SharePoint Online Weekly Update — August 10, 2026

Copilot in SharePoint Turns Content Into Live Dashboards

The August Copilot in SharePoint update is the most consequential item this week, and it shifts the tool's center of gravity from answering questions to helping people build. Copilot can now generate an interactive dashboard directly from a SharePoint list, an Excel file, or a CSV, producing an HTML report that stays connected to the underlying data and refreshes every time the page is opened. That means a team can point Copilot at a project-tracking list and get a live status view without touching Power BI or exporting anything.

The update also introduces page buttons, a web part that wires a saved Copilot prompt to a single clickable button on a page. Anyone visiting the page can run that prompt in one click — a summary, a status roll-up, a formatted extract — without knowing how to write the prompt themselves. Paired with this is Site Skills, which lets a working prompt be saved as a reusable Agent Asset so every user on a site inherits it. This is the mechanism that turns one person's clever prompt into shared organizational capability.

For an organization thinking about how to shape AI deliberately, this is exactly the surface that rewards a little upfront design. Left alone, users will build ad hoc prompts and dashboards of uneven quality; curated Site Skills and vetted page buttons let you seed the good patterns and make them the path of least resistance.

What to do: Identify two or three high-traffic sites where a live dashboard or a one-click prompt would replace manual reporting, build those as Site Skills or page buttons, and treat them as templates your teams can copy rather than letting everyone reinvent the same prompt.

A Broad August Roadmap Wave Lands in OneDrive and SharePoint

Several Microsoft 365 roadmap items carrying an August 2026 target are now rolling out, and together they close a set of long-standing gaps. The most notable for knowledge teams is co-authoring and autosave for Markdown files in OneDrive and SharePoint — multiple people can now edit the same .md file simultaneously with changes saved automatically, the same way they already can with Office documents. Combined with the inline Markdown commenting that entered development last month, SharePoint is quietly becoming a credible home for the growing pile of Markdown-based documentation, wikis, and AI prompt libraries that organizations are accumulating.

On the reading side, the PDF viewer in OneDrive and SharePoint on the web is gaining a thumbnail navigation panel, letting users open a side panel to visually browse pages and jump directly to any page in a long document. It is a small change that meaningfully improves how people work with the contracts, reports, and scanned files that live in most document libraries.

Rounding out the wave, OneDrive is adding an administrator control to exclude specific folders from syncing, keeping designated folders local to a device rather than pushing them to the cloud — useful for teams that keep large scratch or build folders inside synced locations.

What to do: If your teams keep documentation or prompt libraries as Markdown, standardize where those files live now so co-authoring and commenting have a clear home, and flag the new PDF thumbnail navigation in any end-user tips you publish.

Security Controls Tighten Around Sensitivity-Labeled PDFs

This week's roadmap also brings a pair of security-focused improvements aimed squarely at sensitivity-labeled content, reflecting Microsoft's continued push to make labels enforce real behavior rather than just tag files. First, the OneDrive and SharePoint web viewer is gaining the ability to block screen capture for sensitivity-labeled PDFs, extending screenshot protection that already exists for other protected content to the PDF surface. For organizations that route confidential material through PDF, this removes one of the easier ways sensitive content leaks.

Second, and somewhat in tension with the first, the OneDrive mobile apps for iOS and Android are adding the ability for users with editing rights to annotate sensitivity-label protected PDFs directly on mobile, rolling out globally from mid to late August. Previously, protection often meant losing the ability to mark up a document on a phone; now the label travels with the file while still allowing authorized edits. The net effect is that labels become less of a blunt "you can't touch this" instrument and more of a policy that permits the right actions for the right people.

The through-line is that sensitivity labels are becoming the control plane for content behavior across SharePoint and OneDrive, which raises the stakes on getting your labeling taxonomy right before you lean on it for enforcement.

What to do: Review whether your sensitivity label taxonomy and auto-labeling policies are mature enough to depend on for screen-capture blocking, and confirm which labels should permit mobile annotation before the behavior changes under your users.

Two Hard Mid-August Deadlines for Admins

Two dated changes fall inside this window and deserve calendar entries. Starting August 15, 2026, Microsoft ends OneDrive sync app updates on Windows 10 version 22H1 and earlier. Devices on those builds keep running but stop receiving sync client updates, including security and reliability fixes; machines on Windows 10 22H2 or later continue getting updates through October 10, 2028. In practice this is a nudge to finish Windows 10 remediation, since the sync client is one of the most business-critical pieces of software on a knowledge worker's machine.

Separately, on August 17, 2026, Microsoft is changing the behavior of the driveItem.webUrl API in SharePoint Embedded. Any custom application or integration that reads webUrl from that API to build links or navigate should be tested against the new behavior, because URL-shape assumptions baked into code are exactly the kind of thing that breaks silently and surfaces as a support ticket days later.

What to do: Pull an inventory of any devices still on Windows 10 22H1 or earlier and prioritize their upgrade before August 15, and have your developers test any SharePoint Embedded integrations that consume driveItem.webUrl ahead of the August 17 change.

SharePoint Framework Moves to a Predictable Security Cadence

For teams that still build custom web parts and extensions, the SharePoint Framework (SPFx) story this year is stability and hygiene rather than headline features. The 1.22 release delivered a major refresh of the build and toolchain experience — a TypeScript 5.8 upgrade and a cleanup of the npm audit vulnerabilities that had accumulated in the Yeoman generator and scaffolded projects. More importantly, Microsoft committed to a monthly minor-release cadence for security, with point releases like 1.22.2 landing specifically to keep npm audit reports clean, and newer 1.23.x builds continuing that pattern.

The significance here is operational, not glamorous. A predictable security-patch rhythm for SPFx means custom solutions can be kept clean without waiting for a once-a-year major release, which lowers the ongoing maintenance tax on the customizations many organizations depend on. It also signals where Microsoft wants effort to go: with SharePoint Add-Ins and Azure ACS now retired, SPFx is the sanctioned path for extending SharePoint, and it is being maintained accordingly.

What to do: If you maintain custom SPFx solutions, adopt the latest 1.22.x or 1.23.x build to clear known npm audit findings, and plan to track the monthly security releases rather than letting your toolchain drift a full version behind.

One-Time Passcode Retirement Countdown Continues

As a standing reminder rather than fresh news: the retirement of SharePoint One-Time Passcode (SPO OTP) and the transition to Microsoft Entra B2B (MC1243549) is now under two months out, with Phase 2 scheduled to begin October 1 and complete by October 31. New external sharing has already flowed through Entra B2B since May, but once OTP is gone, external users without a B2B guest account can be denied access on previously shared "specific people" links until an internal user re-shares or a guest account is created.

With this week consumed by nearer-term deadlines, the OTP work is easy to defer — but October arrives faster than it looks, and the remediation is inventory-driven, which takes time. Treating the next few weeks as runway to audit external shares avoids a scramble when the retirement window opens.

What to do: Use the remaining runway to inventory external "specific people" shares and identify recipients who lack Entra B2B guest accounts, so the links most likely to break in October are already remediated before the deadline.

Sources

Back to all news