Last month's Microsoft 365 Message Center was dominated by retirements and lifecycle deadlines. Teams live chat, legacy Whiteboards, and Exchange Web Services are all being wound down on firm timelines, and the Teams mobile app now has a hard update deadline just to keep Calendar working. Alongside that, Microsoft quietly flipped the default visibility on 11 profile card properties - a change that's easy to miss but has real data-exposure implications if you don't review it first.
Below are five Message Center items we think warrant particular attention, along with some of the more impactful Roadmap updates on their way.
This is a snapshot, not the full picture. Microsoft ships dozens of changes across the Microsoft 365 estate every single month, and only a handful ever make it into a bulletin like this one. If you need certainty that nothing relevant to your organisation is slipping through, a monthly roundup alone won't get you there. That's exactly what ChangePilot is built for.
Sign up to get the ChangePilot monthly bulletin, curated Microsoft 365 Message Center and Roadmap insights delivered straight to your inbox.
Top 5 Microsoft 365 Message Center Items - September 2026
These five items mix changes rolling out with impact this month alongside newer announcements. All of them need action or awareness now.
Microsoft is enforcing a hard update requirement for Teams mobile on iOS and Android; users on older app versions will lose access to Calendar functionality entirely. Desktop and web clients are unaffected, but this is an easy one for mobile-first and frontline staff to miss.
What's changing:
- Calendar functionality in Teams mobile now requires the latest app version on iOS and Android
- Users on outdated versions will lose Calendar access in the mobile app
- Desktop and web versions of Teams are not affected
Deployment details:
Recommended actions:
- Confirm users are running the latest Teams mobile app from the Apple App Store or Google Play
- For managed devices, verify mobile application management (MAM) policies push the latest version automatically
- Encourage personal-device users to enable automatic app updates
- Give frontline and mobile-first staff advance notice so Calendar access isn't disrupted without warning
Microsoft is switching 11 optional profile card properties, including Division, Role, Employee number, Employee type, and Cost center, from hidden-by-default to shown-by-default whenever they're populated. Previously, admins had to opt in each property; now they need to opt out if they want any of them hidden.
What's changing:
- 11 optional profile card properties become visible by default whenever the underlying field is populated
- The baseline properties admin can't hide (name, email, job title, department, etc.) are not affected
- The change applies automatically unless admins configure visibility beforehand via the Microsoft Graph card API
Deployment details:
- Rolling out from late September 2026
Recommended actions:
- Audit which of the 11 newly-default-visible properties are populated in your directory
- Use the Graph profile card API to hide any fields you don't want surfaced explicitly
- Loop in HR or People teams - fields like Employee number and Cost center may be considered sensitive in your organisation
- Update your data classification or privacy documentation to reflect the new default exposure
Microsoft is retiring Teams live chat, the website widget that routes customer conversations into Teams, entirely. New customer setups were blocked from August 6, 2026, and the service stops relaying messages from October 5, 2026.
What's changing:
- No new Teams live chat setups can be created
- From the retirement date, the widget stops relaying customer messages into Teams and any widgets left on websites will be hidden
- Historical chat data is retained according to your tenant's data lifecycle policies
Deployment details:
- New setups blocked: August 6, 2026
- Act by: October 5, 2026
Recommended actions:
- Inventory any websites or support workflows that currently rely on the Teams live chat widget
- Evaluate replacement options such as Dynamics 365 Contact Center with Live Chat or Copilot Studio-based chat
- Remove embedded widgets from your websites before October 5, 2026 to avoid a broken customer-facing element
- Export or retain historical chat data per your retention requirements before decommissioning
- Brief customer-facing and support teams on the change and the replacement workflow
Microsoft Whiteboard is completing its move to OneDrive-backed whiteboards. Legacy (Azure-backed) whiteboards that aren't migrated or exported will be permanently deleted, and the standalone Whiteboard app is being deprecated in favour of Whiteboard in Teams and on the web.
What's changing:
- Enterprise customers must migrate any remaining legacy whiteboards to OneDrive-backed versions before the migration tooling is retired
- Legacy whiteboards not migrated or exported by the cutoff will be permanently deleted with no recovery option
- Users with personal Microsoft accounts will no longer be able to create or edit whiteboards
- The standalone Whiteboard app (desktop and mobile) is being deprecated; enterprise access moves to Whiteboard in Microsoft Teams
Deployment details:
- September 25, 2026: migration tooling for legacy enterprise whiteboards is retired, and personal Microsoft account users can no longer create or edit whiteboards
- October 16, 2026: any remaining unmigrated legacy whiteboards are permanently deleted with no recovery option
- November 30, 2026: the standalone Microsoft Whiteboard app is deprecated
Recommended actions:
- Identify any legacy (Azure-backed) whiteboards still in use across your tenant
- Migrate all remaining legacy whiteboards to OneDrive-backed versions before September 25, 2026, and verify the migration completed successfully
- Notify affected users of the migration and deletion deadlines
- Personal Microsoft account users should export any whiteboards they want to keep before October 16, 2026, since there's no recovery option after deletion
- Update internal documentation and training materials to direct users to Whiteboard in Microsoft Teams ahead of the November 30, 2026 app deprecation
Exchange Web Services (EWS) begins retiring on October 1, 2026, with full shutdown by April 1, 2027. Ahead of that, Microsoft has introduced EWSAllowedAppIDs, a tenant-level allow list that lets you control exactly which apps can still use EWS during the transition.
What's changing:
- EWS retirement begins October 1, 2026, with full retirement April 1, 2027
- The new EWSAllowedAppIDs setting lets admins allow-list approved app IDs permitted to use EWS
- From October 2026, enforcement becomes strict: if EWS is enabled with no allow list configured, all EWS access is blocked automatically
Deployment details:
- Act by: September 30, 2026
Recommended actions:
- Inventory line-of-business apps, integrations, and hybrid workloads (including legacy Skype for Business Server deployments) that still depend on EWS
- Configure EWSAllowedAppIDs now, while enforcement is still permissive, so you can test your allow list without disruption
- Prioritise migrating remaining EWS-dependent integrations to Microsoft Graph
- Flag this to any vendors or ISVs whose products integrate with Exchange via EWS
Top 5 Microsoft 365 Roadmap Items - September 2026
Here are the key Roadmap updates released in the last month. As Microsoft adjusts timelines, keep an eye on your tenant's rollout messages and update internal comms accordingly.
Edge will proactively unsubscribe users from browser notification permissions they've granted to sites later identified as scam or malicious sources. Closing off a well-known social-engineering trick where fake "prove you're human" prompts are used to plant persistent pop-up spam.
Rolling out:
Recommended actions:
- No admin configuration is required for most tenants - confirm your Edge management policies don't override this protection
- Let users know this is a helpful, automatic clean-up if they've previously granted notification permissions to suspicious sites
- Continue directing anyone still seeing suspicious pop-ups to Edge's site permission settings to manually revoke access
Teams mobile is getting a redesigned header and a lightweight dashboard that surfaces channel details, people, and pinned content in one place, creating a more consistent experience between desktop and mobile.
Rolling out:
- October 2026 (Worldwide, GCC, GCC High, DoD)
Recommended actions:
- Update internal Teams mobile training materials and screenshots ahead of the rollout
- Give frequent mobile users a heads-up so the redesign doesn't come as a surprise
- No policy changes are required - this is a client-side UX update
569212 - Microsoft Copilot (Microsoft 365): Federated Copilot Connectors in Microsoft 365 Copilot
Federated Copilot connectors let users securely connect Microsoft 365 Copilot to third-party sources in real time using the Model Context Protocol (MCP), without indexing or storing that data in Microsoft. At GA, they're supported in Researcher agent and Microsoft 365 Chat.
Rolling out:
Recommended actions:
- Review federated connectors under Microsoft 365 admin center → Copilot → Connectors, filtering by connector type MCP
- Decide which Microsoft-published federated connectors should stay enabled by default versus be disabled for your organisation
- Use staged rollout to pilot specific connectors with select user groups before wider enablement
- Update your AI and data governance documentation to cover real-time, non-indexed data access via MCP
SharePoint is adding the ability to store and render HTML directly as a page in the pages library, with further editing and sharing from there, giving content owners more flexibility for bringing in existing HTML-based content.
Rolling out:
Recommended actions:
- Identify content owners who may want to bring existing HTML content or templates into SharePoint pages
- Review your SharePoint governance and branding guidelines to account for HTML-authored pages
- Test how HTML pages interact with your existing page approval and publishing workflows
Microsoft is extending malicious URL protection in Teams, which automatically scans links shared in chats and channels and warns users of suspicious ones, to GCC, GCC High, and DoD tenants, bringing Gov cloud protection in line with the commercial service.
Rolling out:
Recommended actions:
- If you operate in a Gov cloud tenant, confirm this protection is active - for most tenants, it applies automatically with no configuration needed
- Brief security teams that Gov cloud Teams protection is now aligned with the commercial capability
- Review existing Defender for Office 365 and Teams protection settings to confirm there's no conflicting configuration
Master Microsoft 365 Evergreen Change with ChangePilot
This month's updates share a common thread: Microsoft is clearing out ageing capabilities — Teams live chat, legacy Whiteboards, and Exchange Web Services are all on firm retirement timelines — while quietly changing a data-visibility default on profile cards that's worth reviewing before it lands. None of these are optional; they all need active planning, not just awareness.
September's Roadmap continues in a security- and AI-forward direction, with malicious URL protection extending to Gov clouds, Edge closing off a notification-spam vector, and federated Copilot connectors reaching general availability alongside smaller UX and content updates in Teams and SharePoint.
If you want a monthly summary of the Microsoft 365 changes that actually matter, sign up for the free ChangePilot Bulletin.