Microsoft is quietly upgrading every Microsoft 365 Business plan this summer. If you run Business Basic, Standard, or Premium, your mailboxes are getting more storage and your email links are getting rescanned at the moment someone clicks, and none of it costs extra. The rollout finishes by August 1, 2026, and it lands in your tenant automatically, so there’s nothing to buy and nothing to configure.
- Mailbox storage doubles from 50GB to 100GB per user across Business Basic, Standard, and Premium.
- Business Basic and Standard gain URL time-of-click protection, which rechecks links the instant someone clicks them, not just when the email first arrives.
- Copilot Chat gets inbox and calendar awareness plus access to Word, Excel, and PowerPoint agents.
- None of this requires a new purchase, an upgrade, or a licensing change.
- The changes complete by August 1, 2026, with at least 30 days’ notice posted in the Microsoft 365 Message Center before they show up in your tenant.
What exactly is changing in your Microsoft 365 subscription?
Microsoft published the update as part of its 2026 Microsoft 365 packaging and pricing update, and the short version is that Business plan customers are getting more for the same monthly price. Exchange Online mailboxes move from 50GB to 100GB per user on Business Basic, Standard, and Premium. Business Basic and Standard also pick up URL time-of-click protection, and all three tiers get Copilot Chat improvements, including awareness of what’s in your inbox and calendar and direct access to Word, Excel, and PowerPoint agents inside chat. Rollout started in June 2026 and Microsoft says it completes by August 1, 2026.
How does URL time-of-click protection actually stop phishing?
Most email security today scans a link once, at the moment the message lands in your inbox. Attackers have learned to exploit that gap. They send a message with a link that points somewhere harmless, wait for it to clear your spam filter, then swap the destination to a phishing page or malware download a few hours later. URL time-of-click protection closes that window by rechecking the link’s destination the instant someone clicks, not just on arrival, according to a summary of the rollout from Get Support IT Services. If the page turned malicious after the email was delivered, Microsoft blocks it before the browser even opens. For a small business where one distracted click on a fake invoice or shipping notice can lead to a wire transfer fraud attempt, that second check matters. We’ve covered how attackers exploit exactly this kind of delayed-payload trick in our post on Microsoft 365 device code phishing.
Why is Microsoft doubling mailbox storage now?
Email volume keeps climbing, and attachments, embedded images, and long thread histories eat storage fast. A 50GB mailbox sounds like a lot until an employee starts archiving three years of client correspondence or a marketing team keeps every campaign asset in Outlook. Doubling the default to 100GB per user, at no added cost, removes a recurring support ticket for a lot of small offices: the “your mailbox is full” warning that shows up right before a deadline. It also reduces the temptation to delete old email just to free up space, which matters if you ever need those records for a client dispute or an insurance claim.
Do you need to do anything to get these features?
No. This isn’t an opt-in feature or a new SKU you have to switch to. Microsoft applies the changes directly to existing Business Basic, Standard, and Premium subscriptions as part of the regular update cycle. You’ll see a notice in the Microsoft 365 Message Center, usually at least 30 days before the change reaches your specific tenant, and then the storage and security updates simply appear. If you manage your own tenant, it’s worth skimming the Message Center in August to confirm the rollout has hit your organization. If a managed service provider handles your Microsoft 365 environment, this is exactly the kind of update they should be tracking on your behalf.
What should Boston businesses watch for during rollout?
The biggest risk with any “free upgrade” like this is assuming it fixes problems it doesn’t touch. URL time-of-click protection helps with malicious links, but it doesn’t stop business email compromise scams that use no links at all, just a convincing request to change a bank routing number. It also doesn’t replace multi-factor authentication, and it doesn’t do anything for phishing delivered outside email, like text messages or fake QR codes. Treat this update as one more layer, not a replacement for the basics. We wrote about a related MFA blind spot in our piece on session cookie hijacking and why MFA can’t always save you, which is worth a read if your security plan currently starts and ends with “we require MFA.”
Frequently asked questions
Do I need to upgrade my plan to get these features? No. The storage increase and URL time-of-click protection apply automatically to existing Business Basic, Standard, and Premium subscriptions.
Will this change my Microsoft 365 bill? Microsoft has stated these specific features come at no additional cost. Separate pricing changes for Microsoft 365 have happened on their own schedule, so check your invoice if you’re unsure which changes apply to your plan.
What if I don’t see the new features in my tenant yet? Rollout runs from June 2026 through August 1, 2026, staggered by tenant. Check the Microsoft 365 Message Center for your organization’s specific notice.
Does URL time-of-click protection mean I can drop other email security tools? No. It adds a useful check at the moment of the click, but it doesn’t replace layered defenses like MFA, employee training, or a dedicated email security add-on for organizations handling sensitive data.
Rolling out a licensing change across a fleet of Microsoft 365 tenants is exactly the kind of update that’s easy to miss if nobody owns your IT environment full time, and the gap between “Microsoft turned it on” and “someone in your office actually knows it’s there” is where small businesses get caught flat-footed. If you want a straight answer on what’s changed in your specific tenant and where your real security gaps still are, Boston Managed IT offers a free 15-minute Microsoft 365 and security review. Call (617) 322-5155 or set up a time at bostonmit.com/contact.
— Boston Managed IT
