2025 CW 41 Microsoft 365 Message Center changes

1. CampaignInfo

The CampaignInfo table in the Advanced hunting schema contains information about email campaigns identified by Defender for Office 365. The table will have this schema to help the security teams to investigate threats targeting their users and organization:

2. FileMaliciousContentInfo

The FileMaliciousContentInfo table in the Advanced hunting schema contains information about files that were identified as malicious by Defender for Office 365 in Microsoft SharePoint Online, Microsoft OneDrive, and Microsoft Teams. The table will have this schema to help the security teams to investigate threats targeting their users and organization:

Here are a few sample queries to get you started:

//Emails sent as part of phishing campaigns

CampaignInfo

| where Timestamp > ago(7d)

| where CampaignType has "Phish"

| project NetworkMessageId, RecipientEmailAddress, CampaignName, CampaignId, CampaignType

| join (EmailEvents | where Timestamp > ago(7d)) on NetworkMessageId, RecipientEmailAddress

| project Timestamp, NetworkMessageId, Subject, SenderMailFromAddress, RecipientEmailAddress, LatestDeliveryLocation, LatestDeliveryAction, CampaignId, CampaignName, CampaignType

//Files identified as Malware modified in last 1 day

FileMaliciousContentInfo

| where ThreatTypes == "Malware"

| where LastModifiedTime > ago(1d)

1. CampaignInfo

The CampaignInfo table in the Advanced hunting schema contains information about email campaigns identified by Defender for Office 365. The table will have this schema to help the security teams to investigate threats targeting their users and organization:

2. FileMaliciousContentInfo

The FileMaliciousContentInfo table in the Advanced hunting schema contains information about files that were processed by Defender for Office 365 in Microsoft SharePoint Online, Microsoft OneDrive, and Microsoft Teams. The table will have this schema to help the security teams to investigate threats targeting their users and organization:

Here are a few sample queries to get you started:

//Emails sent as part of phishing campaigns

CampaignInfo

| where Timestamp > ago(7d)

| where CampaignType has "Phish"

| project NetworkMessageId, RecipientEmailAddress, CampaignName, CampaignId, CampaignType

| join (EmailEvents | where Timestamp > ago(7d)) on NetworkMessageId, RecipientEmailAddress

| project Timestamp, NetworkMessageId, Subject, SenderMailFromAddress, RecipientEmailAddress, LatestDeliveryLocation, LatestDeliveryAction, CampaignId, CampaignName, CampaignType

//Files identified as Malware modified in last 1 day

FileMaliciousContentInfo

| where ThreatTypes == "Malware"

| where LastModifiedTime > ago(1d)

Improved budget control through prepaid capacity

Departmental usage isolation via environment-level allocation

Simplified billing setup in MAC

Automated provisioning for Copilot Chat environments

Enhanced cost visibility and governance through detailed usage reporting in PPAC

The feature also supports unlicensed users and includes automatic fallback to PAYG when prepaid capacity is exhausted, ensuring uninterrupted service.

Existing pay-as-you-go billing methods will remain available and unchanged. Capacity Packs offer an additional prepaid option and do not replace current billing models.

The feature is on by default and requires no manual configuration to begin using.

What you can do to prepare

No admin action is required before rollout.

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

Improved budget control through prepaid capacity

Simplified billing setup in MAC

Automated provisioning for Copilot Chat environments

Enhanced cost visibility and governance through detailed usage reporting in PPAC

The feature also supports unlicensed users and includes automatic fallback to PAYG when prepaid capacity is exhausted, ensuring uninterrupted service.

Existing pay-as-you-go billing methods will remain available and unchanged. Capacity Packs offer an additional prepaid option and do not replace current billing models.

The feature is on by default and requires no manual configuration to begin using.

What you can do to prepare

No admin action is required before rollout.

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

Microsoft Purview Insider Risk Management (IRM) will be adding a new role--Data Security Investigation Contributor--to the Insider Risk Management Investigators role group. This will allow members of the Insider Risk Management Investigators role group to launch a Data Security Investigation (DSI) from an IRM case.

DSI is a new AI-powered solution that enables data security teams to identify incident-related data, conduct deep content analysis, and mitigate risk within one unified solution. DSI enables data security admins to efficiently identify incident-relevant content by searching their Microsoft 365 data estate to locate emails, Teams messages, Copilot prompts and responses, and documents. Once the investigation is scoped, DSI's generative AI capabilities allow admins to gain deeper insights into the impacted data, revealing critical security risks and sensitive information. Investigative capabilities include the ability to categorize evidence, perform vector searches, and examine impacted data for security and sensitive data risks. DSI visualizes correlations between investigation data, users, and their activities. To mitigate identified risks, DSI facilitates secure collaboration between partner teams. Post-investigation learnings can be used to refine existing policies to strengthen an organization's security practices.

The integration between IRM and DSI allows an IRM investigator to identify when a risky user needs deeper investigation to launch a pre-scoped investigation directly from the user activity pane, allowing them to view content analysis related to that user and better assess post-incident data impact.

This message is associated with roadmap ID 485707.

[When this will happen:]

Public Preview (Worldwide): We will begin rolling out early April 2025 and expect to complete by late April 2025.

General Availability (Worldwide): We will begin rolling out in mid-July 2025 (previously mid-June) and expect to complete by mid-August 2025 (previously mid-July).

Microsoft Purview Insider Risk Management (IRM) will be adding a new role--Data Security Investigation Contributor--to the Insider Risk Management Investigators role group. This will allow members of the Insider Risk Management Investigators role group to launch a Data Security Investigation (DSI) from an IRM case.

DSI is a new AI-powered solution that enables data security teams to identify incident-related data, conduct deep content analysis, and mitigate risk within one unified solution. DSI enables data security admins to efficiently identify incident-relevant content by searching their Microsoft 365 data estate to locate emails, Teams messages, Copilot prompts and responses, and documents. Once the investigation is scoped, DSI's generative AI capabilities allow admins to gain deeper insights into the impacted data, revealing critical security risks and sensitive information. Investigative capabilities include the ability to categorize evidence, perform vector searches, and examine impacted data for security and sensitive data risks. DSI visualizes correlations between investigation data, users, and their activities. To mitigate identified risks, DSI facilitates secure collaboration between partner teams. Post-investigation learnings can be used to refine existing policies to strengthen an organization's security practices.

The integration between IRM and DSI allows an IRM investigator to identify when a risky user needs deeper investigation to launch a pre-scoped investigation directly from the user activity pane, allowing them to view content analysis related to that user and better assess post-incident data impact.

This message is associated with roadmap ID 485707.

[When this will happen:]

Public Preview (Worldwide): We will begin rolling out early April 2025 and expect to complete by late April 2025.

General Availability (Worldwide): We will begin rolling out in mid-October 2025 (previously mid-July) and expect to complete by mid-December 2025 (previously mid-August).

Coming soon for Microsoft Viva Insights: The Skills landscape report, a new Microsoft Power BI report in the advanced insights app that introduces the skills landscape in your organization, powered by People Skills data. With this report, analysts and leaders can understand People Skills data and its usage in the organization, browse commonly used skills and areas of skills specialization, see how groups of skills are distributed across your groups, and explore the skills hierarchy.

A Microsoft 365 Copilot, Viva Suite, or Viva Insights license is required to enable People Skills data in Viva Insights.

This message applies to the Viva Insights web app.

This message is associated with Microsoft 365 Roadmap ID 491022.

[When this will happen]

Public Preview: We will begin rolling out late June 2025 and expect to complete by late July 2025.

General Availability (Worldwide): We will begin rolling out late September 2025 (previously early August) and expect to complete by late October 2025 (previously early September).

Coming soon for Microsoft Viva Insights: The Skills landscape report, a new Microsoft Power BI report in the advanced insights app that introduces the skills landscape in your organization, powered by People Skills data. With this report, analysts and leaders can understand People Skills data and its usage in the organization, browse commonly used skills and areas of skills specialization, see how groups of skills are distributed across your groups, and explore the skills hierarchy.

A Microsoft 365 Copilot, Viva Suite, or Viva Insights license is required to enable People Skills data in Viva Insights.

This message applies to the Viva Insights web app.

This message is associated with Microsoft 365 Roadmap ID 491022.

[When this will happen]

Public Preview: We will begin rolling out late June 2025 and expect to complete by late July 2025.

General Availability (Worldwide): We will begin rolling out late October 2025 (previously late September) and expect to complete by late November 2025 (previously October).

Coming soon for Microsoft Defender for Office 365: We are excited to announce the new CampaignInfo and FileMaliciousContentInfo data tables in Advanced hunting under Email & collaboration schema.

[When this will happen:]

Public Preview: We will begin rolling out early June 2025 and expect to complete by late June 2025.

General Availability (Worldwide, GCC, GCC High, DoD): General Availability: We will begin rolling out early July 2025 and expect to complete by late November 2025, covering both Advanced Hunting and Sentinel availability.

Coming soon for Microsoft Defender for Office 365: We are excited to announce the new CampaignInfo and FileMaliciousContentInfo data tables in Advanced hunting under Email & collaboration schema.

[When this will happen:]

Public Preview: We will begin rolling out early June 2025 and expect to complete by late June 2025.

General Availability (Worldwide, GCC, GCC High, DoD): General Availability: We will begin rolling out early July 2025 and expect to complete by late November 2025, covering both Advanced Hunting and Sentinel availability.

This message is associated with Microsoft 365 Roadmap ID 499421

When this will happen

Public Preview (Worldwide): Begins rolling out in late August 2025 and expected to complete by early September 2025.

General Availability (Worldwide): Begins rolling out in late September 2025 and expected to complete by mid-October 2025.

We're enhancing the Copilot Studio agents report to provide more actionable insights with weekly data aggregation and active user counts per agent. These updates will help organizations monitor agent performance more frequently and make faster decisions.

This message is associated with Microsoft 365 Roadmap ID 499421

When this will happen

Public Preview (Worldwide): Begins rolling out in late August 2025 and expected to complete by early November 2025 (previously early September).

General Availability (Worldwide): We will communicate via Message center when we are ready to proceed.

Introduction

We're introducing the Microsoft 365 Copilot agents report, a new Power BI report available in Microsoft Viva Insights. This report provides visibility into the usage of declarative agents, which extend Microsoft 365 Copilot capabilities. It enables leaders and admins to understand adoption trends across their organization and explore usage patterns for individual agents.

This new feature is associated with Microsoft 365 Roadmap ID 488104.

When this will happen

Public Preview (Worldwide): We will begin rolling out in early October 2025 (previously mid-September) and expect to complete by mid-October 2025 (previously late September).

General Availability (Worldwide): We will begin rolling out in early December 2025 and expect to complete by late December 2025.

Introduction

We're introducing the Microsoft 365 Copilot agents report, a new Power BI report available in Microsoft Viva Insights. This report provides visibility into the usage of declarative agents, which extend Microsoft 365 Copilot capabilities. It enables leaders and admins to understand adoption trends across their organization and explore usage patterns for individual agents.

This new feature is associated with Microsoft 365 Roadmap ID 488104.

When this will happen

Public Preview (Worldwide): We will begin rolling out in early October 2025 (previously mid-September) and expect to complete by mid-October 2025 (previously late September).

General Availability (Worldwide): We will begin rolling out in early December 2025 and expect to complete by late December 2025.

To help organizations manage metered consumption costs for Microsoft 365 Copilot Chat, we're introducing support for prepaid Capacity Packs in the Microsoft 365 admin center (MAC). This feature enables global administrators to use prepaid message bundles before incurring pay-as-you-go (PAYG) charges.

This update applies specifically to Copilot Chat environments provisioned via the Power Platform admin center (PPAC), including departmental or custom Copilot agents built using Microsoft Copilot Studio.

Each Capacity Pack includes 25,000 Copilot messages per month, which can be allocated to Copilot Chat environments via PPAC. Once enabled, MAC will prioritize usage from these prepaid packs and automatically switch to PAYG when capacity is exhausted.

Admins can monitor usage in PPAC, including:

Total messages consumed

Remaining prepaid capacity

Message allocation per environment

This update is associated with Microsoft 365 Roadmap ID 496139.

When this will happen

Targeted Release: We will begin rolling out in late September 2025 and expect to complete by late September 2025.

General Availability (Worldwide): We will begin rolling out in late September 2025 and expect to complete by early October 2026.

Introduction

To help organizations manage metered consumption costs for Microsoft 365 Copilot Chat, we're introducing support for prepaid Capacity Packs in the Microsoft 365 admin center (MAC). This feature enables global administrators to use prepaid message bundles before incurring pay-as-you-go (PAYG) charges.

This update applies specifically to Copilot Chat environments provisioned via the Power Platform admin center (PPAC), including declarative or custom Copilot agents built using Microsoft Copilot Studio.

Each Capacity Pack includes 25,000 Copilot messages per month, which can be allocated to Copilot Chat environments via PPAC. Once enabled, MAC will prioritize usage from these prepaid packs and automatically switch to PAYG when capacity is exhausted.

Admins can monitor usage in PPAC, including:

Total messages consumed

Remaining prepaid capacity

Message allocation per environment

This update is associated with Microsoft 365 Roadmap ID 496139.

When this will happen

Targeted Release: We will begin rolling out in late September 2025 and expect to complete by late September 2025.

General Availability (Worldwide): We will begin rolling out in late September 2025 and expect to complete by early October 2025.

Starting in October 2025, Global Administrators and AI Administrators will gain the ability to reassign ownership of shared agents created within the organization. This update improves administrative control and ensures continuity in agent management, especially when employees transition or leave.

This message is associated with Microsoft 365 Roadmap ID 502867.

[When this will happen:]

General Availability (Worldwide): Rollout begins early October 2025 and is expected to complete by late October 2025.

[Introduction:]

Starting in October 2025, Global Administrators and AI Administrators will gain the ability to reassign ownership of shared agents created within the organization. This update improves administrative control and ensures continuity in agent management, especially when employees transition or leave.

This message is associated with Microsoft 365 Roadmap ID 502867.

[When this will happen:]

General Availability (Worldwide): Rollout begins late October 2025 (previously early October) and is expected to complete by late November 2025 (previously late October).

This is a reminder based on our previous communication (MC1117814) regarding the Viva Engage email sender domain update. Please ensure your email configurations are updated, as we plan to roll out the new email domains for your tenant starting Monday, October 6, 2025.

[When this will happen:]

Rollout begins: Monday, October 6, 2025

Expected completion: Tuesday, October 7, 2025

Applies to U.S. and EU tenants currently receiving messages from @yammer.com and @eu.yammer.com.

[Introduction]

This is a reminder based on our previous communication (MC1117814) regarding the Viva Engage email sender domain update. Please ensure your email configurations are updated, as we plan to roll out the new email domains for your tenant starting Monday, October 6, 2025.

[When this will happen:]

Rollout begins: Monday, October 6, 2025

Expected completion: Tuesday, October 7, 2025

Applies to U.S. and EU tenants currently receiving messages from @yammer.com and @eu.yammer.com.

Earlier this year, the new Microsoft device ecosystem platform built on the Android Open-Source Project (AOSP) was announced delivering state-of-the art security, reliability, and manageability with Microsoft Intune. Microsoft Teams Android devices will be migrating to this platform. The first step in the migration is a firmware update to Microsoft Teams Android devices in 2024. The firmware update will move devices from Android device administrator to Android AOSP management.

[When this will happen:]

A Preview program for select Microsoft Teams Android devices is targeted for Q2 of calendar year 2024. General release of the firmware update with the Android AOSP management stack will happen starting in Q4 of calendar year 2024 throughout Q1 of calendar year 2025 for all eligible Microsoft Teams Android devices. Auto updates will commence starting May 15th into Q3 calendar year 2025.

Eligible Microsoft Teams Android devices will initially receive a manual firmware update in Teams Admin Center so IT admins can manually verify the migration on their own schedule on select devices of their choosing.

Eventually, the firmware update for migration will be scheduled as an automatic firmware update in Teams Admin Center. This automatic firmware update can be deferred for up to 60 days from first availability based upon the admin configured stages in Teams Admin Center.

Earlier this year, the new Microsoft device ecosystem platform built on the Android Open-Source Project (AOSP) was announced delivering state-of-the art security, reliability, and manageability with Microsoft Intune. Microsoft Teams Android devices will be migrating to this platform. The first step in the migration is a firmware update to Microsoft Teams Android devices in 2024. The firmware update will move devices from Android device administrator to Android AOSP management.

[When this will happen:]

A Preview program for select Microsoft Teams Android devices is targeted for Q2 of calendar year 2024. General release of the firmware update with the Android AOSP management stack will happen starting in Q4 of calendar year 2024 throughout Q1 of calendar year 2025 for all eligible Microsoft Teams Android devices. Auto updates will commence starting May 15th into Q3 calendar year 2025.

Eligible Microsoft Teams Android devices will initially receive a manual firmware update in Teams Admin Center so IT admins can manually verify the migration on their own schedule on select devices of their choosing.

Eventually, the firmware update for migration will be scheduled as an automatic firmware update in Teams Admin Center. This automatic firmware update can be deferred for up to 60 days from first availability based upon the admin configured stages in Teams Admin Center.