The article now describes App Intelligence as using application permissions and activity, adds an owner-notification preview and confirmation workflow, and documents audit-data coverage and reporting delays.
Agentic-user sharing policy guidance arrives before SharePoint’s temporary-URL retirement
Two administrator-level issues stand out: Microsoft has documented an off-by-default tenant policy to block external sharing by agentic users, while SharePoint temporary authentication URLs are scheduled for retirement on April 1, 2027, breaking dependent Power Apps and Power Automate functionality. The week also brought opt-in pay-as-you-go billing for storage overages in January 2027, sensitivity-label-protected PDF annotation in late January, and direct OneDrive video sharing in Teams events beginning mid-November. Remaining page edits were largely operational guidance rather than availability announcements.
- SharePoint temporary authentication URLs retire April 1, 2027
SharePoint · General
SharePoint temporary authentication URLs will be retired on April 1, 2027. Power Apps and Power Automate functionality that relies on them will break, making dependency identification and remediation a time-sensitive administration task.
- New guidance documents an off-by-default agentic-user sharing block
Agents and Copilot · Permissions and governance
A tenant-level policy can block agentic users from sharing SharePoint and OneDrive content with external users. It is off by default and can be scoped to all agentic users or users associated with selected application blueprints through SharePoint Online PowerShell, including first- and third-party applications.
- Pay-as-you-go billing planned for SharePoint storage overages
SharePoint · Licensing and billing
An opt-in meter planned for global rollout in January 2027 will charge for SharePoint storage used beyond the included quota. It integrates with Microsoft 365 Archive and requires Azure billing permissions.
- Protected PDFs will support web annotation without losing labels
SharePoint · General
From late January 2027, users with editing rights will be able to annotate sensitivity-label-protected PDFs in OneDrive for Business and SharePoint on the web. Saving preserves both the annotations and the protections; the notice requires no admin action.
- Teams events will support direct OneDrive video sharing
SharePoint · Permissions and governance
Beginning in mid-November 2026, event organizers and producers can use “Manage what attendees see” to share OneDrive videos directly during Teams events, avoiding screen sharing or PowerPoint embedding for playback. No admin action is required.
Prioritize identifying Power Apps and Power Automate functionality that uses temporary authentication URLs before April 1, 2027. Decide whether to enable and scope the agentic-user policy to all users or selected application blueprints through SharePoint Online PowerShell; it is off by default. If adopting storage-overage billing, arrange the required Azure billing permissions. The PDF and Teams-event updates require no admin action according to their notices.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
Updates this week
Sites, hubs and intranet
1 updateThe page now describes personalized favorites and recents, plus quick access to Discover, Publish, Build, and OneDrive. It also clarifies global navigation requirements, permissions, Teams integration, and the possible 24-hour rollout delay.
Content, versions and storage
1 updateTrim Versions
Doc updateThe article was revised with clearer wording, identifies SharePoint Administrators as able to queue trim jobs, and simplifies the What-if and manual expiration guidance. It now highlights the 30-day minimum and removes the previous text about versions created before January 1, 2023.
SharePoint agents and Copilot
1 updateRestrict external sharing by agentic users in SharePoint and OneDrive - SharePoint in Microsoft 365
New featureSharePoint and OneDrive now document a tenant-level policy that blocks agentic users from sharing content with external users. Administrators can target all agentic users or those associated with selected application blueprints using SharePoint Online PowerShell.
