the Windows app generally available. You can now add physical or virtual Windows PCs by name or IP address and connect to them over Remote Desktop, alongside Windows 365, Azure Virtual Desktop, and Microsoft Dev Box. Windows App is meant to replace the Remote Desktop app. This article covers the setup steps, the prerequisites, and the limitations that Microsoft's announcement does not spell out.

Source

The September 2026 update for Microsoft Sentinel, Microsoft's cloud-based SIEM (security information and event management) platform, includes three items. Case Management is a new public preview in the Microsoft Defender portal for tracking investigations. Defender unified role-based access control (RBAC) custom roles can now be assigned to partner groups through granular delegated admin privileges (GDAP). Codeless connectors in the Sentinel data lake can bring in data from many accounts through a single connector. Microsoft also says the connector catalog now exceeds 500 entries.

Source

Managing and securing endpoints are no longer separate disciplines in the hybrid enterprise. ManageEngine Endpoint Central consolidates both into a single console and a single agent, covering everything from patch deployment to data loss prevention.

Source

The latest Intune updates (service release 2609 and the weeks before it) add deployment plans for staged rollouts of Windows apps and policies, which are in public preview. The new single device page is now the only device view in the admin center. Android Enterprise gets bulk eSIM activation, new settings catalog options, and a Defender for Endpoint step during enrollment. Microsoft Cloud PKI becomes available in the GCC High government cloud. Microsoft's release notes are brief for some items, so this article points out where details are missing.

Source

Microsoft's September 2026 recap for Windows 365 and Azure Virtual Desktop (AVD) lists about two dozen changes. Several of them matter for daily administration: user-initiated provisioning for Windows 365 Reserve, business continuity and disaster recovery settings in Cloud PC configurations, local admin rights in Cloud PC configurations, display protection, TWAIN scanner redirection, and AVD Hybrid. Microsoft's recap is written like a marketing summary, so this article looks at the Microsoft Learn documentation to find out what you must configure and where the limits are. Some features are still in preview.

Source

Windows 11 now includes System Monitor (Sysmon), a tool that logs process creation, network connections, and file creation time changes to the Windows event log. Previously, it was a separate download from Sysinternals. The built-in version is an optional feature that is disabled by default, so you must enable it with PowerShell and install it with the sysmon command. This article explains the prerequisites, the commands, how to apply your own XML configuration, and how to verify that Sysmon writes events.

Source

Microsoft has released the Administrative Templates (ADMX files) and a settings reference spreadsheet for Windows 11 26H2. The templates add 28 new Group Policy settings. They cover taskbar customization, File Explorer behavior, update pausing, Windows Ready Print driver selection, and mounting of ReFS volumes on external drives. This article explains what the templates contain and which new settings are relevant for managed environments.

Source

Microsoft's combined August and September 2026 Teams roundup covers Copilot in conversations, video recaps for meetings, Teams Phone Agent, a new Security Detection Report, and changes for Teams Rooms and Teams Events. Microsoft also announced that the roundup will switch from monthly to quarterly, with the next editions in December, March, and June. This article focuses on the changes that matter to administrators and notes where Microsoft gives few details.

Source

Microsoft released Windows 11 Insider Preview builds 28020.3142 (Beta channel) and 28120.3151 (Experimental channel) for version 26H1 on October 2, 2026. The main change for administrators is the expanded Cloud rebuild recovery option in the Windows Recovery Environment (WinRE). The Experimental build adds drive sanitization and remote control through the Recovery configuration service provider (CSP). Both builds also add precise zoom controls to Magnifier and fix several File Explorer issues.

Source

Microsoft Entra ID can now hand the sign-in step of a federated domain to the system browser on Android, iOS, and managed macOS. This browser authentication for external identity providers lets users sign in to Outlook, Teams, OneDrive, and other brokered Microsoft apps with passkeys or FIDO2 security keys issued by a third-party identity provider (IdP). The feature is off by default, works only for domains federated through WS-Fed or SAML 2.0, and requires a broker app on the device. You enable it per platform with Microsoft Graph or Microsoft Graph PowerShell. This article explains how it works, what you need, and where the documentation is unclear.

Source

Microsoft has published the security baseline for Windows 11, version 26H2. Compared to the 25H2 baseline, it is a small update with only two changed Group Policy settings. One enables Windows Ready Print driver ranking to reduce the print driver attack surface. The other restricts the Internet Explorer TLS setting to TLS 1.2 and TLS 1.3. You can download the package from the Microsoft Security Compliance Toolkit.

Source

Microsoft made WSL containers generally available on September 29, 2026. The feature adds the command-line tool wslc.exe to the Windows Subsystem for Linux (WSL), so you can build and run Linux containers on Windows without Docker Desktop. A container packages an application together with the libraries it needs, so it behaves the same on every machine. Microsoft also added Intune settings and Defender for Endpoint support. This article covers use cases, installation, basic commands, the architecture, the admin controls, and limitations such as missing Compose support.

Source

A neocloud is an AI-focused cloud provider that rents high-performance GPU capacity for training and inference. Training means teaching a model on large datasets, while inference means running the finished model to answer requests. This article compares neoclouds with traditional hyperscalers, lists five popular providers headquartered in the United States and five headquartered in Europe, and explains pricing and how you can use them.

Source

Starting September 23, 2026, Microsoft signs its NuGet packages with a new X.509 author-signing certificate. If you enforce a NuGet client policy with trusted signers in nuget.config or check packages with dotnet nuget verify, package installations can fail with error NU3034 until you add the new certificate fingerprint. This article explains how to find out whether you are affected, where to look for nuget.config files, and how to update your trusted signers and verification scripts. Everyone else can install Microsoft packages as before.

Source

Microsoft has introduced the Integrated Security Operations Center, or ISOC, as a public preview inside the Microsoft Defender portal. It brings selected Microsoft Sentinel functions directly into Defender so analysts and AI agents share the same signals and workflows. The goal is to reduce tool switching and give automation a common data foundation. This preview is limited by licensing, workspace rules, and incomplete integration. The Defender home page introduces these ISOC capabilities alongside cases, workbooks, and automation.

Source