September was a patch-and-govern month more than a features month. The headline item is a SharePoint Server security update that on-prem admins need to act on now, not a splashy new capability. Around it, Microsoft kept tightening the screws on Copilot governance (connector management, agent approval, cost tracking), extended Purview’s data protection reach into non-Microsoft apps, and gave Intune admins a few quality-of-life upgrades for managing device fleets across tenants. There’s also a Power Apps price change worth flagging to clients now so it doesn’t surprise anyone at renewal. Here’s what’s worth your attention this month.
Intune
Unattended Remote Help sessions for Windows devices (week of August 25)
Intune now supports unattended Remote Help sessions on physical Windows devices, letting an authorized helpdesk agent sign in and take control of a device without the end user being present or needing to approve anything. For MSPs running after-hours support or handling devices whose users are out of office, this closes a real gap: previously you needed someone at the keyboard to accept the session, which meant after-hours fixes often had to wait until morning.
A redesigned single device page in the Intune admin center (week of August 25)
Microsoft rolled out a new single device page, enabled by default for all customers, that consolidates device properties, hardware and OS details, remote actions, and remediation status into one view instead of scattering them across tabs. If you manage devices across dozens of client tenants, this is the kind of change that shaves real minutes off every support ticket; a toggle lets you revert to the old layout if your team needs time to adjust.
Operating system version filtering for assignments is now generally available (week of August 25)
The operatingSystemVersion property in assignment filters has moved from preview to general availability, so you can scope app and policy assignments to devices running a specific OS version or build range using the rule editor. That makes staged rollouts, like testing a policy on a newer build before pushing it tenant-wide, something you can standardize across every client instead of managing by hand.
Audit mode for Microsoft Defender Antivirus on Linux (week of August 25)
A new Audit setting in the Defender Antivirus template for Linux lets the antivirus engine detect and report threats without automatically quarantining files. That gives you visibility into what Defender would catch on a client’s Linux endpoints before you flip on full enforcement, which is useful groundwork if you’re extending Defender coverage to servers or workstations that historically ran a different AV product.
Entra ID
No updates worth noting this month.
Defender
No updates worth noting this month.
Licensing
Power Apps Premium pricing increases starting January 1, 2027
Microsoft confirmed that both Power Apps Premium plans, the standard Premium plan and the 2,000-seat-minimum Premium plan, will increase by $2 USD per user per month effective January 1, 2027, moving from $20 to $22 and $12 to $14 respectively. It’s the first list price increase on these plans in more than five years, and it only touches those two SKUs; every other Power Apps and Power Platform product stays at current pricing. Existing subscriptions keep their current rate through the end of their term, so if you have clients renewing in the new year, this is worth flagging now while you’re building their budget rather than explaining it after the invoice lands.
Purview
Data loss prevention now covers non-Microsoft connected apps (preview)
Purview DLP policies can now protect sensitive data at rest in non-Microsoft apps like Box and Google Workspace, using the same Defender for Cloud Apps connectors and classification engine already available for Microsoft 365 locations. For clients running a mixed environment where not everything lives in SharePoint or OneDrive, this closes a coverage gap you’d otherwise have to explain away.
Simulation mode for auto-labeling policies
Before turning on an auto-labeling policy, you can now run it in simulation mode to see which items it would label without actually labeling anything, then review match results and source distribution through a new Insights tab to judge whether the policy is ready for enforcement. That’s a meaningfully lower-risk way to roll out sensitivity labeling for a client, since you can catch a misconfigured policy before it starts relabeling files across their tenant.
Teams
No updates worth noting this month.
Copilot
Copilot-generated files now inherit sensitivity labels (rolled out through the summer)
When Copilot generates a file, it now automatically applies the highest sensitivity label found in the source data it drew from, and flags the user if a label can’t be applied. This closes a data-governance hole that’s easy to miss: without it, a document Copilot generates from labeled, restricted source content could go out unlabeled and unprotected.
Federated Copilot Connectors can now be managed from the M365 admin center
Admins can deploy and manage Federated Copilot Connectors, which use the Model Context Protocol to reach external data sources under the end user’s own permissions, directly from the Connectors tab in the Microsoft 365 admin center. That puts both indexed and federated data connections under one governance view instead of splitting connector oversight across tools, which matters once a client has more than a handful of Copilot connectors in play.
Admin approval required before agents reach the org-wide Agent Store
Agents built in Agent Builder can now be submitted to the Agent Store’s “Built by your org” section, but only after an admin reviews and approves them. Rather than letting anyone in the tenant publish a custom agent for the whole org to find, this gives you a checkpoint to catch a poorly scoped or over-permissioned agent before it spreads, which is exactly the kind of control worth confirming is turned on for every client tenant you manage.
A new dashboard tracks Copilot credit usage and cost
Viva Insights added a Consumption Dashboard that shows Copilot credit usage across AI services like Cowork and the Work IQ API, scoped to managers with at least five direct reports, insights analysts, and global admins. If you’re fielding “how much is Copilot actually costing us” questions from clients, this gives you a native answer instead of having to build one yourself, though it does require usage-based billing to already be set up through Cost Management.
Outlook
No updates worth noting this month.
OneDrive & SharePoint
Critical SharePoint Server security update patches 17 vulnerabilities (KB5002908, September 8)
Microsoft released KB5002908 for SharePoint Server Subscription Edition, bringing it to build 16.0.20326.20136 and closing 17 CVEs spanning information disclosure, remote code execution, spoofing, and elevation of privilege, including CVE-2026-69465, CVE-2026-69690, and CVE-2026-69724. If any client is still running SharePoint Workflow Manager, KB5002799 has to go in first, and Classic Workflow Manager needs a PowerShell debug flag enabled to keep functioning after the update. The same release also disables the GetDataFromDataSourceControl SOAP feature and deprecates ExecuteProxyUpdates, SharePoint 2010 Workflow, and the ToolPane feature, so it’s worth checking whether any client’s customizations lean on those before you push the patch. For every on-prem SharePoint Server client you support, this is the one item this month that belongs at the top of your patch queue rather than the bottom.
The bottom line
Nothing in September was a headline feature, but the pattern underneath is worth noticing: Microsoft keeps tightening governance around the parts of the M365 stack that scale fastest and are hardest to keep an eye on across tenants, Copilot connectors, agent publishing, AI cost, and non-Microsoft data at rest. Layer the SharePoint Server patch on top of that and September is really a month about making sure the controls you already have in place are actually configured the way you think they are, across every tenant you manage, not just the ones you checked most recently.
If you’d rather not chase these changes down tenant by tenant, start a free trial of Augmentt and see what a single view across every client’s M365 environment looks like.
Photo credit: Tyler on Unsplash
FAQ
What is KB5002908 and who needs to install it?
KB5002908 is a September 8, 2026 security update for SharePoint Server Subscription Edition that resolves 17 vulnerabilities, including remote code execution and elevation of privilege issues. Any organization running an on-prem SharePoint Server Subscription Edition deployment should apply it, and those using SharePoint Workflow Manager need to install the prerequisite KB5002799 first.
Is the Power Apps Premium price increase retroactive for existing subscriptions?
No. Existing subscriptions keep their current pricing through the end of their current term. The $2 per user, per month increase only applies to new purchases and renewals starting January 1, 2027.
Does Purview DLP now protect data stored outside Microsoft 365?
Yes, in preview. Purview DLP policies can now be applied to sensitive data at rest in non-Microsoft connected apps such as Box and Google Workspace, using the existing Defender for Cloud Apps connectors and classification engine.
Do Copilot-generated files automatically get protected with sensitivity labels?
Yes. Microsoft 365 Copilot now applies the highest sensitivity label found in the source content it used to generate a file, and notifies the user if a label couldn’t be applied so it can be corrected manually.
Can any employee publish a custom Copilot agent for the whole organization to use?
No. Agents submitted from Agent Builder to the organization-wide Agent Store now require admin review and approval before they appear under “Built by your org,” giving admins a checkpoint against unapproved or over-permissioned agents.
What does the new Consumption Dashboard in Viva Insights show?
It tracks Copilot credit usage across AI services like Cowork and the Work IQ API, giving managers with at least five direct reports, insights analysts, and global admins visibility into AI usage and cost. It requires usage-based billing to already be configured through Cost Management in the admin center.
Is the new single device page in Intune optional?
It’s enabled by default for all customers as of late August 2026, but a “Preview new device view” toggle lets admins switch back to the previous device page layout if needed.
