Five Microsoft 365 changes in and around September 2026 deserve a business owner's attention: Business mailboxes doubling to 100GB, Teams limits on messaging external users, Defender for Endpoint updates moving to Microsoft Update, SharePoint file-level archiving going generally available, and the roadmap becoming the "AI at Work" roadmap. Here's Key IT's plain-English read on what each one means for a business tenant.
If nobody in your business reads the Microsoft 365 message centre — and in most small businesses, nobody does — changes simply arrive: features appear, limits change, behaviours shift. That's usually fine, until one of the changes deserves a decision. Out of this month's stream, five are worth a decision or at least a conscious shrug. (For August's Copilot news, see our Copilot update.)
1. Are Microsoft 365 Business mailboxes going to 100GB?
Yes. Microsoft is doubling primary mailbox storage on Microsoft 365 Business Basic, Standard and Premium from 50GB to 100GB as part of its 2026 plan changes, with the rollout scheduled to finish by the end of September 2026 (check your own mailboxes' quota in the admin centre). It's the primary mailbox only — no extra archiving or compliance features come with it. Genuinely good news, with one caution: a bigger mailbox is not a backup or a filing system. If your business has been using "archive it in email" as a records strategy, doubling the shoebox doesn't make it a filing cabinet. Retention policies and proper document storage still matter, and they're part of how we set up Microsoft 365 for clients.
2. Who do the new Teams external messaging limits affect?
Only organisations still using just the default onmicrosoft.com domain. From mid-September 2026, Microsoft is limiting outbound Teams messages to external users from those tenants — a brake on the spam and phishing that has moved from email into Teams chat, where users' guard is lower (one reason the old phishing advice no longer works). Microsoft hasn't published the thresholds; if one is hit, messages to outsiders pause for a while and internal chat carries on. If your staff sign in as name@yourbusiness.onmicrosoft.com, adding your own domain is the fix. For everyone else this is quiet protection — and a good prompt to review your tenant's external-access settings, which most businesses have never opened.
3. What changes when Defender updates move to Microsoft Update?
Defender for Endpoint's detection and response (EDR) updates are moving out of the monthly Windows security update and into the standard Microsoft Update channel, so fixes can ship without waiting for the next one. If your updates are deployed by hand, the new Defender update package has to be added to that process. For businesses with managed patching this is a non-event — your provider adjusts and life continues. For businesses where nobody owns patching, it's a reminder that your security tooling has a supply line, and someone needs to be checking it's actually flowing.
4. What is SharePoint file-level archiving?
It lets SharePoint move individual files — not just whole sites — into cheaper Microsoft 365 Archive storage, and it's now generally available. Archived files stay in SharePoint with their permissions and retention labels intact; Microsoft 365 Archive is a pay-as-you-go add-on, so it must be set up first. For businesses drowning in old documents — and paying for the storage they sit in — this makes real housekeeping practical: keep the active files fast, move the 2019 project archive to cold storage, stop paying premium rates for files nobody opens. Worth a deliberate policy rather than ad-hoc use.
5. What does the "AI at Work" roadmap mean for your business?
It's a signal of where Microsoft's effort is going: AI. In late August 2026 Microsoft renamed the Microsoft 365 Roadmap the "AI at Work" Roadmap, and the release stream matches: the bulk of new investment is Copilot and agent features. The practical takeaway isn't hype — it's that AI features will keep arriving in your tenant switched on by default, and someone should be deciding which ones your business uses, and with access to what. That governance gap is what we cover in our safe AI adoption and managed IT work.
What should you check in your Microsoft 365 tenant this month?
- Mailbox sizes: the Mailbox usage report (Microsoft 365 admin centre, Reports, then Usage) shows each mailbox's size and quota.
- Your domain and Teams external access: confirm your own domain is added, then review External access in the Teams admin centre.
- Patching: if updates aren't automatic, make sure the Defender update package is in the process.
- Archiving: agree a rule for what gets archived, and by whom, before Microsoft 365 Archive is switched on.
- AI features: list which Copilot and agent features are enabled, and who decides.
Frequently asked questions
Do we need to do anything to get the bigger mailboxes?
Usually not — it's applied automatically to eligible Business licences. Two catches: the extra 50GB comes as a separate storage service plan in the licence, which must stay switched on, and mailboxes with an admin-set custom quota keep it. Then check who was near the old limit and whether your retention settings still make sense.
Will the Teams external messaging limits affect our business?
No, if your business has its own domain set up in Microsoft 365. The limits apply only to organisations using just the default onmicrosoft.com domain, and even then Microsoft expects normal business use to stay under them. If a limit is reached, messages to external users pause temporarily; internal chat is unaffected.
Who should be reading the Microsoft 365 message centre for us?
Whoever runs your IT. It's a core part of managing a tenant: most changes need nothing, some need settings reviewed, and a few need a business decision surfaced to you in plain English — which is exactly what a managed provider is for.
Can we turn off the AI features Microsoft keeps adding?
Largely, yes — most Copilot and agent features have admin controls. The point is that "on by default" means the decision is being made for you unless someone makes it deliberately.
When do the September 2026 Microsoft 365 changes take effect?
In stages. The 100GB mailboxes were due to finish rolling out by the end of September, the Teams limits began mid-September, the Defender change is due to finish on Windows 10 and 11 by late 2026, and SharePoint file-level archiving has been generally available since July. Your tenant's message centre shows the live dates.
Where do we find the Microsoft 365 message centre?
In the Microsoft 365 admin centre, under Health, then Message center. Admins can set up a weekly email digest there, so changes don't sit unread until one of them causes a problem.
Are your staff's logins already exposed? A free dark web scan checks your business email domain against known breaches.
Request the Free Scan