Microsoft began shutting off Exchange Web Services in Microsoft 365 on October 1, 2026. Many older backup, archiving, CRM, and email signature tools still depend on that connection. Basic username and password sign-in for scan to email copiers is also scheduled to be turned off by default at the end of December. In this episode, Jason Russell explains what is changing in plain English, why these failures tend to happen without anyone noticing, and how to get ahead of them this week.

• The EWS shutdown is phased. It started October 1, 2026, and ends permanently on April 1, 2027.
• Silent failures are the real risk. A backup or archive that stops collecting email may not give you an obvious warning.
• Scanners and copiers are next. Devices that send scans by email with a plain username and password need a modern sign-in method or a different setup.
• Make a list. Write down every outside tool and device that sends, reads, stores, or changes your company email.
• Ask every vendor two questions. Ask how their product connects to Microsoft 365 and how you will know if that connection stops working.

Sources

• Microsoft Exchange Team Blog: Exchange Online EWS, Your Time Is Almost Up
• Office Watch: October 2026 Office Changes
• AdminDroid: Microsoft 365 End of Support Milestones
• Manuel T. Gomes Newsletter: Get Ready for a Busy October

On September 1, 2026, the FBI's Internet Crime Complaint Center published a public service announcement titled Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing. In this episode, Jason Russell explains in plain English how a fake app can ask an employee for permission to read their mailbox or files, and why multifactor authentication does not stop it on its own. He also walks through the Microsoft 365 and Google Workspace settings that let an administrator approve app permissions before staff can grant them.

Key takeaways

• Consent phishing does not steal a password. It tricks a user into granting a malicious app permission to their account through a real Microsoft or Google sign-in page.
• Multifactor authentication still matters, but once an app has been granted access it can keep reading data without triggering new sign-in prompts, and a password change may not remove that access.
• In Microsoft 365, administrators can restrict user consent and turn on an admin approval workflow. In Google Workspace, administrators can restrict unconfigured third-party apps through API controls.
• Review the list of apps that already have access to your company accounts and remove anything you do not recognize.
• If someone clicked Accept on a suspicious app, revoke the app's access, check for unusual mailbox rules, and report the incident to the FBI's Internet Crime Complaint Center.

Sources

• FBI Internet Crime Complaint Center, Public Service Announcements