What our customers need to know (and what we’re doing about it)

April has been a busy month across Microsoft 365, Windows, and Azure. Below is a plain‑English summary of what changed, why it matters to your organisation, and the actions we recommend as your MSP.

1. Microsoft 365: retirements, security tightening, and Copilot growth

A major April 2026 Microsoft 365 update focused on three themes: retiring older features, tightening security, and expanding Copilot.

Key points:

• Service retirements and deprecations: Older integrations and legacy authentication paths are being phased out, particularly anything still relying on basic/legacy auth or unsupported clients. This is part of Microsoft’s long‑term push to modern, secure protocols.
• Security hardening across tenants:
  • More aggressive defaults around multifactor authentication (MFA) and conditional access.
  • Stricter baselines for admin roles and privileged operations.
  • Increased emphasis on secure configuration for SharePoint, OneDrive, and Teams.
• Copilot adoption at scale: Microsoft reported over 20 million paid seats for Microsoft 365 Copilot, underlining that AI‑assisted productivity is now mainstream, not experimental.

What we’ll do for you:

• Review upcoming retirements against your current usage and plan replacements or migrations where needed.
• Validate your tenant security posture against the latest Microsoft baselines (MFA, conditional access, admin roles).
• Advise on Copilot readiness: licensing, data governance, and which departments will see the fastest ROI.

2. Windows & server: a huge April Patch Tuesday and BitLocker warning

April 2026 delivered one of the largest Patch Tuesday releases in years, with 160+ security flaws fixed, including a SharePoint Server zero‑day that was already being exploited in the wild.

Highlights:

• 167 vulnerabilities patched overall, with multiple rated Critical.
• SharePoint Server zero‑day: remote code execution risk if left unpatched—high priority for any on‑prem or hybrid SharePoint deployments.
• BitLocker issue flagged: Microsoft warned of potential issues related to BitLocker in this update cycle, requiring careful rollout and validation rather than “set and forget” patching.

What we’ll do for you:

• Prioritise critical patches for Windows, SharePoint, and related server workloads in our managed patching windows.
• Stage and test updates in controlled rings to avoid BitLocker‑related issues before broad deployment.
• Confirm encryption health post‑patch on managed devices and servers.

3. Azure platform: sovereign clouds, new tooling, and security‑focused SDK updates

3.1 Azure Local: built‑for‑sovereign, large‑scale deployments

Microsoft significantly upgraded Azure Local, its on‑premises Azure‑aligned platform, to support large‑scale sovereign infrastructure—think thousands of servers, not just small edge clusters.

Key changes:

• Scales from hundreds to thousands of nodes with improved fault domain modelling and multi‑rack networking.
• Local control plane: Azure Local no longer depends on Azure Arc for management, reducing concerns about data leaving jurisdiction.
• Local Identity with Key Vault: customers can manage their own cryptographic keys, even for air‑gapped environments—important for regulated and public‑sector workloads.

Why this matters:

If you operate in highly regulated sectors (public sector, healthcare, finance, defence) or have strict data residency requirements, Azure Local’s new capabilities make hybrid/sovereign designs more realistic without losing the Azure “look and feel”.

3.2 Azure updates: AI agents, observability, and serverless orchestration

Microsoft’s Azure Updates feed and SDK blog highlighted several April 2026 releases that are particularly relevant to modern cloud architectures.

Notable items:

• Microsoft Agent Framework 1.0 (GA):
  • Stable, long‑term‑support release for building multi‑agent AI systems in .NET and Python.
  • Supports multi‑agent orchestration and multi‑provider model support, with cross‑runtime interoperability.
• Foundry memory (preview) in Foundry Agent Service:
  • Managed long‑term memory for agents, integrated with Microsoft Agent Framework and LangGraph.
  • Reduces the need to build and secure your own memory store for AI agents.
• Container Network Insights Agent for AKS (preview):
  • Natural‑language driven diagnostics for Kubernetes networking issues.
  • Consolidates logs, metrics, and flows into structured summaries with recommended next steps—ideal for faster incident resolution.
• Durable Task Scheduler Consumption SKU (GA) for Azure Functions:
  • Pay‑per‑use orchestration for durable workflows and AI agent scenarios.
  • No storage to manage, no idle capacity to pay for—well‑suited to bursty workloads and event‑driven integrations.

3.3 Azure SDK April 2026: critical security fix and AI library changes

The Azure SDK April 2026 release included a particularly important security fix and several AI‑related library updates.

Key items for development teams:

• Cosmos DB Java SDK 4.79.0:
  • Fixes a remote code execution (RCE) vulnerability by replacing Java deserialization with JSON‑based serialization in several components.
  • Also adds N‑Region synchronous commit and new search‑related features.
• AI Foundry 2.0.0 and AI Agents 2.0.0 (GA):
  • Major architectural and naming clean‑up for Azure AI Projects and AI Agents libraries.
  • Breaking changes aimed at consistency and long‑term maintainability.

What we’ll do for you:

• Coordinate SDK upgrades with your development teams to ensure vulnerable libraries are updated.
• Review AI workloads using these libraries to confirm compatibility with the new versions and avoid breaking changes in production.

4. What this means for your organisation

To keep things practical, here’s how we’re translating April’s news into concrete actions.

For Microsoft 365 tenants

• Map retirements to your environment and plan any necessary migrations.
• Tighten security baselines (MFA, conditional access, admin roles) in line with Microsoft’s latest guidance.
• Evaluate Copilot where it can safely unlock productivity without exposing sensitive data.

For Windows and on‑prem servers

• Apply April’s critical patches in our managed maintenance windows, with special focus on SharePoint and BitLocker.
• Verify encryption and backup health after patching to ensure recoverability and compliance.

For Azure and hybrid environments

• Assess suitability of Azure Local if you have strong data‑sovereignty or jurisdictional requirements.
• Adopt new Azure capabilities (Durable Task Scheduler, Container Network Insights, Agent Framework) where they simplify operations or improve reliability.
• Update vulnerable SDKs (especially Cosmos DB Java) and align AI projects with the new Foundry/Agents releases.

Want a tenant‑specific April 2026 impact report?

If you’d like, we can:

• Review your Microsoft 365 tenant,
• Audit your Windows/SharePoint estate, and
• Map your Azure footprint

against these April 2026 changes and produce a short, tailored impact report with priorities for the next 30–60 days.

At ITS+ we can review and audit your current stack (M365 plans, on‑prem vs cloud, any Azure use), and can provide a risk based review and project plan to maintain and secure your IT environment whilst informing and training key users on how changes in IT infrastructure impact their systems use or open up opportunities to update processes with new feature releases. Call us or chat to us via our webchat link if youd like more information