Loading story…
Microsoft fixed a defect in Classic Outlook for Windows that caused Copilot Chat and other Copilot entry points to disappear for users with the Copilot Chat (Basic) license after updating to builds 16.0.20026.20182 and later. The issue affected the Outlook interface only and did not impact customers with the full Microsoft 365 Copilot license, pointing to a licensing-validation problem in the desktop client rather than a broader Copilot service outage. Microsoft said the Outlook team resolved the problem through a server-side service change and told affected users to restart Outlook or update to the latest build if the buttons did not immediately return.
During the disruption, Copilot remained accessible through Outlook on the web, new Outlook, and the standalone Microsoft 365 Copilot app or web experience, while Microsoft also suggested reverting to build 16.0.20026.20168 as a fallback. Separately, Microsoft said it is investigating another Outlook problem that causes crashes on systems running Kaspersky Antivirus, tied to the Mail Checker module mcou.dll; affected users were advised to review Application log Event 1000 entries showing OUTLOOK.EXE and MCOU.DLL and to contact Kaspersky support.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
After updating Classic Outlook for Windows to build 20026.20182 and later, users with the Copilot Chat (Basic) license lost Copilot Chat and Copilot entry points in the interface. Microsoft said the issue did not affect users with the full Microsoft 365 Copilot paid license.
Microsoft is investigating a separate issue causing Outlook crashes on systems running Kaspersky Antivirus. The company linked the crashes to the Kaspersky Mail Checker module mcou.dll and advised users to verify the problem through Application log Event 1000 entries showing OUTLOOK.EXE and MCOU.DLL before contacting Kaspersky support.
Microsoft said the Outlook team fixed the problem through a service-side change on June 29, 2026. Affected users were advised to restart Outlook, with fallback workarounds including using new Outlook or Outlook Web Access and reverting to build 16.0.20026.20168.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is tightening and clarifying how **Copilot** can access and process user and organizational data across the Microsoft ecosystem. Microsoft is expanding **Purview Data Loss Prevention (DLP)** enforcement so policies that block Copilot from processing restricted/sensitivity-labeled content will apply not only to files in **SharePoint** and **OneDrive**, but also to **locally stored** Word, Excel, and PowerPoint documents. The change is planned for deployment via the *Augmentation Loop (AugLoop)* Office component between late March and late April 2026, and is expected to be automatically enabled for organizations already configured to block Copilot from processing labeled content; Microsoft says the update works by allowing the Office client/AugLoop to read sensitivity labels directly rather than relying on Microsoft Graph calls tied to SharePoint/OneDrive URLs. Separately, a Copilot “Memory” setting labeled **“Microsoft usage data”** has been reported as enabling Copilot to reference data from other Microsoft products (including **Bing, MSN, and Edge**) to personalize conversations, with an option for users to disable it if they have privacy concerns. A third, unrelated Microsoft 365 issue—an acknowledged bug in **classic Outlook** that can cause the mouse pointer to disappear—does not materially relate to Copilot data access or DLP controls and appears to be a usability defect rather than a security event.
Jun 29, 2026
Microsoft is investigating a Microsoft 365 Copilot availability incident tracked as **CP1470554**. Affected users may be unable to open Copilot or may receive errors while accessing or interacting with the service, including through Copilot-integrated Microsoft 365 applications. Microsoft had not disclosed the root cause, affected regions, or an estimated recovery time. The company has not identified the incident as a breach or cyberattack; tenant administrators should monitor the Microsoft 365 admin center Service Health Dashboard and avoid unnecessary endpoint, credential, or client-configuration changes while the cloud-service disruption remains active.
Sep 11, 2026
Microsoft moved to resolve two separate email access problems affecting Outlook and Exchange Online users. In Exchange Online, a newly introduced **virtual account** change intermittently blocked some users from accessing cloud mailboxes through Outlook mobile apps and the new Outlook for Mac, prompting Microsoft to classify the issue as a service outage under `EX1256020`. After infrastructure restarts failed to restore access, the company identified the change as the root cause and began disabling it across affected environments. Microsoft also fixed a classic Outlook bug that caused Gmail and Yahoo accounts to stop synchronizing, triggering errors `0x800CCC0F` and `0x80070057` after users stopped receiving sign-in prompts. The company said the service-side fix was deployed, but some users could continue seeing sync failures until their OAuth token expires, such as after a password change. Microsoft published a temporary workaround to force a new sign-in prompt and noted it is still investigating other Outlook-related problems, including Exchange Web Services group creation failures and a Teams Meeting Add-in issue that can make classic Outlook unusable.
Jun 29, 2026