Microsoft is establishing firm cutoffs for several legacy architectures in today's briefing, starting the countdown on Exchange Web Services and Project Online migrations. We are also examining the shift toward authorization-layer phishing techniques, alongside major legal developments impacting mail-in ballot administration.
On Tuesday, Microsoft officially announced that Project Online will retire on September 30, 2026, due to legacy architecture limitations. End of sale for new tenant SKUs begins on October 1, 2025, with tenant creation stopping on April 1, 2026. Microsoft recommends transitioning to Planner (featuring the new AI-powered Project Manager agent), Project Server Subscription Edition, Dynamics 365 Project Operations, or Project desktop.
Why it matters
This announcement sets a firm 24-month countdown for clients with deep investments in Project Online, custom PWA workflows, or legacy SharePoint site integrations. As you plan migration roadmaps, evaluate whether workloads belong in Planner or require full Dynamics 365 Project Operations licensing to preserve complex portfolio tracking. For regulated life-sciences tenants, auditing dependencies on custom data models now will prevent emergency migrations when tenant creation locks down in early 2026.
Following up on the EWS AppID Allow Lists we tracked last week, Microsoft detailed the phased disablement roadmap for Exchange Web Services. Starting October 1, 2026, unmanaged tenants will automatically transition to a blocked status, culminating in a complete service shutdown on April 1, 2027. Administrators can temporarily preserve connection paths by configuring the allow list and explicitly setting EWSEnabled to True while completing migrations to Microsoft Graph.
Why it matters
Following up on earlier federation announcements, this explicit disablement schedule gives administrators a concrete operational runway. Unmanaged third-party backup tools, legacy mail-archiving scripts, and line-of-business integrations using EWS will break automatically on October 1 unless an AppID Allow List is populated. Auditing client tenants for legacy EWS traffic via Entra ID sign-in logs is an immediate priority for all consulting engagements.
Technical documentation published Monday outlines the Microsoft 365 Copilot Package Management API (`/beta/copilot/admin/catalog/packages`), providing six programmatic endpoints to inventory, filter, block, and reassign Copilot apps and declarative agents. The API requires a Microsoft Agent 365 license and AI Admin privileges, and features a security split where read operations support delegated user context while write operations require application permissions.
Why it matters
Managing agent sprawl manually across large tenants is rapidly becoming impossible. This API offers a programmatic handle to build custom administrative dashboards and automated containment scripts when unvetted declarative agents proliferate. Understanding the permission split allows platform architects to design secure background automation using service principals while restricting interactive inspection to delegated admin sessions.
Details surfaced Monday regarding a specification update to the Model Context Protocol (MCP) that transitions the framework to a stateless architecture. By removing persistent SSE streams, mandatory `Mcp-Session-Id` headers, and state handshakes, the spec enables standard round-robin load balancing and serverless execution. Client identity is now handled via Client ID Metadata Documents (CIMD).
Why it matters
Maintaining stateful Redis clusters and sticky routing solely to preserve AI agent protocol sessions introduces significant operational overhead in cloud environments. Moving MCP to stateless HTTP semantics allows developers to deploy tool-calling agents onto serverless platforms like AWS Lambda or Azure Functions seamlessly. This architectural shift significantly lowers the infrastructure cost and complexity of scaling enterprise agent integrations.
In a 6-3 decision on Monday, the U.S. Supreme Court lifted the federal district court injunction we've been tracking that had blocked executive order provisions restricting mail-in ballot administration. The majority ruled that the challenge brought by 23 states was premature and lacked standing at this phase. A separate federal court injunction directly prohibiting the U.S. Postal Service from altering mail-in voting handling rules remains active.
Why it matters
This ruling creates an asymmetrical legal landscape leading into the midterms: executive directives targeting state mail-in procedures gain legal footing, while operational Postal Service mail delivery rules remain frozen by lower court injunctions. State election administrators must navigate conflicting federal guidelines and local statutory mandates. Watch for state attorneys general to file updated injury claims to establish standing before ballot distribution dates.
Data released Monday shows the Dallas Housing Opportunity Fund (DHOF)—managed by LISC Fund Management and TREC Community Investors—has supported 858 affordable housing units across 10 projects since 2022. By deploying $6 million in municipal seed capital within a $39.8 million private pool, the fund spurred $248.3 million in total construction targeting households earning 30% to 120% of Area Median Income.
Why it matters
This public-private model provides a concrete blueprint for cities struggling with workforce housing deficits without overburdening municipal budgets. By strategically placing units in high-opportunity transit corridors rather than concentrating poverty, the fund demonstrates how catalytic public equity can attract private capital at a 40-to-1 ratio. Urban planners and housing advocates can cite this data when designing local revolving housing pools.
Adding to recent reports of Russian threat clusters abusing OAuth flows, Push Security published an analysis detailing how actors are shifting more broadly to authorization-layer attacks to bypass FIDO2 passkeys. Key vectors include device code phishing for pre-consented apps like Azure CLI, consent phishing, and a new technique termed ConsentFix that uses clipboard injection with OAuth authorization code grants.
Why it matters
Deploying phishing-resistant passkeys does not secure an identity perimeter if authorization flows remain unmonitored. By tricking users into completing device authorization codes or granting permissions to legitimate first-party app IDs, attackers gain persistent session tokens without needing passwords or MFA prompts. Enterprise defenders must immediately enforce Conditional Access policies to restrict device code flows to managed devices and audit OAuth consent grants for anomalies.
Nissan Canada detailed the refreshed 2027 Ariya on Monday, setting the entry SV FWD trim at $48,998 CAD to qualify for $5,000 federal EV rebates. The updated vehicle standardizes a native NACS charging port for direct Tesla Supercharger connectivity, Google built-in software with automated battery thermal preconditioning, and a 7 kW bi-directional charger capable of 1,500W V2L output.
Why it matters
Price adjustments and native NACS hardware demonstrate how automakers are redesigning EV offerings to capture mainstream buyers. Eliminating charging adapters while integrating automated thermal preconditioning into route planning directly addresses cold-weather charging degradation. For EV owners and fleet managers, native V2L power output adds practical utility for job sites and backup home power.
Legislative conference committees in Massachusetts are negotiating differences between House and Senate housing reform bills on Monday. The House favors a $500 million bill containing 'Yes in God's Backyard' (YIGBY) provisions allowing faith institutions to build affordable housing, while the Senate's $325 million draft proposes ending single-family zoning statewide to permit duplexes by right.
Why it matters
With the state facing a projected 222,000-unit housing deficit by 2035, the resolution of these bills will dictate municipal land-use authority across Greater Boston. Ending single-family-only zoning by right would unlock thousands of infill lots for small-scale developers, while YIGBY rules provide non-profit land assets a fast-track path around local zoning boards. Real estate leaders and municipal planners should track which mechanism survives the final compromise.
On Tuesday, Georgia Tech researchers published details on a hafnium oxide ferroelectric NAND flash memory architecture designed for deep-space computing. Tested up to 1 million rads of radiation—100 million X-rays—the memory chips store data via permanent electric polarization rather than trapped charges, demonstrating 30 times greater radiation tolerance than conventional NAND flash.
Why it matters
Data corruption from cosmic radiation is a primary bottleneck preventing the deployment of high-density edge AI processors on long-duration space missions. Eliminating charge-leakage failure modes through ferroelectric polarization allows onboard autonomous systems to process sensor data locally without heavy shielding or continuous ground validation. This provides hardware engineers a proven building block for deep-space exploration payloads.
The ongoing kernel conflict we've tracked between Windows 11 update KB5121003 and third-party RGB lighting utilities using `Inpoutx64.sys` is now triggering 'EXCEPTION_ACCESS_VIOLATION' crashes and reboots in games like THE FINALS and ARC Raiders. Game studios have issued workarounds advising users to delete registry keys tied to the driver.
Why it matters
If family or clients complain about sudden system instability or game crashes following August updates, inspect `System32\drivers` for `Inpoutx64.sys` before assuming a hardware failure. The issue highlights how stricter driver validation introduced in recent Windows 11 security patches directly collides with unsigned or legacy kernel handles.
Deprecation Timelines Force Accelerated M365 Architectural Migrations Hard retirement dates for Project Online and Exchange Web Services signal Microsoft's intent to clear legacy infrastructure and push enterprise tenants into Microsoft Graph and agentic workflows.
Identity Governance Shifts From Policy Documents to Infrastructure Control Runtime gateways, Package Management APIs, and automated system-preferred authentication reflect a industry-wide move toward dynamic enforcement over static sign-in rules.
Phishing Mechanics Adapt to Bypassing Passkey Protections As passkeys eliminate basic credential harvesting, threat actors are leveraging device code authorization flows, OAuth consent abuse, and local token replay to hijack enterprise sessions.
Local Municipalities Experiment With Seed Capital for Housing Deficits Cities like Dallas and Cottonwood are bypassing federal delays by utilizing revolving local funds and hotel conversions to deliver workforce housing in high-cost corridors.
NACS Adoption Accelerates Software and Thermal Hardware Standardization Automakers embedding native NACS ports are pairing hardware updates with automated battery preconditioning and proactive connector servicing to resolve public charging friction.
What to Expect
2026-08-28—Rural Basic Income pilot first benefit disbursements begin across seven Korean counties.
2026-08-30—NASA Nancy Grace Roman Space Telescope launches on a SpaceX Falcon Heavy from Kennedy Space Center.
2026-08-31—Power Platform native GitHub source code integration enters public preview.
2026-09-01—Entra ID automated passkey registration prompts begin for legacy SMS/voice MFA users.
2026-09-15—Power Apps online mode access to Dataverse reaches General Availability.
How We Built This Briefing
Every story, researched.
Every story verified across multiple sources before publication.
🔍
Scanned
Across multiple search engines and news databases
401
📖
Read in full
Every article opened, read, and evaluated
125
⭐
Published today
Ranked by importance and verified across sources
11
— The Tenant Desk
🎙 Listen as a podcast
Subscribe in your favorite podcast app to get each new briefing delivered automatically as audio.
Apple Podcasts
Library tab → ••• menu → Follow a Show by URL → paste