M365AILasith IyanAI Consultant to the Estate
Weekly  ·  Published Thursdays  ·  No Email Required

What Changed in AI —
And What It Means
for Your Tenant

Most AI newsletters report the announcement. This one reports the consequence: the administrative surface a release just added to your estate, the control that became available, and the thing that now needs a decision before your renewal. Anthropic, OpenAI, Microsoft Copilot, Google, and regulation, cited back to primary sources.

Read this week's brief Score your readiness
Issue 05  ·  24 October 2026

Copilot Draws a Trust Boundary Around External Content

Microsoft has described a new enforcement layer in Microsoft 365 Copilot that treats email from outside the organisation as untrusted. It works only where Outlook's external sender tagging is turned on. Cowork can now draw on Power Platform connectors and role-based plugins and can start tasks from events in other systems. Copilot Code has reached Frontier tenants. Anthropic and Google both added administrative controls, and a Claude Code upgrade changes how one MCP allow-list rule is applied. The Microsoft 365 Copilot release notes have had no new section since 6 October, so the Microsoft items come from the Microsoft Copilot Blog. This issue covers the period since Issue 04, which was published on 11 October.

The short version. Check whether external sender tagging is enabled in Exchange Online. Copilot's new prompt-injection protection depends on it, and Microsoft's guidance for CVE-2026-55145 lists it as the customer action. Review the plugin registry again, because Cowork's role-based plugins and more than twenty partner legal plugins are arriving there. Before upgrading Claude Code, check managed allowedMcpServers rules: from 2.1.305 one class of stdio server that those rules used to filter now loads, and only deniedMcpServers keeps it off. Anthropic's revised Usage Policy, covered in Issue 04, takes effect on 12 November. No new regulatory obligations took effect.

Microsoft 365 Copilot

Untrusted Content, Event-Driven Cowork, and Code in the Tenant

The Microsoft 365 Copilot release notes have not added a section since 6 October, which Issue 04 covered. Every item below comes from the Microsoft Copilot Blog, the Microsoft Security Response Center, or Microsoft Learn.

ChangeWhat it doesWhat it means for your tenant
Trust-aware handling of untrusted content
Microsoft Copilot Blog · 13 October · CVE-2026-55145		 Microsoft says it is introducing "a deterministic enforcement layer" between retrieved content and the main model. Content classed as untrusted is not passed to the model directly. It goes through a "quarantined, capability-constrained processing path" that returns a transformed version, with markers showing where the content came from. Initial coverage is "high-risk content, including external communications", with other content types still being explored. The post says that to configure the protection, administrators should enable "the applicable Outlook sender setting" and review the guidance for CVE-2026-55145. That advisory, an Outlook Copilot tampering vulnerability first published on 14 July and rated Moderate, marks customer action as required. Its FAQ says to enable Outlook's external sender tagging with Set-ExternalInOutlook in Exchange Online PowerShell. Run Get-ExternalInOutlook. If tagging is off, Copilot cannot identify external email as untrusted, and this protection does not apply. Turning it on also adds an External icon to messages from outside senders in every Outlook client, which can take 24 to 48 hours to appear. Brief the service desk first, and retire any mail flow rules that already tag subject lines, as Microsoft's cmdlet documentation advises. Review the tagging AllowList: neither the post nor the advisory says whether exempted senders are still treated as untrusted. This reduces prompt-injection risk from external email. It does not cover internal documents, SharePoint content, or the web, and Microsoft does not claim that it does.
Cowork: more plugins and event-driven tasks
Microsoft Copilot Blog · 21 October · rolling out		 Cowork now draws on Power Platform connectors, which are rolling out over the coming weeks, and on federated Copilot connectors over MCP. New Sales, Service, Education, and Legal plugins appear in a Roles & Industry section of the plugin library. Event-driven tasks, which could already start when an email or Teams message arrived, can now start from changes in connected systems, such as a new case in an ERP system or a deal that moves stage. They run "with your permissions", and actions that send a message or change a record wait for the user's approval. The post states that "Your admin decides which plugins and connectors are available". Review the plugin registry again under Agents > Tools, because the new role-based plugins and Power Platform connectors widen what users can request. The post names no administrative control over event-driven automations. Microsoft's Cowork plugin documentation also says there is "no single tenant setting" that stops users sharing a plugin they uploaded with named colleagues, although sharing with the whole organisation needs administrator approval. Plugin activity is recorded in Purview audit under Copilot activities, so confirm that the audit log is being retained before these features spread.
Microsoft Copilot for legal
Microsoft Copilot Blog · 15 October · generally available		 More than twenty legal skills are generally available in Word and Cowork. They review contracts against playbooks, propose redlines as tracked changes, and extract obligations and deadlines. Partner legal plugins started rolling out through the plugin registry, including Harvey, Legora, iManage Work, NetDocuments, Docusign, Relativity, Everlaw, and Bloomberg Law. Several of these plugins connect Copilot to external systems that hold privileged material. Agree with the legal team which of these to approve before anyone enables them, and assign them to the legal team's security group only, not to the whole organisation.
Copilot Code
Microsoft Copilot Blog · 21 October · Frontier only		 A natural-language coding experience in Copilot that builds working applications from the user's emails, meetings, documents, and connected data. Projects can stay on the user's device, connect to a GitHub repository, or be published to Copilot Managed Runtime, where "anyone in the organization with permission to the underlying data can use the app". Microsoft says such apps inherit the governance and security controls already configured. Its 25 September post on the runtime, which is in public preview, says hosted apps appear in the Apps inventory in the Microsoft 365 admin center. In Frontier tenants, this is a new route by which users can build and share applications without IT involvement. Find out whether published apps appear in the admin center Apps inventory, and decide whether users may connect projects to GitHub organisations outside your control. Neither post describes an approval step before an app is shared.
Interactive slides in PowerPoint
Windows, Mac, web · rollout complete by end of October		 A new Create interactive slide skill and ribbon button generate explorable dashboards, timelines, and comparisons from prompts or from other files. It is rolling out on Current Channel and Monthly Enterprise Channel. The post names no administrative control. Dashboards made from a snapshot of data may be shared after the data has changed, so adoption guidance should say that they are snapshots.

Sources: Building Trust-Aware Controls for AI, What's New in Cowork, Introducing Microsoft Copilot for legal, Copilot Code and Interactive slides in PowerPoint, Microsoft Copilot Blog; CVE-2026-55145, Microsoft Security Response Center; Set-ExternalInOutlook, Manage plugins for Copilot Cowork and Microsoft 365 Copilot release notes, Microsoft Learn; Copilot Managed Runtime.

The Frontier Labs

Administrative Controls Over New Models

  • Anthropic
    A Claude Code upgrade loosens one MCP allow-list rule
    From version 2.1.305 (20 October), allowedMcpServers no longer filters stdio servers in managed-mcp.json that use ${VAR} only in env. According to the changelog, a server of this kind that "your allowlist left out now loads on upgrade", and deniedMcpServers is the way to keep it off. The same version adds sandbox.allowNestedUserNamespaces, which the changelog says "lets them get around the sandbox's file protections". Versions 2.1.299 to 2.1.310 (14 to 23 October) also contain more fixes to permissions and the sandbox. MCP allow rules now match only the server they name. A fix stops sandboxed shell startup files from running outside the sandbox. Owners can control cloud sessions and Remote Control through Enterprise custom roles. A new claude_code.safety_event OpenTelemetry event records each tool call that a rule, hook, or the sandbox stopped. For your tenant: before rolling out 2.1.305 or later, list the stdio servers in managed managed-mcp.json files and add any that should stay blocked to deniedMcpServers. Leave allowNestedUserNamespaces unset in managed settings. If you collect Claude Code telemetry, add safety_event to it.
  • Anthropic
    Organisation controls for web fetch, and member instructions in the Compliance API
    The Claude Platform release notes for 20 October say organisation administrators can turn off web fetch, or set allowed and blocked domains for it, on the Capabilities page of the Claude Console. Managed Agents sessions now follow those domain restrictions as well as the organisation's web search settings. On 15 October the Compliance API began returning, in beta for Enterprise, the text that each member saved as Instructions for Claude in claude.ai or as Global instructions in Cowork. API version 2026-10-21 shipped with new major SDK versions, which are now licensed under Apache 2.0 instead of MIT. Claude Models on Google Cloud, operated by Anthropic and billed through Google Cloud Marketplace, launched on 22 October. For your tenant: if your organisation runs a Claude Console organisation, decide whether agents need open web fetch at all, and set a domain list if they do. If you run Claude Enterprise, add saved user instructions to the material you collect for eDiscovery. The Cowork named here is Anthropic's product, not Microsoft's Copilot Cowork, and the release notes do not suggest that these controls reach Claude used through Microsoft Copilot.
  • Anthropic
    Agent Skills donated to the Agentic AI Foundation
    On 22 October Anthropic transferred the Agent Skills standard, its name, and its repository to the Agentic AI Foundation under the Linux Foundation, which already holds MCP. Anthropic says more than 70 platforms have integrated the format, including ChatGPT, GitHub Copilot, and VS Code. The post describes no change to the format. This is a governance change for the standard and requires no action.
  • OpenAI
    Service tier restrictions at organisation level
    The API changelog for 21 October lets administrators choose which service tiers each project can use and restrict tiers across the whole organisation. The Decisions API became generally available on 22 October, and the Responses API added 12-hour prompt caching on 20 October. The changelog records no model deprecations or data-retention changes for the period. For your tenant: if teams hold OpenAI API organisations, the tier restriction is a cost control. Set it at organisation level so that projects cannot opt into more expensive tiers without approval.
  • Google
    Gemini 4 Argon, and Vault exports of Gemini conversations
    Gemini 4 Argon began rolling out to Google AI Pro and Ultra subscribers on 13 October. This is a model release, noted for completeness. On 22 October Google Vault began exporting Gemini in Workspace conversations from Gmail, Drive, Docs, Sheets, Slides, and Meet, filtered by user, organisational unit, and date, as JSON. It captures only conversations created while conversation history is on. Gemini Notebook is now a connected app in the Gemini app, on by default for administrators and off by default for users in the European Economic Area. For your tenant: where Google Workspace runs alongside Microsoft 365, check that Gemini conversation history is enabled for the organisational units that legal hold must cover. Otherwise there is nothing for Vault to export.

Sources: Claude Code changelog; Claude Platform release notes; Donating Agent Skills to the Agentic AI Foundation; OpenAI API changelog; Gemini release notes; Google Vault filtered exports for Gemini in Workspace and Gemini Notebook in the Gemini app, Google Workspace Updates.

Regulation

A Consultation on Enforcement Procedure

Little to act on. As reported by Agence Europe, on 12 October the European Commission opened a consultation, running until 9 November, on a draft implementing regulation. The draft sets out how the Commission conducts penalty proceedings under the AI Act, including safeguards for the companies involved and limitation periods. The Commission's own pages could not be retrieved for this issue. The draft concerns the Commission's enforcement procedure and places no obligation on organisations that deploy AI. NIST's AI Risk Management Framework page records no new publication since April.

Method

How This Brief Is Assembled

The value of a brief like this is entirely in what it leaves out, so the sourcing rules are worth stating.

  • Primary sources first. Vendor engineering blogs, official release notes, model cards, roadmap entries, and regulatory publications — not aggregator summaries of them.
  • Every item links out. If a claim cannot be traced to a primary source or credible reporting, it does not appear.
  • Rumours are labelled as rumours, or omitted. Most weeks they are omitted.
  • The filter is the estate. Model benchmark results are noted briefly; a change to Copilot's administrative surface is covered in full. The test is whether it changes what a tenant administrator can see, control, or has to decide.
  • No email is required to read it, and there is no list to join.

Sources Monitored

Each issue is compiled from the following, plus credible reporting where a primary source is not yet published.

Microsoft 365 Copilot release notes Microsoft 365 Roadmap Microsoft Community Hub Microsoft Tech Community blogs Anthropic news & model cards OpenAI announcements Google AI & DeepMind blogs EU AI Act & Commission publications NIST AI RMF updates

Views expressed are personal and independent of any employer. Vendor names and trademarks belong to their respective owners.

Archive

Previous Issues

Issues are listed newest first. The brief above is always the current one; earlier issues are summarised here rather than reprinted in full.

  • 11 October 2026

    Issue 04 — Plugins Become the Unit of Copilot Governance

    Plugin registry · Claude Sonnet 5.5 and GPT-6.1 Sol in Copilot · item-level oversharing report · Anthropic Usage Policy revision · Claude Code fail-closed hooks
  • 25 September 2026

    Issue 03 — Copilot Separates Everyday AI From Metered Work

    Copilot pricing and spending policies · Claude Opus 5.5 and GPT-6 Sol in Copilot · federated connectors · Outlook inbox rules · Claude Code managed-settings fixes
  • 17 September 2026

    Issue 02 — A Week Decided by Defaults

    Grok in Copilot · Domain Exclusion returns · PowerPoint Brand Kit and Skills · Gemini connectors · API key governance
  • 10 September 2026

    Issue 01 — The Week the Frontier Labs Both Shipped

    Claude Fable 5.1 · GPT-6 Astra · nine Copilot changes · EU AI Act enforcement

Reading the News Is Not the Same as Being Ready

Four minutes across eight pillars will establish whether any of this week's changes are reachable from where your tenant currently stands.

Take the assessment Suggest an item