Microsoft 365 in September 2026: Copilot by licence and by credits, Copilot in SharePoint goes live, and more defaults

We closed August by noting how many new features were arriving already switched on. September carried on in the same vein — and added money to the mix. Microsoft split Copilot in two: everyday work is still covered by the licence, advanced capabilities are paid by consumption, in credits. On the same day Microsoft announced general availability of Copilot in SharePoint and OneDrive, and a few days later HTML pages in SharePoint that can’t be turned off for the whole tenant. This is the sixth instalment of the monthly recap — what September 2026 brought and what to do about it.

The main news, in plain words

A short summary for everyone who simply uses SharePoint and Microsoft 365 day to day:

• Copilot has two price tags. Chat and Copilot in Word, Excel or Outlook are still covered by the licence. New advanced capabilities — such as Cowork, which works on its own with mail, files and the web — are paid by consumption.
• Copilot in SharePoint and OneDrive is a finished product. Since 30 September it is no longer just a preview. Everyday features are in the licence, heavier work costs credits.
• Web pages from HTML. SharePoint will display an HTML file as an ordinary intranet page — whether Copilot created it or someone uploaded it.
• Plans from Teams meetings delete themselves. A Planner plan created from a meeting disappears after 180 days without a single task change.
• Teams on the web is moving to a new address — teams.cloud.microsoft, just as Copilot did in August.

If that’s enough for you, you have the big picture. For context and detail, read on.

Copilot by licence and by credits

The month’s most important news came on 25 September (MC1479276). Microsoft split Copilot into “everyday AI” in the per-user licence and “advanced AI” paid by consumption in Copilot Credits. The licence still covers Chat, Copilot in Word, Excel, PowerPoint, Outlook and Teams, and model choice. Credits pay for Cowork, the new Code (builds simple apps and dashboards from a description), Autopilot (a persistent personal agent, formerly Scout), the most capable models and advanced SharePoint capabilities. The rollout starts in the fourth quarter.

The good news for large tenants: in Enterprise environments nothing is billed until an administrator creates a spending policy in the Microsoft 365 admin center. Users will still see the new features, though — without a policy they get a message with a “Request access” option (from October; from November with deferred release). So expect questions about why “it doesn’t work for us”.

Two things are worth checking right away:

• “Auto-apply new services” is switched on by default in every spending policy (MC1470425). A policy you created for one service will automatically take on every new service paid with credits — advanced SharePoint capabilities included. If you don’t want that, switch the setting off in each policy.
• Newly purchased Copilot Business licences via CSP will have credits switched on by default from 1 December. Partner Center creates a default policy for them with a limit of 4,000 credits per user per month, and it can’t be turned off completely — only capped at zero. For now Microsoft exempts eleven countries; the Czech Republic is not among them. The Copilot price list gives no fixed price per credit; Microsoft’s illustrative examples assume USD 0.01 per credit, so the default cap would amount to up to roughly USD 40 per user per month on top of the licence.

On top of that come new models (MC1483844): GPT-6.1 Sol and Claude Sonnet 5.5 are arriving in Word, Excel, PowerPoint and Chat as part of the licence and switched on by default (Claude only where the Anthropic subprocessor is allowed). Claude Fable 5.1 and GPT 6 Astra are credits-only — in Cowork since September, in Chat and Office from early to mid-November (MC1519122). What else the Copilot price list doesn’t tell you, we covered in What the Microsoft 365 Copilot price list doesn’t tell you.

Copilot in SharePoint and OneDrive goes live

Since 30 September Copilot in SharePoint is generally available (RM501451), and Copilot in OneDrive with it, under the same licensing model. Questions over content, page authoring, metadata and skills stay in the Copilot licence. Credits pay for work at scale, image generation in libraries, AI site analytics and near-instant metadata autofill — and users are asked to confirm before credits are consumed.

For administrators the key date is 1 November. Until then the PowerShell opt-out from the preview (KnowledgeAgentScope) is honoured; after that, availability is managed only through the AI settings of individual sites and Restricted Content Discovery. If you switched Copilot in SharePoint off with a script over the summer, you have a few days left to move to the new controls.

HTML pages: on by default, no tenant-wide switch

In August we wrote that SharePoint would be able to display HTML as a page. In September Microsoft announced the feature (MC1479517), and in an October blog post it added one sentence worth knowing: HTML pages can’t be turned off for the whole tenant. Only the owner of a given site can disable them in its Site Pages library.

HTML created by Copilot, or uploaded from elsewhere, is saved to the Site Pages library and displayed with the site’s header, navigation and footer — including drafts, publishing and analytics. It runs in an isolated frame (sandbox), may call only selected libraries from the Microsoft CDN and reads live data from SharePoint lists, Excel and CSV. A Copilot licence is needed only for authoring with Copilot — anyone with edit permissions on the site can upload and publish HTML. The preview runs from October, general availability follows from mid-November to the end of December.

For intranets this adds a new governance question: who may publish pages on which sites that weren’t created in the SharePoint editor.

What switched on by itself

The September edition of the August list. None of it is bad in itself — it’s just better to decide before you hear about it from the helpdesk:

• Uploading “advanced” agents (with actions or an MCP server): if an administrator didn’t configure anything by 25 October, everyone may upload them (MC1472007).
• Reporting suspicious messages in Teams to Defender switches on on 25 October unless the organisation opts out (MC1478463, only with Defender for Office 365 P1/P2 or E5).
• The conditional access policy for risky users that Microsoft created in report-only mode in tenants with Entra ID P2 turns itself on in the week of 28 October (MC1476122). Exclude your emergency accounts from it.
• New Teams meeting controls with a two-step confirmation for screen sharing arrive from mid- to late October and can’t be disabled tenant-wide (MC1317197).
• A prompt box right on the Copilot button in Word, Excel and PowerPoint (Alt+C) — there is no separate switch (MC1470885).

Governance: Copilot retention and labelling at scale

Two September changes in Microsoft Purview deserve attention even in organisations that use Purview only “at half throttle”:

• Teams retention policies will stop covering Copilot (MC1481313). Legacy Teams policies used to apply to Copilot conversations as well; from late October to mid-November they will behave as Teams-only policies. If you are required to retain — or, conversely, delete — Copilot conversations, you need a separate policy for them.
• A library’s default label for older files too (MC1477181). A sensitivity label set as the default for a SharePoint library used to reach only new and modified files. A new policy applies it to files that were already in the library as well — for now one policy per tenant and at most ten sites.

An August promise was also kept: auto-labelling of up to 500,000 files a day went through a September preview and has been generally available since October. Policy simulation now handles 20 million items instead of 4 million. At the same time, Microsoft is retiring the classic DSPM and DSPM for AI experiences from 30 November (MC1481315) — everything moves to a single DSPM in the Purview portal.

Identity: SMS on the way out, your own provider from 30 October

In September Microsoft clarified the end of SMS and voice calls for authentication (MC1426371). The 1 February 2027 date stands; for global administrators and external users it is 1 July 2027. There is now a temporary opt-out from the automatic enablement of passkeys until 1 February — after that date, passkey registration becomes mandatory for users who have only SMS left. Organisations that genuinely need SMS can choose their own provider through the Microsoft Security Store from 30 October; the contract with that provider is the organisation’s own. Sign-in with an SMS code only, without a password (typically frontline staff), ends on 1 February 2027 even with your own provider (MC1474104).

Teams and Outlook in September

• Teams on the web is moving to teams.cloud.microsoft (MC1465764). The exemption from the redirect can be kept only until 31 December. As with Copilot in August: firewalls and proxies must allow the whole *.cloud.microsoft domain.
• Planner plans created from meetings are deleted after 180 days of inactivity (MC1479508). This applies only to new plans, opening a plan doesn’t count as activity, and the organiser is warned 30 and 7 days in advance. The first plans can therefore disappear in spring 2027 at the earliest.
• Attachments in Outlook on the web and new Outlook are subject to conditional access (MC1472591). An exemption set for Exchange Online doesn’t carry over to attachments — so a report that “the attachment won’t open” may be a policy, not an Outlook bug.
• Teams Events under new licensing (MC1479512): Microsoft 365 Business plans have only foundational event features, the advanced ones are in Teams Enterprise. If you run webinars, check your organisers’ licences.

Slips and corrections

The column also tracks what slipped or didn’t go to plan:

• Retiring one-time passcodes (OTP) for external sharing won’t happen “in October”, as we wrote in August. On 1 October Microsoft spread it from mid-October to the end of November (MC1243549).
• The new sharing model with one main link is rolling out from early October to the end of November (previously mid-September to late October). At its autumn OneDrive event Microsoft announced that it is preparing expiration for these links too — no date yet.
• Copilot UX components and SPFx 1.24 are heading for general availability in October; as of 24 October, however, only the first release candidate of SPFx 1.24 has shipped (React 18 confirmed). The new SPFx CLI has slipped to version 1.25.
• HTML pages start in October only as a preview; general availability comes from mid-November.
• Copilot Notebooks: in August we wrote that they “now have” two connected forms. Microsoft actually moved general availability to the turn of September and October (MC1420901).
• Self-service password reset with registered methods only applies from 7 November — Microsoft gives 9 November in the title of its message and 7 November in the schedule; register methods by 6 November (MC1325414).
• OneDrive on Mac moving to a new sync engine, which we wrote about in August, is something we couldn’t find in Microsoft’s September messages. Only a preview of syncing up to one million items on Mac is confirmed.

Deadlines: what’s coming

October has already seen the end of Teams live chat (5 Oct), the end of support for Office LTSC 2021 and Windows 11 24H2 Home and Pro (13 Oct) and the deletion of old Whiteboard boards (16 Oct). Since 10 October, in tenants that have EWS explicitly enabled (EWSEnabled=True), the switch alone is no longer enough — only apps on the EWSAllowedAppIDs list get EWS access.

Date	What ends / changes
mid-Oct–end of Nov 2026	End of one-time passcodes (OTP) for external sharing in SharePoint and OneDrive — move to Entra B2B
25 Oct 2026	Uploading advanced agents allowed for everyone unless an admin decided; Teams reporting to Defender on
28 Oct 2026	Entra ID P2 — the risky-user policy turns itself on
30 Oct 2026	Your own SMS provider via the Microsoft Security Store; cross-tenant calendar sharing via Cross-Tenant Access Policy
1 Nov 2026	End of the PowerShell opt-out for Copilot in SharePoint
3 Nov 2026	Entra — end of the MemberOf operator in dynamic groups
7 Nov 2026	Entra — self-service password reset with registered methods only
November 2026	Targeted Release — no more assignment changes (full retirement in January 2027)
30 Nov–31 Dec 2026	Purview — end of classic DSPM and DSPM for AI
1 Dec 2026	Copilot Business via CSP with credits on by default
31 Dec 2026	End of the exemption from the teams.cloud.microsoft redirect; around year end SMTP AUTH with Basic authentication also off by default
31 Jan 2027	Restricted SharePoint Search ends (replacement: Restricted Content Discovery)
1 Feb 2027	End of Microsoft-provided SMS and voice-call verification
1 Mar 2027	Classic publishing sites — no new ones
1 Apr 2027	EWS switched off for good; Graph file APIs stop returning pre-authenticated URLs
April 2027	SharePoint agents in the .agent format stop working
1 Jul 2027	Remote Event Receivers — final date; SMS and voice also for global admins and external users
1 Oct 2028	Classic SharePoint pages read-only

Two items in the table affect developers and integrations more than it seems. Pre-authenticated URLs in the Graph file APIs (MC1492958) are used by many older integrations and custom solutions — without changes they may stop working after 1 April 2027. And SharePoint agents in the .agent format can be converted with an Upgrade button to agents in the new Agent Builder from mid-November (they then have to be added to Teams chats and channels again); after March 2027 they stop working.

What’s around the corner

• Targeted Release is ending (MC1490899). From November you won’t be able to change who gets new features early; in January 2027 it will be replaced by Frontier, Standard and Deferred release. If you have a pilot group for new features, it’s time to reconfigure it.
• Plugins instead of Agents (MC1484008) — agents, skills and connectors will come together in one catalogue by the end of November, and the “Agents” button will be replaced by “Plugins”.
• Copilot Search as the default search in SharePoint and OneDrive for users with a Copilot licence — general availability in January 2027.
• Archiving files by retention policy to Microsoft 365 Archive (MC1325441, mid-November to early December) — Copilot doesn’t index archived content.
• From 4 November regular users may create “agent blueprints” in Entra unless an administrator turns it off (MC1506733).

Small things worth a mention

• Site metadata size is calculated differently from 20 October (MC1478966) — including library field data. A site that exceeds the 1 TB limit after the recalculation won’t be able to add new metadata.
• Microsoft 365 Backup raised its limits to a million items per workload and added an activity log in October; backup of Teams teams and channels is due in December. Note: shortening the retention period deletes older restore points after 30 days.
• Excel canvas (MC1485411) — Copilot builds an interactive, self-updating report from a workbook’s data.
• Power Automate and file thumbnails (MC1454816) — since 18 September the action for a SharePoint file thumbnail returns an image instead of a URL, and flows built on the old URL may fail.
• Mailbox archives of up to 3 TB at no extra cost and with no configuration (MC1472592).

What to take away from September

Three things to remember:

1. Copilot has two price tags. The licence covers everyday work, advanced capabilities cost credits. Review your spending policies, switch off “Auto-apply new services” where you don’t want automatic expansion, and if you buy through CSP, agree a limit with your partner before 1 December.
2. Copilot in SharePoint is a finished product and PowerShell no longer suffices. From 1 November its availability is managed only in site settings and through Restricted Content Discovery.
3. Check what switches on by itself. Agent uploads, Teams reporting, the risky-user policy, HTML pages — decide consciously for each whether it should run in your organisation.

---

At EP365 we handle these transitions with companies almost daily — and after September we expect the most questions about setting up Copilot credits (which spending policies to create and with what limits), managing Copilot in SharePoint without PowerShell and rules for publishing pages (who may upload HTML to the intranet). If you run into any of the above and don’t know where to start, take a look at our services or simply write to us — we’ll talk it through, no strings attached.

The next instalment of the monthly column comes out in early November — a recap of what October 2026 brought.