The Same Revoke Sessions Button Everywhere

Part of restarting after a holiday break is catching up with stuff. In my case, I considered the “What’s New in Microsoft Entra – November 2025” post in the Microsoft technical community and the mention there about revoking multifactor authentication sessions. The article said:

Starting February 2026, we are replacing the current Revoke multifactor authentication sessions button with the Revoke sessions button in the Microsoft Entra portal. The legacy Revoke MFA sessions action only applies to per-user MFA enforcement, which has led to confusion. To simplify and ensure consistent behavior, the new Revoke sessions button will invalidate all user sessions, including MFA, regardless of whether MFA is enforced via Conditional Access or per-user policies.

The text certainly confused me. After chatting with some Microsoft contacts, the situation is as follows:

The user properties page in the Entra admin center includes a Revoke sessions button (Figure 1). This button performs the same function as the Revoke-MgUserSignInSession cmdlet.

If you view the authentication methods for a user account, the Revoke multifactor authentication sessions button appears (Figure 2).

As explained in the blog, this button only handles per-user MFA sessions. Microsoft is trying to get rid of per-user MFA and replace the older mechanism with conditional access policies that require multifactor authentication (of different types and strengths).

Conditional access policies are much more functional and powerful, so I don’t have any issues with Microsoft’s direction on a technical level. The sole issue is Microsoft’s insistence that conditional access requires Entra P1 licenses. It would be an easier changeover if use of basic conditional access policies was included in Office 365 E3 and above (E3 includes per-user MFA). It seems like tenants buy Entra P1 for other reasons, so the issue is probably fading over time.

Communications Confusion

Microsoft is dead right that the existence of the two buttons is confusing. When things go wrong and an administrator needs to revoke sessions as part of securing a user account (perhaps after potential compromise), they don’t want to have an internal debate to decide whether to revoke sessions or revoke multifactor authentication sessions.

One button to revoke sessions that might appear in multiple places (if necessary) is perfectly adequate. You can’t complain about Microsoft’s move to rationalize buttons to remove confusion. All I protest is the text. I know I’m not the only one to require several readings to fully understand what the blog intended to communicate.

Include Revoke Sessions in a Script

In any case, revoking sessions is only one step in the actions necessary to secure a user account in case of problems. This is where PowerShell comes in because the best and most efficient approach to disabling user accounts is to create a script to do the job.

A script using Microsoft Graph PowerShell SDK cmdlets to revoke sessions, disable the account, change the account password, and disable devices registered to the account is explained in this article. It’s a good starting point for automating a very important administrative operation. See chapter 4 in the Office 365 for IT Pros eBook for more details.

A Need for Clarity

Explanations about technology can be obscured by our personal knowledge of a situation. We assume that our readers know more about the topic than they do and explain from that point. This can lead to text that confuses and misleads. You’d imagine that something like artificial intelligence could help…

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365. Only humans contribute to our work!

Customer Feedback and No Viable Replacement Forces Cancellation of Mailbox External Recipient Rate

In an unexpected development, the Exchange product group announced in a January 6 EHLO blog post that they have decided to cancel the introduction of the mailbox external recipient rate limit (MERR). Originally proposed in April 2024, Microsoft planned to introduce the new mailbox restriction of being able to send email to 2,000 external recipients over a 24-hour sliding window in January 2025. Following customer pushback, Microsoft subsequently changed the introduction date to April 2026.

Given the wording of the announcement, it seems clear that the level of customer pushback increased as organizations figured out what effect a 2,000 limit would have on their operations. Although Microsoft is quite clear that Exchange Online is not designed to handle bulk email, there’s no doubt that many tenants send communications to external recipients that come perilously close to bulk email. I guess that one person’s highly specific and precise marketing monthly update is another person’s spam.

The tenant-level External Recipient Rate Limit and the overall mailbox recipient limit remain in place and are unaffected by the cancellation.

Make Exchange Online Less Attractive to Spammers

The idea between a mailbox external rate limit is simple. If people can’t send more than 2,000 external emails over a 24-hour period, Exchange Online becomes a lot less friendly for spamming operations. Although some Microsoft decisions seem to be made in a perfect vacuum, I know that telemetry showed that not many mailboxes would fall foul of the limit.

However, the problem is that some of the mailboxes that would be affected send important messages that are incorporated into business processes. A decision to limit spamming also affects how organizations work and their communication with their customers and partners, and that’s unacceptable. Any change made that removes functionality that people depend on is intolerable unless an adequate replacement is available.

No Immediate Replacement for Small-Scale External Email Communications

The problem Microsoft has is that they can’t offer a replacement that allows tenants to send relatively small amounts of external email. The alternative is to use Email Communication Services (ECS), part of the Azure Communication Services (ACS) solution. ECS is built on top of the Exchange Online platform and is absolutely capable of sending very large quantities of external email. That is, after all, what Microsoft designed ECS to do.

However, setting up external email transmission through ECS is not easy for non-technical users. When I last looked at ECS in 2024, it took a considerable number of complicated steps and PowerShell to send email to a bunch of external recipients. Add in the requirement to pay for Azure processing, and you can see why customers are unimpressed by this option.

The ECS experience is definitely nowhere close to using Outlook to compose and send a message to a distribution list. Exchange users have been accustomed to this very simple and straightforward task for many years. Asking them to change to a dramatically different approach introduces a heap of friction into a task that should take just a few seconds.

The HVE Conundrum

Microsoft’s options were limited when they decided to remove the capability to send remote email from its High-Volume Email (HVE) solution. HVE originally could send a limited number of external messages daily, but Microsoft changed its strategy to reposition HVE as an internal email solution for email communications, including email sent by applications and devices such as printers and scanners.

The latest date for general availability of HVE is March 2026, but a quick glance through the comments for Microsoft’s post announcing that date shows that many challenges still exist.

A Good Call to Cancel the Mailbox External Recipient Rate Limit

I think Microsoft was right to reverse course. Pressing ahead with a feature that would do some goodness at the expense of potentially upsetting many customers doesn’t seem like a good strategy. It would have ended in tears of frustration and probably some heated discussions between customers and Microsoft account teams. Dumping the external recipient rate limit for mailboxes was a good idea. Without a no-cost and easy alternative for customers to use, imposing a limit on the external email that individual mailboxes could send would never fly.

Learn about managing Exchange Online and the rest of the Microsoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Another Microsoft Migration Solution

Fresh from announcing their tenant-to-tenant migration “orchestrator” solution, message center notification MC1213779 (6 January 2026, Microsoft 365 roadmap item 485709) brings news of a new Slack to Teams migration solution. Microsoft’s new offering can move Slack public and private channels into Teams channels. The new tool is available in the Microsoft 365 admin center for targeted tenants with general availability worldwide due later this month.

Free and Easy

The big selling point is that Microsoft’s Slack to Teams migration solution is free. In a nutshell, the tool ingests export packages (ZIP files) generated by Slack and uploaded to Azure blob storage to populate Teams channels that the Slack channels are mapped to. Migration can be done for all or just selected Slack channels. Mapping is also required to allow the tool to resolve Slack usernames to Microsoft 365 accounts, and Microsoft has a PowerShell script to check Slack identities against Entra ID to find matching accounts.

Microsoft considers its Slack to Teams migration solution to be a preview offering until it reaches general availability. Some changes might take place between now and then, but it’s likely that the broad overview of the solution will remain the same. As always, take the time to read the online documentation to check the prerequisites (Azure is a big one), required permissions, and so on.

Microsoft’s Need for Migration Tools

Given the array of third-party migration tools that can move Slack content into Teams, many wonder why Microsoft needs its own solution. After all, although the software is free, it must be created, maintained, and supported, and all that activity costs.

The answer is that Microsoft wants to encourage customers to move off competing platforms. Although Teams is a dominant player for Microsoft 365 collaboration with over 320 million monthly active users (last official figure from October 2023), that still leaves 126 million of the 446 million paid Office 365 seats (data from October 2025) to play for. I assume that some of those 126 million users use Slack, and Microsoft would very much like to move them into the Teams ecosystem. Apart from anything else, migrated Slack users might buy Teams Premium and Teams Phone licenses.

It’s all about money. Microsoft wants to sell more licenses and can do so by migrating more people to its platform. Apart from anything else, the number of pure net new Microsoft 365 seats that Microsoft can sell is falling because of the size of the platform. This creates the need to use other methods to acquire new seats. According to DemandSage, Slack has 79 million monthly active users (December 2025), so it’s an attractive migration target.

The Third-Party Alternatives

A quick web search reveals that several ISV migration tools are available to move Slack content to Teams. Looking through the marketing material published by the different vendors, it seems that all the tools take roughly the same approach as used by Microsoft.

Discovering that tools don’t vary too much in how they approach migration isn’t surprising. Depending on available APIs, limited ways often exist to extract and ingest information, so the differences usually occur in how the extracted data is stored and processed prior to ingestion. However, marketing descriptions often hide technical reality, so I recommend that you test the available tools, including Microsoft’s new offering, before making a final choice.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive insights updated monthly into what happens within Microsoft 365, why it happens, and what new features and capabilities mean for your tenant.

Investigations Get a New Purge Mitigation Action

During the quiet holiday period, I took the time to check out the Purview Data Security Investigation (DSI) solution. My interest was prompted by message center notification MC1199763 (18 December 2025, Microsoft 365 roadmap item 542930) announcing the inclusion of an option to purge items found by an investigation (Figure 1).

The new capability is called the purge mitigation action and is in preview and due for general availability in March 2026.

Data Security Investigations

Purview’s DSI solution is currently in preview. The idea is that DSI “helps cybersecurity teams in your organization use generative artificial intelligence (AI) to analyze and respond to data security incidents, risky insiders, and data breaches.” Anyone used to the management of Purview eDiscovery cases will find DSI a familiar place because a lot of the UX is borrowed from the eDiscovery solution. Even the new purge mitigation action comes from the eDiscovery Graph API (implemented as the Clear-MgSecurityCaseEdiscoveryCaseSearchData cmdlet in the Microsoft Graph PowerShell SDK.

Indeed, DSI seems to be the product of melding a hefty chunk of eDiscovery with some of the generative AI used by Security Copilot to analyze and highlight anomalies in data, in this case, information found in Microsoft 365 data sources like mailboxes and SharePoint sites that might point to problems such as data breaches or actions taken by employees to exfiltrate data.

Combining bits of Microsoft 365 and other components together to form new solutions is a well-trodden path. Teams is the best example in the Microsoft 365 ecosystem because it borrows heavily from Exchange Online (calendar and compliance), SharePoint Online (file storage for channels), OneDrive for Business (file storage for chats), Planner, and a bunch of Azure microservices. Indeed, if Microsoft hadn’t used other services to assemble large parts of Teams, there’s no way that the application could have been as functional as it is today.

The compliance records captured by the Microsoft 365 substrate for Teams, Viva Engage, Planner, and Copilot interactions and stored in hidden folders in user mailboxes are another example. The compliance records are used by many Purview solutions like eDiscovery, communication compliance policies, and insider risk management.

DSI Incurs Costs for AI Processing

DSI doesn’t require a specific Microsoft 365 license. Instead, Microsoft charges for the security compute units (SCUs) and storage used by investigations. Part of configuring DSI for a tenant is to associate DSI with a valid Azure subscription that Purview can charge for processing costs. The costs are incurred when generative AI runs against a body of collected items to determine if any problems exist.

Other Microsoft solutions use SCUs are, such as Security Copilot investigations and the Entra ID agents for conditional access and access reviews. At the Ignite 2025 conference, Microsoft announced plans to bundle Security Copilot with Microsoft 365 E5, together with 400 “free” monthly SCUs per 1,000 licensed accounts. The SCUs bundled with Microsoft 365 E5 can be used for any purpose, but tenants without Microsoft 365 E5 must purchase SCUs. To help tenants understand the potential costs to run investigations, DSI includes a cost estimator (Figure 2).

Obviously, a large-scale investigation might cost a lot more than a smaller investigation because of the amount of data involved and the additional AI processing. Running a search estimate to find items of interest should tell you how much data is involved. Estimating the AI costs depends on how intensive the subsequent processing is.

For example, increasing the investigation size (data) from 1 GB to 15 GB resulted in monthly cost going from $323 to $587. Going to 60 GB of data increases the monthly cost to $1,436. Why figure out a monthly cost? Well, the nature of investigations is that they can last a long time, so a monthly figure is a good estimate to have.

Costs Can Mount Rapidly

Be careful about starting off a new data security investigation because you can incur costs from the start. As an example, while testing DSI out for this article, my Azure account racked up over $150 in costs. I assume this was for storage of items found by an investigation, but the cost came as as a surprise that disrupted operations because it blew the monthly Azure budget for my subscription (Figure 3) and disabled the subscription from running any Azure services until funding was available:

Interestingly, when I opened the Purview DSI page to remove the investigation that was racking up the Azure costs, I couldn’t access the investigation through the UX because DSI insisted that I had to set up an Azure subscription first. Because the subscription was blocked, I had to remove the investigation with PowerShell. Log into the Exchange Online management module and then run the Connect-IPPSsession cmdlet. Then find and remove the relevant compliance case using the Get-ComplianceCase cmdlet. DSI investigations have a case type of DataSecurityInvestigation:

Connect-IPPSSession -EnableSearchOnlySession

Get-ComplianceCase -CaseType DataSecurityInvestigation

Name         Status CreatedDateTime
----         ------ ---------------
DSI-2026-001 Active 02/01/2026 16:16:41

Remove-ComplianceCase -Identity DSI-2026-001

Confirm
Are you sure you want to perform this action?
Deleting the compliance case Identity:"DSI-2026-001" will also remove all searches and search actions
associated with this case. Do you want to continue?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y

Get-ComplianceCase -casetype DataSecurityInvestigation
...

Hard to Test DSI Effectiveness

Getting back to the question of how well DSI works, this is a difficult question for me to answer. I don’t have a compromised tenant to hand, so it’s difficult to test the outcome. The good thing about assembling a solution from off-the-shelf components from other Microsoft solutions is that the components usually work as expected. Because all I can feed the AI with is test data, the difficulty is to measure how well generative AI detects real problems in the data that it’s asked to assess. I’ll leave that exercise to a competent investigative team that’s coping with a real problem.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Four Legacy SharePoint Compliance Features to Retire in April 2026

Message center notification MC1211579 (3 January 2026) announces the retirement of several legacy SharePoint (Server) compliance features from SharePoint Online. The features are:

• Information Management Policies.
• In-Place Records Management.
• Document deletion policies (deletion only – part of the SharePoint compliance center).
• Policies for site closure and deletion (deletion only).

Retirement will happen in April 2026. When this happens, users might discover that a feature disappears from the SharePoint Online UX. For instance, Microsoft is likely to remove the option to configure an information management policy setting for a document library (Figure 1). Attempts to get support from Microsoft will be doomed to failure and the removal of configuration options for the features from SharePoint Online will mean that it will no longer be possible to update these options. Finally, background jobs or other processing that support the retired features may (read “will”) stop functioning.

Migrating from SharePoint Compliance to Purview

Of course, none of this will happen immediately and it’s likely that it will take some time before the retired features are finally removed from SharePoint Online, but retirement means retirement and it’s time for tenants to move to a more modern compliance platform, which means Microsoft Purview. In this case, the Purview Data Lifecycle management and Purview Records management solutions.

Microsoft provides some migration guidance here. However, migration is manual and there is no way available to move from the legacy features to Purview.

An Unsurprising Development

It’s unsurprising that Microsoft should move to remove legacy SharePoint Server compliance features from SharePoint Online. Apart from reducing engineering and support effort required to keep the old features in place, the old code is a pale reflection of what Purview is capable of and it’s where any future investment will go. I can’t think of the last time that I saw the soon-to-be-retired features in active use.

Tenants will gain extra functionality through the move. However, licensing might be an issue for some. Unlike the old compliance functionality that’s incorporated into SharePoint and available to all users, Purview Data Lifecycle management requires user accounts to have a minimum of Microsoft 365 Business Premium for manual retention (apply retention labels to files) or Microsoft 365/Office 365 E5 for automatic retention. Records management is an E5 feature.

The same licensing issue arises for Exchange Online, which includes the mailbox retention management (MRM) system spanning mailbox retention policies and retention tags developed for Exchange Server in its base license. Even though Purview Data Lifecycle management lags mailbox retention policies in some respects like the ability to move items to an archive mailbox, adopting Microsoft 365 retention policies can involve additional licensing.

No Room for Old Stuff

Given that SharePoint is approaching its 25th anniversary in 2026, it’s not strange that some old features are still in SharePoint Online. Even though Microsoft has just given the main browser interface a refresh, there are many places where the 2010-2013 style UX (or even earlier) break through if you go looking. As always, the question is whether to spend engineering time on new features or to refresh or rebuild old features.

With Microsoft’s current focus on agents and artificial intelligence (like the new SharePoint list agent described in MC1208689 from 29 December 2025), it seems like the answer is clear, especially for features that are well past their best-by date.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive insights updated monthly into what happens within Microsoft 365, why it happens, and what new features and capabilities mean for your tenant.