Five things Microsoft just changed in your 365 tenant — September 2026
Doubled mailboxes, new Teams messaging limits, Defender updates moving to Microsoft Update, and file archiving going live. What September's changes mean.
Microsoft ships changes to 365 continuously, and most announcements aren't worth your time. These five are. Here's what changed in and around September 2026, and what each one means for a business tenant.
If nobody in your business reads the Microsoft 365 message centre — and in most small businesses, nobody does — changes simply arrive: features appear, limits change, behaviours shift. That's usually fine, until one of the changes deserves a decision. Out of this month's stream, five are worth a decision or at least a conscious shrug. (For August's Copilot news, see our Copilot update.)
1. Business mailboxes are doubling to 100GB
Microsoft has announced that mailbox storage on Business plans doubles from 50GB to 100GB at no extra cost. Genuinely good news — with one caution: a bigger mailbox is not a backup or a filing system. If your business has been using "archive it in email" as a records strategy, doubling the shoebox doesn't make it a filing cabinet. Retention policies and proper document storage still matter, and they're part of how we set up Microsoft 365 for clients.
2. Teams gets limits on messaging outsiders
From mid-September, Microsoft is introducing limits on how many external users a Teams account can initiate chats with — a brake on the phishing campaigns that have moved from email into Teams chat, where users' guard is lower. If your team genuinely messages many external contacts, watch for friction; for everyone else this is quiet protection. It's also a good prompt to review your tenant's external-access settings, which most businesses have never opened.
3. Defender updates are moving to Microsoft Update
Updates for Microsoft Defender for Endpoint components are shifting to arrive through the standard Microsoft Update channel. For businesses with managed patching this is a non-event — your provider adjusts and life continues. For businesses where nobody owns patching, it's a reminder that your security tooling has a supply line, and someone needs to be checking it's actually flowing.
4. SharePoint file-level archiving is generally available
SharePoint can now archive individual files to cheaper storage, not just whole sites. For businesses drowning in old documents — and paying for the storage they sit in — this makes real housekeeping practical: keep the active files fast, move the 2019 project archive to cold storage, stop paying premium rates for files nobody opens. Worth a deliberate policy rather than ad-hoc use.
5. The roadmap is now "AI at Work" — read the signal
Microsoft has renamed its 365 roadmap branding around "AI at Work", and the release stream matches: the bulk of new investment is Copilot and agent features. The practical takeaway isn't hype — it's that AI features will keep arriving in your tenant switched on by default, and someone should be deciding which ones your business uses, and with access to what. That governance gap is what we cover in our AI and managed IT work.
Frequently asked questions
Do we need to do anything to get the bigger mailboxes?
No — capacity increases roll out automatically to eligible Business plans. The useful action is checking whether anyone was near the old 50GB limit and whether your retention settings still make sense.
Will the Teams external messaging limits affect our business?
Only if your staff initiate chats with unusually many external users. Normal collaboration with known partners is unaffected — the limits target mass-outreach patterns typical of phishing campaigns.
Who should be reading the Microsoft 365 message centre for us?
Whoever runs your IT. It's a core part of managing a tenant: most changes need nothing, some need settings reviewed, and a few need a business decision surfaced to you in plain English — which is exactly what a managed provider is for.
Can we turn off the AI features Microsoft keeps adding?
Largely, yes — most Copilot and agent features have admin controls. The point is that "on by default" means the decision is being made for you unless someone makes it deliberately.
The next step
If these changes are landing in a tenant nobody actively manages, that's the real finding of this post. Call 1300 053 948 or see our Microsoft 365 services — setup, security and the ongoing decisions, handled.
Related Key IT services
More insights
Passkeys for business
Passkeys make stolen-password attacks useless — and Microsoft 365 supports them today. What…
Read article →Microsoft 365Microsoft's 2026 legacy login shutdown
Microsoft is disabling legacy authentication and Basic Auth across Entra ID in 2026. Here's how…
Read article →Microsoft 365Microsoft 365 plans compared
Business Basic, Standard or Premium? A clear comparison of Microsoft 365 plans for Melbourne…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.