IT & AI brief, 3 November 2026: Entra SSPR needs registered methods
Entra SSPR will accept only registered methods from 9 November, Power Platform prompts migrate to new GPT models on 2 December, and GitHub blocks pull_request_target by default.
Self-service password reset in Microsoft Entra ID will soon stop accepting phone numbers and emails that users never registered as authentication methods, and the enforcement date is close. Two further deadlines land on 2 December: automatic model changes for Power Platform prompts and GitHub's default block on a risky workflow trigger.
Entra SSPR will accept only registered authentication methods
What changed: Microsoft's message center post says SSPR will require explicitly registered authentication methods starting 9 November 2026. Today, SSPR can still verify people using directory contact details, such as a mobile number or alternate email, that were never registered as methods. The post's schedule also mentions 7 November, so treat the earlier date as the safe one. Microsoft says roughly 86% of SSPR verifications already use registered methods.
Who is affected: All users, including admins, in tenants with SSPR enabled, across public and US Government clouds. Anyone without a registered method cannot finish a reset and must register or ask the helpdesk.
What to do: Open Authentication methods, then User registration details, and find users with no method that satisfies your SSPR policy. Turn on the registration campaign, plan helpdesk-assisted registration for stragglers, and tell staff before the date. See MC1325414, plus our guides at /blog/entra-sspr-registration-lockout-troubleshooting and /blog/entra-sspr-setup-password-writeback.
Power Platform prompts move to new GPT models on 2 December
What changed: Prompts in Copilot Studio, Power Automate and Power Apps will be migrated automatically on 2 December 2026. Basic-tier prompts move from GPT-4.1 mini to GPT-6 Luna. Standard-tier prompts on GPT-4.1, GPT-5 chat, GPT-5.3 chat, Claude Sonnet 4.6 or Grok 4.1 Fast reasoning move to ChatGPT-latest. Premium-tier prompts on GPT-5 reasoning, GPT-5.2 reasoning or Claude Opus 4.6 move to GPT-6 Reasoning. Tier pricing does not change.
Who is affected: Makers and admins whose apps, flows or agents depend on a prompt using a retiring model, including the Anthropic and Grok options.
What to do: Inventory prompts on the retiring models, then test each against the replacement with realistic inputs. Wording, formatting and instruction-following can differ, so check anything that parses the output. Watch consumption afterwards. Details are in MC1536101.
GitHub Actions blocks pull_request_target by default from 2 December
What changed: GitHub moved enforcement of its default block on the pull_request_target event from 2 November to 2 December 2026. It applies to public repositories on Free, Team and Enterprise Cloud, unless an Actions event policy explicitly allows the trigger. The rule runs in evaluate mode first, with enforcement brownouts on 9 and 16 November between 16:00 and 18:00 UTC, when blocked runs fail.
Who is affected: Owners of public repositories that use this trigger. Private and internal repositories and GitHub Enterprise Server are not affected.
What to do: Before 9 November, use Insights to see which runs would be blocked. Either keep the block or allow the trigger through a policy scoped to specific workflow files. The trigger runs with base-repository secrets, so never let it execute untrusted fork code. See the GitHub changelog.
Microsoft 365 Copilot will suggest switching modes
What changed: After a user sends a prompt in Copilot Chat, a banner may suggest a better-fit mode, such as Cowork, and carry the chat context across. Rollout starts in mid-November and should finish in late November 2026. The post describes no admin setting to turn the suggestions off.
Who is affected: Users with access to more than one Copilot mode. Suggestions only appear for modes a user can already use.
What to do: No action is required. Brief the helpdesk, and if Cowork access is granted through a spending policy, check who is in that policy and that the usage-based billing setup is what you intend. See MC1536065.
OneDrive and SharePoint: approve access requests from the Share dialog
What changed: Anyone who can share an item will be able to see pending access requests in the Share dialog. They can approve or decline singly or in bulk, pick the access level, and message the requester first. The feature is in development, on the web only, with general availability listed for January 2027, including GCC, GCC High and DoD.
Who is affected: Users who own or share files, folders and libraries, and the people who request access.
What to do: No admin action is listed. It is worth a line in your sharing guidance, since more people will be approving requests. Source: Microsoft 365 Roadmap 578856.
Also worth knowing
- Google Vids lets users create a custom avatar from an uploaded image, with no admin control; Scheduled Release domains get it from 20 November. Google Workspace Updates
- GitHub security risk assessments now include repository protection status. GitHub changelog
- CISA's KEV catalog showed no new additions after the two Ivanti Connect Secure entries of 30 October; the CVE-2026-118527 due date is 13 November. CISA KEV
Was this helpful?
Get the next guide
Free checklists and new guides: a short weekly digest on Sundays, or an email each day with new articles. Unsubscribe in one click.
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.