Microsoft is locking down the financial rules of engagement for enterprise Copilot usage, rolling out mandatory auto-apply spending caps this morning. Meanwhile, a massive new credential-hijacking campaign is proving that standard multi-factor authentication is no longer enough to secure the Microsoft 365 perimeter.
Under Message Center update MC1469958 released Thursday, September 10, 2026, Microsoft Purview Information Protection increased its auto-labeling simulation capacity from 4 million to 20 million items. The release expands targeting support to 1,000 individual SharePoint sites and up to 50,000 sites via adaptive scopes, alongside SiteTemplate filtering and 30-day processing summaries ahead of late October general availability.
Why it matters
The 20-fold increase in simulation volume solves a major friction point for consultants executing Purview DLP and retention migrations in enterprise tenants. Administrators can now validate complex auto-labeling rules across massive SharePoint document libraries without hitting item caps or running manual split-batch scripts.
Microsoft introduced a preview on Friday, September 11, 2026, for OneDrive Pay-as-you-go (PAYG) billing. The service charges $0.20/GB/month for tenant storage consumed beyond standard license allocations, providing a cheaper alternative to the $0.24/GB/month storage add-ons introduced earlier this summer.
Why it matters
Because this billing policy applies tenant-wide rather than per user, administrators must run PowerShell storage assessments prior to enablement. It offers SharePoint and OneDrive architects a flexible mechanism to handle temporary migration spikes or unarchived user data without locking clients into fixed add-on commitments.
Following the metered Copilot Credits preview we tracked earlier this week, Microsoft announced on Friday, September 11, 2026, a series of financial governance updates for Copilot Cost Management. The changes enable auto-apply spending policies by default for all new Unmetered/Utility-Based Billing (UBB) Copilot services, introduce user threshold email alerts, expand read-only access for consumption reporting, and add custom approval routing for Cowork credit requests.
Why it matters
Enabling auto-apply spending policies by default prevents unbudgeted consumption spikes as enterprise teams build autonomous agents and Cowork workflows. For M365 architects, this shifts governance from reactive invoice auditing to proactive threshold enforcement. Tenant administrators must review default credit allocations immediately to ensure critical production agents are not throttled when hitting automated caps.
Microsoft launched Dynamics 365 Activate in public preview on Thursday, September 10, 2026. The AI-powered tool analyzes existing Salesforce schema, custom apex code, data structures, and security dependencies to generate automated migration roadmaps and configuration templates for Dynamics 365.
Why it matters
For enterprise solution architects, this tool significantly cuts initial discovery and mapping hours during CRM platform shifts. However, technical leads must still audit the underlying data architecture, as automated tools can replicate dirty data or broken legacy relationships into the target Dataverse environment.
Advancing the legal battle over federal mail-in voting limits we've been tracking, a three-judge panel of the First Circuit Court of Appeals ruled on Thursday, September 10, 2026, to deny the Trump administration's request to stay Judge Indira Talwani's lower court injunction. The court noted the administration failed to provide evidence of mail ballot fraud and emphasized the risk of widespread voter disenfranchisement.
Why it matters
The First Circuit decision leaves the injunction in place just as mail-in ballots are being distributed nationwide. The legal focus shifts entirely to the U.S. Supreme Court, where the administration's emergency stay application—which we noted earlier this week—remains pending alongside opposing amicus filings from state election officials.
A white paper published by the Niskanen Center on Thursday, September 10, 2026, highlights that employer health insurance premiums have climbed 342% since 1999 while wages grew 119%. The report advocates for supply-side regulatory reforms in zoning and healthcare delivery over macroeconomic demand suppression.
Why it matters
The analysis explains why household financial pressure remains high despite declining headline inflation rates. For policy makers and regional planners, it argues that easing cost-of-living burdens requires targeted zoning expansion and healthcare supply reform rather than monetary tightening alone.
Adding to the wave of Evilginx-based AiTM attacks we've tracked from PhaaS kits like NovaCookies, security researchers published analyses on Thursday detailing BigBear 2.0. The new campaign used reverse proxies and geo-consistent residential proxy pools to capture 4,148 ESTSAUTH session cookies across 461 target organizations, specifically targeting managed service providers to achieve supply chain access and bypass Conditional Access geo-blocks.
Why it matters
Because Evilginx2 captures post-authentication session tokens, standard multi-factor authentication (including push notifications and authenticator apps) fails to block these intrusions. Security teams supporting M365 tenants must enforce phishing-resistant FIDO2 passkeys or strictly limit token lifespan using Continuous Access Evaluation (CAE) and device compliance policies.
Expanding on the rapid acceleration of non-Tesla NACS hardware we tracked earlier this week, EVgo announced on Thursday, September 10, 2026, that it is deploying Tesla V4 Supercharger stations capable of 500 kW and 1,000V at Midwest grocery locations. Beginning with Meijer stores, the units feature the built-in Magic Dock adapters we've recently seen deployed along the Mass Pike to support both NACS and CCS vehicles natively.
Why it matters
Combining 500 kW fast-charging with retail dwell times solves both charger utilization and speed constraints for 800V vehicle architectures like the Hyundai IONIQ 5 and Porsche Taycan without requiring external plug adapters.
The MBTA officially broke ground on Thursday, September 10, 2026, on the $1.2 billion North Station Draw One project. Contracting firm Skanska will replace a century-old bridge structure over the Charles River, expanding track approaches from four to six tracks to boost northern commuter rail line capacity.
Why it matters
Resolving this bottle-neck is a physical prerequisite for transitioning Greater Boston's rail network toward high-frequency regional transit service. Construction will run through fall 2032, directly expanding access for housing markets along northern transit corridors.
A catalog analyzing nearly 3,000 Type Ia supernovas published Thursday, September 10, 2026, indicates that dark energy density may not be constant. Combined with cosmic microwave background data, the results suggest the acceleration rate of cosmic expansion is slowing over time.
Why it matters
If confirmed by ongoing surveys, a dynamic dark energy component challenges the standard Lambda-CDM cosmological model and requires new theoretical models uniting quantum mechanics with general relativity.
Following the massive September Patch Tuesday release we covered on Wednesday, reports confirmed on Thursday that update KB5002914 causes copy-and-paste and formula dragging failures in Excel across Office 2016 through 2024. Simultaneously, server updates KB5122876 and KB5122882 trigger session deadlocks and connection hangs in Remote Desktop Services on Windows Server 2019, 2022, and 2025.
Why it matters
These regressions create immediate support headaches for IT consultants. While rolling back the updates restores core spreadsheet and remote access functionality, it leaves endpoints exposed to the 970 security vulnerabilities fixed in the September release cycle.
Platform Governance Shifts to Consumption-Based Financial Guardrails Microsoft's September updates across Copilot Credit metering, Pay-as-you-Go OneDrive storage, and model routing in Copilot Cowork show enterprise SaaS moving from static per-user licensing toward metered consumption enforcement.
Adversaries Exploit Post-MFA Session Persistence Over Credential Cracking Campaigns like BigBear 2.0 and PREY-0058 bypass traditional multi-factor authentication by capturing valid session tokens via Evilginx2 reverse proxies and vishing lures, forcing identity teams to enforce continuous token binding.
Deterministic Controls Replace Probabilistic AI System Guardrails Platform updates from Copilot Studio and enterprise agent architectures are prioritizing hard human approval gates and explicit permission scoping over natural-language system prompts.
Federal Election Mandates Face Operational Realities in State Courts Appellate court denials and amicus filings from state election officials reflect growing judicial and administrative pushback against late-stage federal changes to election procedures.
Municipal Infrastructure Approvals Balance Density Against Grid Baselines State executive orders and municipal zoning updates in Greater Boston highlight how local governments are conditioning major development permits directly on clean power provisioning.
What to Expect
2026-10-01—Massachusetts small clean energy zoning framework implementation deadline.
2026-10-13—End of official support for Windows 11 version 24H2.
2026-10-16—Public preview launch for Microsoft Dataverse column-based security filtering.
2026-10-31—General availability cutoff for Microsoft Purview auto-labeling 20M scale increase.
2026-11-03—U.S. Congressional Midterm Elections.
How We Built This Briefing
Every story, researched.
Every story verified across multiple sources before publication.
🔍
Scanned
Across multiple search engines and news databases
395
📖
Read in full
Every article opened, read, and evaluated
118
⭐
Published today
Ranked by importance and verified across sources
11
— The Tenant Desk
🎙 Listen as a podcast
Subscribe in your favorite podcast app to get each new briefing delivered automatically as audio.
Apple Podcasts
Library tab → ••• menu → Follow a Show by URL → paste