New for This week

• As a user of Microsoft technologies, you are receiving this publication to stay informed about critical topics such as Microsoft licensing, price increases, end-of-life dates, technical updates, security notices, and more.
  If you do not want to continue receiving TOP STORIES, click on the unsubscribe link at the bottom of the mail.
  
• Another 3 New vendors CapCut, Syskit and Plumsail are added.
• Microsoft EoL section Updated for April 2027 - all about modernisation!
• DarkWeb Weekly Intelligence Report #166- ShinyHunters are famous this week
• Did you Know? - Your documents probably end up in "File 13" - we have a solution
• New Outlook Catching up - Maybe, one day it will replace OutLook CLassic?!
• What is Hiding in Your Azure bill - Look if you dare! Maybe help is required?
• Sluggish PC's get a Boost - It's not released but this new feature will be welcome
• Agent 365 FAQ Updated again - I think this is going to carry on for awhile
• 32Gig is the new minimum - It REALLY is the new minimum!
• One Vishing call - and millions compromised. Training needs to keep pace.
• AI Phishing Surges - You are going to be tricked by an AI - it's not if, it's When.
• Microsoft Agent 365 out of Preview - MS says AI will be the greatest threat!

We scan the DarkWeb continuously for Hacker signals and Ransomware attacks.

Click above for the report from our live dashboard that we will publish weekly (but actually updated continuously).
This is part of the DarkWeb monitoring services included with many of BUI's managed services offerings. This report is live, and this is a "snapshot" of the top 10 events as of Sunday Afternoon.

CapCut, Syskit and Plumsail have been added for this week.
See below for Linkedin

Try out our AI to see whats been added since launch.

Get all the releases for the next 4 weeks in South Africa.
The long awaited Mortal Kombat 2 is now screening in May along with Masters of the Universe and Mandalorian & Grogu

Register with the link above and get access to the entire TOP STORIES Archive with an AI to help you find what you want. You can also find all the vendors added to FirstMarketPlace and get a whole lot of detail about them!

It's in Beta so it could make mistakes.

Did you know?

Your signed documents may be disappearing into "File 13"

• Most businesses are good at getting documents signed, Adobe Sign, DocuSign, Microsoft 365, email approvals, SharePoint, all very clever........but what happens after the document is signed?

• All too often it disappears into the digital version of File 13, email threads, forgotten folders, half-named PDFs, mystery spreadsheets, and SharePoint sites that slowly turned into dusty caverns.

That is where DocuWare comes in.

• DocuWare helps manage the full document lifecycle, capture, OCR, indexing, approvals, archiving, audit trails, retention, compliance, and fast retrieval.

• This matters when someone asks, “Can you show me the signed document?” and then the nastier follow-up, “Where is all the supporting documentation?”

• Finance, procurement, HR, legal and operations teams all live with this pain, missing invoices, contracts, purchase orders, proof of delivery, employee records, and the inevitable Monday morning scramble.

• DocuWare works alongside Microsoft 365 and Copilot, it does not replace them. Microsoft 365 is where people work, and DocuWare gives structure, control and process to the documents that run the business.

• You have signed the document, now make sure it does not disappear.
  Finding the document should not require a search party, a spreadsheet séance, and three people saying, “I’m sure I saw it somewhere”.

Contact your First Technology Group account manager to connect with our Docuware experts to discuss storing your signed documents in a more recoverable format that is profitable for your business.

Microsoft News This Week

New Outlook is catching up with Classic Outlook

Microsoft is adding a batch of new Outlook features in May 2026, and the good news is that some of them are not just more "AI fairy dust".

The new Outlook is getting proper calendar catch-up features, including automapped calendars, teammates’ calendars in the left navigation pane, bulk calendar group selection, multi-select calendar events, and non-consecutive date selection.
In plain English, this means the new Outlook is slowly getting back some of the practical things people liked in classic Outlook.
Amazing how progress sometimes means putting back what users already had!

Classic Outlook is not being ignored either. Microsoft is bringing Copilot insights into classic Outlook, allowing users to select text in an email and ask Copilot for relevant information.
That is useful, but remember the usual warning, Copilot value depends on licensing, data quality, permissions, and whether users actually know what to ask.

There are also smaller but useful productivity changes, including sorting email by flag status, flag due date and flag start date, plus the ability to save calendar events as .ics files in the new Outlook web client. 
These are not headline-grabbing features, but they do matter for people who live in Outlook every day.

If you have been holding back on the new Outlook because it still felt unfinished, keep testing it. Microsoft is clearly closing the gap with classic Outlook, but do not assume all users should be switched over blindly.

Please contact your First Technology account manager to connect you with our messaging experts to help check shared calendars, delegated mailboxes, automapped calendars, add-ins, and Copilot licensing before making the move compulsory.

What is Hiding in your Azure Bill?

Analyst Lane Shelton from Directions on Microsoft has a very useful warning for anyone approaching an EA renewal.

Your Microsoft 365 bill is no longer just your Microsoft 365 bill. A growing amount of what customers think of as “M365 usage” is now showing up in Azure consumption instead.

Power BI Premium moving to Fabric is the easy example. The old EA line item may disappear, which looks like a saving, but the replacement Fabric capacity lands in Azure. 
Worse, it may cost more than the line item it replaced. So the EA looks cleaner, while the total Microsoft bill quietly gets fatter.

This is not only about Power BI. Sentinel, Azure Monitor, Purview, Copilot Studio, Power Platform, Teams Phone add-ons, Microsoft 365 Backup, Archive, SharePoint Embedded and Graph Data Connect can all create Azure meter charges linked to services people still think of as Microsoft 365.

All this creates a renewal blind spot. You may negotiate the Microsoft 365 agreement, while the Azure bill sits somewhere else, owned by another team, another budget and another contract cycle. 
That means you may negotiate from the wrong baseline.

Before your next EA renewal, pull the Azure consumption data and identify every Microsoft 365-adjacent meter.

Then add that spend back into the renewal discussion. The number that matters is not your EA spend, it is your total Microsoft commitment, including services.

If you do not know what is hiding in the Azure bill, you are not negotiating. You are guessing, and Microsoft will be very happy for you to continue doing that.
Keeping the Support agreement separate without considering alternatives from First Technology Group can also be a serious miss-step.

Please contact your First Technology Group account manager to connect you with our specialists, especially those who can help you understand your Azure bill to both optimise consumption and unpack the aspects that support a licensing agreement negotiation. 
Negotiating a Microsoft Agreement takes a TEAM of experts. Through First Technology Group, you can access the best in the world while unpacking the surprises hidden in your Azure bill, and add 24/7/365 Support services to the overall negotiation.

Sluggish PC's to get a huge boost

Microsoft is reportedly testing a hidden Windows 11 feature called Low Latency Profile, which could make cheaper and older PCs feel a lot more responsive.


The idea is simple, when you click Start, open Outlook, launch Edge, or right-click for a menu, Windows briefly pushes the CPU to full speed for about 1 to 3 seconds. 
Not forever, or enough to cook the notebook in your bag, just a short burst when you actually need it.

In testing by Windows Latest, app launches improved by up to 40%, and Start menu and context menu responsiveness by up to 70%. That is not a small tweak, especially for budget laptops and 16GB machines that are already being punished by Windows 11, browsers, Teams, Outlook, security agents, and every vendor’s “helpful” background service.

The good news is that this is not just brute force stupidity. It is more like “race to sleep”, get the work done quickly, then let the CPU drop back down again. 
Phones and Macs already use similar thinking, which is one reason they often feel snappier even when the raw hardware is not dramatically better.

Warning! This is still hidden in Windows Insider builds and Microsoft has not formally announced it, so don’t go promising users miracles.
But if this lands properly, it could become very useful in 2026, especially with RAM and hardware prices still under pressure.

The bigger point, before replacing machines, customers should be looking at smarter Windows builds, cleaner images, fewer background agents, better browser discipline, and now possibly a Windows scheduler that finally wakes up when you click something.
Please contact your First Technology account manager to connect you with our deployment experts to ensure that we are helping you build debloated, optimal images that get the most out of your PC's resources today, allowing you to be well prepared for these new performance improvements in the near future.

Microsoft Agent 365 FAQ updated 10 May

Microsoft has updated the Agent 365 FAQ again, timed with the 1 May 2026 launch.

The changes are not huge, but they are worth noting. 
A few smaller questions have disappeared, all references to “OBO agents” have been removed, and three new questions have been added for Windows 365 for Agents.

In other words, Microsoft is still tidying the licensing language while the product is going live.

Which usually means, "read carefully before assuming what is included".

Please contact your First Technology account manager to connect you with our experts in First Digital who will be able to help with applying the Agent 365 licensing and capability in your environment.

Microsoft Says 32GB is the (gaming) Sweet Spot for Windows

This story appears to be addressed to gamers, but don’t be fooled.
This is really a corporate PC story wearing a gaming T-shirt!

UPDATE!!! Microsoft has withdrawn this notice about 32 GB being the "sweet spot", but it was because of an outcry, not because anything actually changed technically!


A modern business notebook is not just running Windows, Word and Excel anymore. It is running Teams, Outlook, Edge (with far too many tabs), OneDrive, security agents, endpoint protection, DLP, VPN software, device management tools, browser extensions and all the other “little” things that quietly chew memory in the background.

Now, Add AI

Copilot+ PCs already require 16Gig RAM as the official minimum, with a 40 TOPS NPU and 256Gig storage. That is the start, not the optimal state!
As more AI capability moves onto the device, including smarter search, local translation, image tools, background indexing and whatever Microsoft decides to quietly bolt on next month, 16Gig starts looking like enough for a machine that can boot, not a machine that can cope with real work.

This is why 32Gig should now be treated as the real minimum for any serious corporate PC refresh.
Yes, memory prices are painful, and yes, budgets are under pressure. but buying 16Gig machines today may simply mean buying yourself out of tomorrow’s performance complaint in advance.

The old question was “can it run Windows?”
The better question now is “can it run Windows, the corporate stack, and AI without making the user want to throw it out the window?”
AND...... remember the machine you buy today will STILL be running in your business in 2029...... what will the world look like then?

Before you issue your next RFQ, PLEASE contact your First Technology account manager to connect you with our hardware specialists to revisit the specification.
For most business users, 32Gig RAM and a proper SSD should be the default conversation, and MUCH bigger, higher resolution monitors - 1920X1080 is not practical for work efficiency anymore....but that is a story for another day.
For developers, analysts, heavy Excel users, creative teams and anyone running local AI tools, you may need to go higher - probably double!

Security

How Vishing Exposed Millions of Home Security Customers

ADT, a company whose entire brand is home protection, has suffered its third breach in under two years. On 20 April 2026 the extortion group ShinyHunters extracted records on 5.5 million customers, including names, dates of birth, phone numbers, addresses and partial government IDs. The entry point was not a zero day or a misconfigured firewall.

It was a phone call. One employee at ADT was tricked through voice phishing into surrendering a Okta single sign-on credential, after which Salesforce, where the customer database lived, was wide open.

ShinyHunters has run the same playbook against Microsoft Entra and Google Workspace customers for over a year, and ADT's case is a reminder that identity is now the perimeter, and the human at the keyboard is the weakest part of that perimeter. 
That ADT was undone by a single phone call to a human is a reminder to contact your First Technology account manager to connect you with our training specialists to help ensure your staff are trained to spot they are being manipulated.
This is a good example of how training needs to be customised for what is relevant to YOUR company, because attackers increasingly use information unique to YOU to make their approach feel legitimate.
An extra point:

ShinyHunters has been running this exact playbook against Okta, Microsoft Entra and Google Workspace customers for over a year.
So this was not a one-off, it was a known, repeatable attack pattern that ADT's training had possibly not prepared staff for. 

AI’s Phishing Onslaught: 86% of Attacks Now Machine-Made

KnowBe4's latest Phishing Threat Trends Report shows that 86% of phishing attacks over the past six months relied on artificial intelligence, up from 80% in 2024.

The bigger shift, however, is where these attacks are arriving. 
Microsoft Teams phishing rose 41%, calendar invite phishing jumped 49%, and reverse proxy attacks that hijack Microsoft 365 sessions surged 139%. 
Internal impersonation, a fake message from your CEO or IT team, appeared in 30% of attacks in the first quarter alone. 
Kaseya separately found that 83% of phishing emails now contain AI generated content, and AI spear phishing is achieving click rates of 54%, more than four times the rate of traditional lures.
The classic warning signs, bad grammar, suspicious domains, and clumsy phrasing, are vanishing. Defenders cannot rely on staff spotting the obvious tells anymore, because the obvious tell-tales are gone. 
Training still matters, KnowBe4 data shows it can cut click rates by 85%, but it now needs to cover Teams, calendars and voice, not just email.

Training used to teach staff to spot what was wrong. 
It now has to teach them to question what looks right, because attackers can fabricate emails, voices and meetings convincingly enough to fool careful people.
Please contact your First Technology Account Manager to connect you with our training experts who are able to help address these new issues.

Cloud & AI

Microsoft takes Agent 365 out of preview as shadow AI becomes an enterprise threat


Microsoft has taken Agent 365, its management platform for AI agents, into general availability, signalling that the governance problem around autonomous AI is no longer theoretical.

Agent 365 is positioned as a single control plane that lets IT and security teams discover, govern and secure AI agents wherever they run, whether inside Microsoft Copilot Studio, on AWS Bedrock, on Google Cloud, on partner SaaS platforms, or installed locally on an employee's Windows device.

The most interesting part of this launch is the focus on local AI agents, the coding assistants and personal productivity tools that staff are quietly installing on their own machines, often without IT's knowledge.

Microsoft calls this "shadow AI" and warns that it represents an entirely new category of enterprise risk. Microsoft's own AI Security lead, David Weston, points to three patterns already showing up in customer environments: developers exposing sensitive backends through unauthenticated MCP servers, attackers planting cross-prompt injection attacks in tickets and wikis, and DLP systems that simply do not understand how agents access data.

Agent 365 is available standalone at $15 per user per month, or as part of the new Microsoft 365 E7 suite.

From June, Microsoft Defender will add "blast radius" mapping that shows exactly which devices, identities, MCP servers and cloud resources each agent can reach if it goes wrong.

A new Windows 365 for Agents preview lets organisations sandbox high-risk agentic workloads on isolated Cloud PCs.

For South African customers, the relevance is direct. Most organisations already have employees running OpenClaw, GitHub Copilot CLI, Claude Code or similar tools on managed devices, with no inventory of where those agents are operating or what they have access to. You don't know what you don't know!

Agent 365 closes that visibility gap using the Defender, Intune and Entra estate that most Microsoft customers already have in place. Weston's suggested adoption sequence is sensible, with crawl as inventory, walk as identity and access, and run as isolation and runtime blocking, achievable in roughly 90 days.

Please contact your First Technology Group account manager to connect you with our security and Modern Work specialists, who can review your shadow AI exposure and map out a sensible Agent 365 rollout against your existing Microsoft licensing.