rss.livelink.threads-in-node

Securing AI Agents at Runtime: Real-Time Protection and Threat Detection for Microsoft Agent 365

llevy — Mon, 27 Jul 2026 17:37:49 GMT

Organizations are rapidly adopting AI agents to automate workflows, access enterprise data, invoke tools, and take actions on behalf of users. This autonomy creates a fundamentally new security challenge.

Unlike traditional AI applications, agents operate across dynamic execution flows, interacting with external content, calling tools, and accessing sensitive resources. These interactions create new attack paths that traditional security controls were not designed to address.

Today, we're announcing two major milestones for Security for AI in Microsoft Defender for Microsoft Agent 365:

Threat detection for Microsoft Agent 365 agents — now in public preview.

Real-time protection for Microsoft Agent 365 tooling servers — now generally available.

Together, these capabilities help security teams detect, investigate, and block attacks targeting AI agents, extending Microsoft Defender's threat protection capabilities into the agent runtime.

Threat detection for Microsoft Agent 365 Agents (Public Preview)

Threat detection provides SOC teams with detailed visibility into attacks and suspicious activity targeting AI agents. By analyzing runtime signals across agent interactions, tool usage, and execution patterns, Microsoft Defender identifies suspicious and malicious behavior throughout the agent execution lifecycle and surfaces actionable security alerts for SOC teams.

Threat detection supports cloud agent types that emit observability logs to Microsoft Agent 365, including:

Microsoft Copilot Studio

Microsoft Foundry

Microsoft 365 Copilot Agent Builder

Agents integrated through the Microsoft Agent 365 SDK

This provides consistent threat visibility across supported Microsoft Agent 365 agent experiences, regardless of how the agent was built.

Fig. 1. Microsoft Security for AI alerts in Microsoft Defender XDR (Preview)

Microsoft Defender identifies a broad range of AI-specific threats, including:

Indirect prompt injection (XPIA) — malicious instructions embedded in external content designed to manipulate agent behavior.

Evasion techniques — attempts to bypass agent instructions or security controls.

Malicious content propagation — attempts to use agents to generate or distribute malicious content.

Secret leakage — exposure of credentials, API keys, or other sensitive information through agent interactions.

LLM reconnaissance — attempts to probe agent capabilities, instructions, or security boundaries.

Suspicious IP access — agent access originating from anonymized or suspicious IP addresses.

Alerts are surfaced directly in Microsoft Defender, enabling SOC analysts to investigate and respond using familiar workflows, Advanced Hunting queries, and the Defender XDR investigation experience.

Real-time protection for WorkIQ and Custom MCP servers (General Availability)

Real-time protection moves beyond detection by blocking threats inline when AI agents interact with WorkIQ and custom MCP servers (see Microsoft Agent 365 tooling servers).

When an agent invokes a registered tool or receives a tool response, Defender evaluates the interaction against configured security policies and determines whether to allow or block it directly within the agent's execution flow.

This helps prevent malicious actions and data leakage in real time, without requiring agent developers to implement custom security logic.

Fig. 2. Microsoft Security for AI Real-Time Protection policy in Defender

Real-time protection currently guards against high-impact threats, including:

Evasion techniques — attempts to bypass agent guardrails or security controls.

Malicious content propagation — preventing agents from spreading malicious content through tool actions.

Secret leakage — blocking agents from inadvertently exposing credentials or sensitive data through tool calls.

Communication with untrusted domains — preventing agents from sending email or data to high-risk or untrusted email domains.

Better Together: Detection and Protection

Threat detection and real-time protection address complementary parts of the agent security lifecycle.

Real-time protection provides inline enforcement to block malicious interactions during execution, while threat detection gives SOC teams the visibility and investigation context needed to identify attack patterns, assess impact, and respond to suspicious activity.

Together, they provide a defense-in-depth approach that combines runtime enforcement with SOC-driven detection and investigation, purpose-built for AI agents.

Getting Started

Both capabilities are available through Microsoft Defender, using a dedicated Security for AI workload experience that brings together AI threat detections, investigations, and runtime protection policies.

To learn more:

Enable security for AI agents using Microsoft Defender

Detect and investigate threats to AI agents using Microsoft Defender (Preview)

Protect AI agents in real time using Microsoft Defender

As AI agents become more autonomous and gain access to enterprise data and tools, securing their runtime behavior becomes critical. With Threat Detection and Real-Time Protection, Microsoft Defender helps organizations adopt AI agents with security controls designed for how agents actually operate—detecting attacks, enabling SOC investigation, and blocking malicious interactions at runtime.

AI, Automation & Data Insights with SharePoint, Power Automate, and Excel

NikkiaTCarter1 — Mon, 27 Jul 2026 17:33:16 GMT

Join us for the August edition of Ananse Tech Community, where our speakers will showcase automation, AI, SharePoint, and data analytics.

Check Out Our Featured Sessions!

🔹 Child Flows in Power Automate, Presented by Annan Roberts Jr, SharePoint & Power Platform Developer, Sesa Technology Ltd

Learn how child flows can help standardize business processes, reduce duplication, simplify maintenance, and improve scalability across your Power Automate solutions.

🔹 Discover SharePoint AI Skills, Presented by Marco Rocca, Cloud Solution Architect Modern Work

Explore how SharePoint AI Skills transform traditional document repositories into AI-powered knowledge platforms that help organizations capture and reuse business expertise without custom code.

🔹 Excel with Built-in Python for Data Analysis and Visualization, Presented by Afreh Kriss Ntim, AFREH TECHNOLOGIES

Discover how Python inside Excel enables advanced analytics, automation, and powerful visualizations while working within a familiar spreadsheet environment.

Why Attend?

✅ Learn practical Microsoft 365 and Power Platform skills

✅ Discover new AI capabilities in SharePoint

✅ See real-world demos and use cases

✅ Expand your professional network

✅ Gain insights from experienced developers

Join us for an engaging community session filled with knowledge, live demonstrations, and actionable takeaways.

What is the maximum length of a Check-In Comment in a SharePoint document library?

virendrak — Mon, 27 Jul 2026 17:28:30 GMT

We are using SharePoint document libraries with versioning enabled and users provide comments when checking in documents. Is there a maximum number of characters allowed in the Check-In Comment field, and is this limit documented by Microsoft?

windows 11 update+keyboard not working

Klaus_Fleming — Mon, 27 Jul 2026 17:15:50 GMT

Hi,

I finally updated my laptop to Window11, after my computer stubbornly suggested it for a long time and at the same time I thought that the worst bugs would be bypassed.

My update went well, but the only problem is that the laptop keyboard does not work. When I connect an external keyboard to the laptop, it works fine and of course the mouse and touchpad work.

At first I figured it out on my own and downloaded the latest available drivers, but nothing made the keyboard work.

Finally I ended up asking the artificial intelligence and got good answers and recommendations from there, but it turned out that Asus did not offer all the drivers that the AI recommended.

At the moment the situation is open, I use the computer with an external keyboard, but the idea is also to update back to windows 10, if nothing works. So I would like some advice on how to solve the problem? Thanks in advance.

My laptop is ASUS M433IA-HM493T Laptop.

July update: What’s new for partners in Azure

JillArmourMicrosoft — Mon, 27 Jul 2026 17:00:00 GMT

Stay ahead of key Microsoft partner updates shaping cloud and AI growth in FY27. This month’s highlights include details on the Frontier Accelerate incentives driving AI adoption, hands-on learning at the upcoming Microsoft Partner FY27 GTM Kickoff Event, and much more. Discover how these updates create new opportunities to grow services, increase profitability, and lead customers from cloud adoption to AI-powered outcomes.

Navigate to

News and Announcements, Incentives and Offers, Skilling and Events, Partner success stories, Additional resources

News and Announcements

Get ready for enhanced co-sell referrals with the new BANT automation qualification process: To ensure every submission is complete, actionable, and ready for seller engagement, Microsoft is now validating Budget, Authority, Need, and Timeline (BANT) upfront. Partners can accelerate deal velocity, reduce friction, and increase acceptance rates with this new process, resulting in higher quality pipeline and faster progression from referral to revenue. For more information, read about managing co-sell opportunities.

Azure consumptive promotion capabilities coming in FY27: Partners will be able to use percentage-off promotional discounts on Azure consumption-based services—spanning pay‑as‑you‑go usage, Reserved Instances, and pre-purchase plans—which create new motions to scale Azure consumption and expansion. Learn more in the Partner Center announcement.

Incentives and Offers

FY27 partner incentives deliver rewards for driving Frontier customer growth: FY27 partner investments and incentives went live on July 1. Enterprise, Business Apps Presales Advisory (OSA), SPLA Reseller, and Hoster incentives will be live on October 1. This year's portfolio is built around partners leading Frontier Transformation—empowering customers to move from AI experimentation to scaled, outcome-driven adoption. To bring these investments together, Microsoft is introducing Frontier Accelerate—a connected approach that aligns funding, incentives, and skilling to how you deliver transformation across solution areas. Review the incentives guide to get more details on how you can use these incentives to capture higher earnings and sustain stronger profitability.

Skilling and Events

Build your FY27 growth engine across cloud and AI: Join us at the Microsoft Partner FY27 GTM Kickoff Event on July 28 for a first look at FY27 priorities, go-to-market (GTM) motions, and investments to shape your strategy. The Commercial Cloud and AI track is designed for partners looking to grow across Azure, data, and AI workloads. Sessions will cover where Microsoft is placing FY27 bets across Azure and Microsoft Marketplace, how customers are modernizing estates and unifying data foundations with AI, and what AI apps and agents mean for partner differentiation and scalable growth. You’ll walk away with clarity about what’s changing, where demand is growing, and how to focus your cloud and AI investments to scale your e asset placement guidance: Access updated SMB Azure asset.

Partner success stories

Ingram Micro supports partners guiding customers through cloud and AI modernization: With support from Ingram Micro, partners can move customers from legacy infrastructure to scalable, cost-efficient Azure environments and build on that foundation for AI modernization. Read the case study to find out how Ingram Micro used their Azure expertise to create clear opportunities for their customers to scale from cloud transformation into AI-powered workloads—expanding revenue and deepening long-term customer relationships.

Aiforia brings AI-assisted pathology to NHS lung cancer diagnostics: Using Microsoft Azure, Aiforia is helping University Hospital Southampton NHS Foundation Trust modernize pathology workflows with AI-assisted analysis of lung cancer tissue samples. By combining Azure's secure, scalable infrastructure with digital pathology expertise, Aiforia supports faster, more consistent diagnostic processes while keeping clinicians at the center of decision-making. Read the case study to learn how Aiforia is helping healthcare organizations manage growing diagnostic workloads, standardize pathology analysis, and create a foundation for future AI-powered innovations in clinical diagnostics.

Additional Resources

Sign up for the monthly Microsoft AI Cloud Partner Program newsletter: Encourage your teams to sign up for the newsletter to stay informed on updates, incentives, and partner opportunities. It’s an easy way to get the latest partner news delivered directly to your inbox.

Follow the tag Azure news to stay updated on monthly news and follow the Azure Partners discussion board to ask questions and connect with subject matter experts.

Level Up Your Security Skills This August with the Microsoft Defender Challenge and Learn Live

ShirleyseHaley — Mon, 27 Jul 2026 16:47:02 GMT

Security teams face an increasingly complex landscape. Threats span identities, endpoints, email, cloud workloads, and emerging AI environments. The best defenders aren't just reacting to threats—they're continuously building the skills needed to stay ahead.

That's why we're inviting security practitioners to build practical security operations expertise while working toward their next certification goal. Running from July 20 through August 21, 2026, and focused on skills across Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Defender for Cloud, this hands-on learning experience is the Microsoft Defender Challenge.

Build Skills That Matter to the Modern SOC

The Microsoft Defender Challenge isn't about memorizing content for an exam. It's designed to help you develop real-world security skills you can apply immediately in your organization. Through curated Microsoft Learn content, you'll strengthen your ability to:

Detect, investigate, and respond to threats across Microsoft Defender XDR

Manage incidents and automate workflows with Microsoft Sentinel

Triage and remediate security alerts in Microsoft Defender for Cloud

Secure cloud and AI workloads using modern security practices

Improve operational readiness for today's evolving threat landscape

Whether you're a SOC analyst, security engineer, cloud security practitioner, or IT professional looking to expand your security expertise, the challenge is an opportunity to sharpen skills that map directly to modern security operations.

Complete the Challenge and Enter the Sweepstakes

Learning is the real reward, but there's an added incentive. Participants who complete the Microsoft Defender Challenge and submit the official sweepstakes entry form by August 21, 2026 will have the opportunity to win one of 500 certification exam vouchers worth 50% off one of the following Microsoft Certifications:

SC-200: Microsoft Security Operations Analyst

SC-500: Microsoft Cloud and AI Security Engineer

How to Enter

Complete the Microsoft Defender Challenge on Microsoft Learn.

Before the entry period closes, submit the official sweepstakes entry form.

If selected, you'll receive instructions for redeeming your certification discount voucher.

Challenge window: July 20 – August 21, 2026. Sweepstakes entry deadline: August 21, 2026 at 11:59 PM UTC.

No purchase necessary. See official rules for eligibility and sweepstakes details.

Join Learn Live: Remediating Threats Using Microsoft Defender

Want a guided walkthrough of the skills featured in the challenge? Join a live, interactive event where you can learn directly from Microsoft experts, ask questions in real time, and explore security operations scenarios together. Save your spot for our August Learn Live session.

Date: Wednesday, August 19, 2026 | Time: 12:00 PM PT / 3:00 PM ET

You'll be guided by Scott Landry, Microsoft Security Customer Experience Engineering, as you explore practical approaches to investigating security incidents, managing and remediating threats across the Microsoft Defender ecosystem, automating investigations and response actions, strengthening security operations processes, and applying Microsoft Defender capabilities to real-world scenarios.

Start Building Your Skills Today

Ready to level up? Sign up today to take the Microsoft Defender Challenge, then join us for the Learn Live session on August 19. Your skilling journey doesn't end here—keep learning, keep growing, and keep building beyond August at the Security Hub on Microsoft Learn.

AI Gateway tier of API Management now in public preview

vladvino — Mon, 27 Jul 2026 16:37:53 GMT

Today, we are introducing the AI Gateway tier of Azure API Management, now in public preview. It gives platform teams a purpose-built experience built specifically for AI workloads - publishing and governing models and MCP servers. Controls are configured through policy cards rather than XML and expressions, and the portal experience and control plane are structured around models, MCP servers, and tools rather than APIs. (For brevity, we refer to the AI Gateway tier as AI Gateway throughout the rest of this article.)

AI Gateway is built on Azure API Management, bringing proven operational capabilities to AI workloads. The resource runs in your subscription, uses your Entra tenant, and sends telemetry to destinations you control. The operating model will be familiar to existing API Management customers, but the interface is built around AI workloads. The AI Gateway tier is intended for teams that want this focused experience; other API Management tiers remain the right choice when organizations also need general-purpose API management or capabilities not included in the AI Gateway experience.

A practical model for platform teams

The AI Gateway gives platform teams a shared place to manage models, MCP servers, policies, and observability destinations, with access controlled through Azure RBAC.

For example, a central platform group can connect a set of approved models and tools and publish them for application teams. The application teams can test those assets in the test console and build against them without routing every change through the central group. The platform group still owns the shared guardrails and can see how the assets are being used. After an asset is published, developers can create a named runtime key and begin calling the gateway immediately.

Bring the models and tools you already use

Most organizations don't standardize on a single model provider. Different models are selected based on quality, latency, cost, geography, or specialized capabilities.

The preview supports models from Microsoft Foundry including OpenAI, Anthropic, Mistral, and other Foundry hosted models, as well as models hosted in AWS Bedrock, Google Vertex AI, OpenAI, and Anthropic. A guided wizard simplifies importing models from Microsoft Foundry. Other providers can be added by configuring a connection, with backend authentication configured as part of that connection. All published models are available under the same stable endpoint. Applications continue to use supported API formats such as OpenAI Chat Completions and Responses or Anthropic Messages directly or via SDKs.

The AI Gateway extends governance beyond models to the MCP servers and tools agents use to interact with enterprise systems. You can expose an existing MCP server over SSE or Streamable HTTP, turn all or selected operations from a REST API into an MCP server by uploading its OpenAPI specification, or use more than 1,400 connector-backed tools from the Power Platform and Logic Apps library. You can also federate multiple MCP servers behind a single server, so an agent connects once and sees the tools across those servers. Backend authentication supports an API key, OAuth client credentials, managed identity, or mTLS.

Governance that's built in

Organizations need consistent governance across models and MCP servers without requiring every application team to implement those capabilities independently.

The AI Gateway portal presents governance policies through an intuitive card-based experience rather than requiring policy XML. The same policies are expressed as JSON properties, making them easy to manage as infrastructure as code and to audit and enforce across a fleet with Azure Policy. In the public preview, those cards cover request and token rate limits, token quotas, Azure AI Content Safety, and fallback to a secondary model. Policies are applied per asset, making it clear which controls protect each model or MCP server.

OpenTelemetry-based token metrics

The AI Gateway emits token-usage metrics through OpenTelemetry, with attributes following GenAI and cloud semantic conventions. Metrics can be sent to Application Insights, Datadog, Splunk, Grafana Cloud, or another OTLP endpoint. The portal provides a monitoring view over Application Insights data.

Better together: Microsoft Foundry and AI Gateway

With AI Gateway, teams can extend the same governance controls, for example token rate limits and quotas, across models hosted in Microsoft Foundry and models hosted elsewhere. Foundry and non-Foundry models are published through gateway-managed endpoints, giving applications and agents a consistent way to access governed models regardless of where they are hosted.

Foundry-hosted agents can consume curated sets of tools from Foundry toolboxes, with access to the underlying MCP servers and APIs governed through AI Gateway.

Together, Microsoft Foundry and AI Gateway cover the enterprise application lifecycle: Foundry for building and running AI applications, and AI Gateway for publishing, governing, and observing models, tools, and MCP servers across your AI estate.

The new AI Gateway tier will soon be available through the gateway experience in Microsoft Foundry portal. We are working toward a seamless, integrated AI Gateway experience within Foundry portal and will share more about that work separately.

Available today in public preview

The AI Gateway tier is available today at no cost in public preview in East US 2 and Sweden Central. Pricing will be shared separately.

To provision a resource, add a model or MCP server, and make a first call click this to go to the AI Gateway tier portal and try it.

If you prefer to start from code, use a sample to deploy all the required resources for a Foundry-hosted agent configured to access its model and tools through AI Gateway.

We look forward to your feedback as we continue to rapidly evolve AI Gateway.

Windows 11 Iso

Delrew — Mon, 27 Jul 2026 15:47:43 GMT

Hey does anybody know what changed with the windows 11 iso media installation?

two new folders with the new release, "_manifest" and "Provenance"

Just with the latest version which was released directly from Microsoft but have done this many times before and now im unsure to trust it or not.

Wondering if its an issue or a bug with it?

Add Office.js API to set cursor/selection or preserve scroll in Outlook compose

SDGroup — Mon, 27 Jul 2026 15:32:10 GMT

Problem

In new Outlook on Windows and Outlook on the web, a compose add-in cannot insert or replace a reply template at the TOP of the body without the view/cursor jumping to the bottom, and cannot auto-replace previously inserted text while keeping the quoted history visible.

Root cause: there is no Office.js API to set the cursor/caret/selection position in the compose body. body.setAsync/prependAsync deterministically move the cursor to the end of the body (documented; issue #3290, closed with docs only), and setSelectedDataAsync can only replace a selection the USER already made — there is no way to select programmatically. A Microsoft maintainer confirmed in #5188 (May 2025) that cursor positioning is not currently possible and recommended filing here.

Request

Please add ONE of the following to the Mailbox requirement set:

An API to set the caret/selection position in the compose body (e.g. body.setCursorPositionAsync / body.setSelectionAsync), and/or
An option on body.setAsync/prependAsync to PRESERVE the current scroll and cursor position (e.g. { preserveCursor: true }).

Why it matters

This blocks a very common scenario: reply-template / canned-response / snippet add-ins (e.g. HubSpot Sales in #3290) that need to insert or swap text at the top of a reply while keeping the quoted thread visible and the view stable. Today all three cannot be achieved at once in new Outlook / OWA.

References

github.com/OfficeDev/office-js/issues/3290
github.com/OfficeDev/office-js-docs-pr/issues/5188
Mailbox requirement sets 1.14–1.16 add no cursor/selection/scroll control.

MS Supervisor said Find my Device only works with Surface devices and not desktops

Figureguy — Mon, 27 Jul 2026 15:29:49 GMT

Good morning. I have been having an issue with location settings on my Microsoft account for Find my Device. I am using a Windows 11 Desktop. After a repair install of Windows my location in devices worked briefly. Now the account and devices links on my dashboard bring up a screen with empty gray boxes. When trying to switch to them from a working link I get this screen very quickly pop up:

After 4 chats with Microsoft support a Supervisor came online and said that you could not find your PC with a Desktop, only a surface device. What? Then they said I should reach out to HP and then asked if I was all set. I have never had someone with no idea what to do next just make something up and ask if they can go.

Is "Popular in Your Org" in the Agent Store Actually Based on Usage?

DavidEnestvedt — Mon, 27 Jul 2026 15:19:35 GMT

I've noticed something interesting in the Microsoft 365 Copilot Agent Store and I'm curious if others are seeing the same behavior.

In the "Popular in Your Org" section, many of the agents being surfaced are either:

Blocked by our administrators
Not available for me to install
Restricted due to licensing or governance settings

This creates a somewhat confusing experience because the label implies these are agents that are actively being used or adopted within my organization. However, if users cannot install or access them, it raises questions about what "Popular in Your Org" actually means.

A few questions for the community:

Are others seeing unavailable or blocked agents appear in the "Popular in Your Org" section?
Does anyone know what signals Microsoft uses to populate this list?
Is it based on actual agent usage, admin deployments, views, recommendations, or something else?
Is there a configuration option for admins to make this section reflect only agents that users can actually access?
Has anyone found a way to better align this experience with organizational governance and available inventory?

My expectation would be that "Popular in Your Org" would surface agents that are:

Available to me (or my audience) to install/use
Actively being used within the organization
Relevant to my permissions and licensing

Otherwise, it feels a bit misleading to highlight agents that users discover but ultimately cannot access.

Would love to hear whether others have had the same experience and whether Microsoft has shared any guidance on how this section is populated.

Thanks!

TeamsTab.ReadWriteSelfForTeam: deleting a tab fails with 400 "appId cannot be null or whitespace"

LarsKnoll — Mon, 27 Jul 2026 14:38:43 GMT

We have a published Teams app that pins a configurable tab into a team channel via Microsoft Graph and removes it again when the user uninstalls our app from that channel. Creating the tab works. Deleting it always fails with a 400 that looks like an unhandled null-argument exception inside the Graph Teams service rather than a permission problem.

I reported this in October 2025 as https://github.com/MicrosoftDocs/msteams-docs/issues/13432, but that is a documentation repository and the issue has had no response, so I am reposting here, as we can still reproduce the issue.

We're using a delegated token for the operation. The only tab-related scopes are `TeamsTab.Read.All` (read-only) and `TeamsTab.ReadWriteSelfForTeam`. According to the docs (https://learn.microsoft.com/en-us/graph/api/channel-delete-tabs), `TeamsTab.ReadWriteSelfForTeam` is the **least privileged** delegated permission for the delete, so the token should be ok.

What works

Creating the tab, with the same delegated user token:

POST https://graph.microsoft.com/v1.0/teams/«teamId»/channels/«channelId»/tabs Content-Type: application/json { "displayName": "«AppName»", "email address removed for privacy reasons": "https://graph.microsoft.com/v1.0/appCatalogs/teamsApps/«teamsAppId»", "configuration": { "entityId": "«entityId»", "contentUrl": "https://«ourhost»/teams/tabs/channel/«entityId»", "websiteUrl": "https://«ourhost»/app/tickets?channel=«entityId»", "removeUrl": "https://«ourhost»/teams/remove-tab/«entityId»" } }

→ `201 Created`. The tab appears in the channel and renders correctly.

Listing the tabs afterwards also works and returns our tab together with its `id`:

GET https://graph.microsoft.com/v1.0/teams/«teamId»/channels/«channelId»/tabs?$expand=teamsApp

Works as well and lists our tab. Might be served by the TeamsTab.Read.All permission.

What fails

DELETE https://graph.microsoft.com/v1.0/teams/«teamId»/channels/«channelId»/tabs/«tabId»

→ `400 Bad Request`

{ "error":{ "code":"BadRequest", "message":"appId cannot be null or whitespace. (Parameter 'appId')", "innerError":{ "date":"2026-07-27T13:45:31", "request-id":"f930c847-0b48-4a46-b17e-f0ee10ff8177", "client-request-id":"f930c847-0b48-4a46-b17e-f0ee10ff8177" } } }

(leaving in the error details, maybe that helps diagnosing the issue)

appID is not even part of the request, it's probably resolved against the TeamsTab.ReadWriteSelfForTeam permission on your side.

Let me know if you need any more details.

Title: Request for Accurate Subscription Recognition & Option to Disable Promotional Banners

renegadeoffunk — Mon, 27 Jul 2026 14:36:53 GMT

I’m a fully paid Microsoft 365 / Copilot Pro subscriber, and I’m consistently seeing upgrade prompts, premium banners, and promotional messages across OneDrive and other Microsoft services — even though my account is already upgraded.These prompts create confusion and make it appear as if my subscription isn’t active, isn’t recognized, or needs to be repurchased. This feels misleading and causes unnecessary concern about billing accuracy, account status, and potential double charges.

I’m requesting that Microsoft:Accurately recognize paid accounts across all Services stop showing upgrade banners to users who already have premium Plans add a clear ON/OFF toggle to disable promotional Messages improve transparency around subscription status and Billing. I invite other users to share their experiences. If you’ve also seen upgrade prompts despite being fully paid, please speak up. The more voices we have, the more likely Microsoft will address this issue.Paid users deserve clarity, accuracy, and a user experience that respects their subscription — not one that feels confusing or like repeated upselling.

Right for AI Staff members

Kelabyte12 — Mon, 27 Jul 2026 14:30:55 GMT

Satya Nadella recently suggested AI should be treated as staff.

What are the implications for harm, liability, and rights?” what happens when someone harms an AI system? Is it a workplace incident?

Is there liability?

How does Microsoft define “harm” to

AI?

GitHub Copilot Voucher

hbi — Mon, 27 Jul 2026 14:23:21 GMT

Hi, where can I order GutHub - Copilot Voucher? They are needed for the Students. Thank you in advance.

Feature request: Historical Agent Activity Timeline for Microsoft Teams Queues

RomainWeimer — Mon, 27 Jul 2026 13:53:18 GMT

Hi everyone,

We're currently using the new Microsoft Teams Queues app for our IT Service Desk and are very pleased with the improvements Microsoft has introduced.

One capability we feel is still missing is a historical Agent Activity Timeline.

Today supervisors can only see an agent's current Opt-in/Opt-out status. There is no historical overview showing:

When an agent opted in
When an agent opted out
Which agents were opted in at a specific moment
Whether the change was made by the agent, a supervisor or automatically

This makes it difficult to investigate:

Missed calls
Queue performance
SLA deviations
Staffing questions
Incident investigations

A simple historical timeline containing the timestamp, queue, agent and source of the status change would already provide tremendous value for supervisors and service desk managers.

We've submitted this as a feature request through the Microsoft Feedback Portal:

https://feedbackportal.microsoft.com/feedback/idea/2df346ee-bc89-f111-9b47-7c1e52444ef6

If you experience the same limitation, we'd really appreciate your vote.

I'm also interested in hearing how other organisations deal with this today. Are you using manual checks, screenshots or another workaround?

Thank you!

Romain Weimer
Head of ICT Operations and Support
Witteveen+Bos

Prioritize exposure resolution with a new dashboard experience (public preview)

liorarviv — Mon, 27 Jul 2026 13:30:43 GMT

Cut Through the Noise and Focus on What Matters Most

Security teams face a constant challenge: too many findings, too many dashboards, and not enough clarity on where to act first.

Organizations today are managing vulnerabilities, internet-facing assets, misconfigurations, code weaknesses, exposed secrets and more across an increasingly complex environment. While each signal is valuable on its own, security teams often spend significant time switching between tools and reports to determine where risk is concentrated and what actions will have the greatest impact.

Today, we're excited to announce the public preview of the redesigned Exposure Management dashboard, helping analysts to quickly identify the risks that matter most, act with confidence, and follow a clear path toward zero critical issues.

From Visibility to Action

Exposure management is most effective when it helps security teams move beyond visibility and into remediation. Every insight is designed to support decision-making and accelerate remediation.

The redesigned dashboard consolidates critical signals across:

Validated internet-exposed assets
Business critical assets
Vulnerabilities
Security misconfigurations

The dashboard prioritizes findings based on risk and directly connects them to remediation workflows. Security analysts can immediately understand:

Where exposure is highest
Which risks require immediate attention
What actions will reduce risk fastest

Resolve Risk Faster with Resolve Now

At the center of the new experience is Resolve Now, a focused set of prioritized recommendations designed to help reduce exposure on internet-exposed and business-critical assets. Resolve Now organizes work into three action categories, with items within each category prioritized based on the remediation approach:

Patch: Identify software updates that address known vulnerabilities, with prioritization based on exploitability and internet exposure.
Mitigate: Address risks that cannot be immediately patched, including zero-day vulnerabilities, through compensating controls and mitigation guidance.
Fix: Reduce attack surface risk by addressing security misconfigurations and code weaknesses, particularly those affecting internet-exposed cloud assets.

This approach helps teams focus on meaningful risk reduction instead of chasing long lists of findings.

Understand Your External Attack Surface

Internet-exposed assets remain one of the most common paths attackers use to gain access to environments. The new dashboard provides a consolidated view of internet-facing resources across:

Cloud assets
Devices
Shadow resources

Security teams can quickly understand where exposure exists across the environment and prioritize remediation efforts based on risk.

Measure Progress Across Critical Security Domains

Exposure management isn't only about fixing today's risks. It's also about driving continuous improvement. The redesigned dashboard introduces visibility into security initiatives across five key domains:

Code
Endpoint
Cloud
Identity
SaaS apps

Domain initiative scores help organizations measure progress toward target security outcomes, identify gaps, and track improvements over time. Teams gain a clearer path toward reducing organizational exposure by combining tactical remediation with strategic posture improvement,

Get Started Today

The redesigned Exposure Management dashboard is now available in public preview through the Microsoft Defender portal. Navigate to: Exposure Management → Overview to explore the new experience and begin prioritizing risk across your environment.

Learn more about using the new dashboard here

Is Microsoft Teams a good Intranet?

CandyMullany — Mon, 27 Jul 2026 13:19:09 GMT

Our company is fully on Microsoft 365, but employees still struggle to find basic information like policies, company updates, forms, department resources, and important links. Most of it is scattered across SharePoint sites, Teams channels, emails, and random folders. I want to turn Microsoft Teams into that hub where all of this lives, kind of like an intranet. Any suggestions?

Is Microsoft Teams a good Intranet?

CandyMullany — Mon, 27 Jul 2026 13:19:06 GMT

Building Autonomous Network Operations: From Vision to Measurable Business Impact

rickliev — Mon, 27 Jul 2026 13:17:08 GMT

At TM Forum DTW Ignite 2026, industry leaders gathered to discuss one of telecom's most important transformations: the shift from network automation to truly autonomous operations. In the session, Building Autonomous Network Operations, Microsoft's Thomas Steagall joined AT&T's Mark Austin, VP of Data Science and AI, and Microsoft's Jamie Gaudette, VP of Networking and Infrastructure, to share real-world lessons from deploying AI and agents in production network environments. Rather than focusing on theoretical architectures, the discussion centered on measurable business outcomes, operational governance, and the organizational changes required to scale autonomy.

One theme stood above the rest: autonomous networks are no longer a future aspiration. They are delivering measurable value today.

TM Forum DTW Ignite 2026 | Building Autonomous Network Operations

AT&T's Agentic AI Journey Starts with Data

According to Mark Austin, the foundation for autonomous operations remains unchanged regardless of whether organizations are implementing traditional AI, machine learning, or generative AI: it starts with data. AT&T's approach has evolved into a four-layer architecture consisting of a Data Layer, Knowledge Layer, Agentic Layer, and User Experience Layer. This layered model enables AI agents to move beyond analytics and actively participate in operational workflows.

The scale of AI adoption at AT&T is remarkable. The company's Ask AT&T platform now hosts 150 Generative AI solutions in production, processing approximately 40+ billion tokens every day, with generative AI representing roughly 85% of the organization's work.

However, the most compelling story is not the technology itself—it's the operational outcomes.

Turning 136 Billion Signals into Customer Outcomes

AT&T processes approximately 136 billion network signals per day to monitor fiber and wireless network performance. Managing this volume of data manually would be impossible. Instead, AT&T is using AI agents to transform network operations from reactive troubleshooting into proactive problem prevention.

One example is Agentic Root Cause (ARC), an AI-powered capability that analyzes charts, trends, telemetry, and operational data to identify the root cause of network issues. Tasks that previously required four hours of engineering investigation can now be completed in approximately one minute.

The operational and financial impact is significant:

136 billion network signals processed daily for incident management and monitoring.
Four-hour troubleshooting processes reduced to approximately one minute.
More than 3 million truck dispatches avoided through precise fault identification in broadband and fiber networks.
Approximately 30x ROI achieved over the life of the program.

Perhaps the most impressive outcome is that these operational improvements have enabled AT&T to offer a customer-facing service guarantee. The company now guarantees that customers will experience no more than 20 minutes of downtime on fiber services or 60 minutes on wireless services, or AT&T pays compensation. According to Austin, the guarantee is possible because of the organization's ability to identify outages faster and remediate issues proactively.

"We've gotten so good at this in catching these outages and fixing things ahead of time, we now issue a customer guarantee. We guarantee you're no longer going to be out more than 20 minutes on fiber or 60 minutes on wireless, otherwise we pay." — Mark Austin, VP Data Science & AI, AT&T

For telecom operators pursuing autonomous networks, this is the ultimate proof point: AI is no longer just reducing operational cost—it is directly improving customer experience and supporting new commercial commitments.

Governance Matters: AT&T's RODEO Framework

While excitement around autonomous agents continues to grow, AT&T emphasized that governance must advance alongside autonomy.

Austin introduced AT&T's RODEO framework, a simple but memorable approach for governing AI agents at enterprise scale:

Register agents to ensure they are identifiable and managed.
Observe their behavior and actions.
Discover rogue or unauthorized agents.
Enforce operational and governance policies.
On Guard through continuous monitoring and oversight.

The RODEO model reflects an important lesson for telecom operators: trust is built through visibility, control, and continuous evaluation. AT&T's approach is to start with small proofs of concept, rigorously evaluate outcomes, and gradually expand agent autonomy as confidence grows.

As autonomous networks move from experimentation to production, governance frameworks such as RODEO may become just as important as the AI technologies themselves.

Microsoft's Experience: Scaling Networks Without Scaling Headcount

While the AT&T story demonstrates business value, Microsoft's experience provides evidence that similar principles apply at hyperscale.

Jamie Gaudette described Microsoft's challenge of growing infrastructure 10x over the next four years without increasing operational headcount, while managing one of the world's largest backbone networks, which recently surpassed one exabit per second of traffic.

Microsoft discovered that many operational bottlenecks were not technical configuration tasks, but rather the coordination of people, field services, carriers, and repair activities. AI agents proved particularly effective in these workflow-heavy scenarios.

One example is Miles, an AI agent responsible for coordinating the resolution of outside plant fiber cuts. The agent recently handled 200 fiber cut incidents in a single day and now performs these coordination activities 95% of the time without human intervention.

"Build your system in a way where they can work across your whole organization seamlessly, and you can get out of the way, because these things are going to surprise you with what they can do." — Jamie Gaudette, VP Networking & Infrastructure, Microsoft

Importantly, Microsoft maintains strict controls around network changes. Agents can recommend and request changes, but code-based change management systems remain the final authority for executing actions on the network. This "human-on-the-loop" model provides safety and accountability while still enabling substantial operational gains.

Autonomous Networks Require Organizational Transformation

One of the more surprising insights from the discussion was that autonomy is driving organizational change as much as technological change.

Gaudette explained that Microsoft reorganized its operations teams around the concept of humans managing digital workers. Subject matter experts increasingly supervise teams of agents, update skill files, and refine operational knowledge rather than performing repetitive processes themselves. The result is that employees remain central to operations, but their focus shifts toward governance, knowledge management, and continuous improvement.

The vision presented by both organizations is not one of replacing people. Instead, it is about enabling human experts to oversee increasingly capable digital workforces.

The Road Ahead

Looking forward, both leaders expect the next wave of innovation to come from expanding agentic workflows across the enterprise. Austin described applying agents beyond network operations into functions such as finance, HR, and broader business operations. Gaudette emphasized the growing importance of knowledge systems and skills frameworks that allow agents to collaborate across organizational boundaries and optimize end-to-end processes.

The message from DTW Ignite 2026 was clear: autonomous networks are no longer defined by experimentation. The leaders who are creating competitive advantage are those connecting AI directly to operational outcomes.

AT&T's results—150 AI applications, 40+ billion tokens processed daily, 136 billion network signals analyzed, four-hour investigations reduced to one minute, 3 million avoided dispatches, approximately 30x ROI, and customer-backed service guarantees—demonstrate what happens when agentic AI moves from pilot to production.

For telecom operators pursuing TM Forum Level 4 and Level 5 autonomy, the lesson is straightforward: start with a strong data foundation, build knowledge and governance layers, introduce agents into targeted workflows, and measure outcomes relentlessly. Autonomous networks are not a future vision—they are becoming an operational reality today.