SharePoint Online Weekly Update — July 17, 2026

External Sharing Enforcement Tightens as Entra B2B Takes Over

The long-running move of external sharing authentication from SharePoint Online One-Time Passcode (SPO OTP) to Microsoft Entra B2B reached an enforcement milestone this month. Starting in July 2026, external collaborators who do not have a Microsoft Entra B2B guest account begin seeing "access denied" when they try to open newly shared content, because new invitations and authentication now flow through Entra B2B rather than the legacy SharePoint OTP system.

It's worth being precise about what is and isn't retiring. One-time passcodes themselves are not going away — Entra B2B still uses OTP as the default authentication method for guests. What's changing is the plumbing: the code that mints and validates those passcodes moves out of SharePoint's legacy stack and into the unified Entra identity platform, which brings guests under consistent lifecycle management, Conditional Access, and governance across all of Microsoft 365. Microsoft has rescheduled the full retirement of the old SPO OTP path to complete in October 2026, and "specific people" links shared before the change rolled out to your tenant keep working on the old path until then.

What to do: Run an external sharing report now to identify guests who are collaborating without an Entra B2B guest account, and pre-create guest accounts for anyone who needs continued access. Waiting until October means those users hit access-denied errors with no fallback.

The Last Classic SharePoint Alerts Have Gone Dark

The multi-year retirement of classic SharePoint Alerts has now reached its final stage. New alert creation was blocked for existing tenants back in January 2026, existing alerts have been expiring on a rolling 30-day basis since then, and as of July 2026 any alert still configured simply stops delivering notifications — no further extensions, and no warning to the end users who were relying on them.

Many organizations discover this the hard way, because alerts were often set up years ago by individual users on document libraries and lists and then forgotten. The moment they stop firing, people quietly stop learning about changes to content they care about, and the failure is invisible until someone notices they missed something. A common follow-up question this month has been whether OneDrive alerts are affected as well; the retirement is scoped to SharePoint's classic alert feature, but the practical guidance is the same — move notification scenarios onto a supported platform.

What to do: Replace any remaining alert-based notifications with Power Automate flows or the newer Rules feature built into modern lists and libraries. Prioritize business-critical libraries where a missed change notification would actually cause a problem.

New Permissions Report Arrives in the SharePoint Admin Center

Microsoft added a Permissions Report to the SharePoint admin center under Data Access Governance, giving admins a consolidated view of which sites a given user can reach — including both permissions granted directly and access inherited through Microsoft 365 groups and security groups. Until now, answering "what can this person actually get to?" meant stitching together information across many site collections by hand.

The report fits into the broader data-governance push Microsoft has been layering into the admin center to help organizations get ahead of oversharing before Copilot amplifies it. Because Copilot surfaces content based on a user's existing permissions, any latent oversharing becomes far more visible once AI can search and summarize across a tenant. Tools that make effective access legible — permissions reports, data access governance insights, restricted content discovery — are increasingly the front line of preparing a tenant for AI.

What to do: Use the new Permissions Report to spot-check access for a few high-sensitivity roles and any recently offboarded users, and fold it into your regular access-review cadence rather than treating it as a one-time audit.

Copilot in SharePoint: Org Agent Store Submissions and Smarter Metadata

Two meaningful Copilot in SharePoint updates landed in the first half of July. First, organizations can now submit agents built in Agent Builder to the Agent Store under a "Built by your org" section, gated behind admin review and approval in the Microsoft 365 admin center. This turns ad-hoc, individually built agents into governed, shareable assets — an admin reviews, approves, and publishes an agent so colleagues can discover and reuse it, which helps validated solutions scale without a free-for-all.

Second, Microsoft is improving how Copilot understands column metadata when a SharePoint library or folder is attached to a prompt or referenced by URL. Copilot can now factor in the library's metadata columns when answering, which sharpens contextual relevance — for example, respecting a document's status, category, or department field instead of treating every file in the library as undifferentiated text. For organizations that have invested in disciplined metadata, this is a direct payoff.

What to do: Decide who in your organization should be allowed to submit agents to the org Agent Store and document a lightweight review checklist before approvals start piling up. Separately, treat consistent library metadata as a Copilot-quality investment, not just a findability nicety.

SPFx Roadmap: Navigation Customizers, React 18, and the Road to 1.24

The developer side of the house continues to firm up around the SharePoint Framework (SPFx) July roadmap. Beyond the previously announced SharePoint Copilot Apps public preview, Microsoft detailed several capabilities converging on the SPFx 1.24 general availability release now targeted for September 2026. These include navigation customizers — a way to override navigation nodes and experiences with SPFx components — server-side support for overriding the new-item and edit panels in lists and libraries, and a refreshed set of open-source templates.

Perhaps the most consequential item for existing solutions is React 18 support, which Microsoft expects to achieve by SPFx 1.24 GA. Out-of-the-box web parts will move to React 18 only once that work lands, but custom web parts can begin adopting it ahead of the platform. Microsoft also continues nudging developers off the legacy Gulp build system toward Heft, with that migration becoming increasingly important as the 1.24 line matures. The team reiterated its shift toward a more predictable, quarterly-oriented release cadence.

What to do: Developers maintaining SPFx solutions should inventory their React version and build tooling now, plan the React 18 and Gulp-to-Heft migrations rather than deferring them, and watch the roadmap for preview access to Copilot Apps and navigation customizers.

Sources

Back to all news