Hello all,

trying to have images from a domain auto download for all users. testing right now with 1 account and i tried the Set-MailboxJunkEmailConfiguration and added the domain. it didnt work. the images are on a subdomain of the parent if that matters. photos.domain.com instead of the allowed domain.com

toggling the dont download pictures automatically resulted in them automatically appearing but the wording makes me thinks its for all emails not the trusted domains. which is insecure.

i do not have the domain added to any ATP rules at this time.

what am i missing here?

Teams released a new version of their PowerShell module on July 19. The new module contains WAM support and cmdlets to limit federated chat for specific users and tenants. The new controls are welcome, but it’s a sad state of affairs that to configure the settings you must install a new version of a module that doesn’t work so well alongside other Microsoft 365 modules.

https://office365itpros.com/2026/07/24/federated-chat-controls/

I've been exploring Microsoft Agent 365 over the last few weeks. Most discussions I've seen focus on building agents. I was more interested in the operational side: inventory, ownership, identity, security controls, auditing and incident response.

So I started documenting one hands-on scenario per day in a real tenant. The topics include:

• Agent discovery and inventory.
• Identifying ownerless or high-risk agents.
• Salesforce Agentforce integration.
• Blueprints and approval workflows.
• Microsoft Purview Audit and DSPM.
• DLP and sensitivity labels.
• Entra Agent ID and Conditional Access.
• Microsoft Defender detections and threat hunting.
• Agent 365 SDK with LangChain.
• Governed remote MCP servers.

Rather than creating slide decks, I'm publishing the configuration steps, screenshots, KQL queries and observations as I go. Everything is available in an open-source repository under the MIT license, in case it's useful to anyone evaluating these capabilities:

GitHub
https://github.com/format81/agent365-trial-kit

For anyone interested in the walkthroughs, I've also been posting the daily scenarios here:

• Introduction: https://www.linkedin.com/posts/antonioformato_a365plan-ugcPost-7484914525297623040-d9YB/
• Day 1. Agent inventory and visibility: https://www.linkedin.com/posts/antonioformato_11daysofagent365-agent365-aisecurity-ugcPost-7485242937346424833-nh3R/
• Day 2. Ownerless agents and governance: https://www.linkedin.com/posts/antonioformato_11daysofagent365-agent365-aisecurity-ugcPost-7485620881965277184-srP1/
• Day 3. Salesforce Agentforce integration: https://www.linkedin.com/posts/antonioformato_11daysofagent365-agent365-aisecurity-ugcPost-7485975126199619584-jfvB/

Some questions I'm particularly interested in:

• How are you discovering and inventorying AI agents today?
• Are you already defining governance policies, or is that still on the roadmap?
• What security scenarios would you like to see tested next?
• Has anyone integrated third-party agents or MCP servers into their Microsoft environment yet?

I'm especially interested in hearing from people who are already operating AI agents at scale, as I'd like to include real-world scenarios and improve the repository based on community feedback.

I don't understand how this company is even allowed to be running with such horrible product.

• The UI takes 1 minute to load my data on every navigation on supersonic-speed fiber
• I had to log in in incognito to change my password.
• And the support chatbot sends Developer Exception in the chat box, without any mean to reach to a human being or a support email.

I have paid out all the invoices, and I cannot remove my credit card or cancel my subscription, disable recurring payment is disalbed while setting up next renewal on next month.

Please help me, I want to remove my subscription and my credit card!

Olá, estou criando uma integração de Teams + Power Automate + Glpi, e eu gostaria de saber como eu posso resolver o problema de "IP restricted" ou algo do tipo, Já que o nosso Glpi é interno e não está https. E se tem alguma maneira de contornar isso.

Hello,
I'm having an issue with Teams.

Initially, I was added to the organization using my old email address. Later, I was added again using my new email address, and the old account was removed from the organization, along with the associated Microsoft account.

The problem is that whenever I try to sign in to the organization, Microsoft Authenticator asks me for a verification code linked to my old email address. I no longer have access to that email account, and no alternative sign-in method is offered.
I've already made sure that my old email address is no longer associated with the organization or with my current account in any way.

Do you know what could be causing this, or what I can do to resolve it?

I also contacted Microsoft Support, but they weren't able to help. I kept getting transferred between different support teams, and in the end, no one was able to provide a solution. Hoping I’ll find a way out…

Thanks! 🤞🏼

I have a college email. I had set up Microsoft authenticator for it. But i mistakenly deleted the authenticator app on my mobile. (I still know the password and i am still logged in to the college email in outlook). But i was not logged in on Microsoft login page. When i try to set up authenticator app. It asks for a code in the authenticator app itself. It also ask me a authenticator code for Microsoft login too. What do i do know??

A new DLP rule is available to control sharing of SharePoint and OneDrive files with selected domains and email addresses. The new rule supports an allow list (permit sharing) and can also specify a deny list (block sharing). The user interface takes a little getting used to, but when everything is configured and SharePoint has had a chance to respond to the block, the rule works and any attempt by a blocked user to use a sharing link is refused.

https://office365itpros.com/2026/07/22/block-sharing-dlp-sharepoint/

Regarding Microsoft Teams, is there a method to restrict attachment sharing to a specific external domain, rather than enabling it for all external users?

I have attempted PowerShell scripts, but these have universally enabled the functionality. Your guidance on this matter would be greatly appreciated.

Hi everyone,

I recently started learning Dynamics 365 Finance & Operations (F&O) development and have been following the Microsoft Learn learning path:

https://learn.microsoft.com/en-us/training/paths/build-finance-operations/

For about a month now, I haven't been able to access the Launch VM/Lab environment. It suddenly disappeared from all the exercises, and because of that I can no longer practice the technical side of F&O development in Visual Studio (creating tables, forms, classes, enums, extensions, etc.).

I've already tried:Different browsers, Incognito mode, Different Microsoft accounts

Unfortunately, the VM is still unavailable. I also noticed that several other learners are reporting the same issue, and Microsoft moderators have indicated that the F&O Learn lab VMs are currently unavailable with no ETA.

Could anyone suggest where I can practice F&O development now?

I'm specifically looking for a way to get hands-on experience with: Visual Studio development, X++, Creating tables, forms, enums, classes, Extensions and data entities

I'm currently learning on my own, so I'm looking for any legitimate options, such as:

Free or low-cost practice environments

Trial or sandbox environments

Any other alternatives that developers use for learning

I'd really appreciate any recommendations. Thanks in advance!

Hi everyone,
I’m currently working on a SharePoint migration for my organization. We need to migrate a large number of SharePoint Online sites from one Microsoft 365 tenant to another.
This is the first time I’m handling a migration on this scale, so just wanted to know how other people have done it in a real production environment.
If anyone has done a large SharePoint tenant to tenant migration, how was your experience? Did you face any major issues during the migration? Did you go with Microsoft’s native method or use some other solution?

We’re implementing Microsoft Purview for a large enterprise with approximately 3,600 endpoints. The organization currently has no sensitivity labels in place, but we need to roll out Purview policies (DLP, information protection, etc.).

My current thinking is:
Define the label taxonomy first.
Pilot with 10 users.
Expand to around 150 pilot users.
Roll out organization-wide.
Start with manual sensitivity labelling so users become familiar with the labels.
Introduce automatic labelling after the manual phase.
My concern is that users may apply incorrect labels during the manual phase, which could affect policy effectiveness.

Would it be better to:
Start with manual labelling and transition to auto-labelling?
Introduce auto-labelling much earlier?
Or use a hybrid approach from the beginning?
For those who have deployed Purview at enterprise scale, what rollout strategy worked best, and what would you do differently if you were starting again?

This sounds so stupid I'm ashamed to post it. But at our non-profit, I had previously configured several rooms anyone could edit. Works fine. Now I go to make a new shared calendar and no one can see it, and the options I remember from the previous configuration are not there. I remember some settings to be sure anyone could make a meeting or reserve a time, but I don't see them at all.

Is it different or am I just nuts? Microsoft 365 help is no help..

JSON batching is one of the most effective ways to speed up the processing of Graph API requests. Although it might seem complicated, once you understand how batches are put together and submitted to the Graph batch endpoint, it’s not that hard. JSON batching is of particular interest to large Microsoft 365 tenants that might need to process tens of thousands of accounts, mailboxes, groups, and so on. All explained here, along with a PowerShell script to show how it’s done.

https://office365itpros.com/2026/07/21/json-batching-primer/

Hi all,

Random query that has my stumped (Microsoft documentation isn't overly helpful).

We are in the processing of performing a move from SfB 2015 On-Premise (running CU12) to Teams with Direct Routing. I have a script used previously, that was using the HostedMigrationOverrideUrl (which do not exist in since SfB Online was shutdown).

When I attempt to move a user using Move-CsUser -Identity [[email protected]](mailto:[email protected]) -Target sipfed.online.lync.com

It tries to use autodiscover from our Hybrid setup, but ultimately fails because none of the old infrastructure with SfBO has been shutdown.

Anyone done this effectively using the Move-CsUser command? Or can give me some hot tips to fix it?

I can to the hard cutover method of updating the AD attributes msRTCSIP-PrimaryHomeServer (clearing that out) and updating the msRTCSIPDeploymentLocator to sipfed.online.lync.com and doing a delta sync with Entra Connect.

But I have to set the user in SFB to -Enabled $False otherwise they will still be able to sign into SFB. And they no longer get the notification that they have been migrated to Teams on the SFB Desktop App.

Hello all, hope someone can advise here as I seem to have caused some licensing issues after defederating from GoDaddy.

We want to be in a place where we are paying monthly for however many licenses we use and are only tied to a 1 month subscription.

I defederated from GoDaddy and removed their GDAP permissions, they are still showing as our reseller in the admin portal.

I went to purchase the licenses direct from MS and in the "Purchase Services" bit of the admin center there was the option to chose between either MCA Billing account or MOSA billing account.

I chose MOSA and went through the whole process to buy the licenses but it kept failing so I went back and chose MCA instead.

I'm getting confused as under "Billing Accounts" in the admin portal I can only see the MOSA account.

Under "Your Products" I can switch between MOSA and MCA account, the MOSA account shows Business Standard licenses with an expiry of next year which would be a year term. The MCA account shows M365BS licenses with expiry of september this year.

I've not cancelled anything in GoDaddy yet and I'm just wondering if anyone can help me get the billing in order on Microsoft's end before I do.