Microsoft 365 Data Residency Switch, Copilot Cost Controls, EWS Cutoff & More: Top Enterprise Changes

Tom Arbuthnot (Empowering.Cloud) and Rolf Tröndle (Change Cockpit) pick out the Microsoft 365 enterprise changes worth acting on this month. They cover a new in-country data residency switch (MC1470876, MC1470878) with a 14 December deadline, the EWS switch-off from 1 October (MC1469960), Copilot credit spending controls (MC1470425) and passkeys as a first MFA method (MC1450133).

This post summarises the highlights.

Chapters

• Act now: EWS switches off from 1 October unless you have set EwsEnabled to true. Project Online Essentials also reaches end of support on 1 October.
• Act by 14 December: check the in-country data storage setting if your tenant is in France, Germany, Norway, Sweden or Switzerland.
• Plan: agree who in the business owns Copilot credit spending, and decide your passkey strategy before phase 1 arrives in October and November.

Chapters

• 0:00 Introductions
• 0:32 New data residency control: store Microsoft 365 customer data in-country — MC1470876, MC1470878
• 3:06 Build apps in Copilot Studio and Copilot Cowork (Frontier) — MC1469329
• 5:13 Cowork effort control — MC1461699
• 6:57 Copilot cost management: spending policies, alerts and consumption dashboards — MC1470425
• 9:10 Fable 5.1 in Cowork and Copilot Studio with enterprise data protection — MC1465748
• 11:40 EWS switch-off and EWSAllowedAppIDs — MC1469960
• 13:55 Passkeys as a first MFA method — MC1450133
• 15:11 Passwordless password change in My Sign-Ins — MC1437671
• 16:13 Shared voicemails in the Queues app for call queues and auto attendants — MC1287371, MC1443511
• 17:02 QR code protection for Teams messages from external users — MC1470410
• 18:55 Microsoft 365 Roadmap becomes the AI at Work Roadmap — MC1461528
• 20:20 Project Online Essentials end of support — MC1466302
• 21:20 Refreshed Teams meeting experience — MC1317197
• 22:19 AI toggles in Teams meetings — MC1319216
• 23:13 Channel whiteboards now stored in SharePoint — MC1253753
• 24:12 Call delegation: lock a call and delegate warning tone — MC1429012
• 25:06 Retirement of the Microsoft 365 companion apps — MC1474111
• 26:11 Change the organiser of a meeting — MC1472028
• 28:48 Self-service Copilot connectors — MC1459140
• 30:08 Excel Copilot Change History skill
• 30:57 Auto-expanding archive capacity increases to 3 TB — MC1472592
• 33:12 Wrap-up

Which Microsoft 365 changes need action this month?

Five changes have a deadline or a direct cost impact. The rest are user-facing changes your adoption team should communicate.

Why did tenants get two different data residency Message Center posts?

Some tenants received the new in-country storage control switched on by default (MC1470876) and others switched off (MC1470878). If yours is off, your data can move from in-country storage to regional storage within the EU Data Boundary when the setting takes effect on 14 December.

The control applies to tenants in France, Germany, Norway, Sweden and Switzerland. Data stays inside the EU Data Boundary either way. For organisations with in-country data residency commitments, though, that is a compliance change.

Admin path: Microsoft 365 admin center → Settings → Org settings → Organization profile → Data location

For a related data boundary issue in Copilot, see Microsoft 365 Copilot Flex Routing and the EU Data Boundary.

What happens when EWS switches off on 1 October?

From 1 October, Microsoft switches off EWS in any tenant where EwsEnabled is not set to true. If your EWSAllowedAppIDs list is empty, Microsoft fills it in from the last 60 days of usage. If you set the list yourself, Microsoft never changes it.

Your tenant receives Message Center posts listing the apps still using Exchange Web Services. Tom's reminder is that these targeted posts only appear in your own Message Center. If they are new to you, Message Center and the Microsoft 365 Roadmap explained covers how targeting works.

How do the new Copilot cost controls work?

MC1470425 adds spending policies that automatically include new services and agents, email alerts when users reach a spending threshold, consumption dashboards for the AI Reader, Global Reader and License Administrator roles, and custom approval policies for Cowork credit requests.

Tom describes cost management as "the hottest topic at the moment in my enterprise conversations." His view is that IT enables the service and the business decides what counts as a good spend. Two related changes push consumption up:

• Cowork effort control (MC1461699): users choose light, medium or high effort for each task. Higher effort uses more credits, and it also makes simple answers slower.
• App building in Cowork and Copilot Studio (MC1469329): Frontier only for now. Published apps appear in the admin centre under Apps. The open question is who maintains an app after its creator leaves.

Does Fable 5.1 in Copilot keep data in the EU or UK?

No. Fable 5.1 (MC1465748) no longer needs the "Anthropic models with data retention" setting, so Anthropic does not store your data. Processing still happens in US data centres, however, and the "AI providers as subprocessors" setting is still required.

For more on the subprocessor setting, see OpenAI as a Copilot subprocessor: what changed and what to check.

When do passkeys become a first MFA method?

Phase 1 runs from October to November and covers synced passkeys, Entra passkeys on Windows and FIDO2 keys. Phase 2 runs from January to February 2027 and covers Windows Hello for Business, macOS Platform SSO and Authenticator passwordless. Users will be able to register a passkey first, without Authenticator as a fallback.

A separate change (MC1437671) lets passwordless users change their password from My Sign-Ins. It is off by default. Tom points out the trade-off: if a passkey is hijacked, it could be used to change the password. This arrives as Microsoft retires SMS and voice MFA in Entra (MC1426371), so plan the two together. See also the Microsoft Entra passkey documentation.

What else changed in Teams and Microsoft 365?

• External QR codes blurred in Teams chat (MC1470410). Users must click to reveal them. Tom notes the real risk is a user scanning the code with a less well-managed personal phone.
• Shared voicemail in the Queues app (MC1287371, MC1443511). Requires Teams Premium.
• Refreshed meeting experience (MC1317197) and AI toggles in meetings (MC1319216).
• Channel whiteboards stored in SharePoint (MC1253753).
• Call delegation lock and warning tone (MC1429012).
• Users can change the meeting organiser (MC1472028). Phase 1 covers meetings without a Teams link.
• Self-service Copilot connectors (MC1459140). New connectors sit in the admin centre for seven days before users see them, so check weekly.
• Microsoft 365 Roadmap renamed the AI at Work Roadmap (MC1461528). It now includes Dynamics 365, Power Platform and Dataverse.
• Auto-expanding archives increase to 3 TB (MC1472592) for E5, A5, G5, F5 Compliance and Purview Suite licences.

Frequently asked questions

Which tenants are affected by the Microsoft 365 in-country data residency switch?

Tenants in France, Germany, Norway, Sweden and Switzerland. Tenants that received MC1470878 have it off by default.

What date does EWS switch off in Exchange Online?

1 October, unless EwsEnabled is set to true.

Will Microsoft overwrite my EWSAllowedAppIDs list?

No. Microsoft only fills in the list if it is empty.

Which roles can see Copilot consumption dashboards?

AI Reader, Global Reader and License Administrator.

Is passwordless password change on by default?

No. An admin must enable it.

When do the Microsoft 365 companion apps retire?

16 December.

Go deeper

• Every Message Center post in this episode is linked on the ChangePilot portal.
• In-depth breakdowns of individual changes are on the ChangePilot Microsoft 365 blog.

Insights summarised by AI from the episode transcript, reviewed by the Empowering.Cloud team.