If you manage a Microsoft 365 environment, or even just rely on Outlook to get through your day, this past week gave you a lot to pay attention to. A major outage disrupted email and collaboration tools for millions of users, Microsoft flipped the default sign-in method for the first time in years, and a quieter but important change to password resets is landing on September 7. Below is a rundown of the Microsoft 365 updates that actually matter this week, along with what you should be doing about each one.
What happened with Microsoft 365 this week
The short version is that Exchange Online had a rough few days. A widespread authentication problem knocked out mail flow, search, and several connected services starting on August 31, and the effects were still being cleaned up as late as September 2. If you noticed Outlook acting strange, you were far from alone.
The Exchange Online outage that knocked out Outlook, Teams, and more
Microsoft traced the disruption to "core authentication configuration issues used by multiple internal services within the Exchange Online infrastructure." That single misstep had a ripple effect across the platform. According to Microsoft's own incident tracking, the outage also affected OneDrive for Business and SharePoint Online, Microsoft Teams, Microsoft Purview, and Microsoft Defender XDR.
Users weren't just dealing with slow email either. Microsoft listed several distinct symptoms, including delays or failures when sending or receiving email messages, delays or incomplete results when searching mailboxes, and authentication-related errors when accessing Exchange Online services. For a lot of businesses, that meant a stretch of hours where basic communication tools simply couldn't be trusted.
The recovery was gradual rather than instant. By Monday evening, Microsoft said Outlook users should see gradual recovery to mail flow, though search functionality remained degraded. Search issues improved not long after, and by early Tuesday the company reported that service availability remains stable above 99 percent and the majority of users should no longer be seeing impact from this issue.
The bigger lesson here isn't really about this one incident. It's about what it reveals. When a single authentication component has a bad day, it can take down email, files, chat, security tooling, and compliance systems all at once. If your business has never mapped out what happens during a multi-hour Microsoft 365 outage, this is a good week to have that conversation internally.
Passkeys are now the default sign-in method in Microsoft Entra
Separate from the outage, Microsoft also rolled out one of its bigger identity changes of the year. Starting September 1, 2026, passkeys became the default authentication method in Microsoft Entra, replacing Microsoft-provided SMS and voice authentication, with the change rolling out that day and completing by February 1, 2027.
This isn't a sudden lockout. Anyone currently using text or phone-call codes for multifactor authentication is being moved into the new system automatically, but gently. Anyone currently set up for text or phone-call codes is automatically enabled for passkeys, and the next time they complete a sign-in they get prompted to register one, though it is a nudge rather than a wall since people can skip it.
Why is Microsoft pushing this now? The reasoning ties directly back to how much AI-driven phishing has improved. Attackers have gotten dramatically better at tricking people into handing over codes sent by text or phone. Passkeys are built to resist exactly that kind of attack, which is why Microsoft is treating this as foundational rather than optional going forward.
What this means for your SMS and voice authentication users
If nobody on your team has said anything about this, expect some confused messages once employees start seeing an unfamiliar prompt. The retirement timeline gives you breathing room, since after February 1, 2027, anyone whose only second factor is a text message or phone call is required to register a passkey during sign-in before they can continue into their account. Organizations that genuinely still need SMS or voice codes for certain users will need to line up a third-party telecom provider through the Microsoft Security Store rather than relying on Microsoft to keep providing that service for free.
The practical move here is simple. Get ahead of the automatic enrollment by communicating with your team now, rather than letting them discover a new security prompt on their own and start calling your help desk in a panic.
A new password reset rule kicks in September 7
There's a smaller but easy to miss change coming just a few days later. Right now, Microsoft Entra ID's self-service password reset feature will sometimes accept contact details stored in the directory even if a user never formally registered them as an authentication method. That flexibility goes away soon. Starting September 7, 2026, only explicitly registered authentication methods will be accepted for SSPR verification, and users without registered methods will be unable to complete password resets.
This one is worth checking before the deadline rather than after. If a chunk of your users have never gone through formal authentication method registration, they could find themselves locked out the next time they need to reset a forgotten password. A quick look at your registration details in the Entra admin center will tell you whether this affects your organization.
Copilot keeps expanding, this time with Python in Excel
Not everything this week was about outages and security deadlines. Microsoft also continued rolling out new Copilot capabilities across its apps. One update that stands out for data-heavy teams is the ability to run Python directly inside Excel through Copilot. As Microsoft describes it, Edit with Copilot now helps users work with Python in Excel by executing code for advanced analysis, automation, and data transformation, with results outputted directly in the workbook, allowing for statistics, simulations, and advanced visualizations using existing workbook data.
For anyone who has ever exported data out of Excel just to run a proper analysis somewhere else, this closes that gap. It's a small feature on paper, but it's the kind of thing that quietly saves hours for people who work in spreadsheets all day.
What this means for the week ahead
Taken together, this week is a good reminder that Microsoft 365 updates rarely arrive one at a time. You've got a reliability event that exposed how interconnected these services really are, a major identity shift that changes how people log in, a compliance-style deadline around password resets, and ongoing feature growth in Copilot that keeps changing what "normal" work looks like inside these apps.
None of these changes require panic, but they do require attention. Take a few minutes this week to check your authentication method registrations, have a short conversation with your team about the upcoming passkey prompts, and make sure whoever handles IT for your organization has a plan in case Exchange Online has another rough day. Staying a step ahead of these changes is a lot easier than reacting to them after something breaks.