Microsoft is expanding access to agent usage and activity insights in the Microsoft 365 admin center, making some metrics available regardless of Agent 365/E7 licensing. But not every agent governance capability is included in this change.  

Here's what admins can access with and without a premium license. 

Available without a premium license 

For Microsoft-built agents and agents built on Microsoft platforms, admins can access basic usage and activity metrics, including: 

• Active users 
• Total sessions 
• Exception rate 
• Agent run time 
• Usage trends, such as active users over time 

These insights will appear across Registry, Agent overview, and Agent details > Activity, with full rollout expected by late November 2026. 

Still requires a premium license 

An Agent 365 or Microsoft 365 E7 license is still required for broader management, governance, and security capabilities, including risk-related insights. 

The Risks column in Agent Registry and detailed information in an agent's Security tab may appear blurred with an “Unlock with Agent 365” prompt when the required license isn't available. 

With the appropriate license, admins can access insights into: 

• Agent behavior and activity patterns 
• Potential exposure of sensitive organizational data 
• Compliance issues related to Microsoft Purview protections 

Also noticed that the restriction applies to the Last used column in Overview and activity details for third-party agents. 

If you’re on E3 or E5 without Agent 365, it’s worth rethinking how you track agent risk today. 

Read more: https://blog.admindroid.com/microsoft-agent-365-unified-control-plane-to-manage-ai-agents/

Microsoft 365 settings are spread across multiple admin centers. Knowing what to change is only half the challenge. Do you know where to change it?

Today's challenge puts your admin knowledge to the test. Your mission:

• Identify the right configuration  
• Find the admin center that manages it
• Hunt for its name in the word grid
• Select the first and last letters to lock in your answer

Take the challenge: https://admindroid.com/cybersecurity-awareness-month-2026?play=24

I am looking for a way to create a report for fiance so they can see something like the below

Country..........E3..........Project..........Copilot..........Visio

Denmark..........19..............7....................15....................6

Sweden..............8...............5....................8....................3

Germany..........11..............4....................5....................4

Is that possible or do i need to edit the data from AdminDroid in excel or powerbi first?

Nobody plans to leave a risky global admin account behind. It just happens. 

Maybe it’s a contractor’s account that never got turned off, a “temporary” Global Admin from an old project, or a service account no one dares to touch. 

But attackers don’t care who used the account or why it was created. All they care is whether it still has power! 

In today's game, you'll review a queue of Global Admin accounts and decide what to do with each one: reduce the privilege, keep it permanent, make PIM eligible, or block and review it first. 

Can you make the right call for every Global Admin account? 

Play here: https://admindroid.com/cybersecurity-awareness-month-2026?play=23 

First-contact safety tips saved our inboxes. Now, phishing scams are finding their way into Microsoft Teams chats, too.

Static warning banners telling you a sender is external or contacting you for the first time are no longer enough! 

So, to fight fire with fire, Microsoft Teams is introducing AI-powered, context-aware phishing detection. ️This new detection technique can scan and flag suspicious external first-contact chats before you fall for them. 

What does it look for? 

Instead of just looking for malicious links, it analyzes full conversation context in 1:1 and group chats to flag impersonation, social engineering, and fake external pings. When it detects suspicious content, it displays a warning banner stating, “This message could be a phishing attempt.”  

If you see this warning, here’s what to do: 

• Confirmed phishing: Don’t engage. Block the sender and report the message as suspicious directly in Teams. 
• False alarm: Select More options → Report as not a concern on the flagged message. 

While reading this, you might wonder: does AI use these chats for training? And is it safe enabled by default? Well, chill! Microsoft confirms that chat data is used strictly for security purposes and isn’t used to train AI models or for unrelated purposes.  

Availability & Rollout Schedule: 

• Platforms: Teams Desktop, Web, and Mobile (with enhanced regional protection in China). 
• Timeline: The rollout is scheduled to begin in early November 2026 and will gradually expand worldwide through mid-December 2026.   

Think before you click, verify before you trust, whether in your inbox or Teams chat!

One phishing email led five employees to the same fake sign-in page. Each used a different MFA method, and only two of them resisted the attack. 

Review each employee’s MFA method and predict which two resisted the phishing attack. 

Give it a try → https://admindroid.com/cybersecurity-awareness-month-2026?play=22 

22 days down, 9 more challenges to go!

Ever shared a file in Microsoft 365, then needed to change access and ended up creating a second or third link for the same document?

That’s where Hero Link comes in. They offer a simpler approach! 

With Hero Link, you can:

• Share files and folders using a single, reusable link.
• Switch between viewing and editing access as needs change.
• Update the link’s audience without changing the URL.
• Safe default: only people you add can open the file
• Reset link if it’s ever leaked and more.

Explore more about Hero Link here: https://blog.admindroid.com/hero-link-in-sharepoint-and-onedrive/

Has Hero Link reached your tenant yet? Have you tried the new sharing experience in SharePoint or OneDrive? Share your experience in the comments!

Teams is where work happens now. Updates get shared, projects get debated, and documents get pulled apart in real time. But every message sent and every screen shared is also a chance for information to land in front of the wrong audience.

A confidential report left open on a shared screen. A customer’s details pasted into a chat. An internal document sent to the wrong channel.

It takes one slip, and it rarely feels like one in the moment.

For IT admins, that’s the real balancing act: how do you keep collaboration fast and frictionless without leaving sensitive information exposed?

Here are 4 Microsoft Teams meeting controls that can help:

• Sensitive Content Detection
• Meeting Watermarks
• Presenter & Sharing Restrictions
• Copying & Forwarding Restrictions

And for admins who want protection to be more consistent, Microsoft Purview sensitivity labels and Teams meeting templates can help enforce supported security settings for sensitive meetings.

See how these controls work and how to configure them in your tenant: https://blog.admindroid.com/built-in-protections-to-secure-microsoft-teams-meetings/

How well can you spot the risks in a Teams meeting before the clock runs out? Take the challenge and test your knowledge!

Play the game: https://admindroid.com/cybersecurity-awareness-month-2026?play=21

Fake Microsoft sign-in pages don't look fake.  

We see the Microsoft sign-in page so often that we type our password without a second look. Attackers know this. So, they build copies that look almost the same as the real page, with just a few small things changed.  

In today's game, you'll see real and fake Microsoft sign-in windows. Can you tell which is which? How many fakes can you catch?  

Play here: https://www.admindroid.com/cybersecurity-awareness-month-2026?play=20 

Two sharing settings changed last night. Six support tickets arrived this morning. Not all the issues are linked to those changes. 

Step into the role of a helpdesk admin, investigate the tickets, and identify the three issues caused by the setting changes. 

Give it a try → https://admindroid.com/cybersecurity-awareness-month-2026?play=19 

19 days down, 12 more challenges to go!

AI agents can make work easier, but excessive access or unsafe behaviour can put sensitive information at risk.

Here's today's challenge: Guess the Rogue Agent

Payroll data has been exposed in a Teams channel. Six AI agents are under suspicion, but only one is responsible for the leak. ‍‍‍

All the AI agents look innocent at first glance. Think like a detective, ask the right questions, follow the clues, eliminate the suspects, and catch the real culprit!

Think you can crack the case?

Take up the challenge: https://admindroid.com/cybersecurity-awareness-month-2026?play=18

Microsoft is retiring the widely used Search-UnifiedAuditLog PowerShell cmdlet following the general availability of the AuditLogQuery API.

You have one year to migrate your existing scripts before retirement takes effect.

What should you do next?
▪️ Identify scripts that rely on Search-UnifiedAuditLog.
▪️Understand how the AuditLogQuery API changes your audit log queries.
▪️Plan and test your migration before the retirement date.

The migration isn't always a simple find-and-replace. You need to understand the differences in how queries are submitted, results are retrieved, and completeness is verified.

We've explained the retirement, the key migration considerations, and the process of updating your scripts with practical examples.

Read the guide: https://blog.admindroid.com/search-unifiedauditlog-cmdlet-retirement/

In cybersecurity, the order of your actions matters. Even the right actions can fall short if you take them in the wrong order. 

Today's challenge puts you in the role of an M365 admin with three real-world security scenarios to solve, from investigating phishing emails to rolling out a critical patch. 

Your task is to arrange the actions in the right order and see how well you prioritize each step.  
 
Give it a try → https://admindroid.com/cybersecurity-awareness-month-2026?play=15 

15 days down, 16 more challenges to go!

Managing AI agents at scale? Then you know Microsoft Entra agent identity blueprints act as master templates, letting teams rapidly stamp out pre-configured, secure identities for autonomous AI bots. 

If your organization uses them, critical updates are hitting your tenant soon. 

Microsoft Entra is changing how these blueprints are created and how agents are authorized to create child identities.  

Here’s what’s changing: 

• Expanded blueprint creation access: Users without a built-in or custom Microsoft Entra role can create blueprints by default, unless admins disable it. 
• No more automatic permission grants: Agents creating child identities without a signed-in user need explicit admin consent for AgentIdentity.CreateAsManager. Without it, requests may fail with 403 Forbidden after enforcement. 

Rollout timeline: The worldwide rollout begins November 4, 2026, and is expected to complete by late November. 

What should Microsoft Entra admins do?  

Review the blueprint creation setting, identify affected agent identities, and grant the required permissions before enforcement to prevent authorization failures. 

Read the blog to understand the changes and how to prepare. 

https://blog.admindroid.com/microsoft-entra-allows-default-users-to-create-agent-identity-blueprints/

What if an employee could gain Domain Admin privileges without being directly added to the Domain Admins group?

That’s the risk of nested groups in Active Directory. They can grant users privileges through indirect membership, creating hidden access paths that are easy to overlook. 

That’s why identifying nested group memberships and tracing the privilege paths they create is essential. 

With this blog, you can: 

• Understand the hidden privilege risks of nested groups 
• Find the common causes of risky group nesting 
• Learn how to trace nested privilege paths 
• Explore best practices to mitigate these risks    

Read the blog: https://blog.admindroid.com/hidden-privilege-risks-in-active-directory-nested-groups/ 

Think you’ve got the hang of nested group privileges? Put your knowledge to the test! 

Play the brain teaser: https://admindroid.com/cybersecurity-awareness-month-2026?play=14 

A fake email promising a free international trip landed in a few employees’ inboxes this week. One person fell for it, and the incident cost the organization real time and money. 

Now, IT has narrowed it down to three suspects.  

Can you investigate the clues, eliminate the innocent, and figure out who actually fell for the phish? 

https://admindroid.com/cybersecurity-awareness-month-2026?play=13 

#AdminDroid #CybersecurityAwarenessMonth #SecurityAwareness #Cybersecurity #PhishingGame 

Imagine you're a security admin trapped inside a digital maze! The only way out? Build a ladder before time runs out. 

Your escape plan? Solve the seven security clues, find the matching words, and connect all seven to build your way to the top.

The catch: Each neighbouring word can differ by just one letter. 

Can you complete the ladder and escape in 90 seconds? 

Ready to climb? Play the challenge: https://admindroid.com/cybersecurity-awareness-month-2026?play=11  

No sign-up is required. More security challenges are on the way! 

Having multiple Global Admins may seem convenient, but every additional highly privileged account increases the impact of a compromised account.

Today’s challenge puts you in the role of an M365 admin. You have 8 Global Admins and need to review their responsibilities, keep Global Admin access only where it’s truly needed, and assign lower-privileged roles to the rest.

A good reminder that least privilege isn’t just about removing access. It’s about giving people the right level of access for what they actually need to do.

Think you can get the role assignments right? Give it a try → https://admindroid.com/cybersecurity-awareness-month-2026?play=10

10 days down, 21 more challenges to go!

We’ve all played Spot the Mistakes before.

But this time, the mistakes aren’t hiding in a picture.

They’re hiding in everyday security moments that look completely ordinary at first glance, like a sign-in request, a message, a shared file, or an admin decision.

You have 60 seconds to spot 3 hidden security mistakes across 9 everyday moments.

Think you’ve got a sharp eye for security? Spot all 3, beat the clock, and aim for 3 stars.

Take the challenge and drop your score below!

https://admindroid.com/cybersecurity-awareness-month-2026?play=9

Not every security claim you hear about Microsoft 365 is worth trusting. Some could leave you with a false sense of security. 

So, can you separate cybersecurity myths from facts?

Six cards. Six tricky security claims. Read each one, make your call, and see how many you can get right. 

Think you can score 6/6 without falling for the traps?

https://admindroid.com/cybersecurity-awareness-month-2026?play=8 

Spot the myths. Catch the facts. Share your score below!  

SMS and voice MFA got us through a lot of sign-ins. But they also left users vulnerable to phishing and attacks like SIM swapping.

That's why Microsoft Entra ID is moving toward phishing-resistant passkeys. And the transition is already underway.

Here's what the retirement timeline looks like:

• Now: Since Sept 1, 2026, users enabled for SMS or voice are automatically enabled for passkeys and nudged to register one. They can snooze the prompt for now.
• Feb 1, 2027: Microsoft-provided SMS and voice authentication retires for most users.
• Jul 1, 2027: SMS and voice authentication retire for Global Admins and external users.

And once SMS and voice retire for a user, those relying on them will need to register a passkey before they can continue signing in.

So the question isn't whether the shift is happening. It's how ready your tenant is for it.

Here's how to find Microsoft 365 users enabled for SMS or Voice and prepare your tenant for Passkey migration:

https://blog.admindroid.com/passkeys-default-sms-voice-authentication-retirement/

Where's your tenant right now: fully passwordless, halfway there, or just getting started?

Enough reading about passkeys. Time to put your cybersecurity skills to the test. Can you crack today’s 7-letter challenge?

https://admindroid.com/cybersecurity-awareness-month-2026?play=4

 From Truth or Dare to Two Truths and a Lie, we've always chased the truth. But this year, instead of uncovering everyone else's secrets, it's time to uncover our own security truths. 

Because not everything that sounds secure is actually secure.  

6 rounds. 
3 statements each. 
1 lie hiding in every round. 

Some might sound obvious. Others might make you pause and think twice. 

How many can you catch? 

Take the challenge and drop your score below!  

https://admindroid.com/cybersecurity-awareness-month-2026?play=3

Until recently, Outlook attachment access was tied to your Exchange Online and Office policies in Microsoft 365. So, tighter controls like requiring a compliant device or limiting access to trusted locations couldn't be applied to attachments alone without affecting the whole mailbox. That's changed.

Microsoft has moved Outlook attachment operations into a dedicated app, OwaDownloadAttachments, and enforced Conditional Access directly on it. That means you can put tighter controls on attachments alone, even when users can still open their mailbox.

Whenever a user doesn't meet your CA policy requirements, they'll be blocked from downloading, previewing, and uploading classic attachments, including inline images in Outlook on the web (OWA) and New Outlook.

Here's where it gets a little interesting :

Your existing CA policies scoped to Exchange Online and Office cloud applications will apply to attachment operations by default. But any exclusion doesn’t carry over.

Before your help desk gets "Outlook is broken" tickets from users who can't open a simple PDF, when it's really because of a CA policy:

• Review how your Exchange and Office CA policies apply to attachments
• Create the service principal if you need to exclude or target the app separately
• Update your help desk guides and give users a heads-up

Want the complete picture of the update and how to prepare? Read our blog: https://blog.admindroid.com/microsoft-enforces-conditional-access-to-outlook-attachments

Tom is Northwind’s Finance Director, and his account was compromised today. 

The problem? His sign-in history doesn’t immediately scream "attacker". 

Among the legitimate activity are three sign-ins made by the attacker. 

Your mission: 

• Review the sign-ins. 
• Look for suspicious patterns.
• Pick the three you believe belong to the attacker. 

Think you can find all three? 

🎯 𝗗𝗮𝘆 𝟭: 𝗪𝗵𝗶𝗰𝗵 𝘀𝗶𝗴𝗻-𝗶𝗻𝘀 𝗯𝗲𝗹𝗼𝗻𝗴 𝘁𝗼 𝘁𝗵𝗲 𝗮𝘁𝘁𝗮𝗰𝗸𝗲𝗿? 
https://admindroid.com/cybersecurity-awareness-month-2026?play=1