M365 Cyber Governance Daily

On today's episode of Governed Today I ended with two items that look harmless on their own. Put them side by side and you get a data-loss scenario most offboarding checklists don't cover.

This is the longer version, with the checks I'd run this week.

What changes in Teams

Microsoft published MC1523076 on 23 October. From mid-November 2026, with rollout expected to finish by late November, collaborative meeting notes in non-channel Teams meetings are stored in the meeting organizer's OneDrive, in the Meetings folder. That includes Loop-powered meeting notes and Facilitator notes.

Today the file lands in the OneDrive of whoever happens to click "start notes". After the change, the organizer owns the file even if someone else starts it.

A few details matter:

• Only newly created notes are affected. Existing notes stay where they are and are not moved.
• Channel meeting notes are not changing.
• No configuration is required, and there's no setting to turn this off mentioned in the post.
• Microsoft explicitly tells you to review governance processes and retention policies that assume the old location.

In many ways this is an improvement. Ownership becomes predictable. But predictable also means concentrated. The organizer of a recurring steering group, a project sync or a customer call now holds every set of notes from those meetings in a personal OneDrive.

The OneDrive clock

The second half is not new behavior, but it's the part people get wrong.

When a user account is deleted in Entra ID, their OneDrive enters a retention period. The default is 30 days. If a manager is set on the account, that manager gets an email with access and a warning. If no manager is set but a secondary owner is configured in the SharePoint admin center, that person gets it instead. Seven days before the end, there's a reminder.

Then the OneDrive goes to the site collection recycle bin for 93 days. From that point people can no longer reach anything shared from it, and restoring it means PowerShell. The recycle bin isn't indexed, so search and eDiscovery can't find content there.

Two things often surprise people. Blocking sign-in or removing the license does not start this clock; deleting the account does. And unlicensed OneDrives have their own lifecycle now. MC1381110 introduced read-only at day 60 and archive at day 93 for unlicensed accounts, with unpaid ones at risk of deletion after 12 months.

Microsoft also has a Purview Data Lifecycle Management roadmap item (RM569721) for deleting inactive OneDrives and mailboxes of departing employees at scale, listed with preview in November and GA in December 2026. That's useful if you want deletion to be deliberate. It also means more of offboarding will run automatically, so your retention design has to be right before it gets switched on.

Why the combination matters

Picture a project lead who organizes the weekly meeting for a year. From mid-November, every new set of notes from that meeting lives in their OneDrive. They leave. HR closes the ticket, IT deletes the account, and nobody on the project gets an email because the manager field in Entra was never filled in.

Thirty days later the notes are gone from everyone's view. The decisions, action items and Copilot-generated summaries the team relied on went with them.

Unless a Purview retention policy or an eDiscovery hold covers that OneDrive. Microsoft is clear that retention policies and labels take precedence over the standard OneDrive deletion process, and a OneDrive under hold isn't deleted until the hold is lifted. So the fix exists. You just have to have set it up.

What I'd check this week

1. The deleted-user retention setting. SharePoint admin center, Settings, Retention. Any value from 30 to 3650 days. Or Set-SPOTenant -OrphanedPersonalSitesRetentionPeriod. Thirty days is short for most organizations.
2. Purview retention policies for OneDrive. Check that a policy actually includes OneDrive accounts, and that the scope isn't limited to a few users. Loop and meeting notes are files in OneDrive, so they follow that policy.
3. Manager attributes in Entra ID. The manager handover email only works if the field is populated. Set a secondary owner in SharePoint as a fallback.
4. The offboarding runbook. Add a step: before deleting the account, ask who organized recurring meetings and move or share what the team needs. Don't rely on the 30-day email arriving at the right person.
5. eDiscovery holds for people under legal or HR review. Put the hold on before the account is deleted.
6. Tell your users. A one-line note before mid-November helps: "Meeting notes now live with the organizer. If you run a recurring meeting, plan for what happens to the notes when you hand it over."

Related items from the past week

A few other things from recent digests fit the same pattern of ownership and lifecycle.

AI agents without owners. Microsoft's Zero Trust Assessment 3.1.0 adds a view of agents that have no owner or sponsor, and CISA's ScubaGear v2.0.0 adds an Entra baseline policy for blocking high-risk AI agents. An agent built by someone who has left is the same problem as the meeting notes. Nobody is accountable for it, and maybe it still has access.

Copilot connectors, MC1454973. From 30 October the Copilot Connectors page honors the Allowed agent types setting in the Microsoft 365 admin center, and the old setFederatedConnectors CLI toggle is retired. If you used the toggle, check that the new setting says what you think it does before Friday.

Intune RBAC, MC1456780. The new device page is the default from release 2609, and admins now need Managed devices/Update on top of the specific action permission. Changing a device's primary user, which often happens at offboarding, needs both. Check your helpdesk roles.

Closing

None of these changes is bad. Most of them make ownership clearer. But clearer ownership only helps if your offboarding process knows who the owners are and what happens when they leave.

I cover this kind of thing every weekday on Governed Today. Today's episode, "CISA Deadlines and AI Agent Threats", is here: https://governed.today/episode/2026-10-26

You can also find the show on Spotify (https://open.spotify.com/show/0BWSOu6yKm9SPYMznRVEHN) and Apple Podcasts (https://podcasts.apple.com/se/podcast/governed-today/id6825837004).

How does your offboarding handle content the leaver owned for the team? I'd like to hear what works.

Sources

• MC1523076, Teams Loop meeting notes stored in the organizer's OneDrive: https://mc.merill.net/message/MC1523076
• OneDrive retention and deletion (Microsoft Learn): https://learn.microsoft.com/en-us/sharepoint/retention-and-deletion
• Set the OneDrive retention for deleted users: https://learn.microsoft.com/en-us/sharepoint/set-retention
• Restore a deleted OneDrive: https://learn.microsoft.com/en-us/sharepoint/restore-deleted-onedrive
• MC1381110, retention enforcement for unlicensed OneDrive accounts: https://mc.merill.net/message/MC1381110
• RM569721, Purview DLM deletion of departed users' OneDrives and mailboxes: https://message.cengizyilmaz.net/roadmap/rm569721-microsoft-purview-data-lifecycle-management-ensure-regulatory-compliance-by-deleting-inactive-onedrives-and-mailboxes-for-departing-employees
• MC1454973, Copilot connectors managed via Allowed agent types: https://mc.merill.net/message/MC1454973
• MC1456780, new Intune device page becomes default: https://mc.merill.net/message/MC1456780
• Zero Trust Assessment releases: https://github.com/microsoft/zerotrustassessment/releases
• ScubaGear releases: https://github.com/cisagov/ScubaGear/releases