Microsoft announced on October 12 that Search-UnifiedAuditLog, the Exchange Online PowerShell command many of us use to pull the Microsoft 365 audit log, will stop working on October 15, 2027. It works as normal until then and there's no tenant setting to put it off, but the notice tells admins to track down every script and workflow that calls it.

That's a bigger deal than it sounds, because this is the command the playbooks tell you to run. Microsoft's guide to investigating a compromised mailbox uses it, and so do Microsoft's own incident responders in their December 2023 write-up of a real OAuth attack. Mandiant's managed defense team recommended it in a 2020 post, and CISA's Untitled Goose Tool, last updated October 13, still pulls the audit log with it. Microsoft's last two retirement notices for older audit commands, in August 2024 and July 2025, both told admins to move to this one.

The replacement is the Graph AuditLogQuery API, and it isn't a drop-in swap. You register an app, an admin approves the permissions, and each search is created, checked until it finishes, and then read. The baseline is 200 searches per rolling 24 hours, with more for bigger tenants. On the plus side, it takes a list of users, so a loop that searches one user at a time can become a single search, and one query can return up to a million records instead of 50,000. But every script still has to be rewritten.

Microsoft says to use the Office 365 Management Activity API for recurring downloads, and nothing in the notice retires it. The catch is that Microsoft's FAQ says that API only returns the last 7 days, while the cmdlet returns the full retention period, so it can't answer what happened three months ago.

One more gap: Microsoft's Graph page lists the new API for the global service but not for US Government GCC High, DoD or China's 21Vianet cloud, and the notice only says "Worldwide."

What else in your environment calls this command, and if you're in a government cloud, has anyone heard what the plan is?defence

So, I work in a health system and we constantly have issues with our users putting in tickets about external recipients unable to open our encrypted emails. I have explained to the users that they need to make sure they are sending to the proper address, explain to the recipient that they need to click on the “Read Message” button in the email and not the attachment that shows up, and even gave them some troubleshoot tips to send to the recipients in the event they have a problem. I still constendly get tickets and managers emailing my boss demanding that I fix a problem that isn’t there..in my opinion. Recently I had a staff member start including me in the recipients replied to help the recipient directly. In this instance, the code that OTP was never received. In that instance I let them know to check junk/spam and get with their email admin to see if the message was blocked somewhere else since it comes from Microsoft and not our hospital.

Anyone have a successful tips to education the end users, as well as the recipient. I’d love to change the Microsoft encryption email that gets sent out to have our branding or something but haven’t found a good place to do that. Is it possible via Poweshell?

Last note. I don’t hate email, I just hate that end users can’t attempt to understand why we have DLP and these safety measure in place and that even though people have issues, it’s not our fault.

Outside sales rep here. I have 100+ accounts and want to use Copilot as a lightweight CRM.

Most of my customer data already lives in M365 — emails and OneDrive. I also use Plaud AI to record and transcribe meetings, then clean up the summaries with Claude AI before storing them. Maybe 10 transcriptions per day. Needs to be mobile friendly.

My problem is I don't know where in M365 to store those cleaned up transcription summaries so Copilot can reliably find them alongside my emails. My corporate IT restricts connecting Outlook to anything outside M365, so the solution needs to live entirely within the Microsoft ecosystem.

What are other M365 users doing to:
-Store meeting summaries so Copilot can reliably surface them alongside email history — OneNote, SharePoint, OneDrive?
-Use Copilot as a practical day-to-day sales tool across a large account base?
-Build a lightweight CRM workflow that stays entirely inside M365?

M365 Business license. Everything needs to stay inside the Microsoft ecosystem.

A user has an issue with sharepoint, whenever she creates a file in a sharepoint folder and closes it, it created a new one with her name at the end...

Example:

file.xlsx original

once she closes

file-name.xlsx

She does have a laptop and desktop, and it is happening on both.

Any ideas?

A user sees another employee’s account in the Microsoft Copilot account switcher at m365.cloud.microsoft/chat. The account does not appear in Edge profiles, Windows accounts, or any other Microsoft 365 application.

We cleared all Edge browsing data and reproduced the issue in InPrivate mode, but the other account still appears.

Based on the impacted user's description he's not able to switch to the other account so maybe this is only a visual MS bug ?

Company wide it's the first reported issue, but it may have occured for others.

Me for example I don't see this account switcher button yet.

Have someone here seen this occurance before ?

Could this be stored in Copilot-specific account data or the Windows WAM/OneAuth identity cache?

Is there an admin-side method to remove it?

In our Entra ID tenant (cloud-only, no on-prem sync) password expiration is set to one year. When I run Get-MgDomain, I see PasswordValidityPeriodInDays = 365, so the policy looks like it's configured correctly.

However, when checking the lastPasswordChangeDateTime property on our users, I see plenty of accounts with a last password change date well over a year ago.

Does anyone know if this policy is actually still works? And is lastPasswordChangeDateTime a reliable property to check this against?

**Adding users to multiple Teams and channels can be a tedious task, so I decided to simplify it.**

With my new app, you can:

* Sign in to your tenant

* Retrieve your Teams and channels

* Build a reusable list

* Add a user to the selected Teams and channels

* Edit and save the configuration as a JSON file for future use

Simple, reusable, and designed to make Teams administration easier.

[mthorngaard/teams-membership-manager: Local web app for adding a Microsoft 365 user to a maintained list of Teams and channels.](https://github.com/mthorngaard/teams-membership-manager)

I haven't gone into the MS 365 admin center in months, all of a sudden people are complaining about their deleted items not getting emptied automatically. Where do I go check the auto delete policy in the new admin center? I can't find anything.

About a week ago, I created a Distribution List in the Exchange Admin center. Today, I found out that it would be much better if the distribution list was a Microsoft 365 group so that it would have a SharePoint site associated with it.

I went back into Groups -> Distribution List -> highlighted the list name and selected Change Group Type -> Send upgrade request. There are two owners of the group so I selected one of them and then sent the request to one of the owners to upgrade the site. The owner got the email request and approved it. It then said that the Upgrade Process was Initiated. It also said that this normally takes 5-10 minutes to complete.

I did that at 8:00am eastern and its now 3:45pm eastern. When I go back into Exchange Admin Center -> Groups -> Distribution List, it's still listed there and not in the Microsoft 365 group. I tried initiating a new request for it to be upgraded but when I did that it said "Upgrade process failed". I'm guessing it failed because it was already requested once to be upgraded.

Is there anything I can do to fix or see what is going on with this group? Should I delete the Distribution List group and then recreate it as a Microsoft 365 Group? Any help or advice would be greatly appreciated.

Hi All,

Just seeing if anyone else has this issue. When using the tenant switcher to connect to another O365 tenancy with a GDAP relationship, under Admin Centres we have no Identity shortcut to get us into Entra.

It shows when i'm in my tenancy and i can connect to their Entra portal when using my credentials and the direct link like the below:
https://entra.microsoft.com/<Customer Name>.onmicrosoft.com

Does anyone else have this issue? Microsoft's first line have said this is wither by design or a UI issue.

We are Win11 users, and some of our users are having issues searching files on local desktop (not online). When I search for files I have a search box that says search and has a magnifying glass with some sparkles around it (new Dell XPS laptop), whereas other users just have a search box with regular magnifying glass (no sparkles). They are on regular laptops or desktops.

How can I enable 'intelligent' search for them?

The Entra admin center will soon get a new user role permission to control whether users can create agent blueprints. The control will be enabled by default. I think this is a terrible idea. Outside the hallowed walls of Microsoft, does the need really exist to allow average users to create agent blueprints? I don’t think so. Agents are like apps. They need to be controlled and managed by people who know what they are doing.

https://office365itpros.com/2026/10/15/agent-blueprint-option/

So is it not possible to call them if I have a billing issue? Every time I try to open a Word file this infernal app takes me to a page saying that I need to change my payment method... but they've been taking the payment out regularly every month from that method! I don't get it! Any advice as to how I can actually talk to someone in billing about this?

In addition to my feature submission request, if anyone has suggestion for workarounds in Planner (and ways to integrate it with the rest of the 365 suite), I would love to hear them!

We're a company with three different office locations in the same city.

I'd like to automatically add the location details of the meeting room (the one I select when creating the invite) as text in every calendar invitation I send, so external recipients always know exactly where they need to be before yet another guest ends up at the wrong location.

Does anyone know how to set this up tenant-wide?

Hi everyone,

We have an odd case, several groups have suddenly had their mailboxes seem to disappear.

It has coincided with the issues with people being able to reply to mail enabled groups, but it seems to stem beyond that.

It's like some level or corruption is affecting them, the group is still present, teams site still present but mailboxes disappear from outlook, bounce backs then when trying to email them.

If we use PowerShell to query them, nothing present, check deleted groups, nil - change logs show nothing happening with it also.

Microsoft support being as absolutely useless as they are, won't escalate the case

I know they had an issue with groups mailboxes receiving mail however the fact that trying to view the group mailbox in exchange online management throws an error, the mailboxes that are showing this error are also now gone from outlook clients access, they receive bounce backs.

But they are just dumping this under the "check the public advisory for the issues" and "we will escalate the display problem with them, it's just a UI issue because you can view the group details under the groups section of the management console so it's fine, it's just a bug in the exchange management console"

We have another separate client where this exact same thing has occurred but with 1 users mailbox, Microsoft support still can't figure out where the mailbox just went, it's just disappeared and again appears corrupted, but OneDrive, SharePoint, Teams etc all still present.

Has anyone else experienced similar?

Cheers

I work for a very small company that doesn’t have an IT department. Myself and a colleague deal with any IT issues that occasionally pop up but one of the biggest issues is we don’t have admin access to the work email. It was set up decades ago by someone and no one has a clue who it was so there’s no chance of getting into it that way.

Does anyone know of an email address or phone number that we can call to try and get admin access assigned to us?

Idk if this makes any sense because I'm tired and just kind of give up on this. I feel like I'm doing so much research and trying to find instructional resources but don't understand what anyone is talking about/

I'm new to a very small team and trying to create/find a pre-built an integrated system for my teammate and I to manage our partnership with another organization. The partnership is fairly new and there is no collaborative system to keep everything together, and even though there have been no issues yet, there will be. I think I know what we're looking for and how we'll use it, but I just don't understand how to build this. It's easy to have shared files, but we need to track assets, when activations are coming up, track our tasks and item's we're waiting on, and anything important we need to go back to reference.

In addition to this, I need help with my outlook--I know I need to organize/automate it but idk how.