Microsoft 365 Migration Insights

Microsoft Teams Events Licensing in 2026: What Admins Need to Know

seo — Sat, 24 Oct 2026 06:59:02 GMT

Planning a Microsoft Teams webinar or town hall requires more than scheduling an event. The organizer's license determines which features are available, how attendees can interact, and how large the audience can be.

Microsoft's 2026 licensing changes introduce a clearer distinction between foundational and advanced Teams Events capabilities.

For Microsoft 365 administrators, understanding this distinction can prevent last-minute licensing problems and event capacity limitations.

What's changed in Microsoft Teams Events licensing?

Effective April 1, 2026, Microsoft moved several advanced Teams Events features from Teams Premium to eligible Teams Enterprise licenses.

Microsoft now divides Teams Events capabilities into two categories:

Foundational features: Essential tools for creating events, managing attendees, and enabling basic participation.
Advanced features: Additional controls for registration, customization, event production, monitoring, and larger interactive audiences.

New Teams Premium licenses no longer provide advanced Teams Events capabilities independently. However, eligible legacy Teams Premium subscriptions retain their previous event benefits until their existing license term ends.

The key point is that event capabilities depend on the organizer's assigned license, not simply the licenses held by attendees.

Which Microsoft 365 licenses support Teams Events?

Microsoft provides different event capabilities across business, frontline, enterprise, and education plans.

License category	Available capabilities
Microsoft 365 Business Basic, Standard, Premium	Foundational
Microsoft 365 F1, F3; Office 365 F3	Foundational
Office 365 E1, E3, E5	Advanced
Microsoft 365 E3, E5, E7	Advanced
Microsoft 365 A1 and qualifying A3/A5 Student licenses	Foundational
Qualifying A3/A5 Faculty licenses	Advanced
Teams Essentials, Trial, Exploratory	Foundational
Eligible legacy Teams Premium	Advanced during the qualifying license term

Advanced event licenses also include foundational capabilities.

For education tenants, the distinction between student and faculty licensing is particularly important when scheduling large institutional events.

Foundational Teams Events features

Foundational features provide the essential tools for organizing webinars, town halls, and other structured events.

Depending on the event type and supported audience capacity, they include:

Attendee microphones and cameras
Chat, reactions, and raised hands
Q&A for audience questions
Basic registration forms
Attendance reporting
Options to hide attendee names

These features are suitable for regular business webinars, department presentations, training sessions, and smaller community events.

Advanced Teams Events features

Advanced capabilities are designed for organizations that need more control over how events are organized and delivered.

They include:

Customized attendee emails and reminders
Registration waitlists and manual approval
Registration start and end controls
Advanced attendee visibility settings
RTMP-In for external production equipment
Microsoft eCDN for enterprise video distribution
Event insights, engagement reporting, and monitoring

These capabilities are useful for large town halls, corporate broadcasts, customer webinars, and professionally managed events.

Some advanced features may have separate capacity restrictions or rollout dependencies.

How many attendees can join a Teams event?

The maximum audience size depends on both the organizer's license and the type of interaction required.

Event experience	Foundational	Advanced
Full interaction with microphones and cameras	1,000	1,000
Chat, reactions, polls, raised hands, and Q&A	1,000	3,000
View-only experience with Q&A	10,000	10,000

For example, an organization hosting an interactive webinar for 2,500 attendees needs an eligible advanced event license.

However, a broadcast-style town hall with 8,000 attendees watching and using Q&A may fit within the foundational view-only capacity.

Important: A 10,000-attendee view-only event does not provide the same participation features as a fully interactive event.

When do you need a Teams Attendee Capacity Pack?

Organizations planning larger events may need additional attendee capacity.

Microsoft offers Teams Attendee Capacity Packs that can increase supported event sizes up to 100,000 attendees.

Available pack sizes include:

5,000 and 10,000
20,000 and 35,000
50,000 and 75,000
100,000

Capacity packs are add-ons for eligible Teams Enterprise organizers.

They are required when organizations need supported engagement experiences beyond 3,000 attendees or view-only audiences exceeding 10,000.

A capacity pack increases audience capacity but does not automatically remove every feature-specific limitation.

Admins can manage these add-ons in the Teams admin center under Add-on Licenses → Teams Events.

Teams Premium vs. Teams Enterprise

One common licensing mistake is assuming Teams Premium still provides all advanced event capabilities.

Under the updated licensing model:

Eligible Teams Enterprise licenses include advanced Teams Events features.
Newly purchased Teams Premium licenses focus on advanced meeting protection, branding, personalization, communications, and intelligence.
Eligible Teams Premium subscriptions purchased before April 1, 2026 retain their existing event capabilities until the current term ends.
Large events may require an Attendee Capacity Pack after legacy licensing expires.

Organizations should review organizer licensing before renewing subscriptions or scheduling large events.

External attendee verification

Microsoft may require external attendees to complete email one-time passcode verification before joining Teams events.

This is a service protection measure designed to reduce fraud and abuse.

It is not an advanced Teams Events feature and does not depend on a particular premium license.

Event organizers should account for possible verification steps when preparing joining instructions for external attendees.

Microsoft Teams admin checklist

Before scheduling an important event, administrators should review the following:

Organizer license: Confirm whether the assigned license includes foundational or advanced capabilities.
Expected audience: Estimate the number of attendees before publishing invitations.
Interaction requirements: Decide whether attendees need microphones, cameras, chat, polls, or Q&A.
Registration controls: Check whether advanced registration features are required.
Production requirements: Confirm whether external encoders or eCDN monitoring will be used.
Capacity packs: Assign an appropriate add-on for large-scale events.
Legacy licensing: Review Teams Premium expiration dates and transition requirements.
External access: Prepare attendees for possible email verification.

Testing the event configuration before publishing registration links can help avoid last-minute issues.

Final takeaway

Microsoft's 2026 Teams Events licensing changes make organizer licensing a critical part of event planning.

Foundational licenses support everyday webinars and broadcasts, while eligible Teams Enterprise licenses provide advanced event management and production capabilities.

Organizations planning audiences beyond standard limits may need Teams Attendee Capacity Packs.

For Microsoft 365 admins, the best approach is straightforward: verify the organizer's license, choose the required interaction level, confirm attendee capacity, and test the event before launch.

This helps deliver a smoother experience for both event organizers and attendees.

References

Original Apps4.Pro article:

Microsoft Teams Events Licensing: Business Plans vs. Enterprise Capabilities

Microsoft documentation:

Microsoft 365 Copilot Agent Usage Report: Admin Guide

seo — Fri, 14 Aug 2026 09:29:48 GMT

Microsoft 365 Copilot is moving beyond individual prompts. Many organizations are now using Copilot agents to answer questions, retrieve business information, support workflows, and help employees complete tasks faster.

As agent usage grows, Microsoft 365 admins need visibility into which agents are being used, how many users are active, whether adoption is increasing, and which agents need governance review.

That is where the Microsoft 365 Copilot Agent usage report in the Microsoft 365 admin center becomes useful.

What is the Copilot Agent usage report?

The Microsoft 365 Copilot Agent usage report helps admins understand how Copilot agents are being used across the tenant.

Instead of relying only on feedback or manual checks, admins can review agent activity from the Microsoft 365 admin center.

The report helps answer:

Which agents are being used?
How many users are using agents?
Is adoption increasing?
Which agents are getting low or no usage?
Which agents need governance, training, or cleanup?

This matters because AI agents can quickly become part of daily work. Without reporting, admins may not know whether agents are delivering value or creating governance gaps.

Where to find the report

Admins can find it here:

Microsoft 365 admin center → Reports → Usage → Microsoft 365 Copilot → Agents

This gives IT, adoption teams, business leaders, and compliance teams a central place to review Copilot agent usage.

Why this report matters

Copilot agents can help employees find information, summarize knowledge, answer common questions, and automate repeated work.

But as more agents are created, admins need a way to manage them properly.

The report supports:

Adoption tracking
AI governance
Agent lifecycle management
User training decisions
Ownership review
Security and compliance review
Cleanup of unused agents
Copilot rollout planning

It is not just a usage report. It helps admins understand where agent activity is growing and where governance attention is needed.

Which agents are included?

The report focuses on agents used with Microsoft 365 Copilot.

This may include:

Agents built with Microsoft Copilot Studio
Agents built with Teams Toolkit
Admin-approved agents
Agents used in Microsoft 365 Copilot experiences
Agents used in Copilot in Word and PowerPoint

However, not every agent type may be included yet. SharePoint agents and some Microsoft or partner-built agents may not be fully reflected depending on Microsoft’s reporting scope.

So admins should use this report as an important signal, but not the only source of truth for every agent across Microsoft 365.

What admins should review

Admins should look at the report from both adoption and governance angles.

Start with:

Active agents
Active users
Frequently used agents
Low-usage or unused agents
Adoption trends
Business units using agents
Agents needing ownership review
Agents needing permissions review

High-use agents may need stronger documentation, support, monitoring, and ownership.

Low-use agents may need training, improvement, or retirement.

Fast-growing usage may indicate that policies, permissions, support, and governance processes need to be reviewed.

How this supports AI governance

AI governance is not only about enabling Copilot. It is about understanding how AI is used across the organization.

Copilot agents may access business data, answer user questions, and support workflows. That makes visibility important.

The usage report helps admins identify:

Which agents are becoming business-critical
Which agents have strong adoption
Which agents are unused or abandoned
Which agents need clearer ownership
Which agents require permissions review
Which departments need more training

This helps organizations manage agents as business assets, not just optional AI tools.

Recommended admin actions

Admins should include this report in regular Microsoft 365 governance reviews.

A practical process:

Review agent usage weekly or monthly.
Identify high-use agents.
Confirm owners for important agents.
Review permissions and data access.
Check whether documentation exists.
Compare usage with the Copilot rollout plan.
Improve training where adoption is low.
Retire unused or duplicate agents.
Share insights with business teams.
Include agent usage in AI governance meetings.

Use it with other governance tools

The agent usage report is useful, but it should not be used alone.

Combine it with:

Microsoft Purview
Audit logs
Sensitivity labels
DLP policies
SharePoint permissions
Teams app governance
Power Platform controls
Copilot readiness reports
Copilot usage reports
Security and compliance reviews

An agent may have high adoption, but admins still need to confirm that it has the right permissions, data boundaries, ownership, and lifecycle controls.

Final takeaway

The Microsoft 365 Copilot Agent usage report gives admins a practical way to track agent adoption and governance needs.

It helps organizations understand which agents are being used, how adoption is developing, and where action is required.

For Microsoft 365 admins, the goal is not only to measure usage. The real goal is to make sure Copilot agents are useful, secure, governed, and aligned with business needs.

A simple approach works best:

Track usage.
Review active agents.
Confirm ownership.
Check permissions.
Train users.
Retire what is not needed.
Govern agents as part of the wider Microsoft 365 AI strategy.

As Copilot agents become part of everyday work, visibility becomes essential. The agent usage report is one of the first places admins should review.

SharePoint Audit Logs in Microsoft Purview: A Practical Admin Guide

seo — Mon, 22 Jun 2026 09:01:42 GMT

SharePoint stores some of the most important business data in Microsoft 365: files, contracts, project documents, customer records, internal pages, and collaboration history.

That also means every permission change, external sharing link, file download, deletion, and site-level update matters.

A SharePoint audit log helps admins answer the basic but critical question:

Who did what, when, and where?

Today, SharePoint audit events are not handled through the old site-collection audit reports most admins may remember. In modern Microsoft 365, SharePoint audit activity is searched through Microsoft Purview Audit, as part of the Unified Audit Log.

This guide explains what SharePoint audit logs capture, where to search them, which record types matter, and which reports every SharePoint admin should keep ready.

What changed with SharePoint audit logs?

In older SharePoint environments, admins often looked for audit settings inside individual site collections.

That is no longer the main model for SharePoint Online.

In Microsoft 365, SharePoint audit events flow into the Unified Audit Log. The same audit system also supports activities from Exchange, Teams, OneDrive, Entra ID, Power BI, Power Automate, and other Microsoft 365 services.

For SharePoint Online, Microsoft lists record types such as:

Record type	What it helps track
`SharePointFileOperation`	File access, downloads, uploads, edits, deletes, moves, copies, previews
`SharePointSharingOperation`	Sharing invitations, anonymous links, company links, external sharing events
`SharePoint`	Site administration, permissions, settings, and governance events
`SharePointListOperation`	List and list-item related activities
`SharePointCommentOperation`	Comment-related activities

Microsoft documents these SharePoint Online record types as part of the services supported by Microsoft Purview auditing.

The important takeaway is simple:

If you want to audit SharePoint Online today, start with Microsoft Purview Audit — not old site-level audit pages.

Why SharePoint auditing matters

SharePoint rarely fails because one admin forgot to check a log.

It fails because risky activity stays invisible for too long.

A few common examples:

Someone creates an anonymous sharing link to a sensitive folder.

A project site keeps external access long after the project ends.

A temporary Full Control permission becomes permanent.

A user downloads hundreds of files before leaving the company.

A site owner breaks permission inheritance and no one reviews it again.

During a migration, old sharing links and permission changes are moved forward without being revalidated.

Without audit logs, these issues are difficult to prove. With audit logs, admins can build a timeline of activity and understand what changed.

That matters for security investigations, compliance reviews, insider-risk checks, and tenant-to-tenant migration planning.

What SharePoint audit logs can capture

SharePoint audit logs are broader than just “file opened” or “file deleted.”

In Microsoft Purview Audit, SharePoint activity can include several categories.

File and page activity

These events help you understand how users interact with files and pages.

Examples include:

FileAccessed, FileModified, FileDownloaded, FileUploaded, FileDeleted, FileRecycled, FileRestored, FileCopied, FileMoved, FileRenamed, FilePreviewed, and PageViewed.

This is useful when you need to investigate file access, bulk downloads, deleted content, or unusual activity on sensitive sites.

Sharing and access activity

Sharing events are often the most important part of SharePoint auditing.

Examples include:

SharingInvitationCreated, AnonymousLinkCreated, AnonymousLinkUsed, CompanyLinkCreated, SharingSet, AccessRequestCreated, and AccessRequestApproved.

These events help answer questions like:

Who shared this file externally?

Was an anonymous link created?

Did a guest receive access?

Was a company-wide link used?

For organizations preparing for a Microsoft 365 migration, this is one of the most important audit areas to review before cutover.

Permission and admin activity

Permission changes are another high-risk area.

SharePoint audit logs can help track site admin changes, permission level updates, sharing policy changes, and role assignments.

This is especially useful when investigating broken inheritance, unexpected Full Control access, or permission changes on sensitive sites.

List, library, and governance activity

SharePoint audit logs may also include activities related to lists, libraries, labels, retention, and DLP-related events.

This helps security and compliance teams understand how content is being managed, protected, or changed across the tenant.

How to search SharePoint audit logs in Microsoft Purview

Most admins can start with the Microsoft Purview portal.

Go to:

Microsoft Purview portal → Audit → Search

From there, configure the search using these filters:

Field	What to use
Date range	Select the investigation period
Record types	Choose SharePoint-related record types
Activities	Select specific activities or leave blank for a broader search
File, folder, or site	Add the site URL or file/folder path when you need a narrow search
Users	Add specific users if the investigation is user-focused
Search name	Use a clear name like `Finance Site External Sharing Review`

Microsoft notes that audit search uses UTC time, and the maximum date range for a single search in the Purview portal is 180 days. Large searches can also take significant time depending on tenant size, date range, and activity volume.

A good first search for SharePoint admins is:

Record types:
SharePoint, SharePointFileOperation, SharePointSharingOperation

Date range:
Last 7 or 30 days

Scope:
One sensitive site or department site

This gives you a clean starting point without pulling too much noise from the entire tenant.

PowerShell option for recurring audit searches

For one-time investigations, the Purview portal is usually enough.

For recurring exports, PowerShell is more practical.

Microsoft confirms that the audit log can be searched using the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell.

Example:

$StartDate = (Get-Date).AddDays(-7)
$EndDate = Get-Date

Search-UnifiedAuditLog `
  -StartDate $StartDate `
  -EndDate $EndDate `
  -RecordType SharePointSharingOperation `
  -ObjectIds "https://contoso.sharepoint.com/sites/Finance/*" `
  -ResultSize 5000 `
  -SessionId "finance-sharing-review" `
  -SessionCommand ReturnLargeSet |
Export-Csv "SharePoint-Sharing-Audit.csv" -NoTypeInformation

Use this pattern when you want to review external sharing, permission changes, deleted files, or bulk download behavior on a regular schedule.

For high-volume audit extraction or security monitoring solutions, Microsoft recommends using the Microsoft 365 Management Activity API instead of relying only on PowerShell scripts.

Six SharePoint audit reports every admin should maintain

A raw CSV export is not enough.

A useful audit process turns raw events into reports that answer real questions.

Report	Question it answers	Useful activities
External sharing report	Who shared content outside the tenant?	`SharingInvitationCreated`, `AnonymousLinkCreated`, `AnonymousLinkUsed`, `SharingSet`
Permission changes report	Who changed access or site admin roles?	`PermissionLevelAdded`, `RoleAssignmentAdded`, `SiteCollectionAdminAdded`, `SharingPolicyChanged`
Bulk download report	Did one user download an unusual number of files?	`FileDownloaded` grouped by user
Deleted content report	What was deleted, recycled, or permanently removed?	`FileDeleted`, `FileRecycled`, `FolderDeleted`, `FileVersionsAllDeleted`
Site activity report	Which sites are active or inactive?	`FileAccessed`, `PageViewed` grouped by site
Migration baseline report	What permissions and sharing existed before cutover?	Sharing + permission activities before migration

For most organizations, the first two reports are the most important:

External sharing report

This shows where sensitive data may already be exposed outside the organization.

SharePoint permission changes report

This helps identify risky permission changes before they become long-term governance problems.

Audit log retention: what admins should know

Audit retention depends on licensing.

Microsoft states that Audit Standard retains audit records for 180 days for non-E5 users. For users assigned Office 365 E5, Microsoft 365 E5, or eligible Purview audit add-on licensing, Microsoft retains Microsoft Entra ID, Exchange, and SharePoint audit activity for one year by default.

Microsoft Purview Audit Premium can also support longer retention through audit log retention policies. Retention can go up to 10 years with the required add-on licensing and policy configuration.

This is important in mixed-license tenants.

Do not assume the whole tenant gets the same audit retention because some users have E5. Audit retention is tied to the license of the user who generated the activity.

For migration planning, this matters even more.

If the source tenant will be decommissioned after migration, export and preserve the audit evidence before it disappears.

Limitations to plan around

SharePoint audit logs are powerful, but they are not a complete monitoring system by themselves.

A few limitations matter:

Audit records are not always instant. Microsoft says core service events such as Exchange, SharePoint, OneDrive, and Teams are typically available within 60 to 90 minutes, but Microsoft does not guarantee a fixed time for every event.

A single Purview portal search is limited to a 180-day date range.

Large audit searches can take longer, especially in large tenants.

Export limits vary by audit license level. Microsoft documents export support up to 50,000 rows for Audit Standard and up to 1,000,000 rows for Audit Premium.

Audit logs record evidence, but they do not automatically create every alert or weekly report you may need.

For real-time alerting, insider-risk detection, or automated governance, you may need Microsoft Defender, Purview Insider Risk Management, Sentinel, the Management Activity API, or a third-party reporting process.

Why audit logs matter before a Microsoft 365 migration

A tenant-to-tenant migration is not only a data movement project.

It is also a governance checkpoint.

Before migrating SharePoint content, admins should understand:

Which sites are externally shared

Which files have anonymous links

Which users have elevated permissions

Which sites have broken inheritance

Which sensitive sites have recent downloads or deletes

Which old project sites are inactive

Which permissions should be recreated, restricted, or retired

Do not blindly carry every old sharing relationship into the target tenant.

Some access should move. Some should be reviewed. Some should be removed.

The audit log gives you the evidence to make that decision.

Practical weekly audit routine

A simple weekly SharePoint audit routine can be enough to catch many common risks.

Start with these four checks:

Review external sharing activity from the last 7 days.

Check permission changes on sensitive sites.

Look for unusual bulk downloads.

Review deleted content from high-value sites.

Once this becomes routine, expand it into monthly governance reports and migration-readiness checks.

For large tenants, move from manual Purview searches to scheduled exports using PowerShell, Azure Automation, or the Microsoft 365 Management Activity API.

Final takeaway

SharePoint audit logs are not just for security incidents.

They are useful for everyday governance, compliance evidence, access reviews, and migration planning.

The most important thing is to start before there is a problem.

Run the sharing report.

Run the permission changes report.

Export the evidence.

Keep a baseline before migration.

Then use that baseline to validate the target tenant after cutover.

In SharePoint governance, the audit log is not the final answer — but it is often the first place you should look.