User impact: Admins and users managed through Microsoft 365 Groups may be unable to access some Microsoft 365 services.

More info: This issue specifically affects admins and users whose service access is managed by Microsoft 365 Groups that were previously configured with the “SecurityEnabled” setting set to “True”.

While we finalize the deployment of our fix to restore the appropriate configuration for the impacted Microsoft 365 Groups, affected admins can follow the steps below to manually restore the SecurityEnabled property configuration and resolve the impact:

1. Connect to Exchange Online PowerShell with “Connect-ExchangeOnline”, then run the following command to retrieve audit logs specific to this scenario:
$AuditLog = Search-UnifiedAuditLog -Operations “Update group” -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -ResultSize 5000.

2. Filter logs matching the issue to gather affected group info by running the following two commands:

$GroupID = $AuditLog | % {ConvertFrom-Json $_.AuditData} | ? {($_.Actor -match “Group Configuration Processor”) -and ($_.ModifiedProperties -match “SecurityEnabled”)} | % {$_.ObjectId -replace “^.*Group_”, “”}

$GroupID | Get-UnifiedGroup -ResultSize Unlimited

3. Connect to Microsoft Graph PowerShell with Connect-MgGraph -Scope “Group.ReadWrite.All” and then run the following command to restore the SecurityEnabled property for the affected groups to True, which should remediate the impact:

$GroupID | % {Update-MgGroup -GroupId $_ -BodyParameter @{SecurityEnabled = $true}}

For further information on how to run Microsoft Graph PowerShell commands and cmdlets or guidance on connecting to Exchange Online through PowerShell, please reference the following documentation:

learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps

learn.microsoft.com/en-us/powershell/microsoftgraph/authentication-commands?view=graph-powershell-1.0

Current status: The fix deployment is progressing as expected and we’re continuing to monitor as it saturates.

Scope of impact: Admins and users whose service access is managed by Microsoft 365 Groups that were previously configured with the “SecurityEnabled” setting set to “True” may be impacted.

Start time: Tuesday, October 7, 2025, at 8:27 AM UTC

Root cause: A recent service operation intended to upgrade our API flow impacted Microsoft 365 Groups that were previously configured to have the “SecurityEnabled” setting enabled, switching this value back to “False” by default and resulting in impact to admins and users whose service access was being managed by the affected groups.

Next update by: Friday, January 30, 2026, at 8:00 AM UTC