1. Exchange Online Protection Update – “Monitor Action in Safe Attachments Policy” to Retire by August 2025
Overview
Microsoft is going to retire Monitor action in the Safe Attachments policy for Exchange Online Protection (Defender for O365), concluding the process by late August 2025. Post this update, Safe Attachments policies will only support Off, Block, and Dynamic delivery actions.
The Monitor action previously allowed attachments to be scanned in a sandbox, but still delivered to users—even if they were flagged malicious. These reports would then be used to track such detections without enforcement.
So, as part of this retirement, Microsoft will automatically convert all existing Monitor actions to Block. That said, they will leave this policy’s priority, status, recipients, etc. unchanged.
Also, “Redirect messages with detected attachments” setting, which was previously dependent on the Monitor action, is also going to be removed.
Impact
- Policies that use Monitor will automatically switch to Block.
- Monitor option will be gone from Defender portal and PowerShell.
- The Redirect messages with detected attachments option won’t be available.
- Users can not configure Safe Attachments policies with Monitor action after this change.
Action Needed
Review all Safe Attachments policies. If any of your users are using Monitor, switch to Block. Or you can use Evaluation mode if you need audit-only behavior.
On the other hand, use Threat Protection Status report under Evaluation mode for monitoring.
Learn more: Safe Attachments – Microsoft Learn
2. SharePoint SendEmail API Set to Retire by October 2025
Overview
Microsoft announces retirement of SP.Utilities.Utility.SendEmail API in SharePoint Online.
This API is commonly used in custom solutions and Power Automate workflows and it will stop functioning after October 31.
New updates include removal of the Power Automate license requirement, automatic M365 environment setup for scheduled prompts, etc but no changes to existing DLP policies though. Also, Copilot for M365 users will also be able to access scheduled prompts from this July.
Admins can now track API usage using Purview audit logs. All they need is to search for the SendEmailApiInvoked operation.
If results show ApplicationDisplayName = “Workflow”, those items follow the SharePoint 2013 Workflow retirement path. They are not impacted by this update though.
Impact
- The SendEmail API will cease all functionality after October 31.
- Any custom code or processes depending on this API won’t be able to send emails from SharePoint Online.
- No changes required for existing DLP policies.
- M365 Copilot scheduled prompts will have their roll out in July 2025.
Action Needed
Identify affected components. Run an audit log search in Purview portal. Migrate to Microsoft Graph’s SendMail API, or use Power Automate’s Outlook connector with the “Send an email” action
3. Microsoft Teams Devices on Android – Mandatory Authentication Upgrade Timeline
Overview
Microsoft is going to enhance security of Android based Microsoft Teams devices i.e. Teams Phones, Panels, Displays, Teams Rooms on Android, etc. They are basically employing Entra ID tokens to transition them into modern authentication.
This shift enables features i.e. Continuous Access Evaluation, IP based conditional access, etc. So to avoid service interruptions, you need to mandatorily update devices before next year: 2026.
Impact
Admins need to update Android-driven Teams devices to the minimum required app versions:
- Teams Phones: 1449/1.0.94.2025020301
- Teams Rooms on Android: 1449/1.0.96.2025020302
- Teams Panels: 1449/1.0.97.2025020502
- Teams Displays: Version still to be announced
Key Dates:
- July 31, 2025: Devices on supported versions will begin using modern authentication, excluding Teams Displays.
- September 30, 2025: All MTRA devices on minimum versions must adopt modern authentication.
- December 31, 2025: Legacy authentication will be retired fully.
Action Needed
Update all certified Android Teams devices to the required app versions ASAP to ensure uninterrupted service.
4. OneDrive Unlicensed Accounts – Upcoming Enforcement and Required Admin Action
Overview
Microsoft is going to enforce some stricter policies on unlicensed OneDrive accounts for all commercial tenants. This enforcement drive already began in Jan 2025 and continues until October this year. They basically aim to archive/restrict access to accounts without valid licenses. On the other hand, they are also going to offer some handy tools to manage/archive/delete them.
June last week is the time Microsoft enhances the Unlicensed OneDrive Accounts report with detailed explanation of each account status. Admins now need to act based on enforcement timelines and new reporting to avoid data loss/access loss.
Note: These changes do not currently apply to Education tenants. But they still carry storage/compliance/security implications.
Impact
- January 2025: Enforcement rollout began.
- June 24, 2025: New report reasons available for better admin insight.
- July 28, 2025: Cutoff date for classifying old vs new unlicensed accounts.
- September 26, 2025: Unlicensed accounts (prior to July 28) become read only.
- October 29, 2025: These accounts get archived.
- Post-July 28 unlicensed accounts:
- Day 60: Read only mode.
- Day 93: Archived/recycled. Deprovisioned if billing not enabled.
After archiving, accounts are going to be inaccessible to users. But admins can still manage them.
Admins can:
- Enable billing to access/edit.
- Delete accounts.
- Renew licenses to avoid enforcement.
Accounts with 93+ days of unlicensed status are inaccessible unless billing is set up.
Action Needed
After Oct 29, 2025: Archived accounts require billing to be reactivated or they surely remain inaccessible.
5. External Users Must Be Reinvited After Enabling SharePoint + Entra B2B Integration
Overview
Organizations that use SharePoint or OneDrive with Microsoft Entra B2B integration need to reshare all previously shared content with external users from July 1, 2025.
Any links shared before enabling this integration, specifically those using OTP method, won’t work. The change is sure to enhance guest access security as it shifts all future sharing to Entra B2B Invitation Manager.
Impact
- Who’s affected: Organizations that have already enabled or plan to enable SharePoint/OneDrive integration with Entra B2B.
- What breaks: All external sharing links created before the integration that used OTP will stop working.
- End user experience: External users trying to access affected links will see error message:
- “Sorry, something went wrong. This organization has updated its guest access settings. To access this item, please contact the person who shared it with you and ask them to reshare it with you.”
- Workaround: You need to reshare content via new B2B-based sharing mechanism. If the original sharer is unavailable, you need another authorized user to send invitation.
Action Needed
- Notify users about the upcoming change.
- Plan for MFA. All external users will be asked to register for multi factor authentication.
Windows Management Experts
Now A Microsoft Solutions Partner for:
✓ Data & AI
✓ Digital and App Innovation
✓ Infrastructure
✓ Security
The Solutions Partner badge highlights WME’s excellence and commitment. Microsoft’s thorough evaluation ensures we’re skilled, deliver successful projects, and prioritize security over everything. This positions WME in a global tech community, ready to innovate on the cloud for your evolving business needs.
Unlock the Full Potential of Microsoft 365
Keep your business at the cutting edge with the latest Microsoft 365 enhancements. The future of work is evolving. Are you ready? Connect with our experts today to ensure your Microsoft 365 & Azure systems are secure and future-proof.
