I’ve spent more than 20 years running IT and security for organizations across California and around the country. Over that time, my team has taken over, deployed and cleaned up Microsoft 365 environments for law firms, commercial real estate companies, manufacturers, healthcare practices and schools. We’ve supported more than 7,500 users along the way.

After working with that many tenants, the biggest takeaway is simple: most Microsoft 365 security problems aren’t especially sophisticated. Usually, a control was never turned on, only covered part of the organization, or somebody made an exception years ago to keep something working and it was never revisited. Microsoft gives organizations a lot to work with. More often than not, the problem is how the environment was configured and maintained, not a lack of security tools.

These are the issues we run into most often and the areas I’d look at first.

Most environments are still running on their original settings

When we first assess a tenant, we often find that nobody has really gone back through the security settings since it was originally set up. MFA may cover some users but not everybody. Legacy authentication is still allowed. There are too many global administrators. Nobody is quite sure when audit logging was last reviewed.

Last year we took over a 45-person medical practice that had been on Microsoft 365 for almost a decade. We found nine global administrator accounts, including two belonging to employees who had left years earlier. MFA was enabled, but only for the physicians. The front desk and billing staff, who handled the most patient data, had none.

Usually, nobody intentionally ignored security. The company grew, email kept working, people got busy and the original setup stayed in place. We see this constantly. Something working every day doesn’t necessarily mean it is configured the way you would want it configured today.

For a smaller organization without dedicated identity management, Microsoft’s security defaults are a good place to start. They require MFA and block legacy authentication without adding another license. As the environment gets more complex, and assuming the licensing supports it, conditional access gives you much more control over who can sign in, from where and from what device.

MFA is the starting point, not the finish line

At this point, most business leaders know MFA needs to be enabled. What still gets missed is the idea that turning it on somehow finishes the job.

Attackers have adjusted to MFA. Push fatigue attacks still work because eventually somebody may approve a prompt just to make it stop. Adversary-in-the-middle phishing kits can steal a live session token and get around standard MFA altogether. OAuth consent phishing is another issue: a user can be tricked into approving a malicious application through what looks like a legitimate Microsoft or Google consent screen. At that point, changing the user’s password may not even remove the access.

A few months ago, a paralegal at a law firm we support clicked what looked like a shared document from opposing counsel and signed in through a convincing Microsoft login page. She had MFA and completed the prompt, but the page was relaying her session in real time. Within minutes the attacker was in her mailbox from overseas. We caught it through an impossible-travel alert, revoked the session and reset the account before any client data left.

There are a handful of things we normally tighten up here. Use number matching in the authenticator app. Put administrators and other high-risk users on phishing-resistant methods such as FIDO2 keys or passkeys. Don’t let users approve any third-party application they want. And where licensing allows it, use conditional access so a password or stolen session by itself isn’t enough to get into the environment.

Legacy authentication remains the open side door

This one still surprises a lot of executives. They know MFA is enabled and assume that means every sign-in is protected. That isn’t always the case. Legacy protocols such as POP, IMAP and older SMTP connections don’t support MFA, which can leave a path around the control.

Microsoft has retired a lot of legacy authentication already, but we still come across exceptions that were left in place for an old scanner, a line-of-business application or sometimes one user’s device. Find out what actually still needs it, fix or replace that dependency, and close the exception. We have seen organizations leave a security hole open for years because of one multifunction printer.

Licensing determines what security is actually available

Licensing is another area that causes a surprising amount of confusion. Two plans can sound almost identical while giving the IT team very different security capabilities. Office 365 E3 and Microsoft 365 E3 are a good example: Microsoft 365 E3 includes Intune device management and Entra ID P1 conditional access, while Office 365 E3 does not.

We once had a healthcare client with a departing employee who kept a company laptop with patient records on it. Leadership assumed we could lock or wipe it remotely. We couldn’t. They were licensed for Office 365 E3, not Microsoft 365 E3, so the device had never been enrolled in Intune. We got the laptop back, but only after several uncomfortable days, and they upgraded their licensing the following week.

So before putting together a security roadmap, I would first confirm exactly what licenses are in place and what those licenses actually include. We’ve had more than one situation where leadership assumed a security capability was available simply because the Microsoft plan name sounded similar.

Email is still where most incidents begin

For us, email is still where a large percentage of incidents start. It may be a credential phishing page, a malicious link, or an inbox rule created after somebody has already gained access to the account.

Business email compromise is especially dangerous because the attacker often doesn’t do anything obvious right away. They get into a mailbox, create forwarding rules or hide replies, and wait. The goal may simply be to sit there until an invoice or wire transfer gives them an opportunity. According to the FBI’s Internet Crime Complaint Center, reported cybercrime losses reached $16.6 billion in 2024, and BEC continues to be one of the more expensive categories of fraud.

At one law firm, an attacker compromised a mailbox and created a rule that quietly moved any email containing “invoice” or “wire” into an unused folder. Two weeks later, a client received updated wiring instructions for a settlement payment from what looked like the firm’s own account. The client called to confirm before sending the funds, and that phone call is the only reason the money didn’t go out.

We normally put several controls around this. Block automatic forwarding to outside domains. Alert when inbox rules are created or changed. Most importantly, have an internal policy that any change to payment or wiring instructions gets confirmed verbally using a phone number you already know. That last one has nothing to do with cybersecurity software, but it can stop a very expensive mistake.

Privileged accounts need their own standard

The global administrator list should be short, intentional and documented. We also don’t want somebody using the same privileged account to read email and browse the web all day. It sounds basic, but we correct this all the time.

Use separate administrative accounts, put phishing-resistant MFA on them, and use just-in-time elevation where the licensing supports it. A compromised global administrator account gives an attacker an enormous amount of control, so we treat those accounts differently from a normal user.

Logging only helps if it’s configured before you need it

When something does happen, we immediately need to know what happened, when it started and what the attacker touched. If the right logging wasn’t enabled beforehand, or the retention period is too short, sometimes you simply can’t reconstruct the whole incident after the fact.

I’d much rather configure logging on day one and never use it than reconstruct an incident from partial data. CISA’s Secure Cloud Business Applications (SCuBA) baselines are an excellent, free reference for which settings to enable and how to verify them.

Where I would start

Microsoft 365 can be a very secure platform. In most environments we take over, the issue isn’t that Microsoft was missing some critical security feature. It’s usually a relatively short list of settings, permissions and exceptions that accumulated over time.

If I were reviewing an environment this quarter, these are the four things I would verify first:

1. Administrative access is minimal and protected with phishing-resistant MFA.
2. Legacy authentication is blocked.
3. MFA covers every user, and users can’t approve third-party apps unchecked.
4. You would have complete logs if something happened tomorrow.

Those four checks won’t solve every security problem, but they eliminate a lot of the issues we repeatedly find when we’re brought in to assess an environment or clean up after an incident.

Microsoft believes the era of enterprise agentic transformation is here, underscored by a slew of Microsoft Fabric announcements at the European Microsoft Fabric + SQL Community Conference in Barcelona today.

“We’re going to talk a lot about the notion of how you prepare your data estate to really provide the context for AI agents to help you transform the organization,” Amir Netz, CTO of Azure Data, told CIO.com last week.

At Microsoft Build 2026 in June, Microsoft unveiled Rayfin, a new open-source SDK and CLI that supports AI-assisted development. Now Microsoft has introduced Fabric Apps, which leverages Rayfin to bring applications development directly to governed data in Microsoft Fabric. The idea is to help organizations build and scale AI-powered applications with new capabilities for data connectivity, transactional workloads, backend logic, storage, and policy-controlled access.

“It’s not just the data itself,” Netz said. “You can build the entire app, including the web pages, the business processes, the functions, and you can build it end-to-end in Fabric. You don’t need to deploy containers. It’s fully hosted, fully managed, fully governed, only Fabric.”

Strength in numbers

Microsoft is also introducing new agentic data engineering features in Fabric that stem from its acquisition of Osmos in January. The AI-based data engineering firm’s tech uses agentic AI to turn raw data into analytics, and AI-ready assets in OneLake, the data lake at the core of Microsoft Fabric. With these new features, engineers can now define an outcome and set boundaries, and an agent can autonomously execute the work, validate the results, and refine the approach.

“They have this secret sauce of how to get really high accuracy from agents in very complex data engineering projects that you can’t just achieve by telling Claude to do it for you,” Netz said. “No matter how well your prompt is constructed, it’s not going to be good enough. The accuracy level we’re getting from this Osmos technology is significantly higher than any other commercially available agentic system from the best frontier labs.”

Meanwhile, Observability in Fabric is a new feature to support proactive operations rather than reactive troubleshooting. The Monitor Hub provides a unified view across jobs, capacities, workspaces, and workloads. Operations agents and Activator help teams investigate issues, identify root causes with AI, and automate responses.

“Observability is required for teams to both debug their projects and manage projects after they’re released in production,” Netz said. “It’s spanning both agents and code because you have agents that are going to call code, and you need to have the entire journey of the logic, and the execution from end-to-end.”

Shot in the arm for admin

For administrators, Database Hub in Fabric, now in public preview, provides a central control plane for managing SQL Server, Azure SQL, PostgreSQL, Cosmos DB, and SQL databases in Fabric. This helps administrators monitor and govern their entire database estate.

“Fabric is becoming the center point for everything data at Microsoft and everything that’s context based on data,” Netz said. “Fabric has always been about unifying all the data services, unifying all the data, and unifying users in one place. Now it unifies the entire inventory of databases, both in Azure and on-premises, in one place. You can find all your databases, monitor them, manage them, administrate them, and do it all with the help of an agent.”

To help companies share data with agents outside organizational boundaries, Microsoft has also introduced IQ Share in Microsoft Fabric, which allows organizations to securely share data and the business context around it while maintaining governance.

“The agents work on the same copy across the two organizations and the context comes with it so agents on both sides can really understand the meaning of the data,” Netz said.

Microsoft’s Copilot super-app has arrived, two months after CEO Satya Nadella confirmed it was in development. It combines conversational Chat, the autonomous Cowork agent, a redesigned coding environment named Code, and Autopilot, the persistent agent formerly known as Scout, into a single Copilot experience.

The idea is to make those capabilities look less like separate tools and more like different ways of getting work done through a unified experience. The end goal is to enable users to describe what they want to accomplish without choosing a mode themselves, and with Copilot routing the task to Chat, Cowork, Code or another capability, Microsoft said.

The individual pieces of this experience are not entirely new, and build on  launches and consolidation moves that Microsoft has made over the past several months.

Nadella first described the unified Copilot architecture during an earnings call in July. He said it would bring chat, agents and business workflows into a single AI workspace while separating the orchestration layer, context and memory from any one AI model. Microsoft subsequently began unifying its consumer and Microsoft 365 Copilot apps ahead of the broader overhaul.

But Microsoft laid much of the groundwork in the period after its November 2025 Ignite conference, with the launch of Cowork for delegated multistep work, Scout for persistent agentic tasks, and natural-language app-building capabilities that have now evolved into Code.

The broader change goes beyond bringing those Copilot experiences together. With Friday’s updates, Microsoft is also adding components and infrastructure aimed at turning Copilot from an AI assistant embedded across Microsoft 365 into a broader orchestration layer for enterprise work.

These include Fabric IQ and Work IQ for enterprise context, Copilot Managed Runtime for running AI-built applications, a unified plugin registry for connecting capabilities, and usage-based billing and FinOps controls for managing agentic workloads and AI spending.

More enterprise context could boost productivity

The inclusion of Fabric IQ in Chat and Cowork, along with Work IQ’s access to data and workflows in Dynamics 365 and Power Platform, will make Copilot more effective for enterprise tasks by giving it a broader understanding of an organization’s data and workflows, potentially reducing hallucinations and improving productivity, said Abhishek Satapathy, principal analyst at Avasant.

“The practical shift is from AI that knows information to AI that can connect what happened, why it happened and what needs to happen next. For example, a business insight can increasingly become the starting point for analysis and follow-up action rather than requiring the user to manually move that context between reports, documents, conversations and business systems,” said Satapathy. “This is particularly relevant for analysts, managers and operations teams working across functions.”

Fabric IQ’s integration with Chat and Cowork is now generally available. Microsoft plans to integrate it with Code soon through its Frontier program. Work IQ will enter public preview over the next month, it said.

Redesigned Code expands the scope of software creation

Productivity is also the focus of Microsoft’s redesigned Code environment.

It “broadens the audience for software creation” by addressing the middle ground between traditional development and simple automation, bringing more use cases into the scope of what business users can build, including those that may be too narrow for a formal development project but too complex for basic automation, Satapathy said.

That means more internal applications, dashboards and workflow tools can potentially be built without going through a traditional development project, while developers can use the same environment to accelerate application creation and focus on more complex engineering and production requirements, he added.

Alongside Code, Microsoft is introducing Copilot Managed Runtime, a governed hosting environment for applications built with Code, Cowork and Copilot Studio. The runtime allows those applications to run within an organization’s Microsoft 365 environment while giving IT control over security, governance and access to live data, Microsoft said.

For enterprise developers and IT teams, the runtime could provide a common production layer for AI-created applications, helping enterprises move applications from experimentation and prototyping into production without having to create a separate operating model for each one, Satapathy said.

It could also help IT teams and CIOs curb shadow IT and application sprawl, said Manoj Chandra Jha, principal analyst at Nord-IQ Research. In its governed environment, IT departments can managed applications and agents created by employees consistently for security, identity, policies, lifecycle management, observability and deployment.

The new Copilot Managed Runtime is currently in public preview and will also be accessible inside the redesigned Code experience, Microsoft said. That experience will roll out to Microsoft’s Frontier program at the end of the month, with broad availability in the coming weeks, it added.

New FinOps tools could help CIOs judge business value

Beyond productivity, faster scaling of AI applications and curbing application sprawl, Microsoft is also giving enterprises more tools to manage the cost of agentic AI by expanding its cost-management capabilities in Agent 365 to include Code and Copilot Managed Runtime.

These capabilities will allow administrators to manage AI spending policies at scale, control access to model families and route credit requests through existing approval workflows, while giving visibility into the outcomes generated by agentic workloads to decide where to sustain, expand or optimize usage, the company said.

End users will also be able to view their credit usage, remaining balances and usage history directly in Copilot, helping them manage their AI usage, it added.

For Bhupendra Chopra, chief revenue officer at IT consulting firm Kanerika, the expanded FinOps capabilities will be critical for CIOs, particularly for understanding if agentic workloads and automation are delivering sufficient business value and if they need to be reworked.

“These capabilities can reveal correction rates for agents. If employees regularly have to undo an agent’s work, that can indicate stale context, poor business rules or an unreliable data foundation before it shows up as a larger operational problem,” Chopra said.

“These capabilities can reveal another insight: whether the time supposedly saved by automation actually translates into a measurable business outcome. Enterprises can automate 20 minutes of work but simply spend that time elsewhere, meaning the productivity gain only matters when it produces a measurable result,” he added.

Usage-based billing extended

Alongside these FinOps capabilities, Microsoft is also extending usage-based billing to more of the capabilities being brought together under Copilot. The model is not new to the platform, having been introduced for Cowork when the agent became generally available in June.

While Cowork, Code and Autopilot, along with new long-running agentic capabilities and frontier models, will use usage-based billing, Chat and Copilot across Microsoft 365 will remain covered by the user subscription license, the company said.

That distinction could require CIOs to think about AI spending differently from traditional productivity software, Satapathy said.

Instead of budgeting primarily around the number of users with Copilot licenses, CIOs may need to consider what work is being delegated to agents, how much that work consumes and what business value it produces, he added.

“Two employees with the same Copilot license, for instance, could generate very different AI costs depending on whether one uses Copilot for assistance while the other delegates longer-running work to agents,” he further said.

However, that might still be some way off, with several of the key capabilities still in preview or yet to roll out.

Home, the new starting point in Copilot where Chat and Cowork come together, will begin rolling out through Microsoft’s Frontier program in the coming weeks, while Autopilot is expanding to private preview at the end of the month, Microsoft said.

This article first appeared on Computerworld.

There’s a new development in a Microsoft antitrust case, originally filed in England’s High Court in April 2021, and it doesn’t look good for the tech giant.

A consent order from the UK Competition Appeal Tribunal is demanding documents from past and present Microsoft executives that may have a bearing on a £270 million (about $361 million) lawsuit filed by secondhand software reseller ValueLicensing. The company alleges that Microsoft offered incentives to customers to shift to subscription services without selling their pre-owned licenses.

Central to this development is a historic, potentially damning internal “Second-Hand Software” (SHS) presentation, referred to in the consent order as a “known adverse document.” The specific content of the presentation has not yet been made public, but Microsoft has until October 31 to explain why it did not disclose the presentation earlier.

Further, a confidentiality designation that previously applied to 11 documents relevant to the case has been lifted.

These developments represent “an inflection point in European tech litigation,” said Forrester senior analyst Dario Maisto.

“For Amazon (AWS), Google, and Microsoft, the signal is clear: Antitrust tribunals are fully comfortable examining software licensing mechanics as tools of anticompetitive lock-in.”

The allegations against Microsoft

Under EU law, it is fully legal to resell perpetual pre-owned (“second hand”) software licenses; software makers cannot use their Terms of Service (ToS) to override this right. ValueLicensing specializes in this secondary market, re-selling licenses for products including Microsoft Windows and Microsoft Office.

But the company alleges that Microsoft has stifled the supply of these pre-owned licenses in the UK and the European Economic Area (EEA) comprising 27 European Union member and non-member countries. It says Microsoft abused its market dominance and entered into agreements that “prevented, restrained or distorted competition” via clauses restricting customers from reselling their Microsoft perpetual licenses in return for subscription service discounts.

“The net result has been higher prices and less choice for customers, who have been steered into cloud-based Office365 and Azure subscriptions,” ValueLicensing claimed, pointing out that many enterprises, as well as publicly-funded organizations, rely on pre-owned Microsoft licenses to keep operating costs low.

The consent order is asking Microsoft to provide its “view” of whether those allegations are true, and to make “reasonable endeavors” to contact former COO Kevin Turner, former president and EVP Jean-Philippe Courtois, and former corporate VP of worldwide licensing and pricing Joe Matz. The company must document that it has done so by November 30.

The company must also file a witness statement from a former consultant addressing who within the company was aware of the SHS presentation and when they became aware of it; why the presentation was not disclosed as a “known adverse document”; when in-house legal counsel became aware of the presentation; what steps were taken to check for these types of “known adverse documents”; and the decision making process within the company when the presentation was located.

Microsoft is also being asked to search for specific terms in the emails and document repositories of Matz, Courtois, Turner, and several other named current and past research managers, former VPs and presidents, between July 2012 and June 2020.

The more than 40 search terms include “SHS,” “antitrust,” “competition,” “ValueLicensing,” “used licenses,” “do nothing,”  “competition,” “revenue,” and “discount licensing.” These documents cannot be designated “restricted” or “confidential,” according to the consent order. They must also be disclosed by November 30.

A witness statement from deputy general counsel Cynthia Randall has been paused.

Microsoft has said that any abuse of dominance was “objectively justified” and that the contractual terms at issue were “necessary and reasonable.” It also argued that anti-competitive effects were “outweighed by and proportionate to” certain benefits and efficiencies.

The company did not reply to a request for comment.

Microsoft is facing similar antitrust allegations from UK barrister Alexander Wolfson, who issued an opt-out class action claim in May 2025 alleging that public and private UK organizations that purchased software licenses, including those for Microsoft Office and Windows, were overcharged over a 10 year period due to Microsoft’s market practices.

Wolfson said in a release at the time that Microsoft’s actions had a significant and far-reaching impact on UK consumers, businesses, and public bodies. “With billions of pounds potentially at stake, this case is about ensuring fairness in the digital marketplace and ensuring even the largest tech companies play by the rules,” he wrote.

Implications for enterprise leaders

For enterprise CIOs, procurement leads, and IT financial managers, the current development holds “practical implications,” said Forrester’s Maisto: Organizations that surrendered perpetual licenses or agreed to contractual restrictions against reselling software as part of an enterprise agreement (EA) renewal or cloud commitment may have given up quantifiable asset value.

“The secondary market for perpetual licenses remains legally valid,” he pointed out.

CIOs should pay close attention to licensing “penalties” or inflated costs for running legacy software on third-party clouds, like AWS or GCP, versus Azure, he said. They should also evaluate the benefits of hybrid licensing strategies. Combining pre-owned perpetual licenses for static workloads with cloud subscriptions for dynamic workloads can yield significant cost savings compared to all-subscription models, Maisto pointed out.

Finally, he urged, “use these rulings as leverage during Microsoft agreement renewals.”

This article originally appeared on Computerworld.

All of the major AI providers want you to use, and ideally stay within, their super apps, and now Microsoft is looking to capture that attention, too.

During an earnings call this week, CEO Satya Nadella confirmed that the tech giant is building a Copilot ‘super app’ that will be rolled out this quarter. The new platform will bring together various Copilot tools, including chat, Cowork, long-running Autopilot agents, and the always-on Microsoft Scout, powered by OpenClaw.

Microsoft said the super app will be wired into many of its other governance platforms, including Agent 365, IT Ops, SecOps, FinOps, and business processes. And, it said, CRM and ERP systems will “serve as skills and plug-ins that go into core work.”

“You’re able to take that enterprise-wide workflow and wire it into the super app,” Nadella said, describing it as “the coming together of a new way to work.”

With this move, Microsoft will compete with OpenAI’s ChatGPT Work, Claude Cowork, and a growing number of others trying to capture as much of a user’s workflow as possible. It could prove a strong contender, as everyday Copilot “usage intensity” is at the same level as that of Outlook or Teams, Nadella said, and paid seats now surpass 30 million.

Every model should be ‘swappable’

Even as it builds a super app to bridge workflows, Microsoft is acknowledging enterprise demand for model choice. Customers are making it clear that they don’t want to be locked into one model; they want the ability to move between open, closed, and frontier options based on the best tool for the job.

This trend is reflected in Redmond’s own usage statistics: Since the beginning of the year, it has tracked a 5x increase in the number of customers building with models from multiple providers featured on its platform.

The company claims it has the broadest model catalog in the cloud, offering more than 11,000 models from OpenAI, Anthropic, Mistral, its own MAI family, and others.

“We are building a new model system, where the harness, context, memory, and action space are separate from any one model family, thereby moving the frontier on the cost-to-outcome curve,” Nadella said. “That’s really the enterprise design architecture that we are going to evangelize.”

He described enterprises as “learning machines” that need their own internal learning machines, and said that they will be evaluating how providers are helping them reach their business goals and support knowledge creation.

“The models are an input, not some extraction of the knowledge of the enterprise,” Nadella said. “This is not going to be about, ‘come in and take all my knowledge and benefit yourself, [and] I am not getting anything out of it.’”

The key is in balancing the advantages of frontier models with lower-cost options, open weights with closed weights, and having the ability to train internal models based on outputs, traces, and context. “You should and you can use frontier models,” Nadella said. “There’s no reason not to.”

However, he said, any given model at any given time should be swappable to democratize design.

For instance, data from cybersecurity evaluation framework CyberGym showed that Microsoft’s new MAI-Cyber-1-Flash coding agent achieved Claude Mythos-level performance at 50% of the cost. This is because 90% of tasks were completed by Cyber-1-Flash and 10% by frontier models from OpenAI, Anthropic, and others. 

This ability to use the right model for the right task in what is essentially a pipeline job is a “super important characteristic,” Nadella said. Microsoft Copilot, Security Copilot, and GitHub Copilot are all built to support movement between different models based on the task.

This strategy is also reflected in the company’s new Project Perception cybersecurity offering. The platform features three specialized types of agent (red, blue, and green), and the underlying harness decides which AI model is best suited for a given task. Guided by specialized playbooks, red team agents discover vulnerabilities, blue team agents triage, and green team agents propose remediation plans.

“You create your own agentic system that’s continuously operating to create the cyber defense you need,” Nadella explained. “Especially in cyber[security], it becomes critical to have that multi-model approach.”

Nadella also pointed to the recent Hugging Face incident, in which an OpenAI model went rogue, broke out of its sandbox, and launched an attack against the popular open-source platform, noting that enterprises will likely need to use multiple models to offset and remediate the various challenges of each, and should not be “subject to the refusals of one model.”

“We talk about the frontier as if it’s one thing,” Nadella said. “The frontier is about every firm having a frontier, the choice, the cost control, and the capability that they need in order to be able to control their destiny.”

Increased push to usage-based pricing, closing demand gaps

As Microsoft emphasizes its model-agnostic architecture, it is also shifting from per-seat to per-seat-plus-consumption pricing; the company recently added usage-based billing to Cowork and Agent 365, and plans to continue that trend across its products.

While these moves have resulted in sticker shock and ‘tokenmaxxing’ at many companies, Nadella framed it as a revenue driver. “We are advancing the frontier on the cost-to-outcome curve, ensuring every customer can turn tokens into business results.”

Meanwhile, Microsoft said it will continue to close data demand-capacity gaps.

The company added 88 data centers in FY 2026, including 31 across five continents this past quarter. It contended that it is bringing capacity online “faster than ever,” reducing dock-to-live times for new GPUs in its largest regions by nearly 50% over the fiscal year.

However, CFO Amy Hood acknowledged during the earnings call, “the situation is obviously that demand exceeds available supply in a relatively extreme moment.”

Reflecting this, revenue for Azure and other cloud services grew by 43% in Microsoft’s fiscal year ended June 30, and the company expects similar revenue growth (45%) in fiscal year ‘27.

Hood said that Microsoft remains “focused on delivering efficiencies,” including in its CPU and GPU fleets, and engineers are also working on process improvements. The company added another gigawatt of capacity this quarter and is on track to roughly double its overall capacity in two years.

“We are also getting more from the infrastructure we already have by optimizing across silicon, systems, and software,” Hood said.