Put multiple values in one cell with lists and arrays in Excel
Throughout Excel's 40-year history, you've only been able to put one value per cell. In this announcement, we're excited to share how that's changing with the release of lists, arrays in cells, and nested arrays, initially to Microsoft Excel for Windows and Mac Beta Channels. Many workbooks already try to pack multiple values into one cell. A project might list "Carlos, Henrietta, Jacob" as three owners, or a Forms survey might return "2:00 PM; 2:30 PM; 3:00 PM" as one response. With lists, you can keep those values in one cell, while also keeping them separate for filtering, calculation and more. Later in this post, we'll explore arrays in cells and nested arrays in more depth. NOTE: These are preview features. Their behavior may change before general release based on your feedback. We don't recommend using them in important workbooks until they're generally available. Lists Lists let you put multiple values into one cell. You can create a list by selecting Insert > List or pressing Ctrl+J, then typing or pasting items separated by commas or semicolons, depending on your regional settings. Selecting the icon in the cell shows the individual values. You can add, remove, or edit list items by double-clicking the cell or pressing F2, just like other values. With lists, you can filter by one or more individual items instead of whole text entries. Referencing a list returns all its values for calculations. For example, =B2 spills those values into separate cells. Arrays in cells Lists are useful on their own, but they're part of a much broader change to Excel. For the first time in Excel, arrays can exist natively in cells as values or as formula results. They can be any size or shape and can even contain other arrays. You can now keep the result of any spilling formula in a single cell by "wrapping" the formula body with braces { }. Since the introduction of dynamic arrays, array results have spilled across cells – for example ={1;2;3}. Wrapping the original array with braces creates a 1x1 array around it, so instead of spilling to multiple cells, the array stays in a single cell. Braces have long been used to describe arrays in Excel and this extends that behavior by allowing multiple layers of braces. This gives you more flexibility when building spreadsheets. Instead of leaving room for a formula to spill, you can keep the result in one cell. Arrays inside arrays, or nested arrays Arrays can now also "nest" inside other arrays. For example: ={{1,2,3};{4,5,6}} Previously, a formula that produced an array of arrays would return a truncated result or #CALC! error. Now, supported formulas return the complete nested result. In the example below, you can see how TEXTSPLIT behaves with and without nested arrays. Without nested arrays, Excel only returns the first item for each row. With nested arrays, the result spills, one array per row. The arrays in each row can then be used in further calculations. Four new functions: FLATTEN, HAS, HASANY, HASALL To help you work with arrays more easily, we've added four functions. FLATTEN(array, [pad_value], [levels]) simplifies nested arrays by removing one or more levels of nesting. Continuing from the prior example, FLATTEN lets you simplify the nested array output, spilling the individual results into the grid. We used an empty string ("") for pad_value so rows with fewer items show blanks in the remaining columns. Three HAS functions check whether values are in an array: HAS(array, value) returns TRUE if value appears anywhere in array, and FALSE otherwise. HASANY(array, values) returns TRUE if any of the values appear anywhere in array, and FALSE otherwise. HASALL(array, values) returns TRUE if all of the values appear anywhere in array, and FALSE otherwise. Do more with spreadsheets using arrays in cells and nested arrays Arrays in cells open up spreadsheet designs that weren't practical before. The run tracker below captures split times (how long it takes to run each kilometer) in a table with one run per row. The number of splits depends on the length of the run. Stats for each run are calculated right in the same table. For more examples, I recommend looking to your favorite Excel communities on LinkedIn, YouTube, Reddit, or elsewhere. Enabling nested array calculations in a workbook Compatibility Version 3 will be released alongside arrays in cells and is required for most calculations involving nested arrays. You can set Compatibility Version for each workbook in by selecting Formula > Calculation Options. See compatibility versions for more information. Some existing formulas return different results in Compatibility Version 3. If your workbook doesn't behave as expected, you can keep it set to Compatibility Version 1 or 2. Known limitations As this feature rolls out to Beta Channel, the following limitations apply: Conditional formatting doesn't inspect array contents unless you use a formula Data validation can't use a list or array as dropdown items Charts don't expand an array into data points PivotTables don't read array values as source data Power Query doesn't load or emit array-valued columns Find & Replace can't replace list/array items Availability These improvements are rolling out to Beta Channel users running: Windows: Version 2610 (Build 20520.20000) or later Mac: Version 16.114 (Build 26092111) or later Features covered on this blog roll out over time to enable us to monitor quality and performance, so some preview features may not be available to you right away. Also note that features may be paused, adjusted, or removed as part of that process. Feedback Click Help > Feedback in Excel to tell us what you think.What You’ll Learn, Explore, and Experience at ESPC 2026
From November 30 through December 3 at the RAI Amsterdam, ESPC brings together IT professionals, business leaders, developers, architects, partners, MVPs, community leaders, and Microsoft experts to explore what’s next across Microsoft 365, Copilot, Teams, SharePoint, Power Platform, Security, Fabric, Azure, and AI.The CISO Cheat Sheet to Microsoft Digital Defense Report 2026
I know we’re all busy, so I’ve pulled the most important data from this year’s Microsoft Digital Defense Report into one short read. The full report is well worth exploring, but this article focuses on the numbers and trends most relevant to security leaders. This year’s edition shows that AI is lowering the time, expertise and cost required to discover and exploit weaknesses, enabling attackers to operate with greater speed, scale and autonomy. The report describes this as AI “changing the physics of cybersecurity”: attack timelines are compressing and agentic systems are beginning to automate more of the attack lifecycle. Trend 1: Time has collapsed The clearest finding is about speed. Vulnerability discovery is increasingly running ahead of remediation, while the time from discovery to weaponisation is shrinking. In the AI era, weaponisation can follow in hours. Vulnerability discovery and weaponisation now often needs only a well-written prompt. The median time from discovery in the wild to weaponisation is below 24 hours. Vulnerabilities were on track for a record estimated 72,000 CVEs in 2026. The report expects a multi-year period in which the number of known but unpatched vulnerabilities rises sharply before eventually declining. The median time from container start to first exploit attempt is 5.3 hours. The ransomware actor Storm-1175 moved from web-facing exploitation to deploying Medusa ransomware in as little as 24 hours. CISA added over 110 CVEs to its Known Exploited Vulnerabilities catalogue between November 2025 and May 2026, most within a week of disclosure. The mismatch with enterprise reality is the uncomfortable part. The report says the disclosure-to-exploitation window has shrunk to single-digit days. Between November 2025 and May 2026, CISA added more than 110 vulnerabilities to its Known Exploited Vulnerabilities catalogue, most within a week of disclosure. In one example, Storm-1175 moved from exploiting a web-facing vulnerability to deploying Medusa ransomware in as little as 24 hours. Microsoft’s Red Team makes an important point: a patch is also a disclosure. Every fix points attackers towards the flaw it closes. As AI-assisted analysis makes reversing patches faster and more reliable, the report argues that patch velocity, not simply patch availability, becomes the control that matters. Trend 2: Attack chains are gaining autonomy The report charts a clear progression: September–November 2025: AI assists in orchestrating a campaign, as in the Anthropic-reported espionage case. April–June 2026: Full-chain autonomy is demonstrated in labs. July 2026: Real-world autonomous attacks of increasing complexity appear. Two frontier models, Mythos and GPT-5.5, completed a 32-step attack chain against an emulated enterprise with no human help. The test environment had no defenders. The UK AI Security Institute reached a similar finding independently. GPT-5.5 was the second model to solve its end-to-end corporate network attack simulation, a task AISI estimates would take a human about 20 hours. Open-weight models lag closed models at orchestrating attacks by about seven months. In the wild, early July 2026 saw the first documented automated ransomware extortion attack, named JADEPUFFER by Sysdig. Microsoft has seen AI-orchestrated intrusions that share elements with it. Initial access consistently came from internet-exposed services running known-vulnerable software. The report is measured on this point. Volumes of AI-orchestrated activity remain low. In most observed real-world operations, complex end-to-end intrusions still retain meaningful human direction. The Red Team's framing is the most useful one: AI doesn't create a new class of attack, it collapses the effort needed to find and exploit existing attack paths. Trend 3: AI has become an attack surface The report's second takeaway is that attackers are already targeting AI itself. The adoption numbers explain why. 88% of enterprises are experimenting with agents, and 82% of leaders plan broader rollouts within 12–18 months. The report cites industry projections of roughly 1.3 billion agents in production by 2028. What attackers are doing to AI systems: Four techniques accounted for roughly 90% of observed attack activity in telemetry from Azure AI workloads: malicious link injection (52%), jailbreaks (16%), tool and agent abuse (12%), and identity and credential abuse (10%). Memory poisoning: An attacker who can place content anywhere an agent reads can often place it where the agent remembers. Email is the dominant pathway the Red Team has observed. Human-in-the-loop isn't a complete control: Red team testing saw approval prompts ignored, or bypassed by a policy stored in poisoned memory. Developer tools turned against their owners: The "s1ngularity" malware hijacked locally installed AI command-line tools to hunt for secrets. It leaked about 2,000 secrets and 20,000 files across 225 victims. AI browsers: In daily use at more than 40% of organisations in Microsoft's dataset, they were the initial infection vector in incidents involving 57 malware families in a May 2026 analysis. Chat histories as a target: Malicious AI-assistant extensions reached nearly 900,000 installs and more than 20,000 enterprise tenants, harvesting AI chat histories that often contain code, architecture and credentials. The identity implications are direct. Each agent needs its own identity, not one borrowed from an employee, and a named human sponsor. The report also treats revocation latency, the time to cut off a compromised agent, as a measured outcome. Trend 4: The front door is still identity AI changes the speed and personalisation of social engineering. It hasn't changed where attacks start. Initial access in Defender Experts data: User execution: 30% Valid accounts: 20% Malicious copy-and-paste: 13% Phishing: 11% Together, user execution and valid accounts account for over half of observed activity. In incident response engagements, phishing as an initial access vector jumped from 7% to 23% year on year. The standout numbers: ClickFix: Defender saw user-pasted malicious commands on more than 1.1 million unique devices between February and early May 2026, roughly an 8x increase. AiTM: URLs accounted for 45% of the identified phishing techniques in the report’s breakdown. Separately, the share of AiTM phishing and token-theft attacks more than doubled during the first six months of 2026, although the report notes that their overall share remained comparatively small. Teams vishing: Weekly confirmed malicious volume increased 502% year on year. Per attempt, 48% of vishing calls kept the victim engaged for more than 20 seconds, and 30% lasted more than one minute. When a call succeeds, attackers can persuade the victim to install a remote-management tool and complete reconnaissance in two minutes or less. Business contact impersonation (BCI): The report introduces this term for conversations that start with a trusted-looking contact. Microsoft detected more than 46 million attacks in 12 months, with a 121% spike in April 2026. The share of first-contact messages that explicitly asked for money or documents fell from 17% to 3%. The first message is deliberately bland, like "Are you at your desk?" Password attacks declined 26% year on year, which the report describes as strong evidence that MFA and passkeys are forcing attackers to pivot. That pivot includes techniques such as fatigue attacks, AiTM phishing and token theft designed to circumvent conventional MFA. Trend 5: Attackers are inheriting trust rather than breaking in The report's headline theme is that risk is increasingly interconnected. Threats travel through the trusted relationships between identities, software supply chains, partners and cloud platforms. The numbers: Supply chain: Major open-source ecosystems saw attacks roughly every ten days, accelerating through Q2 2026. Shai-Hulud 2.0 affected 25,000 repositories. Megalodon backdoored 5,561 GitHub repositories in under six hours. Trusted signing: In May 2026, Microsoft disrupted Fox Tempest, a "malware-signing-as-a-service" operation that obtained genuine certificates for ransomware loaders and infostealers. Microsoft revoked over a thousand fraudulent code-signing certificates. Legitimate access: An unsanctioned remote monitoring tool is now one of the most reliable mid-stage indicators of a human-operated intrusion. Cloud identity: Cloud identity abuse was the most observed technique against critical infrastructure, representing 78% of the technique mix in Microsoft’s data for March to June 2026. Hybrid intrusions: The Storm-2885 case showed an attacker using a privileged cloud identity to close and downgrade security alerts. The report says identity governance and alert-handling workflows deserve Tier 0 treatment. Dwell time: DART data shows a statistically significant increase in dwell time year on year, meaning organisations took longer to detect intrusions. Ransomware shows the same ecosystem pattern. Qilin led leak-site data with 16.4% of victims, up 386%. Defender detections tell a different story, with Akira at 22%. Trend 6: Defence works best when it's connected The report is not only a catalogue of threats. The strongest defensive evidence: Disruption works. Following the March 2026 disruption, Tycoon2FA activity had fallen 95% from its November 2025 peak by June. Its share of CAPTCHA-gated phishing declined from 76% in December 2025 to 12% in June 2026. Correlation is the highest-leverage variable. The report argues that how well defenders share and correlate signals across endpoint, identity, cloud, email and network is one of the highest-leverage strategic variables under their control. AI is also changing defensive operations. The report describes AI-assisted triage, incident summarisation, hunting-query generation and detection engineering as ways to accelerate investigations and allow analysts to concentrate on higher-value work. Automated disruption can compress response time. The report says that when a correlated incident reaches a defined confidence threshold, defensive systems can automatically isolate devices, disable compromised accounts, revoke sessions or quarantine affected cloud resources. It also stresses the importance of appropriate governance and human oversight for high-risk AI actions. The report also recommends changing what leaders measure. It suggests moving from patches deployed to exposure reduced, detection coverage increased and time-to-mitigate compressed. What the MDDR recommends: ten security priorities The report starts its recommendations with the foundations: Secure by Design, Secure by Default and Secure Operations, applied through identity-centric Zero Trust. Microsoft says these keep the priorities below durable as AI adds more identities, applications, agents and dependencies to govern. Govern cyber risk at leadership level. Report identity exposure, patch latency, agent permissions, critical dependencies, dwell time and recovery readiness to the board. Defend identity as the primary control plane. Deploy passkeys and phishing-resistant MFA, reduce privilege and govern human and non-human identities. Invalidate and rotate tokens and session credentials quickly. Establish governance, visibility and data controls for AI. Keep visibility of approved AI tools, services and agents, and monitor for unauthorised or unmanaged use. Apply sensitivity-aware access and data protection to the data those systems can reach. Reduce exposure and edge risk. Continuously discover internet-facing assets and patch edge devices quickly. Centralise high-fidelity logging, enforce strong authentication and combine network visibility with threat intelligence. Focus on cross-signal correlation. Correlate endpoint, identity, cloud, application, email and network signals to detect intrusions earlier. Correlation also helps defenders anticipate attack paths and likely targets. Enact a continuous threat and vulnerability management model. Combine asset visibility, vulnerability identification, threat detection and AI-accelerated insight into a single continuous programme. Validate exposure through proactive testing. Run assume-breach exercises on cloud services, SaaS platforms, APIs and workflow automation. Prioritise them by where your highest-value data is stored, accessed or aggregated. Secure software dependencies. Harden software installation, keep a software inventory and validate provenance. Monitor packages and prepare for rapid containment. Participate in collective defence. Share actionable threat indicators and victim-informed intelligence with trusted partners and law enforcement. This supports coordinated tracking, investigation and disruption. Prepare for long-horizon technology transitions. Build a cryptographic inventory and advance post-quantum planning alongside AI governance. Read together, the numbers tell one story: the attacker’s workflow is becoming faster and less expensive. AI can shorten vulnerability discovery, exploitation, secret discovery and lateral movement, while organisations still face the slower operational work of testing, coordinating and deploying safe changes across complex environments. At the same time, agent identities can proliferate faster than organisations can inventory, govern and revoke them The defining question for boards today is not whether disruption will occur, but whether the organization can continue operating, contain harm, recover quickly, and maintain trust when it does. Source: Microsoft Digital Defense Report 2026, Version 1.1. Reporting period: July 2025–June 2026.
Excel and word saving to invalid cloud location
There is a random account that belongs to my wife that keeps showing up randomly in my office 365. Supposedly last year it was "fixed", yet now suddenly it's showing up again when I create a new file in word. It says I need to sign in when I make it so I have to save a copy to my actual cloud to use it. This is driving me nuts, I need an actual solution, tried support and that was a joke. I'm on iPhone 15 pro max with iOS 27.2365 tenant blocked for delivery e-mails
Hi Good Day ! Microsoft have blocked our tenant for 2 weeks due spam originating from the domain. Still we cannot send any e-mails and the block is not removed inspite of us contacting microsoft and their engineer connecting to the tenant and checking the tenant for any connectors and updating the outbound delivery settings. The engineer is not responding. How can we contact microsoft as it is a small business and no mails can be delivered. Please can some guide or help. Thank you M CarvalhoOneDrive won't sign in until I log into an external account in Teams
OneDrive gets stuck on "Signing in" after every restart – Sign-in only works when I log into a second organization in Teams I've noticed that OneDrive consistently gets stuck at the "Signing in" stage every time I restart my Mac. I have tried several troubleshooting steps to resolve this issue, including: Quitting OneDrive completely and restarting the Mac. Running the ResetOneDriveApp.command reset procedure. Running the standalone version of the OneDrive reset procedure (ResetOneDriveAppStandalone.command). Removing the "OneDrive Cached Credential" entry from macOS Keychain Access. Testing the sign-in process through a web browser. Testing the connection using a mobile hotspot to rule out potential network-related issues. Updating the standalone OneDrive application to the latest available version. Unfortunately, none of these steps has permanently resolved the issue. Even when OneDrive starts working again, it gets stuck at the sign-in stage after a subsequent restart. However, I have discovered something quite interesting. Recently, while preparing for a Teams meeting, I signed in to one of my two accounts in Microsoft Teams. At that exact moment, I noticed that OneDrive suddenly completed its sign-in process and started working normally, even though it had previously been stuck at the "Signing in" screen. Here is how my account setup is configured: OneDrive is currently syncing folders belonging to my primary organization, as well as one shared folder from an external organization. I have two accounts configured in Microsoft Teams, representing my primary organization and the external organization. Both accounts are essentially associated with the same email address and my primary organization's Exchange account. The external organization's shared access also uses the same email address, but with some additional characters appended to the email address. The interesting part is that OneDrive only manages to complete its sign-in process when I sign in to the external organization's account in Teams. Otherwise, it remains stuck in an endless sign-in loop. This makes me wonder whether there is some kind of authentication dependency or token-sharing mechanism between Teams and OneDrive that is causing this behaviour. What I would like to understand is: Is it possible to make OneDrive authenticate independently, without relying on signing in to the external organization's account in Teams? Is this expected behaviour when using multiple organizational accounts and shared folders across different Microsoft 365 tenants? Could a recent update to OneDrive, Teams, or macOS have introduced a change in how authentication tokens are handled? What's particularly confusing is that I have been using exactly the same account configuration and setup for quite some time without any issues. This behaviour only started appearing after recent updates. I'd really appreciate any insights or suggestions on how to resolve this permanently, rather than having to sign in to the external organization's Teams account every time I restart my Mac just to get OneDrive working. Thank you in advance!Partner Blog | Make each Microsoft 365 Business Premium opportunity a security conversation
Small and medium-sized businesses (SMBs) want to put cloud and AI to work while protecting their people, data, and operations. Cybersecurity Awareness Month brings those priorities into focus each October, but building a secure foundation for productive, AI-ready work is a year-round business need. For Microsoft partners, that makes each Microsoft 365 Business Premium opportunity a security conversation and a path to recurring managed services. Lead with the outcomes customers need: adopt AI with confidence, strengthen protection against advanced cyberattacks, and secure sensitive data while addressing compliance requirements. Microsoft 365 Business Premium brings productivity and foundational security together. Microsoft Defender Suite for Business Premium and Microsoft Purview Suite for Business Premium extend that foundation with advanced threat protection, data security, and compliance capabilities. Together, they give you a connected Microsoft platform to assess, deploy, manage, and expand as customer needs evolve. The opportunity continues well after the initial sale. By guiding adoption, maintaining security posture, and strengthening governance, you can build repeatable managed security services that deepen customer relationships and create opportunities for recurring revenue. Security is the foundation for productive, AI-ready work Security is now a priority across the partner ecosystem and a prerequisite for nearly every customer initiative. Secure identities, protected data, threat protection, and clear governance create the foundation for productive work today and for governed AI adoption over time. That’s the thinking behind the FY27 SMB sales plays, including the “Run your business securely” security sales play. Rather than leading with a product list, start with the business outcome the customer is trying to achieve and the risk that could get in the way. The FY27 SMB partner resources provide conversation guides, pitch materials, and discovery questions you can use to turn that framing into a business case. The FY27 SMB Channel Partner Playbook extends that guidance across customer conversations, readiness, and go-to-market execution. This secure foundation also matters as customers move from isolated AI use to repeatable, governed ways of working, a core part of Frontier Transformation. For SMBs with lean IT teams, or who rely on their Managed Service Provider (MSP), an integrated approach can simplify the environment while improving visibility across identity, endpoints, data, and compliance. Partners can guide that progression by keeping security, productivity, and AI readiness connected throughout the customer relationship. Continue reading here
Microsoft auto-removed a user's license is action needed?
This is a strange one. Not my domain but someone I support. A 365 tenancy was created with a trial subscription. The trial subscription was used for setup, but allowed to expire as licenses were purchased from a reseller instead. While the trial was active it showed extra unused licenses but after the trial expired only the reseller's licenses were active, as expected. However, when the date passed for the trial subscription to be permanently deleted, a user's license was removed, disabling email, while an unused license remained in the tenancy. Re-assigning the license has fixed the problem but leaves me worrying that other weird stuff might happen to the tenancy, while also being annoyed that a user with a valid paid-for license had it auto-removed by some background process and email interrupted. Is there any further action I need to take to ensure that this tenancy continues to function correctly, I worry that one day the whole tenancy might get deleted?Add custom attributes to users (or devices) to map hardware peripherals
Hello everyone, I am seeking some help, guidance or suggestions with the following situation. We are looking for a solution that could map peripherals (such as monitors) to a user or a device. Once we have that info, we will utilize an additional tool to extend our visibility over the assets & assignments. I reviewed a few documentations and videos about potential solutions, and I just want to know if that's possible or I should not invest time on it any longer. The scope is the following: 1. We've collected information about connected monitors using Intune Script detection. That's perfect. It already maps devices with monitor's serial numbers and other details. 2. Export in CSV is fine (although, the data is not a 100% accurate, we have an internal data base that we can compare). 3. Now, how can we properly map that data to the cloud objects? What the best approach is? Logically, the monitors should be added to the devices, but Intune Custom Attributes are not easily populated/managed (?). On the other hand, Entra AD is capable of managing such expressions and overall has better capabilities (or am I wrong?) when it comes to operating with cloud objects. I am really looking for a human response; more of a knowledge share. I'd appreciate if someone shares their experience with similar scenarios. :) I apologise in advance if my question is not in the right section. Docs: https://learn.microsoft.com/en-us/graph/extensibility-overview?tabs=http https://www.reddit.com/r/AZURE/comments/1e5z3kv/add_customextension_attribute_in_entra_id/ https://www.reddit.com/r/AZURE/comments/1dz4cru/comment/lcdf2ev/?context=3&share_id=UqZR0m9s-9SWiHOiVwwAM&utm_content=1&utm_medium=ios_app&utm_name=ioscss&utm_source=share&utm_term=1 https://www.youtube.com/watch?v=kBm-fjqg0PU https://www.youtube.com/watch?v=LHXfFoygiOA Thanks :)
SharePoint /:f:/r/ links fail from Outlook: %2F becomes %252F
We are seeing a reproducible issue with SharePoint Online folder sharing links (/:f:/r/) sent via Outlook. A freshly generated folder link works when opened directly in Edge. When opening the link from Outlook, it can also work the first time, but subsequent attempts fail with: "Unknown render failure. This item isn't available." The failing URL shows what appears to be double URL encoding in the SharePoint id parameter: Working: id=%2Fsites%2F... Failing: id=%252Fsites%252F... We tested: - Edge and Edge InPrivate - Fresh authentication - Normal paste into Outlook - Hyperlink via Ctrl+K - Microsoft Defender Safe Links configuration A normal SharePoint site URL sent via Outlook works correctly. We also found a reliable workaround. Instead of the SharePoint sharing URL: https://<tenant>.sharepoint.com/:f:/r/sites/.../Forms/AllItems.aspx?id=...&share=... we use the direct library URL: https://<tenant>.sharepoint.com/sites/.../Forms/AllItems.aspx?id=...&p=true The direct AllItems.aspx URL works both directly and when sent through Outlook. Has anyone seen this behavior recently? In particular, why would a folder sharing link work on the first click but subsequently result in %2F becoming %252F? We have already opened a Microsoft support case. Note: This post was written with the assistance of Microsoft Copilot based on my own troubleshooting results and tests.
