IT & AI brief, 10 November 2026: Claude on by default in EU Copilot tenants from 9 December
Claude models become default-on for EU and EFTA Copilot tenants on 9 December, Teams Free off-network invites are retiring, and Claude Fable 5.2 reaches GitHub Copilot with a policy switch.
Microsoft will switch on Anthropic's Claude models by default for eligible EU and EFTA Microsoft 365 tenants on 9 December 2026, so admins in those regions who want a different outcome have a month to decide. Microsoft's November Patch Tuesday is today, but release details were not yet confirmed on a primary source when this brief was written.
Claude models default-on for EU and EFTA Copilot tenants
What changed: MC1546438 says that on 9 December 2026 Claude models will be enabled in Microsoft Copilot for EU Data Boundary-eligible tenants that have not made a selection. Claude processing moves inside the EU Data Boundary in early December; until then it is not covered by that commitment. The "Copilot in Microsoft 365 apps only" option is retired, and tenants using it move to All users.
Who is affected: Admins of EU and EFTA tenants. Tenants that already assigned Claude, or disabled it, keep their selection.
What to do: If you are happy with Claude for everyone, do nothing. Otherwise, before 9 December, go to Microsoft 365 admin center, Copilot, Settings, "AI providers operating as Microsoft subprocessors", Anthropic, and choose No users or specific groups. You need the AI Administrator or Global Administrator role. Tell your helpdesk and compliance team. Our guide to Copilot licence assignment may help with scoping.
Teams Free: off-network invitations are retiring
What changed: MC1546409 announces that work and school users will no longer be able to invite people without Teams to create a Teams Free account and join a chat, by email or chat link. Rollout starts in early December and should finish by late December 2026. Federation with Teams Free, meetings and team or channel collaboration are not affected.
Who is affected: Users who currently send these invitations, on desktop, web and mobile.
What to do: No admin action is required. Microsoft suggests updating user guidance and helpdesk documents before 6 December. Point users to guest access instead, and see Teams external access vs guest access.
Claude Fable 5.2 reaches GitHub Copilot, off by default
What changed: GitHub made Claude Fable 5.2 generally available in Copilot on 9 November, with a gradual rollout. It covers Copilot Pro+, Max, Business and Enterprise across VS Code, Visual Studio, JetBrains, Xcode, Eclipse, the CLI, github.com and mobile. It is billed at provider list pricing under usage-based billing.
Who is affected: Copilot Business and Enterprise admins, and developers on those plans.
What to do: The model is off until an admin enables its policy in Copilot settings. Enabling it acknowledges that the model requires data retention by default, and GitHub says Anthropic keeps prompts and outputs for safety classifiers. Check this against your data-handling rules before turning it on. Some approved enterprises can use zero data retention only until the end of the calendar year.
Secret scanning for Actions workflow logs (public preview)
What changed: GitHub's changelog says secret scanning now checks workflow logs after each run completes. Alerts appear in the normal secret scanning list. It is a public preview and off by default.
Who is affected: Enterprises on GitHub Enterprise Cloud with Secret Protection or Advanced Security, including GHE.com data residency.
What to do: An enterprise owner can enable it under Policies, Advanced Security. Note the preview limits: existing logs are not scanned, generic and custom patterns and already-masked secrets are not detected, and alerts send no notifications, so check the alert list manually.
Exchange: cross-tenant calendar sharing moves off EWS
What changed: MC1446796 says Free/Busy, MailTips and calendar sharing between Exchange Online tenants move from EWS-based sharing to the Cross-Tenant Access Policy. Worldwide completion for calendar sharing is now 23 November 2026, previously 3 November. Final EWS shutdown is 1 April 2027, and GCC, GCC High and DoD rollout is paused.
Who is affected: Tenants with Organization Relationships or Sharing Policies that share with other Microsoft 365 tenants. Hybrid and on-premises setups are out of scope for now.
What to do: Run Get-OrganizationRelationship and Get-SharingPolicy to see your exposure, plan the migration, and remove unused relationships. If you are not ready, setting EWSEnabled to True keeps access until 1 April 2027. The post's timeline has changed several times, so recheck it. See EWS retirement in Exchange Online.
CISA adds four items with a 12 November deadline
What changed: The KEV catalog lists four additions dated 9 November, each due 12 November: IBM Aspera Faspex (CVE-2026-123218), SignalWire FreeSwitch (CVE-2026-116779), OpenBSD OpenSSH (CVE-2026-123158) and GPUStack (CVE-2026-102895). The SonicWall SSLVPN entry from 6 November remains due on 20 November.
Who is affected: Anyone running these products, notably internet-facing OpenSSH hosts and Faspex servers. The deadline formally binds US federal agencies but is a useful benchmark.
What to do: Check vendor advisories for fixed versions, patch exposed systems first, and record any exceptions.
Also worth knowing
Was this helpful?
Get the next guide
Free checklists and new guides: a short weekly digest on Sundays, or an email each day with new articles. Unsubscribe in one click.
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.