CMMC Level 2: Is Your Staff Augmentation Partner an ESP?

As of September 2026, 32 CFR 170.4 makes your Microsoft staff augmentation partner an External Service Provider in your CMMC Level 2 assessment only if your CUI or Security Protection Data, such as configuration data, logs or admin credentials, is processed, stored or transmitted on the partner’s own assets. If...

Microsoft 365 Copilot or Glean: Which Fits Enterprise Search?

As of September 2026, if your answers mostly sit in Microsoft 365 and users hold Copilot licenses, choose Copilot; if most sit elsewhere, choose Glean, or both. Microsoft builds its semantic index “for users with a paid Microsoft Copilot license”, and Glean says it “inherits and enforces source-system permissions”.

HCL Domino (Lotus Notes) Apps: Power Apps, SharePoint or .NET?

If you run Domino v9, v10 or v11, Extended Support “will now end June 30, 2030”, according to HCL’s support articles as of September 2026. Retire unused databases first; send documents to SharePoint, forms and records to Power Apps, heavy logic to custom .NET; keep stable applications on Domino.

Dynamics 365 License or Model-Driven Power App: Which Do Users Need?

If a model-driven app is proposed over Dynamics 365 seats: as of September 2026, Microsoft’s licensing guide lets Power Apps users access “any Dynamics 365 non-restricted table in the Dataverse”, but writing to Case and other restricted tables needs Dynamics 365 licensing. Check each role’s tables.

Dynamics 365 Migration From AX, GP, NAV or CRM: Which Route Applies?

As of September 2026, Microsoft publishes a separate route into Dynamics 365 for each legacy product: Dynamics AX 2012 R2 and R3 upgrade into finance and operations apps, Dynamics GP and Dynamics SL 2015 or later migrate to Business Central online with built-in tools on SQL Server 2016 or later,...

DoD 5015.2 File Plan: How Does It Map to Purview Records Management?

As of September 2026, a DoD 5015.2-style file plan maps onto Microsoft Purview Records Management one component at a time: each record category or series becomes a retention label carrying Purview’s Category and Sub category file plan descriptors, cutoff instructions and event triggers become event-based retention, a vital-records designation maps...

Bot Framework SDK End of Support: Copilot Studio or Agents SDK?

If a review flags the SDK, Microsoft's archive notice (September 2026) states: "Support tickets for the Bot Framework SDK will no longer be serviced as of December 31, 2025". Move code-heavy bots to the Agents SDK and content bots to Copilot Studio where your cloud offers the channel.

Does Anyone Still Use SharePoint?

Yes, enterprises still use SharePoint, and any organization on Microsoft Teams uses it whether or not anyone chose it, because Microsoft stores each team’s files in a SharePoint site. The useful question is which of your workloads SharePoint should carry.

Windows 11 23H2 End of Updates: Which Update Path for a WSUS Fleet?

As of September 2026, Windows 11 version 23H2 Enterprise and Education editions reach end of updates on November 10, 2026, according to Microsoft, which recommends “updating eligible devices running Windows 11, version 23H2 Enterprise and Education editions to Windows 11, version 25H2”, a version its release information on Microsoft Learn...

OpenAI Models in Microsoft Copilot: Do They Meet FedRAMP and PCI?

As of September 2026, OpenAI-operated models have been enabled by default in Microsoft Copilot for eligible commercial customers since July 24, 2026, and Microsoft’s own documentation states that these models aren’t FedRAMP High authorized and that a PCI DSS Attestation of Compliance, a HITRUST CSF Certification Letter and a SOC...

HIPAA or CUI: Document Intelligence, SharePoint Premium or AI Builder?

If you key paper forms, choose by where documents live and who maintains the model: SharePoint Premium in SharePoint libraries, AI Builder in Power Platform, Document Intelligence in your developers’ Azure code. Under CUI the cloud decides first; under HIPAA, confirm Microsoft’s BAA scope before PHI enters the service.

Colorado Regulation 10-1-1: What Must Insurers Evidence on AI?

As of September 2026, Colorado Regulation 10-1-1, as amended, requires private passenger automobile and health benefit plan insurers that use external consumer data and information sources (ECDIS), or algorithms and predictive models that use ECDIS, to keep a fourteen-component governance and risk management framework available on request and to submit...

Zero Data Retention for Healthcare AI: Is It Required?

No. HIPAA does not require zero data retention, and no provision of the Privacy or Security Rule uses the term. What HIPAA requires is a Business Associate Agreement with the AI vendor, technical safeguards over electronic protected health information, and audit controls that record activity in systems handling ePHI. Zero...

Security Copilot in Microsoft 365 E5: What Should You Govern First?

As of September 2026, Microsoft includes Security Copilot with Microsoft 365 E5, provisions it automatically with Microsoft 365 data access turned on and owner and contributor access inherited from existing administrator roles, and gives 400 Security Compute Units a month for every 1,000 paid user licenses, up to 10,000, shared...

Copilot in Dynamics 365 Customer Service: What Does IT Decide?

Copilot in Dynamics 365 Customer Service is Microsoft's AI assistance for service representatives: turned on per environment, it answers questions, drafts emails and chat replies, and summarizes cases and conversations within each representative's access. IT decides its sources and its users, and confirms whether your cloud has it.

Azure AI Pilot: What Should You Lock Down Before Production?

An Azure AI pilot security checklist covers six checks before production: vault networking, Private Link, key authentication, managed identity, Azure Policy, Azure Government. Microsoft says a new vault’s firewall “is disabled”, which “doesn’t mean that any user will be able to perform operations on your key vault”.

Active Directory or Entra ID: Which Fits a CMMC Level 2 Boundary?

As of September 2026, whichever directory authenticates the users who reach CUI provides a security function to the CMMC Level 2 assessment scope, so keeping on-premises Active Directory as the identity authority brings its domain controllers and the Microsoft Entra Connect server, which Microsoft’s Prerequisites for Microsoft Entra Connect says...

ITAR Data in Microsoft Teams: What Does GCC High Cover?

As of September 2026, Microsoft’s ITAR offering lists Microsoft Teams among the Office 365 GCC High in-scope services, backed by contractual commitments on where stored data is located and on limiting access to US persons, but the same International Traffic in Arms Regulations (ITAR) compliance page also states that “there’s...

Entra ID Sign-In: How Do You Connect Apps, and Which Go First?

As of September 2026, connecting an application to Microsoft Entra ID means choosing the sign-in method that application supports (Microsoft says to choose OpenID Connect and OAuth where the application supports them, SAML for existing applications that do not, and password-based sign-on for applications with only an HTML sign-in page),...

Does Dynamics 365 Supply Chain Fit FDA Lot and Serial Traceability?

As of September 2026, Dynamics 365 Supply Chain Management documents the core of an FDA-regulated manufacturer’s traceability and record controls (batch and serial registration from component to finished product, item tracing forward and back, quality orders and batch holds, and electronic signatures with a logged audit trail), but its as-built...