We live and work in browsers. It’s where we spend most of our time — and it’s where we waste most of our time as well. Web browsing is slow, inefficient, and full of time-sapping annoyances.

But it needn’t be that way. You can turn your browser into a lean, mean productivity machine. To do it, just follow these tips for Microsoft Edge in Windows 10 or 11. You’ll learn how to switch between home and work profiles, put idle tabs to sleep to speed up your PC, tap into the power of Microsoft’s Copilot AI assistant, and more.

(Note that these tips are written for the most recently updated version of Edge in Windows 11 25H2 and Windows 10 22H2. Things may be slightly different if you use a different Windows version, and not all of these features are available for Edge on macOS or other platforms.)

So let’s get started — time’s a-wasting, and so is your productivity.

1. Switch between work and personal profiles

With remote and hybrid work models now common, many people use the same device for work and personal use. When it comes to using a web browser, that can quickly become problematic.

Mixing work and personal favorites makes it far more difficult to quickly get to important work websites or personal websites. When you’re working, you don’t want to wade through hundreds of links to family photos, vacation destinations, and YouTube videos of cats befriending parrots when you’re just looking for the OSHA website about mine safety regulations. And when you’re off working hours and want to watch a video of a Persian cat nuzzling a cockatiel, a website detailing the GDPs of every country in Europe and Asia is not your primary destination.

Different profiles let you completely segregate your browser use. That doesn’t just mean different favorites. It also means different Collections, different extensions, different passwords, and more.

Each Edge profile is tied to a different Microsoft account. So to use different profiles, you’ll need to create different Microsoft accounts. To create a new Microsoft account in Windows 10 or 11:

1. Go to https://account.microsoft.com. If you’re signed in to your account, click your profile icon or initials in the upper-right corner and select Sign out. Close Edge, restart it, and go back to https://account.microsoft.com/.
2. Scroll down to the button that says Create an account, click it, and follow the prompts to create a new account.
3. On the page that appears, click the Sign in button in the middle of the page. On the screen that appears, select the Create one! link, then follow the prompts to create a new account.

You’ve now got two different Microsoft accounts you can use for Edge. When you log into one of those accounts in Windows, that will be the default account that Edge will use when you browse the web.

To switch between the two accounts, you’ll need to add that second account to Edge. To do it:

1. Click the user profile icon at the top right of Edge. On the small pane that appears, select Set up a new profile, then select either Personal or Work or School. 
2. You’ll be sent to a web page in a new instance of Edge. Click the Sign in button at the far right, then select Sign in to sync data.
3. On the screens that appear, sign in and confirm that you want to proceed.

Once you’ve done that, you don’t have to log out of your current account and then log into the second account to use it in Edge. Instead, when you want to use the second account, click the user profile icon at the top right of the Edge window. A small pane appears with your current profile at the top. To switch to your other profile, select it in the “Other profiles” section.

You’ll now be sent straight to that profile. When you do that, Edge will open in a new window. So you’ll have both your profiles running simultaneously, each with its own tabs, in two separate windows. (Note that you can set up multiple additional profiles.)

You can also tell Edge which profile to use when you visit certain websites. To do it:

1. Click the user profile icon in Edge and select Profile settings. (Alternatively, you can click the three-dot icon next to the user profile icon and select Settings > Profiles.)
2. In the “Profile settings” area, click Profile preferences.
3. At the bottom of the “Automatic profile switching” section on the page that appears, click Add site next to “Custom site switch.”
4. On the “Add site” popup, enter a website URL and select the profile you want to switch to for that site.

Should you decide you want to remove a profile, go to Settings > Profiles and scroll to the “More profiles” section. Click the trash can button next to any profile you want to delete. You can always add it again later using the steps above.

2. Get to your most-used sites quickly

Bookmarking and organizing favorites is a great way to manage a large collection of websites, but it’s not that useful if you simply want to get to a frequently used site quickly. Edge has some tricks up its sleeve if you want to get your most-used sites pronto.

Add a site to the new tab page

When you open a new tab in Edge, a page appears that shows you news and other items you might be interested in. It’s easy to pin a site to this page so it’s accessible whenever you open a new tab.

Look toward the top of the page, just underneath the search box. If you don’t see icons for pinned pages (such as for Yahoo, Amazon, your inbox, and so on), click the settings icon on the upper right of the page (it looks like a gear) and turn “Quick links” on.

A row of site icons appears, along with a + icon. Click the + icon and type or paste in the name and URL of the site you want to pin, then click Add. The site will now appear along with the other pinned pages.

You can rename or remove any site pinned to the new tab page by clicking the three-dot icon next to the site icon and selecting Rename or Remove from the menu that appears.

The new tab page is tied to your current profile, so you can set up different pinned sites on the new tab page for each of your profiles.

Pin tabs to the top of Edge

For even faster access to frequently used sites, you can pin them as browser tabs so they appear at the far left of all your other tabs in Edge. When you’re on the site you want to pin as a tab in Edge, right-click its tab and select Pin tab from the menu that appears. The pinned tab will now appear to the left of all your open tabs.

The icon for the pinned tab looks smaller than all of your other tabs, and it will persist even after you shut down and restart Edge. If you have multiple pinned tabs, all of them will appear to the left of any non-pinned tabs.

Like pinned sites on new tab page, your pinned tabs are unique to each Edge profile; they won’t carry over from profile to profile.

Pin sites you often visit to the Windows taskbar

For Windows users, the fastest way to access a frequently used site is to pin it to the Windows taskbar. That means it’s always visible (even when Edge isn’t running), and you can launch it with a single click.

When you’re on the site you want to pin, select the three-dot icon at the top right of the browser window and select More tools > Pin to taskbar. A small screen appears with a text box in it with the name of the site. Use the name provided or type a new name into the text box and click Pin.

3. Create tab groups for more efficient browsing

If you’re like lots of people, you frequently browse with many tabs open, and find yourself wasting time switching to the tab you want because of all of the clutter.

There’s a simple fix: group tabs into categories so you can quickly switch to the tab group that has the tab you want. For example, you might group them into “News,” “Museums,” “Finance,” and so on. Or you could create a tab group for research related to a specific project.

To do it, right-click a tab, select Add tab to new group, and then name the tab group. You can then drag other tabs into the group. You can also assign each tab group a unique color so they’re easy to differentiate at a glance.

If you’ve already created a group, when you right-click a tab, you’ll see “Add tab to group” rather than “Add tab to new group.” When you click the arrow next to it, you’ll see a list of all your existing groups, so you can easily add it to any of them. You’ll also see “New group,” which will let you create and customize a new group.

Once you’ve created a tab group, you can rename it, change its assigned color, add new tabs to it, ungroup the tabs from it, delete the group and all the tabs in it, and more. Just right-click the name of any group and select an option from the menu that appears.

4. Enlist a Copilot as you browse

Microsoft’s genAI chatbot, Copilot, has become increasingly integrated with Edge, so much so that Microsoft now calls Edge an “AI browser.” At the moment, that’s more hype than fact, but it is true that Edge gets new Copilot features added on a regular basis.

Edge provides a couple of ways to interact with Copilot, one of which is to open the Copilot sidebar to the right of the main browser window. (We’ll go over the other method later in the story.) Click the Copilot icon at the top right of Edge, and the Copilot pane appears. Here’s where you type in prompts for Copilot.

There’s a tremendous amount you can do with Copilot, most of which is beyond the scope of this article. To learn more about what it can do and how to use it, see our story “9 ways to use Copilot right.”

However, here’s one use designed specifically for web browsing: summarizing the contents of the page you’re currently visiting. Depending on the structure and content of the page, Copilot can give a high-level overview of the entire page, provide capsule descriptions of individual articles or sections, and more. You can also ask Copilot to extract specific information from a page, such as all the AI-related information on it, and organize the information into a bulleted digest.

To do all that, open a web page and open the Copilot sidebar. You’ll see a few suggested prompts, one of which should be related to summarizing the page, such as Summarize the main points on this page or Create a summary of this page. Click the prompt, or if you don’t see it, type it into the text box at the bottom of the Copilot pane.

You can also ask it to summarize the last page you’ve visited. Click the down arrows towards the bottom of the Copilot pane, and you’ll see a listing for the previous page you’ve visited, such as Computerworld.com. Click the text summarize my recent activity on [page] and it will do that for you. Again, if you don’t see that text, type it into the Copilot text box.

The summarization feature, though, still has rough edges, or at least it did when I was writing this article. If you leave the web page you’re currently on and go to a new one, the summary of the old page remains, and there isn’t an immediate way to summarize the new one. To get a summary of the new page, you’ll have to scroll to the bottom of the Copilot pane, click the arrow (it will be facing either up or down, depending on whether you’ve previously clicked it) and click “Create a summary of this page.”

In that section, you can also click listings of your other open tabs and get summaries of any of them.

5. Remove clutter when you launch new tabs

When you create a new tab, the initial page is filled with pinned sites, suggested news stories, widgets, and more. If you find that page distracting, you can change it to a much cleaner, more stripped-down page.

If you haven’t pinned specific sites to the row of icons below the search box (see tip #2 above), you can make Edge’s default icons go away: Click the gear icon on the upper right of the page, and a “Page settings” panel pops up. In the “Quick links & search” section, click the dropdown next to “Quick links” and select Off. That gets rid of the icons for web sites just beneath the search box.

If you have pinned your own preferred sites there, you’ll want to leave quick links enabled, but you can turn the “Show sponsored links” toggle to Off to get rid of ads.

To get rid of the news articles that overwhelm the page, go to the “Show content” area of the panel and move the “Show feed” toggle to Off. Or, if you want to really strip down the page, move the “Show content” toggle to Off. That kills pretty much everything on the page except the weather. If you don’t want to see that either, scroll down a bit more and move the “Weather” toggle to Off.

 You can also strip out the background graphic for the new tab page by turning off the “Background” toggle. I don’t recommend it, though, because when you do that, you’ll get a gray page with a big Microsoft logo dead center when you launch a new tab.

6. Launch Copilot-centered new tabs

If you’re a frequent Copilot user, you might want to take a different approach to the new tab page.

The Copilot you get in a side pane when you click the Copilot icon at the top right of Edge is a somewhat stripped-down version of Microsoft’s full-blown Copilot app. If you’re looking to use the full-fledged version, there’s a simple way to do it: Tell Edge to open Copilot every time you open a new tab.

To do it, click the three-dot icon to the left of the Copilot icon at the top right of Edge and navigate to Settings > Start, home, and new tab page. In the “New tab page” section, turn on the Copilot new tab page toggle. From then on, every time you open a new tab, you’ll launch a full Copilot screen that’s similar to the standalone Copilot app.

You’ll see the usual Copilot prompt box front and center, and beneath that, several prompts Microsoft thinks you might want to use. (Note to Microsoft: I’ve never used one of those suggestions even once. I’d guess few other people have either.)

What’s really new here are the vertical icons running down the left side of the page. Here’s a brief rundown of what each one does:

• Open sidebar: Widens the navigation bar and shows a list of your recent chats so you can revisit any of them.
• New chat: Start a new chat with Copilot.
• Library: Build a library of Copilot-created content such as images, reports, podcasts, documents, and more.
• Tasks: Create a Copilot task that automates something you want done, such as sending you a weekly email about a company’s stock price.
• Health: Open Copilot Health, a version of Copilot designed specifically for getting health information.
• Shopping: Use Copilot as a shopping assistant.
• Imagine: Create or edit an image using Copilot.
• Experiments: Discover and use new Copilot features that Microsoft is testing but that may or may not be officially launched at some point.

Clicking the Copilot icon at the top of the list of vertical icons returns you to the main Copilot interface you get when you launch a new tab.

As you can see, many of these new Copilot functions are aimed at consumers and unlikely to be useful in a business setting. Still, if you frequently turn to Copilot for help, you might find the Copilot new tab page a good alternative to the standard new tab page.

And note that setting up the Copilot new tab page doesn’t prevent you from browsing or searching the web normally. Just enter the search term or website you want to visit in the address bar at the top of the screen.

7. Put tabs to sleep to conserve system resources and boost battery life

If you’re like most people, you keep multiple tabs open in Edge so you can easily switch among the sites, web apps, and information important to you. It’s a great time-saver.

But it can also be a big memory and processor hog, which can slow down both your browsing and your other computing tasks. It needn’t be that way, though. You can put inactive tabs to “sleep” until you need them, freeing up resources, which will make your PC speedier and make its battery last longer, even when you have multiple tabs open. Microsoft claims that putting inactive tabs to sleep reduces memory use by an average of 32% and CPU use by an average of 37%.

Here’s how to do it:

1. In Edge, click the three-dot icon on the upper right of the screen and select Settings > System and Performance > Performance.
2. In the “Memory” section, move the slider to On next to Automatically put tabs to sleep.
3. To change the length of time it takes to put an inactive tab to sleep, below “Automatically put tabs to sleep” click the drop-down arrow and select a time. Your choice is anywhere from 30 seconds to 12 hours.

To reawaken any tab that’s been put to sleep, simply click on it, and it will resume normal activity.

There’s a chance that some sites might not work properly after they’ve been put to sleep. If that happens to you, you can tell Edge never to put that site to sleep again. To do it, scroll up to the “General” area on the “System and performance / Performance” page of Settings. Click the Add site button next to the “Always keep these sites active” item and paste in the URL of any site you don’t want to sleep.

8. Reduce power use with ‘energy saver’

Browsers can be power hogs, especially if you have multiple tabs open and are playing videos or music in them. That can be a particular problem if you’re using a laptop that isn’t plugged into a power source.

In Edge, the “energy saver” setting reduces the amount of system resources the browser uses, which extends your PC’s battery life. If you enable energy saver, it becomes active when your laptop is unplugged. Microsoft claims energy saver can give you on average an extra 25 minutes of battery life. To use it:

1. In Edge, click the three-dot icon on the upper right of the screen and select Settings > System and Performance > Performance.
2. In the “Power” section, make sure the toggle next to “Enable energy saver” is turned on. When you do that, you see two options: “Balanced” and “Maximum savings.”
3. Select Balanced if you want your laptop to go into a lower-power mode to save battery life when your laptop is unplugged or has a low battery. Select Maximum savings if you know you’re not going to be able to plug your laptop in for some time. Note that in this mode, your video quality may be affected.

There’s also a separate option to use energy saver even if your laptop is plugged in. Use this option if you want to consume less energy when you use your computer. Note that if you use it, you may experience slowdowns when browsing the web.

9. View and mark up PDFs

With Edge, there’s no need to launch a separate application when you want to read or mark up a PDF; its built-in PDF app is quite good. With it, you can draw on and highlight sections of the PDF and erase the marks you made as well. So save yourself time and use Edge rather than third-party software.

You don’t need to do anything to read a PDF online. Simply click it, and by default it will launch in Edge’s reader. You’ll find the markup tools, including for drawing, highlighting, and erasing, in a toolbar towards the top of the screen. To open a PDF from your hard disk, when you’re in Edge, press Ctrl-O, then navigate to the PDF and click it.

If you prefer to use your own PDF reader, even for PDFs found online, you might be annoyed that every time you click a PDF, it opens in Edge’s PDF reader. You can change that, though, by changing your default PDF reader.

In Windows Settings, select Apps > Default Apps and in the search box at the top of the screen just below “Set a default for a file type or link type,” type in .pdf. After you do that, the listing “Microsoft Edge Microsoft Edge PDF document” appears. Click it, and a screen appears showing you all the applications on your PC that can read PDFs. Select the one you want to use instead of Edge.

10. Turn on Edge’s AI-powered ‘scareware’ blocker

The internet is filled with scammers using sophisticated attacks to steal your data or money. A common one is so-called “scareware,” in which when you visit a website, your PC is suddenly locked into full-screen mode filled with fake malware warnings that claim your computer has been infected and urge you to call a phony tech-support line or allow remote access to your device to supposedly fix the problem.

Once you do that, the scammers steal your data, get you to pay for phony solutions, or embed malware on your system.

To fight that, Edge includes an AI-powered scareware blocker that builds and constantly updates a machine-learning model that detects suspicious behavior and stops the scamware in its tracks.

Typically, the scamware detector is turned on, but there’s a possibility it’s been turned off at some point or was never turned on in the first place. For example, on PCs with only 2GB of RAM or fewer than 5 cores, it’s not turned on by default. Microsoft recommends enabling it on those machines. To do it, in Edge go to Settings >Privacy, search, and services > Security, and in the “Scareware blocker” setting, turn the slider from off to on.

When you do that, make sure that “Block sites detected as scams” and “Share detected scam sites with Microsoft Defender SmartScreen” are turned on as well.

11. Use Edge’s one-click form filler

How many hours a week do you spend mindlessly filling out web forms — your office or home address, shipping address, email address, and phone number? Wouldn’t it be nice to get that time back?

With autofill, built into Edge, you can. To use it, in Edge go to Settings > Passwords and autofill > Addresses and more. Turn on the toggle next to “Save and autofill addresses.” You can also choose to have Copilot analyze web forms and decide which bits of your information belong in which part of the form.

From now on, whenever you visit a web form, just click in a text box, and your information will appear in a popup. Select it and the form will fill in. You can go back to Passwords and autofill to change any information you want.

12. Save time with keyboard shortcuts

There’s a good chance you use keyboard shortcuts for some of your office applications, like Word and Excel — and you likely use some for Windows itself.

But when it comes to browsers, many people forgo the keyboard except when absolutely necessary. That’s too bad, because keyboard shortcuts are a big timesaver. So to improve your productivity, check out these keyboard shortcuts for Edge in Windows. (Mac users can generally substitute the Cmd key for Ctrl and the Opt key for Alt.)

For even more shortcuts, see Microsoft’s complete list of keyboard shortcuts for Edge.

Useful keyboard shortcuts in Microsoft Edge

Key combination	Task
Ctrl-Shift-B	Show or hide the favorites bar
Ctrl-D	Add the current site to favorites
Alt-D or Ctrl-L	Select the URL in the Address bar
Ctrl-E or Ctrl-K	Open a search in the Address bar
Ctrl-F	Find on the current page
Ctrl-R	Reload the current page
Ctrl-H	Open your History
Ctrl-M	Mute or unmute volume on the current tab
Ctrl-N	Open a new window
Ctrl-Shift-N	Open a new InPrivate window
Alt-F4 or Ctrl-Shift-W	Close the current window
Ctrl-T	Open a new tab and switch to it
Ctrl-W	Close the current tab
Ctrl-Tab	Switch to the next tab
Ctrl-Shift-Tab	Switch to the previous tab
Ctrl-+ (plus symbol)	Zoom in
Ctrl– (hyphen)	Zoom out
Ctrl-P	Print the current page
Ctrl-Shift-.	Open the Copilot pane

This article was originally published in March 2021 and most recently updated in July 2026.

An “AI worm” can spread through Microsoft Word documents using Copilot as a vector, a prominent Norwegian AI researcher reported on Tuesday.

The report from Håkon Måløy, later confirmed by Microsoft, said that an attacker can conceal instructions in a document that is later used as source material for Copilot-generated or Copilot-edited Word documents, for example, as input to a financial report. Those malicious instructions could potentially alter figures in the document being created. They then copy themselves into the new document, causing it to become a carrier of the attack when used in another Copilot-assisted workflow.

Måløy noted: “To my knowledge, this is among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite.”

Microsoft on Thursday emailed a statement to CSOonline discussing the report’s revelations. 

“We have addressed the findings reported by the researcher and thank them for working with us through coordinated vulnerability disclosure. To address this class of risk, we use a defense-in-depth strategy with safeguards that block malicious instructions at multiple points and help keep tasks aligned with users’ requests,” Microsoft said.

“We are continuously strengthening these safeguards as the technology and threat landscape evolve,” it added. “We encourage customers to install the latest updates, use multiple layers of security protection, treat content from unknown sources with caution, and review AI-generated content before using or sharing it.” 

Sidesteps defenses

Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, has reviewed the mechanisms used in this vulnerability and says that it is much worse than it might seem, because it will sidestep just about every defensive mechanism enterprises have in place today.

“This is a worm, a self-propagating malware pattern that uses Copilot as the transmission mechanism and legitimate corporate collaboration as the delivery channel. It bypasses every traditional email security control because the document is not malicious on delivery and it becomes malicious when Copilot processes it. That means that it bypasses DLP because the exfiltration happens through the user’s own authenticated Copilot session,” Mahapatra said. “It then bypasses endpoint protection because no code executes, only instructions get followed by an AI service the enterprise has explicitly authorized.”

He also noted that researchers have been warning about this class of attack for two years.

Microsoft’s involvement

Måløy said that he has been working with the Microsoft Security Response Center (MSRC) since March 3 and Microsoft  subsequently implemented and distributed multiple small focused mitigations, but the core vulnerability has yet to be fixed.

He said he was hesitant to disclose an active vulnerability, but felt that it was now time to publish. 

“My reasoning is that defenders cannot reduce exposure to a risk they are unaware of,” Måløy wrote, “and the propagation mechanism described here affects ordinary document workflows that many organizations already rely on.”

In an email interview, Måløy noted that the tweaks Microsoft has implemented were helpful, nonetheless. 

“The coordinated disclosure process showed that mitigations can meaningfully reduce the demonstrated attack surface, making attacks less reliable and limiting their reach, even without completely eliminating the underlying problem,” he said. 

Måløy also addressed the resolution that many analysts and consultants suggested, which is to change the nature of LLMs to fully isolate instructions from the data they operate on. 

“Separating instructions from data may be part of the solution, but I think the distinction between data and instructions is not always clear in real-world workflows. For example, a user may ask an agent to arrange a business trip, requiring the agent to retrieve an email specifying the approved itinerary and a document containing the booking procedure,” Måløy said.

“My view is that the broader challenge is therefore not simply to prevent systems from interpreting external content as instructions, but to evaluate whether those instructions align with the user’s goals and the context in which the system is operating,” he added.

Problem hard to overstate

Mike Wilkes, enterprise CISO at Aikido Security, said it would be difficult to overstate the potential problems from this situation. 

“This is a significant issue because it moves prompt injection from a single compromised interaction into a potentially self-propagating document integrity attack,” he said, noting that it is not a conventional worm that spreads automatically. A user or Copilot workflow must still bring an infected document into the model’s context. “But once that happens, the malicious instructions can reportedly alter business information, conceal themselves inside the resulting Word document and turn a legitimate internal file into the next carrier,” he said.

That, he pointed out, creates “a dangerous enterprise supply chain in which financial reports, contracts, policies and partner documents may inherit malicious behavior while retaining the trust associated with their legitimate authors and Microsoft 365 accounts.”

Not a new issue

The key issue behind this flaw is the fact that genAI tends to struggle with telling the difference between data that a user offers as input and the instructions the AI is to execute.

Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, observed that the same problem with mixed data and instructions occurred in databases decades ago, and turned into what we know as SQL injection attacks today. But, he noted, a few years later, parametrized binding for the database access layers was developed, which separates instructions, which are handled internally and safely, from data, which can come from untrusted sources. “The same needs to happen with LLMs and other AI,” he said.

Mike Leone, a VP/principal analyst at Moor Insights & Strategy, agreed.

“It’s hard not to chuckle a bit with this one. People have been asking whether data can give orders since SQL injections. We fixed that one by giving the database a way to tell an instruction from a value,” Leone said. “Thirty years later, we’ve built an entire category of software that can’t tell the difference at all.”

Tom Findling, CEO at Conifers.ai, also said he sees the data-vs-instructions issue as the biggest problem. 

“Separating data from instructions is still unsolved at the model layer. The labs are making real progress, but not enough to be your only control,” he said, and stressed, “Microsoft doesn’t need to wait for that. It can slow propagation inside Copilot: stop hidden content from being written into new documents, surface hidden text before it’s used, preserve the trust level of what Copilot read and show all AI-generated changes.”

Fix needs industry agreement

However, Frank Dickson, group VP for security at IDC, argued that a fix needs industry agreement. 

“A fundamental fix requires the industry to converge on the same architectural change, which isn’t happening anytime soon given the incentives and the fact that the major players are far from besties,” he said, pointing out that Instruction-data separation would need to be baked in at the model or platform level across every major vendor. “None of them are rewarding that work commercially right now, so treat that as a multi-year research problem, not something a CISO should wait on.”

Leone disagreed, arguing that a single vendor can do quite a bit, at least for its own customers. 

“Microsoft has said publicly since last year that indirect prompt injection can’t be fully prevented, and I give them credit for saying it out loud rather than pretending otherwise,” Leone said, noting that the industry doesn’t have to move in lockstep. “This attack lives inside one product,” he said. “If Microsoft hardens the Copilot document path, Copilot customers get safer whether or not anyone else moves.”

Dickson added that another critical problem with this vulnerability is that the carrier documents are created by legitimate employees using legitimate tools, “so there’s no obvious point of origin once the payload starts moving; an organization could be laundering corrupted financial figures through its own workflow for weeks before anyone notices.”

Tactics that might help

That said, experts had some specific suggestions for CISOs trying to negate this problem. 

IDC’s Dickson said, “the most useful lever right now sits outside the model entirely, in how much untrusted content Copilot is allowed to pull into a session without a human choosing it.” He noted that enterprises can turn Copilot’s auto-discovery behavior off or restrict it, and require humans to explicitly select the documents they feed it. “That alone closes off one of the two ways the attack gets a foothold,” he said.

IDC also suggested a visible diff or redline of anything Copilot changes in a financial or otherwise consequential document, and the requirement for a human to approve the changes. “That’s not a technical fix, it’s a workflow one, and it’s available today,” Dickson said.

He said that IT should also track where content came from and what was touched by an AI system, in metadata that travels with the document. “It doesn’t stop the injection, but it means when something does get through, an organization can actually trace how far it spread instead of discovering a corrupted number three reports later with no way to reconstruct the chain,” he said.

However, one expert, Tyler Reguly, Fortra’s associate director of security R&D, said that he didn’t see this vulnerability having a meaningful impact because it feels like what he called a “laboratory vulnerability.”

Normal enterprise workflows don’t encompass a number of the necessary steps for compromise, he said, pointing out that, if anything, people are trained not to download Word documents. Plus, he noted, looking at the blurred example in the report, the malicious document contained an additional apparently blank page which held the concealed prompts in white text.

“That page is going to send up warning signs for me if someone even managed to convince me to download an external Word document,” he said. So, overall, “this feels like it requires a perfect storm.”

This article originally appeared on CSOonline.

Traveling enterprise employees beware: Think twice before you log onto that oh-so-convenient public Wi-Fi.

Since at least June, threat actors have been compromising “captive” Wi-Fi gateways and other portal appliances at hotels, conference centers, and similar shared venues to hijack users’ Microsoft 365 accounts, according to the ReliaQuest Threat Research team.

Once a threat actor controls a gateway, they can silently redirect a user’s traffic to their own infrastructure and steal their Microsoft 365 credentials without ever touching the user’s device, compromising endpoints, or sending phishing links or malicious attachments.

“The most dangerous element is that it operates at the network gateway, which sits beneath most of the trust assumptions users and devices make,” ReliaQuest told CSO Online. “It’s not necessarily an enterprise breach level event on its own, but it’s a very real risk to individual accounts.”

Exploiting a ‘fundamental trust’

Domain Name System (DNS) poisoning, in which false data is injected to redirect regular web traffic to fraudulent domains, has previously been observed on small office routers, but attackers are now expanding the technique to higher-level targets, the ReliaQuest researchers explained in a blog post.

Attackers likely gain access to the gateways through weak or reused admin credentials in combination with exposed interfaces like Secure Shell (SSH), Simple Network Management Protocol (SNMP), and other web consoles, they pointed out.

Admin access to the gateway is all that malicious actors need, because devices are designed to inherently trust DNS, which translates domain names like login.microsoftonline[.]com into IP addresses to route them. Therefore, a single gateway compromise gives the attacker the ability to redirect traffic for every guest logging into the network, providing IP addresses it controls in response to DNS requests, rather than the legitimate ones, without touching a single endpoint.

“Captive portal appliances sit at the network perimeter for every guest on that network,” the researchers wrote. “Detection is inherently difficult because the attack happens gateway-side, outside the endpoint’s visibility.”

In the campaign tracked by ReliaQuest, four attacker-registered domains, m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com, were used for Microsoft-impersonation lures.

The compromised Wi-Fi gateways were discovered across multiple US cities as well as in India and Saudi Arabia, and impacted users were from companies in professional and financial services, legal, retail, health care, and energy, indicating that the method isn’t sector-specific.

“We’ve seen enough SharePoint exfiltration cases to know that a single popped account can cascade into meaningful data loss,” ReliaQuest noted. Meanwhile, for the network operators, there’s a “reputational dimension”; user compromise is a “serious trust and brand problem, regardless of how sophisticated’ the underlying attack is.”

Safe services, DNSSEC not enough

Locking network configurations to a ‘safe’ DNS provider such as Google (8.8.8.8), Cloudflare (1.1.1.1), or the cloud-based OpenDNS isn’t a sufficient tactic, because it doesn’t change the path that queries actually travel over, ReliaQuest contended.

By default, devices send DNS queries as unencrypted protocol traffic, and those packets still have to traverse the hotel’s network to reach Google, Cloudflare, or OpenDNS, the company explained. Since the gateway sits directly in that path, it can inspect, block, or redirect the query before it ever reaches the chosen resolver.

“Specifying a trusted DNS server changes the intended destination, not who controls the road to get there,” ReliaQuest noted.

Further, Domain Name System Security Extensions (DNSSECs), which use digital signatures and public-key cryptography, only “partially” address the problem. DNSSEC provides authentication and integrity for signed domains, which means a validating resolver can detect and reject forged or tampered responses.

“What it does not do is provide confidentiality or availability,” the company said. “It does not encrypt DNS traffic or stop an attacker from intercepting, blocking, or redirecting requests.”

So while DNSSEC can defeat certain response-forgery attacks against signed zones, an on-path gateway can still see queries, drop them, or force fallback behavior. However, this protection layer only helps when domains are actually signed, and then only when the client or resolver performs validation, which “many stub resolvers do not,” according to ReliaQuest.

Full-tunnel VPNs required

To combat the problem, enterprises should require all corporate devices to use a full-tunnel VPN for network connection. Controls should prevent internet access until a tunnel is active, ReliaQuest advised.

This will route all of a device’s traffic, including DNS, through an encrypted connection to a trusted VPN server before it travels anywhere else, the company explained, thus preventing local networks like hotel gateways from seeing or modifying DNS and internet traffic.

“In effect, it takes the untrusted network out of the trust equation,” ReliaQuest noted.

However, full-tunnel configuration is not the default for VPNs, because it comes with “real trade-offs,” the researchers noted: It adds cost, latency, and bandwidth demands, since every packet has to travel through company infrastructure. Thus, forcing all traffic through the corporate backbone is “not always practical” for distributed or bandwidth-heavy workforces.

Enterprises should also enforce conditional access in Entra ID to block device-code authentication flow, which has few legitimate use cases for most users in most environments, ReliaQuest noted.

Additional precautions

The company also advised:

• Restricting Proxy Auto-Configuration (PAC) file retrieval to approved internal hosts;
• Disabling automatic Web Proxy Auto-Discovery (WPAD) via Group Policy to (this is often enabled by default in Windows);
• Deploying encrypted DNS such as DoH or DoT in strict mode as a “complement or alternative” to full-tunnel VPN. This is particularly important for organizations where always-on VPN is not feasible.
• Training employees to verify the URL and certificate of any page requesting credentials before entering them, particularly on public Wi-Fi networks.

Prevention is more important than detection here, ReliaQuest pointed out: while in tools like Microsoft Defender for Endpoint, ‘DnsConnectionInspected’ events showing queries to attacker-controlled domains are a primary endpoint-level signal, “by the time those events fire, the redirect has typically already occurred. In other words, endpoint telemetry confirms what happened more than it prevents it.”

This is exactly why methods like encrypted transport, Conditional Access, and WPAD and PAC hardening matter more than detection alone, the researchers emphasized.

This article originally appeared on CSOonline.

The European Commission has fined Google a total of €890 million ($1 billion) for its breaches of the Digital Market Act (DMA).

Just over half the fine — €460 million — was because Google illegally gave preference to its own services in Google Search results.

The remainder was because in the Google Play store for Android apps, the company prevented app developers from leading consumers to alternative, often cheaper, purchase channels. Under the DMA, app developers who distribute their apps via Google Play or Apple’s App Store should be able to inform customers of alternative offers.

Now Google must give third-party services featuring in its results the same treatment as its own services, and allow developers of apps in the Play Store to communicate about offers both in and outside the Play Store, or face further fines.

The Commission first raised these issues with Google in March 2025. In April of this year, the Commission laid out plans as to how Google should allow other third-parties to share its searches, suggestions that the tech firm firmly resisted. Earlier this month, the Commission also said  Android should be open to other AI agents and not limited to Google’s own Gemini.

Google is not the only US company to have fallen foul of the DMA. In April 2025, Apple was fined €500 million for breaching the Act and, last month, the Commission fired the first shots at cloud hyperscalers Microsoft and Amazon.

Healthy software companies typically don’t suddenly eliminate one-fifth of their workforce, but monday.com is doing just that as it bets on flatter teams, AI agents, and customer implementation expertise as the winning combination in the AI era.

Monday.com co-founder and co-CEO Eran Zinman today announced the “very difficult decision” to reduce the AI work platform company’s global workforce by about 20%, or 620 people.

The move has nothing to do with increasing margins or replacing humans with AI, he insisted in his post on LinkedIn; rather, it’s a calculated decision to trim down and hone the company’s focus as AI becomes integral to day-to-day workflows.

“This is not a distress signal; it is a deliberate reset, disclosed with its price attached,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. “The industry has quietly swapped the meaning of productivity, and this filing is the clearest exhibit yet.”

A ‘significant opportunity’ in technology

In a SEC filing this week, monday.com said its restructuring plan reflects the “ongoing transformation of its product, marketing, and go-to-market strategy.” The move is intended to support a “leaner, more focused operating model” as the company continues to invest in its AI-driven strategy.

Zinman noted in his post that the company has shifted to “doing the work with AI and not just managing it,” and is focused on building environments where “people and AI agents [work] together in one workspace.”

In recent months, monday.com has evolved its products, strategy, and the way it serves its customers, and Zinman contended that “the organization we built for our previous chapter is not the organization that fits the new AI era.” Monday.com needs to “execute more decisively,” take on new challenges, and quickly respond to market changes, he said.

“We have never seen such a significant opportunity in software, driven by such exciting technology,” Zinman noted. He emphasized that the reduction is not to replace people with AI, nor to improve margins; the “vast majority” of savings will be reinvested into talent, products, and AI.

The restructuring will result in a “flatter organization” with fewer management layers and smaller, more autonomous teams, and monday.com also has a new go-to-market model, Zinman explained. Customers expect “deeper implementation support” as they deploy AI, and the company will work more closely with customers, increase its on-site presence, create new roles, and “adapt many existing ones.” In its SEC filing, the company said it expects to continue hiring in “key strategic areas” throughout 2026.

Workers will be expected to work better, “not harder,” Zinman noted. He pointed to several past examples where work could have been done in a few days, but instead took many months with “multiple meetings and endless friction.”

“This wasn’t people’s fault and everyone was frustrated by this,” he said. “Our new org changes ownership to allow people to make decisions and move fast.”

A spokesperson for monday.com declined to comment further on the staff reductions.

Monday.com’s key market advantages

Monday.com certainly isn’t struggling; the company expects 19% to 20% year-over-year growth in 2026.

“Companies in that position do not restructure because they must,” Greyhound’s Gogia noted. “They restructure because they have decided to become something else.”

Melody Brue, VP and principal analyst at Moor Insights & Strategy, pointed out that organizational redesign is important for real AI transformation, but while it can signal confidence to the market, it can still be “devastating” to humans.

While the company looks as though it’s trying to do right, that ultimately remains to be seen, she said. “There are often hidden internal bruises that can surface long after layoffs.”

Monday.com’s advantage is in its “structured substrate,” Gogia noted; its boards, permissions and typed workflows give agents something firmer to act on than just documents and chat history. The company highlights its natively built agents that can be configured by any team member, as well as connectors with Claude, Microsoft Copilot, and ChatGPT, and dedicated routes for external agents to authenticate and operate.

“For some time, the sharper enterprise question has been shifting from who has an agent to who owns the governed runtime in which an agent can safely act,” he said. “Structured work is a serious claim on that runtime.”

But parts of monday.com’s agent estate remain in staged release, and its product is ultimately “mid-transition,” Gogia pointed out; its agent builder carried a beta label as recently as March,. Also, the company’s pricing model changed in May to a hybrid model charging for seats as well as mandatory AI credits. And, while its AI-powered no-code builder monday vibe passed $1 million in annual recurring revenue within two and a half months, monday.com has not released subsequent outcomes, usage volumes, or attach rates.

Further, there’s an element of “gravity” with its competitors, he observed. Asana is reorganizing teams around agents, Atlassian is wiring agents into the developer estate, and others are simply bundling them into their offerings: Microsoft is doing so across the productivity stack, and ServiceNow across enterprise operations, each with identity and procurement built in.

“Their pull is strongest exactly where monday.com wants to grow, in the largest accounts, where control-plane depth and administrative reach decide the deal,” said Gogia.

Actions for the near-term

Going forward, buyers should focus on operating risk, not headline risk, Moor’s Brue noted. In practice, that’s continuity of service, roadmap consistency, and strength of enterprise support. Productivity should be valued as better outcomes per unit of organizational effort, not mere activity.

“It should be a measure of how much smoother, faster, and more effective the operating model becomes when AI is built into the work,” said Brue.

Gogia noted that strain surfaces first in customer service, and monday.com’s attention is being redistributed. The company’s annual report disclosed that its focus is now concentrated on the largest accounts, with support for medium-sized clients moved to an AI-first and human-supported model.

During the first month of the transition, buyers should track named account continuity and escalation times, he advised. By the first quarter, keep an eye on whether credit governance and admin controls mature on schedule, and if the roadmap beyond the AI estate keeps pace. By the half-year mark, determine whether promised implementation depth is producing outcomes or “simply more billable engagement.”

Support tiers should be enumerated in writing before renewal, and buyers should contract for “side exits,” Gogia emphasized, with overage pricing fixed in advance, the right to pause consumption, and portability for workflows and agent configuration “if the relationship sours.” Finance should also insist on monthly consumption reporting by capability. Further, integration efforts, partner dependency, and change management should be considered first-class costs of the agent era, “not as afterthoughts to a license.”

“A license was a known cost,” said Gogia. “A meter is a behavior, and behavior is harder to forecast than headcount.”

This article originally appeared on CIO.com.

Building a presentation can take lots of time. There are design choices to figure out: the slide layouts, fonts, theme colors, and so on. You can use a template to skip this hassle, but you still have to paste your text and other content into the slides and edit it all so that the results are visually appealing.

In PowerPoint, Microsoft’s Copilot AI assistant can now automate the heavy lifting of presentation creation. It can generate a first-draft presentation in minutes, then help you edit it. You can also prompt Copilot to help you quickly understand the contents of a presentation and glean insights from it. Use the tips in this guide to save oodles of time as you create and work with presentations.

Who can use Copilot in PowerPoint

Individuals with a Microsoft 365 Personal, Family, or Premium subscription have access to Copilot from within PowerPoint and other Microsoft 365 apps. Users with a Premium plan have higher Copilot usage allowances and access to advanced AI features.

For business users, it’s more complicated. Organizations with more than 2,000 users must pay for Microsoft 365 Copilot licenses for their users in addition to their regular Microsoft 365 licenses. Users at organizations with fewer than 2,000 users can use Copilot within M365 apps even without the M365 Copilot add-on licenses, but there are limitations in usage, speed, and feature availability.

To see what kind of access you have, log in to Microsoft’s Copilot Chat web hub and look for your name in the lower left corner. If you see “M365 Copilot (Premium)” under your name, you can use Copilot in M365 apps with priority access and advanced features. “M365 Copilot (Basic)” means you can use Copilot in M365 apps with lower-priority access and limited features. If you see “Copilot Chat (Basic)” or nothing below your name, you can’t use Copilot in M365 apps.

(Copilot Chat Basic users do get some Copilot functionality, including the ability to generate presentations, via the Copilot Chat hub. See our Copilot Chat tutorial for details.)

In this article:

• Working with Copilot in PowerPoint
• Create a presentation template
• Create a presentation from a document
• Add content from a document to a slide
• Refine your slide text
• Find or create an image
• Expand your presentation with relevant slides
• Summarize a presentation
• Answer questions about a presentation
• Help you navigate a large presentation
• Generate speaker notes and/or an FAQ

Working with Copilot in PowerPoint

First, let’s quickly go over the notable settings of the Copilot sidebar.

When you have a presentation open in PowerPoint, click the Copilot icon; it may be floating at the lower-right corner of your PowerPoint window or parked at the right end of the Ribbon toolbar. The Copilot sidebar will open along the right of the page. You’ll type your prompts to Copilot inside the chat window in this pane.

Agent mode: By default, Copilot can build a new presentation or make changes to an existing one in the main PowerPoint window. This is known as “agent mode.” To change this so that Copilot can’t take direct action on a presentation (all its responses appear in the sidebar), click the Allow editing button above the chat window and change it to Chat only.

The tips in this guide require that Copilot be in agent mode, so make sure you see Allow editing above the chat window.

Choice of AI model: Behind the scenes, Copilot has access to various genAI models, including different versions of Anthropic Claude and OpenAI GPT.  By default, it decides which model to use based on your prompt. You can set it to use a particular model: click Auto at the upper right of the Copilot pane and select a model from the dropdown that opens.

The tips in this guide should work fine on the default Auto setting. But feel free to experiment switching to specific models to see which give you the best results for particular tasks.

Important: Remember that generative AI output often includes errors, so always check Copilot’s output for accuracy. (Also see our tips for reducing hallucinations in Copilot.) You’ll likely want to rewrite it in your own voice as you’re reviewing it.

1. Create a presentation template

For many people, the hardest part of creating a presentation is getting started. What types of information should be included on the slides, and in what order? Copilot can give you a leg up by creating the type of presentation you need, with placeholder data that you can later replace with your own.

Start a new presentation, open the Copilot sidebar, and type your prompt into the chat window. It’s best to provide very specific details in your prompt. The more context or details you provide, the more likely Copilot will generate a presentation template that suits your needs.

A good prompt should contain the slide count, subject, audience, and tone. Example:

• Create a 6-slide presentation for a sales meeting focusing on Q1 revenue. The audience is the sales team, so keep the tone professional and focused on the sales data.

Copilot may ask a series of follow-up questions, such as your preferred visual style and desired level of detail. Then it will generate a presentation template.

You can optionally prompt Copilot for revisions, and when you’re happy with the template, swap in your own data.

2. Create a presentation from a document

You can attach a document (such as a Word document, Excel spreadsheet, or PDF) and prompt Copilot to generate a presentation based on its contents. This works best with a structured-format document (such as a business plan, project proposal, or summary report) that contains sections with headings.

Copilot can extract the document’s text and structure to generate the slide content for the new presentation. This can especially be useful for quickly turning a long report into a visually appealing presentation.

In the Copilot pane, click the + icon at the bottom of the chat window. A list of documents that you’ve recently accessed appears. Select the one that you want Copilot to use. Alternatively, click the magnifying glass icon and inside its search box, type a few letters of the filename for the document you want. (Business users with an M365 Copilot license can select up to five files for Copilot to pull from when creating a presentation.)

Then in the chat window, you can enter a prompt that’s as simple as “Create a presentation,” although as always, providing more details and context is better. This is especially important for corporate users who reference multiple source files. It’s useful to tell Copilot what data to pull from each document.

Answer any follow-up questions that Copilot asks, and it will then generate the presentation.

Note: Your marketing department may have created one or more branded company templates for Copilot to work from. If that’s the case at your organization, simply open the appropriate company template as your first step. Then you can upload docs and type a prompt as described above. Copilot will create a presentation using the branded template.

3. Add content from a document to a slide

Manually copying text or other content from a document and pasting it into a new slide is a chore. Instead, you can prompt Copilot to extract information directly from a Word document, Excel spreadsheet, or PDF to create new slides.

In the Copilot pane, attach the document using the same steps described in tip 2, then tell Copilot to create a slide from the document. As always, it helps to provide details such as the new slide’s focus or what data to include:

• Add a slide based on the attached document.
• Use the attached file to add a slide about the project budget that focuses on Q1 projections.
• Summarize only the financial section of the attached document as a slide.

4. Refine your slide text

A presentation should be visual and display only the core message. Conciseness and proper writing tone are essential for your slides, so that they don’t lose the attention of your audience.

You can prompt Copilot to refine text on an individual slide in various ways, such as rewriting it in a more professional tone or making it more concise. Highlight the text inside a text box on the slide. On the toolbar that appears over the highlighted text, click Edit with Copilot.

On the menu that opens, you can select a preset prompt to refine the text, such as Condense or Make professional. Or, at the top of this menu, you can type a prompt to rewrite the highlighted text.

Note that this feature affects all the text inside the text box. To rewrite only a portion of text inside a text box, you must split that portion out into a separate text box.

Alternatively, you can prompt Copilot to analyze your entire presentation and tighten up the wording throughout all of its slides. For example:

• Make these slides more visual and use less text.

5. Find or create an image

If you have Copilot generate a presentation from an existing Word document that contains images, it will incorporate those images into the presentation. If there are no images in the source document, you can ask Copilot to find or create one and add it to a slide.

To add a stock image or an image from your organization’s brand library, tell Copilot what you’re looking for:

• Add a stock photo of young adults in a cafe drinking boba tea.
• Add a photo from our asset library of young adults in a cafe drinking boba tea.

To have Copilot create an image using Microsoft’s Designer image generation tool, describe your desired image. As always, specificity is helpful:

• Create a photorealistic image of a diverse group of 5 or 6 fashionable young adults sitting in a cafe drinking boba tea. They’re smiling or laughing, and some are looking at their phones.

Just as you need to review any text output from Copilot, take a close look at generated images to be sure nothing looks off.

Also note that Copilot image generation isn’t always reliable in PowerPoint. For some time during our testing for this story, Copilot said it couldn’t create an image because “the image generation service is returning a server error on every attempt.” After about a day and a half, the service began working again.

6. Expand your presentation with relevant slides

As you’re building your presentation, you may find that it’s become text heavy. Or perhaps it could use more visually oriented slides to break things up and make its progression flow better. Copilot can generate and insert new slides that are based on the content of the slides already in the presentation.

In the Copilot pane, specify exactly where you want the new slide to go. This helps Copilot to analyze the content of the slides before and after where you want the new slide. Then it can generate a slide to bridge between the two slides. Examples:

• Add a slide after slide 3 about our competitive advantages.
• Add a slide after slide 11 that transitions to slide 12.

7. Summarize a presentation

Maybe you need a quick refresh of your presentation before an important meeting. Or maybe a co-worker has sent you a presentation that’s packed with lots of slides. You can prompt Copilot to generate a summary of the presentation’s overall messaging.

In the Copilot pane, just type “summarize this presentation.” You can also have Copilot flag key slides that contain important information: “show me key slides.”

8. Answer questions about a presentation

As you’re reviewing a presentation, especially one that you didn’t create and are not familiar with, you can get Copilot to pull key data points from its slides.

In the Copilot pane, type specific informational questions. Examples:

• What are the action items in this deck?
• What is the proposed budget mentioned here?

If Copilot can’t find the exact answer to the question you ask, it will provide related information from the presentation.

This method can also help you validate that your presentation includes everything you want it to. If you ask Copilot about the action items in a presentation and it can’t find any, you know you need to add them. (Copilot will likely offer to generate them for you based on the rest of the slides.)

You can even take this tactic a step further and ask Copilot if the presentation is missing any important data, if any slides are weak or confusing, if there are any awkward transitions, if there are key points that should be better emphasized, and so on.

9. Help you navigate a large presentation

In the business world, presentations with dozens of slides are not uncommon, such as for financial reports or project documentation. Trying to find a specific slide or multiple slides can be tough. Copilot can help you navigate such a presentation.

In the Copilot pane, prompt Copilot to find slides based on specific topics. Example:

• Show me the slides about the project timeline.

Copilot will analyze the presentation and reply with a list of links to the relevant slides. Click one of these to jump directly to that slide.

10. Generate speaker notes and/or an FAQ

Here’s a great timesaver when you’re preparing to show your presentation to an audience: Copilot can automatically generate suggested speaker notes for you, based on the content of your slides. Example prompt:

• Write speaker notes for every slide with one talking point per slide.

In a related feature, Copilot can create a frequently asked questions list (FAQ) for you to consult in your speaker notes or to present as a slide:

• Write an FAQ for these slides.

Copilot will ask where you want the questions and answers added — as a new slide at the end, integrated into the speaker notes of relevant slides, or somewhere else that you designate. Make a selection, and Copilot will generate the FAQ based on the content of your presentation.

Related reading:

• 11 cool things Copilot can do in Excel
• 9 ways Copilot can turbocharge OneNote
• PowerPoint for Microsoft 365 cheat sheet
• Copilot Chat: Your hub for document creation and analysis
• How to curb hallucinations in Copilot (and other genAI tools)
• Microsoft Copilot can boost your writing in Word, Outlook, and OneNote — here’s how
• More Microsoft tips and tutorials

Here in this high-tech era of 2026, keeping important info backed up and synced should be effortless and something that just happens on its own, automatically, without any actual thought or ongoing human effort.

In many areas of our digital life, that mercifully does Just Work™ in exactly that way. Fire up an email in most modern mail services, and you can stop at any point and find your in-progress draft in that same app on any other device. The same applies to any file you’re finessing within Google Drive or other cloud storage services or document you’re dawdling over in Docs.

One area where seamless syncing somehow still doesn’t occur, though, is in the domain of downloaded documents on Android. If someone sends you a PDF or a Word file and you save it to your phone, that file exists in an archaic-seeming silo — only locally, on that one gadget. And that, of course, means (a) you can’t access it from any other device, and (b) if you misplace your phone or move into a new one at some point along the way, the file will be left behind in time and entirely unavailable.

Well, take a moment to join me in celebration: Amidst all the Gemini gobbledegook that no one asked for (and that often falls somewhere between “pointless” and “actively counterproductive”), Google’s giving us a major upgrade to Android’s backup capabilities right now. It’s a simple-seeming switch buried in your system settings, and it’s up to you to find and activate it.

Once you do, though, those once-orphaned documents on your Android device’s local storage will be perpetually synced and protected, automatically, without any ongoing thought or effort.

All you’ve gotta do is find and flip that one new switch.

[Don’t let yourself miss an ounce of Android Intelligence. Join my free weekly Android Intelligence newsletter and get one new thing to try in your inbox every Friday!]

The Android backup lowdown

So, for a quick bit of pertinent context on this: Android’s backup systems have actually come a really long way over the years.

‘Twas a time, y’see, when little to nothing about you would sync and carry over automatically from one Android device to another. Years ago — back in the ancient-seeming prehistoric era of the early 2010s — Android enthusiasts in the know would rely on community-created third-party apps for everything from remembering and resyncing downloaded apps to restoring data from within those apps and onward. And reconfiguring your system preferences would be a whole time-consuming song and dance every single time you reset a device or moved into a new one, as little to nothing would automatically carry over.

Most of that stuff is now effortless and automatic. And, thanks to apps like Google Messages, Calendar, Drive, and Docs, many other areas of important data are also synced on their own at the app level — outside of any system mechanisms.

Locally stored files, however, have remained an awkward omission. To this day, anything you download on any Android device exists only on that one device and isn’t synced or backed up anywhere. The only way that happens is — in a blast-from-the-past twist — if you go out of your way to find and set up a third-party app to handle the heavy lifting.

That brings us to today. Right now, as we speak, Google’s in the midst of sending out a quiet under-the-hood update that (brace yourself…) adds in the option to automatically sync and back up any documents on your device as a native part of Android’s backup setup.

See?

The option is on its way to all devices running 2018’s Android 9 release and higher. (If you’re still using a phone with an Android version older than that, you’re now a whopping eight years out of date, and you have much bigger problems.)

Once the added option is present and available for you, you’re literally lookin’ at 10 seconds to find and activate it.

Lemme show ya how.

Android’s document backup addition

I promise: This couldn’t be much simpler.

No matter what kind of Android device is in front of you, just head into your system settings and open the section called “Accounts and backup,” “Back up or copy data,” or something along those same lines. (The exact wording can vary based on who made your device and when it was released or last updated.)

Either tap the line labeled “Google Backup” or look for an option to “Back up data” via Google Drive. You should then either see a series of options for different areas of available backup right then and there — or, depending on your device, you might have to tap a line labeled “Other device data” (or something similar) to find the full list of possibilities.

However you get there, once you’re lookin’ at that list, you’ll see a newly added line for “Documents” if this latest under-the-hood update has reached you.

And from there, all that’s left is to tap it and enable the switch to include that in your automated backups from that moment forward.

If you aren’t seeing the option yet, don’t panic. Google always sends these under-the-hood updates out bit by bit over time, so the change probably just hasn’t reached your device quite yet. As long as you’re running Android 9 or higher, it’ll get there. Set yourself a reminder to check back once a week or so. Odds are, you’ll see it pretty soon.

Notably, all documents synced in this way are always encrypted for security, and they’re kept in your personal (or, depending on the nature of your account, perhaps company-connected) Google Drive storage. That does mean they’ll count against your overall Google storage total, so keep an eye on your Drive storage total to make sure you’re in solid shape and look to the Google One storage hub if you ever want some simple suggestions for freeing up space.

Speaking of other Google services: If you ever want to keep other types of locally stored non-document files from an Android device synced and available elsewhere, you can easily rely on Google Photos for syncing screenshots and other images — after enabling sync in general, be sure to look in the app’s “Collections” areas to find the “On this device” folder and then flip the toggle to “Backup all device folders” (or get more nuanced and open specific individual on-device folders if you want to sync some but not all of those areas) — and you can still turn to those aforementioned third-party apps for broader syncing of anything else imaginable.

But with documents now being handled automatically and natively, that’s one big worry now out of your hair. Just note that the onus will fall on you to find and flip the switch and actively opt in to the feature on each and every Android device you’re using.

Take 10 seconds to do that, though, and you’ll have one less void in your Android data arena. And you don’t need Gemini to tell you that that can only be a good thing.

Get practical Android knowledge in your inbox every Friday with my free Android Intelligence newsletter — one new thing to try each week, straight from me to you.

Long before Taco Tuesday became part of the pop-culture vernacular, Tuesdays were synonymous with security — and for anyone in the tech world, they still are.  Patch Tuesday, as you most likely know, refers to the day each month when Microsoft releases security updates and patches for its software products — everything from Windows to Office to SQL Server, developer tools to browsers.

The practice, which happens on the second Tuesday of the month, was initiated to streamline the patch distribution process and make it easier for users and IT system administrators to manage updates.  Like tacos, Patch Tuesday is here to stay.

In a blog post celebrating the 20th anniversary of Patch Tuesday, the Microsoft Security Response Center wrote: “The concept of Patch Tuesday was conceived and implemented in 2003. Before this unified approach, our security updates were sporadic, posing significant challenges for IT professionals and organizations in deploying critical patches in a timely manner.”

Patch Tuesday will continue to be an “important part of our strategy to keep users secure,” Microsoft said, adding that it’s now an important part of the cybersecurity industry.  As a case in point, Adobe, among others, follows a similar patch cadence.

Patch Tuesday coverage has also long been a staple of Computerworld’s commitment to provide critical information to the IT industry. That’s why we’ve gathered together this collection of recent patches, a rolling list we’ll keep updated each month.

In case you missed a recent Patch Tuesday announcement, here are the latest six months of updates.

July’s Patch Tuesday sees an end-of-support collision amidst a massive, record-setting patch wave

Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.

The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today. The Readiness team has provided a handy infographic of the expected risk profile of this month’s Patch Tuesday updates.

More info is available here on Microsoft Security updates for July 2026.

For June, Patch Tuesday means an IT scramble

Microsoft this month released 206 updates affecting Windows, Office, Exchange Server, and its developer tools — including three Windows vulnerabilities already publicly disclosed. That trio includes an elevation of privilege in the Collaborative Translation Framework (CVE-2026-45586), a denial of service in HTTP.sys (CVE-2026-49160), and a BitLocker security feature bypass (CVE-2026-50507). At the moment, none appear to be under active exploitation, but all three are rated “Exploitation More Likely.” 

Even without an exploited zero-day, the June 2026 Patch Tuesday release requires Patch Now recommendations for Windows, Office, and Exchange. The latter is back in the patch picture with a consolidated security update that Microsoft recommends installing “as soon as possible.”

More info is available here on Microsoft Security updates for June 2026.

For May, Patch Tuesday means 139 updates — but no zero-days

Microsoft this month released 139 updates affecting Windows, Office, .NET, and SQL Server (though there were no updates for Microsoft Exchange Server). Despite the absence of zero-days, the May Patch Tuesday update still requires Patch Now recommendations for Windows and Office. 

The combination of three unauthenticated network RCEs (Netlogon, DNS Client, and SSO Plugin for Jira and Confluence), four Word Preview Pane RCEs, the large TCP/IP vulnerability cluster, and the carry-over BitLocker recovery condition (still active on Windows 10 and Windows Server) warrants an accelerated deployment release schedule. 

More info is available here on Microsoft Security updates for May 2026.

Microsoft’s Patch Tuesday release for April is a whopper

Windows admins are going to be busy this month, dealing with the largest Patch Tuesday cycle in memory. The April release involves 165 updates and roughly 340 unique CVEs from Microsoft — including two zero-days, one of which is already being actively exploited in the wild. 

The Readiness team recommends “Patch Now” schedules for nearly every major product family: Windows, Office (with a zero-day), Microsoft Edge (Chromium), SQL Server, and Microsoft Developer Tools (.NET). April also brings Phase 2 of Microsoft’s Kerberos RC4 hardening with full enforcement set for July. There is a lot to cover, so here’s a useful infographic mapping the deployment risk for each platform.

More info is available here on Microsoft Security updates for April 2026.

For March, Patch Tuesday delivers fixes for 83 vulnerabilities

Microsoft’s March Patch Tuesday release addresses 83 vulnerabilities across Windows, Office, SQL Server, Azure, and .NET — with two publicly disclosed zero-days affecting SQL Server and .NET (though neither is being actively exploited in the wild.) Six additional vulnerabilities spanning the Windows Kernel, Graphics Component, SMB Server, Accessibility Infrastructure, and Winlogon are flagged as “Exploitation More Likely.”

The most significant change this month is the introduction of Common Log File System (CLFS) hardening with signature verification, which will affect how Windows handles log files across the operating system. More info on Microsoft Security updates for March 2026.

February’s Patch Tuesday release fixes 59 flaws, including 6 being exploited

The company’s Patch Tuesday release for February addresses 59 CVEs across the company’s product family — roughly half the volume of January’s 159 patches. Six vulnerabilities, affecting Windows Shell, MSHTML, Desktop Window Manager, Remote Desktop, Remote Access, and Microsoft Word, are already being actively exploited. (All five Critical-rated CVEs target Azureservices rather than Windows, however.) 

Both Windows and Office get a “Patch Now” recommendation, with CISA setting a March 3 enforcement deadline for all six exploited vulnerabilities. Two new enforcement timelines also take effect in April: Kerberos RC4 deprecation (CVE-2026-20833) and Windows Deployment Services hardening (CVE-2026-0386). More info on Microsoft Security updates for February 2026.

CISOs at government organizations and universities have an unexpected ally coming to their aid: OnlyFans models.

For some time, hackers have exploited weaknesses in the websites of universities or government departments to host scams or malware, using content stolen from the OnlyFans website as bait to attract victims.

Now, according to security researchers at Upguard, the fightback has begun: creators of adult content on OnlyFans are leveraging Google search results and the protection offered by copyright law to break up the traffic distribution systems created by bad actors.

These distribution systems work in three stages: entry points using adult or other content to attract and capture web traffic, a routing system sends it to destination sites, and those sites monetize the traffic through scams and malware. It has proved to be a lucrative business for the scammers.

Google recognizes the approach and calls such actors SEO parasites as they benefit from the reputations of other organizations — in particular government or academic sites, which Google views as having high authority.

Since the creators of OnlyFans content are also the copyright holders, they are able to issue Digital Millennium Copyright Act (DMCA) take-down notices for the stolen content posted by the bad actors to other sites. Upguard was able to track this through Google’s DMCA Transparency Report, and through the Lumen Database, another tracker of takedown notices, to which it was granted research access.

“This allows us to identify likely compromised sites: government and university domains advertising unlicensed adult content,” Upguard said.

The OnlyFans creators’ action has two benefits for the operators of the affected websites: The adult content associated with their domain disappears from Google search results, no longer affecting their reputation — and if they receive takedown notices for such content they can check their webservers for the vulnerabilities that enabled the bad actors to post it there in the first place.

This article first appeared on CSO.

Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.”

The issue is especially significant given Zoom’s extensive reach; it reportedly has more than 300 million daily active users, including 470,000 paying business customers. Given that reach, Zoom has been impacted by many other security incidents and France recently tried banning its use by French government users. 

 Zoom security bulletins released Tuesday revealed the bug, and three other security issues, which Zoom patched on Wednesday. 

The company originally said that the takeover issue impacted Zoom Desktop Client for Windows before version 7.0.0, Zoom VDI Client for Windows before version 7.0.10 and 6.6.15 and 6.5.18 in their respective branches, and Zoom Meeting SDK for Windows, but on Wednesday, without explanation, it removed Meeting SDK for Windows as an affected product.

The other three holes were less severe, but still significant, and they all involved privilege escalation. They impacted Zoom Workplace for Windows before version 7.0.5, Zoom Workplace VDI Client for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Workplace VDI plugin for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Rooms for Windows before 7.0.5 and Remote Control for Zoom Contact Center for Windows before version 7.0.0.

A second privilege escalation issue impacted Zoom Rooms for Windows before version 7.1.0, and another impacted Zoom Workplace VDI Plugin for Windows before version 6.6.14.

Zoom did not immediately reply to a request for comment.

‘As bad as it gets’

Frank Dickson, group VP for security at IDC, said the nature of the reported hole is alarming.

This bug “is about as bad as it gets, short of a worm. It is exploitable over the network, low complexity, zero privileges required, no user interaction needed,” he said, pointing out that exploitation is easy once technical details leak or someone reverse-engineers the patch, which is not as challenging as it once was, thanks to AI. “Yesterday’s script kiddies have been empowered,” he said.

Dickson said the only good news is that Zoom discovered the hole itself, and that “no in-the-wild exploitation has been reported by any outlet as of Thursday.”

Consultant Brian Levine, executive director of FormerGov, agreed with Dickson’s characterization of the hole, but said a potentially bigger issue is the high level of sensitive data that Zoom accesses. 

“An attacker with unfettered access to a Zoom account may be able to listen to recordings of sensitive meetings, to eavesdrop on future meetings, and to impersonate the organization in an effort to social engineer its clients and partners. Thus, given that ubiquity of Zoom in large enterprises, this vulnerability is pretty concerning,” Levine said.

He’s encouraged, however, that Zoom found the flaw itself, which indicates its security team is “actually doing the hard, unglamorous work of auditing its code.”

Giuseppe Trotta, principal security researcher at Malwarebytes, has a theory about what was behind the Zoom disclosure. 

“Because the vulnerability requires zero privileges and absolutely no user interaction, the remote network attack vector is highly suspected to involve the mishandling of deep links, such as custom URL schemes like zoommtg:// or zoomworkplace://,” he said. This led him to think that if the Zoom Workplace client for Windows fails to properly sanitize and validate incoming arguments passed via these special browser-to-desktop links, an unauthenticated attacker could craft a malicious string that could trick the desktop application into exposing or redirecting the user’s active session tokens directly to an attacker-controlled server, achieving a seamless and completely silent account takeover.

“Watch out for Zoom links and invites if you are on Windows or VDI and haven’t updated yet,” he advised.

Mike Wilkes, enterprise CISO at Aikido Security, offered kudos to Zoom for discovering the critical flaw, but he wanted to know how such a severe bug got into its software initially.

“This vulnerability raises questions about why the defect was not caught by design review, fuzzing, or pre-release abuse-case testing,” Wilkes said. “A historical defect in Zoom’s product/security relationship has been prioritizing ease of use over security risk.”

All four bugs important

Justin Greis, CEO of consulting firm Acceligence, said that the two types of holes reported by Zoom, account takeover and escalation, are both important, but for different reasons. 

“The critical vulnerability is significant because it has the characteristics security teams worry about most,” Greis said, but the privilege escalation holes “are certainly important to patch as they primarily increase the impact of an attack that has already begun. The critical vulnerability has the potential to be an initial entry point, which is why it deserves the most attention.”

Greis also applauded Zoom’s response, saying that it “reflects a reasonably mature security program.”

He pointed out that no complex software platform will eliminate vulnerabilities entirely. “The differentiator is whether vendors are continuously investing in offensive testing, finding weaknesses before attackers do, and moving quickly to develop and distribute fixes,” he said.

The US Cybersecurity and Infrastructure Security Agency (CISA) has urged organizations to immediately secure Microsoft SharePoint deployments after warning that three vulnerabilities affecting the on-premises collaboration platform are being actively exploited.

A recent advisory from the federal cybersecurity watchdog asked administrators to patch vulnerable servers, review Microsoft’s mitigation guidance, and assume that internet-facing SharePoint instances remain attractive targets for attackers seeking an initial foothold into enterprise environments.

While applying patches remains the immediate priority, security experts caution that organizations should view the advisory as more than another Patch Tuesday exercise.

“This is what separates an IT incident from a business crisis,” said Chris Boehm, field CTO at Zero Networks. “One compromised SharePoint box is a ticket. That same box, with a clear path to your domain controllers, backups, and file shares, is how you end up with an encrypted infrastructure and a disclosure event. Segmentation stops the first from becoming the second.”

CISA’s advisory highlights CVE-2026-332201, CVE-2026-45659, and the newly added CVE-2026-56164, all of which have now been confirmed as exploited in the wild and added to the agency’s Known Exploited Vulnerabilities (KEV) catalog.

Exploitation tells a different severity story

The latest addition to CISA’s KEV catalog is CVE-2026-56164, an elevation-of-privilege vulnerability affecting Microsoft SharePoint Server. Although assigned a CVSS score of 5.3, the flaw can be exploited remotely without authentication, making it significantly more dangerous in practice than its severity rating alone suggests.

Microsoft has released security updates for supported SharePoint versions and recommended enabling the Antimalware Scan Interface (AMSI) integration to help detect malicious requests associated with exploitation attempts.

CISA also advised organizations to follow Microsoft’s incident response guidance, hunt for indicators of compromise, and rotate SharePoint machine keys where appropriate, acknowledging that patching alone may not fully remove attacker persistence from already compromised servers.

Older vulnerabilities remain active entry points

Alongside the newly disclosed flaw, CISA reiterated the urgency of addressing CVE-2026-45659, an insecure deserialization vulnerability allowing RCE that Microsoft had marked as “exploitation less likely” in its advisory in May. Another old bug CISA flagged is CVE-2026-32201, an improper input validation flaw that allows spoofing over a network.

Both of these flaws are being actively exploited in the wild.

CISA called out organizations failing to catch up with SharePoint updates, adding that attackers are increasingly targeting N-days rather than relying exclusively on newly discovered zero-days.

On concerns of patching speed, Boehm noted resilience is becoming an architectural challenge as much as an operational one.

“Stop measuring this in patch speed,” he said. “That’s a race you eventually lose. Some of these landed as zero-days with no fix on day one, and the window between disclosure and exploitation keeps shrinking. So the board-level question isn’t whether a server gets compromised. Assume one will. It’s how much of the business a single-owned system can take down with it.”

Boehm argued that limiting network reachability through segmentation should sit alongside patch management and threat hunting as a core defensive strategy. Reachability, he said, is a control that organizations own, not patch timing. CISA has given Federal Civilian Executive Branch (FCEB) agencies three days to remediate CVE-2026-56164 under Binding Operational Directive (BOD) 22-01.

The article originally appeared on CSO.

Widgets, widgets, widgets. Has there ever been an Android feature so full of promise that went unloved by Google for so very long?

Okay, so maybe there has been — erm, lots of times, actually. But even so, Android’s widgets system is a perfect example of an exceptional advantage that Google basically buried, abandoned, and left on the brink of extinction up until its overdue revival in 2021’s Android 12 update. (And that revival, by the way, happened for no apparent reason whatsoever. Just a totally random, unprompted change of heart after a decade of indifference. Riiiiiiiiight.)

Google may have given up on widgets for a while, but the good news is that (a) they’re back, baby — still now, more than ever, even in our overly AI-obsessed 2026 timeline — and (b) the Android developer community keeps chuggin’ along and coming up with ever-more creative new ways to embrace widgets beyond what Google itself sees fit to give us. That means no matter what Android version your favorite phone is running, you can step up your own Android widget game and give yourself some fresh and fruitful paths to make the most of your phone’s framework.

Here, my dear, are some fantastic beyond-the-basics ways to put your favorite Android widgets to use and change the way you get stuff done on your phone. 

[Psst: Love learning new things? Get my free Android Intelligence newsletter to get a tasty new tip in your inbox every Friday.]

Android widget enhancement #1: The on-demand home screen pop-up

Widgets are a wonderful way to interact with all sorts of info without ever having to open up apps, but having too many widgets can quickly lead to a cluttered and overwhelming home screen.

Well, here’s a neat way to give yourself the benefit of a widget while still maintaining a neat and minimal space for working: An excellent app called Popup Widget lets you create an on-demand pop-up widget (get it?!) that looks like a regular ol’ icon on your home screen but then loads any widget you want when tapped.

See?

You can even get really wild and set up a single icon that opens multiple widgets at the same time — like your inbox and your calendar together:

Not bad, right?

Popup Widget costs two bucks and doesn’t require any special permissions or manners of access. And it’s pretty simple and self-explanatory to set up: Once you install and open the app, it’ll walk you through adding in whatever pop-up widgets you want. You can choose the name and even the icon associated with each one along with its precise placement on your screen and how much the screen behind it should dim when it’s loaded.

The app will offer to add the shortcut directly onto your home screen for you then, or you can also find all of your Popup Widget creations by pressing and holding the main Popup Widget icon in your app drawer.

Alternatively, if you’re already using a custom Android launcher like Smart Launcher or Niagara, you can find similar options for summoning widgets on demand within their settings — no separate apps even required.

And that, my widget-loving wallaby, is but our first winning widget possibility.

Android widget enhancement #2: The on-demand universal pop-up

If you like the idea of having a widget on demand but would rather have it be available to summon from anywhere instead of just from your home screen, this next wacky widget option is just the thing for you.

It comes from a spectacular app called Edge Gestures, which works in conjunction with Popup Widget to take that same concept and make it universally accessible. (I told ya it was wacky!)

When you first install Edge Gestures, the app will prompt you to enable it as a system accessibility service and to grant it the ability to display over other apps. These permissions sound scary — and they should! — but in the case of this specific utility, they’re absolutely appropriate and necessary in order for it to operate. The former is the only way an app is able to create a custom system-wide gesture, which we need for this setup to work its magic, and the latter is how your widget is able to be shown on top of whatever else you’re doing.

(If you’re at all worried, note that Edge Gestures doesn’t request any other significant system permissions. Beyond that, it’s reputable, it’s been around for quite a long while, and it has a large number of overwhelmingly positive reviews.)

Where were we? Oh, right: Once you’re inside the Edge Gestures configuration area, you’ll be able to select exactly what gesture you want to use for pulling up your widget. I’d think carefully about finding something that won’t interfere with anything else, like the system-level Android gestures, and that’ll be convenient to access without being a command you’re likely to trigger by mistake.

So, for instance, you might make the gesture a simple swipe downward along the left side of your screen. To do that, you’d find the “Swipe down” option within the app’s “Left” tab, and you’d set it to “Popup Widget” — and then create or select whatever Popup Widget item you want. And remember: You can select one widget or multiple widgets, too.

Prepare yourself for some serious oohing and ahhing:

As you can see, this opens up a whole new world of mobile multitasking potential. I mean, really: How could you not love that?!

The final thing worth doing is going into all the other gesture options in that same configuration area and tapping “Clear” for each of ’em to get rid of Edge Gestures’ default actions. I’d also go into whichever side of the screen you aren’t using — left or right — and tap the toggle to turn the gestures for that side off entirely. That way, you won’t inadvertently activate any gestures that you don’t actually want or need.

Edge Gestures costs $2 to use.

Android widget enhancement #3: The physical key call

Next, here’s an interesting twist on that same on-demand Android widget idea: You can make any widget especially easy to access from anywhere without even having to mess around with any on-screen swiping by setting one of your phone’s physical keys as a trigger for the widget’s appearance.

I’ll give you a second to catch your breath and process the sheer splendor of that sorcery.

Back? Cool. So, the key to this feat (har har) is the combination of the aforementioned Popup Widget and a handy Android contraption called Key Mapper — which makes it easy to map your phone’s physical keys to all kinds of crazy custom actions.

In this case, we’ll set it up so that pressing and holding one of your volume keys causes whatever widget you want to be summoned, like so:

Pretty nifty, no?

I’ve got step-by-step instructions for making this happen in this separate guide.

Android widget enhancement #4: The floating bubble

If you like the notion of having a widget always available but aren’t so keen on the hidden gesture concept, an app called Overlays will let you create a small floating bubble that you can position anywhere on your screen and then tap to pull any widget up when you want it — just like with Android’s recently revived Bubbles multitasking system, only compatible with any Android device and version and with the simplicity of a widget instead of the complexity of an entire app.

Check it out:

By default, Overlays gives you a bunch of its own little widgets to choose from, but the real power comes from adding in widgets from the Android apps you actually rely on. To do that, tap the “Triggers” tab at the bottom of the Overlays configuration area, then tap the red plus button in the lower-right corner of the screen. Select “Manual,” then type in whatever name you want for your widget and tap the icon to pick any icon you like.

Tap “Save,” then select “Widget” and find the widget you want from the list. At that point, you’ll see a preview of the widget. Move or resize it if you like, then hit the arrow in the upper-left corner of the screen to exit out of that interface. Last but not least, tap the name of your newly made widget on the screen that comes up next to change its status to “Always on.”

As soon as you head out of the app and back to your home screen, your fancy new widget should pop right up. All you’ve gotta do is tap the little downward-facing arrow in its corner to minimize it down to a bubble, which you can then press and hold to move anywhere your widget-worshipping heart desires.

Overlays can also create widgets that automatically appear based on context — so you could have something show up every time you connect to a certain Bluetooth device or Wi-Fi network, for instance. To explore those options, just follow the same steps from above but pick “Event” instead of “Manual” when you reach the “Triggers” tab configuration.

Overlays is free with an optional $4 in-app upgrade that removes some ads from the configuration tool and unlocks a handful of advanced features.

Android widget enhancement #5: The widget stack

Last but not least in our collection of wacky Android widget possibilities is one of my favorite widget wonders — and that’s the ability to stack multiple widgets and then swipe between ’em on your home screen without having ’em take up any extra space.

Check it out:

This enhancement presents a bit of a choose-your-own-adventure-style path:

First, if you’re using a reasonably recent Samsung Galaxy gizmo, the option is should already be present and available in your standard Samsung home screen setup. Just press and hold any open space on your home screen and then select the option to add a widget — then, once the widget is added, press and hold it and look for the “Create stack” command.

With any other Android gadget — or even with a Samsung device, if you want extra options and flexibility — you can use a custom Android launcher like the aforementioned Smart Launcher or Niagara as well as the retro-geeky T9-themed Key Launcher I introduced to you earlier this summer.

Those launchers replace your phone’s entire home screen environment and give you all sorts of interesting new possibilities for optimizing your interface and making it especially well-suited for you. And the stacked widget feature is just one small sliver of what they offer and how they’ll transform your Android experience.

So there ya have it: five wacky, wild, wonderful ways to make widgets even more wow-inducing. Some days, you’ve just gotta love Android and the endless customization, control, and power it provides.

Put even more Googley goodness in your noggin with my free Android Intelligence newsletter — one exceptional new thing to try every Friday!

A newly documented phishing-as-a-service platform distributed through Telegram is lowering the technical barrier to Microsoft 365 account takeovers by giving less-skilled attackers automated tools to evade some authentication controls and retain access after compromise.

The platform, called Forg365, uses AI-assisted lure creation alongside device-code abuse and adversary-in-the-middle techniques, according to research published by security company ZeroBEC.

Forg365 was offered with a five-day free trial, followed by subscriptions priced at $400 per month or $3,800 per year, the researchers said.

Customers can build phishing lures and control email delivery through a single operator panel. They can also manage captured account data and monitor compromised Microsoft 365 mailboxes. The service includes templates that impersonate widely used business platforms such as DocuSign, Adobe Acrobat Sign, SharePoint, and OneDrive.

“Phishing-as-a-service has been around for quite a few years,” said Jonathan Ong, senior analyst for managed security services at Omdia. “But the degree to which AI is integrated into Forg365 and enables users is what makes it concerning.”

Forg365’s significance lies in the industrialization and productization of the operator workflow, according to Devashri Datta, a cybersecurity researcher. “It integrates AI-assisted lure creation, evasion, and post-compromise mailbox operations into a subscription service distributed through Telegram,” Datta said.

How Forg365 works

ZeroBEC said the campaign it investigated began with an email built around a business-document and remittance-approval pretext. The message relied on legitimate cloud and email services before sending the recipient through several redirects.

Forg365 classified visitors before deciding whether to display a device-code phishing page, an adversary-in-the-middle flow, or a harmless decoy.

In the device-code attack, the victim is directed to a legitimate Microsoft authentication process and persuaded to enter a code that authorizes a session controlled by the attacker. The involvement of genuine Microsoft infrastructure can make the request appear credible.

The platform can also relay authentication through an adversary-in-the-middle attack and capture session information. ZeroBEC said suspicious visitors were diverted to a benign page, helping the operators conceal the phishing flow from researchers and automated security tools.

Complicating incident response

A browser extension called ForgCookie allows attackers to generate and refresh Microsoft single sign-on cookies from their own browsers, ZeroBEC said.

Forg365 also advertises tools for keeping sessions active and monitoring a compromised inbox. Read-only access to the mailbox can then be shared through a password-protected link.

As a result, resetting a password may not remove the attacker. Stolen refresh-token material or an attacker-controlled session could remain usable after the password is changed. Any devices registered during the compromise must also be investigated.

“CISOs should treat two controls as co-equal priorities rather than sequential ones,” Datta said, referring to tightly restricting device-code authentication and deploying phishing-resistant MFA such as FIDO2 or WebAuthn passkeys.

Organizations that do not require device-code authentication should consider blocking it in Microsoft Entra ID, said Keith Prabhu, founder and CEO of Confidis. This can disrupt the device-code component of a Forg365 campaign, although it would not stop attacks that rely on adversary-in-the-middle techniques or stolen session cookies.

Companies that still depend on device-code authentication should identify legitimate uses before imposing a broader restriction. Exceptions may be needed for some command-line tools, conference-room systems or other devices with limited input capabilities.

Deploying phishing-resistant authentication may also require hardware security keys or managed smartphones and could increase support requests during the transition, Datta said.

After detecting a compromise, response teams should revoke active refresh tokens and terminate existing sessions. Prabhu also recommended reviewing and revoking unauthorized OAuth permissions. Because ForgCookie runs in the attacker’s browser, defenders should look for repeated silent sign-ins and non-interactive Microsoft Graph activity from unfamiliar addresses, according to ZeroBEC.

Mailbox forwarding rules and delegated access should be reviewed for unauthorized changes, Prabhu said. Such changes could allow attackers to monitor communications or retain access after a password reset.

“IR teams should audit newly registered devices and remove any that cannot be attributed to the user,” Datta said. Teams should also check whether an attacker enrolled an unauthorized authenticator application or passkey during the compromise, she added.

ZeroBEC found that some devices registered during its investigation had names beginning with “Forg365,” giving defenders a possible indicator of compromise.

The article originally appeared on CSO.

Nearly five decades after the launch of VisiCalc, AI is reshaping one of the world’s most familiar productivity tools — the humble spreadsheet.

While a lot of knowledge workers interact with spreadsheets on a regular basis, many lack the skills and confidence to access more advanced functions.

“For a very long time, spreadsheets forced you to learn spreadsheet syntax and spreadsheet ways of working,” said Eric Birnbaum, director of product management for Google Sheets. “But think about how many people need to use spreadsheets at work and don’t have the skill set to create the kinds of spreadsheets that can be really helpful for them.”

The addition of artificial intelligence can help handle that issue, he said, making the software more accessible to a wide range of office workers. “AI is unlocking the power of spreadsheets, taking on a lot of the difficult work that’s required to use them. That can be incredibly empowering for users,” said Birnbaum.

Google has steadily expanded generative AI (genAI) capabilities in Sheets since launching Duet AI — now Gemini — for Workspace in 2023.

Gemini in Sheets is available at no extra cost to Google Workspace subscribers, though a paid AI Expanded Access add-on – costing $30 per user each month – is required to remove certain usage limits.

Features that have rolled out in recent months include the ability for a Gemini agent in Sheets to carry out multi-step actions such as formatting, analysis and data entry, and, more recently, the ability to create entire spreadsheets from a single prompt. A Fill with Gemini feature builds on the existing AI function, enabling users to automatically populate selected cells by detecting intent from information within a spreadsheet as well as from the web.

Another feature, Sheets Canvas (currently available in alpha), lets users generate interactive apps that update in real-time based on changes to spreadsheet data. This could be a kanban board for a sales pipeline, for instance, or an analytics dashboard that uses Sheets as its back-end data source. 

Google claims users already see a range of benefits from Gemini in Sheets. According to an August 2025 survey of 200 Sheets users conducted by the company, the majority of knowledge workers (89%) said AI features in Sheets save them at least an hour a week, and 88% believe AI features have made them more confident in their data analysis skills. 

The most popular AI use cases include creating spreadsheets and charts, analyzing data, and fixing broken formulas. How widely these features are actually used is unclear; Google declined to provide weekly usage statistics for Gemini in Sheets.

As the company embeds Gemini deeper into Sheets, questions remain about just how much businesses can trust AI tools to handle important business data, as well as what increased automation means for those who spend much of their day wrangling data. 

Computerworld recently talked with Birnbaum about the potential benefits and challenges of the latest evolution of spreadsheet software. This interview has been condensed and edited for clarity.

As businesses become more focused on seeing value from AI investments, what measurable benefits are customers seeing from Gemini in Sheets – for example, time saved or other forms of return on investment? “Spreadsheets remain one of the universal languages for businesses, and we don’t anticipate that’s going to change anytime soon. But by bringing AI into the product where people work, we think it can significantly reduce the technical tax of data: the time spent understanding it, sourcing it, analyzing it, visualizing it.

“Historically, data professionals spent — let’s estimate it at 80% of their time — on the mechanical groundwork, data cleaning, crafting formulas, formatting, troubleshooting, and maybe only 20% of their time on actual strategic decision-making.

“We think that by offloading the manual, time-consuming, error-prone data work to Gemini, we can flip that ratio a bit, so humans can focus on the things that really matter: the high-value questions to ask and the judgment calls and decisions that get made from them. We’re starting to see evidence of that in our own user base and customer base.

“The second point to make is that AI can democratize data analysis to some extent, and make it available to many more users. For so many years, the spreadsheet was a gatekeeper; if you couldn’t speak the rigid language of spreadsheet formulas, you couldn’t extract the value from data. But by introducing these natural language interfaces, AI is separating the analytical capability from the technical literacy. 

“If you can ask the right questions, or describe what you want in plain language, Gemini and Sheets can help you achieve your goals in a spreadsheet, even if you have minimal spreadsheet skills yourself.

“What we’ve seen so far from users and customers is that it’s incredibly empowering for people who might have been scared off by data analysis or dreaded opening spreadsheets in the past. You don’t need to go and wait for a data analyst to help you; you can go and do this work yourself in a spreadsheet.”

The flip side is, how confident can businesses be if more junior employees can take on higher-level analysis tasks by relying on AI? Given the propensity for AI models to hallucinate, to what degree can businesses trust that these tools won’t introduce errors into important business data? “It’s something we spent a ton of time thinking about. We’ve gone to great lengths to build these AI tools to collaborate with you, to show their work, explain what they did, and make sure that you can take over where they leave off.

“Our Sheets agent, for example, lays out a really explicit, transparent plan for you to review and approve before any data manipulation happens. It’s designed to do that in plain natural language in a way that the average user could understand, and then it gives you back that final summary, so you know exactly what it did and where it did it.

“The other thing is that the model is great at explaining things. If you inherit a spreadsheet that has some complex formula that you don’t understand, for example, the model does an amazing job of explaining how it works and what it’s doing.

“In many ways AI is not only making these features more accessible, but helping users feel more confident in the output. Human error is an inherent risk in manual data management, with or without AI. One misplaced comma or broken cell reference can completely corrupt an entire financial model, and it can be completely undetected. 

“Our approach with AI in Sheets is to create this deliberate verification loop. You now have another spreadsheet expert working along with you, reducing the likelihood of these mistakes.”

Even if humans produce errors too, does it ultimately come down to accountability when AI is involved? “Our point of view here is that AI should be partnering with the knowledge worker who’s doing the work here. And everything that we’ve built is designed to be that partner. You might be able to offload tasks to the model, but we’re citing sources, we’re providing plans and explanations. We’re ultimately relying on the user to do that final verification.

“We spend a humongous amount of time focused on quality. We know that for AI to be useful in spreadsheets, it has to be reliable. When we launched Sheets Gemini Agent, for example, we were really proud that we set a state-of-the-art benchmark on the full SpreadsheetBench data set, which at the time exceeded competitors and near-human expert ability. 

“But we know quality is never ‘good enough’ or done. We’re constantly working to improve quality for our users and customers, and for the use cases where they’re relying on AI most.”

What potential do you see for more agentic functionality in Gemini Sheets — for example, bringing in data from other sources, creating recurring reports, or taking more actions independently? “We’re listening closely to customers and users and building what they’re telling us they need. The agent is already capable of doing very complex multistep workflows, and we see users discover that the agent is extremely capable of doing end-to-end spreadsheet tasks. In terms of connectors, in an alpha we have connections available to HubSpot, Salesforce, and Mailchimp. We hope to expand that over time.

“There’s no path to have AI replacing analysts. I think AI is giving analysts more time back to actually do the more valuable parts of their job. Analysts that I work with are way more productive and impactful than they ever were before, because they can push that uninteresting spreadsheet grunt work off to the model, freeing up time for more interesting and impactful work.

“A great example: the visualizations I’m getting back from analysts nowadays are canvases instead of static charts that I can explore myself. It’s way more informative and useful than what I was accustomed to before.”

Looking ahead, do you expect a larger share of spreadsheet work to be carried out by agents, with humans setting goals and reviewing results? What will be the biggest change in how people use spreadsheets with AI? “The tasks are likely to stay similar and the use cases for spreadsheets are likely to continue to be relevant. The biggest change will be the ability to push the uninteresting spreadsheet grunt work off to a model and free up time for the user to do things that are more impactful, more interesting, more meaningful to the business.

‘Spreadsheets have historically been these like static containers where data goes to rest. I think AI can turn spreadsheets into these dynamic, localized software applications. And I do actually think this sort of changes the game for how people might use spreadsheets moving forward. 

“It’s not just a passive grid full of numbers; spreadsheets are evolving to become these live, long-lived, collaborative applications. Employees can build these on the fly, like a basic CRM or supply chain dashboard in seconds. This is an area of investment for us moving forward, and we’re really excited to see how this evolves.”

AI assistants and agents, such as ChatGPT or Claude, might be able to analyze spreadsheet files and business data without users working inside a spreadsheet application. What do you think will keep Sheets central to the workflow, rather than simply making it one part of a wider AI-driven process?“We’re in constant touch with customers and users; it’s clear work is still happening in spreadsheets. I think spreadsheets remain incredibly popular tools. If we can bring the AI capabilities users need directly into the product where they already are, we’ll transform the way they work.  

“I think we can be the front-end for some of this great AI innovation and the products that users are accustomed to today. Everything we build is guided by user feedback: users are telling us right now they want AI to help them do their everyday or more complex tasks, and they’re starting in Sheets today.”

Few things are as delightfully divisive as Android’s dark mode.

Some phones now ship with Android’s darker-style interface activated by default. Most reasonably recent devices offer it as a swift ‘n’ simple toggle. And most people, in my experience, have amusingly strong preferences about which approach they prefer — the standard Android “light” mode, in which screens tend to be bright and with shades of white as a foundation, and the dark mode (a.k.a. “dark theme”), where black and dark gray dominate and everything is much more muted and muddy.

It really is a night and day difference, so to speak — but no matter where you fall on the light vs. dark preference spectrum, it’s well worth your while to noddle over two pertinent points:

1. Android’s dark mode doesn’t have to be an all-or-nothing decision. With the right setup, you can use it as a dynamically activated sometimes switch that enables itself automatically based on different variables and gives you a darker, less glary motif when conditions call for it while leaving you with the lighter, brighter look the rest of the time.
2. Regardless of how often you’re using dark mode, a few easy adjustments will make it meaningfully more complete and effective as an end-to-end interface style for whatever you’re doing on your device.

It occurred to me recently that we’ve gone over several smart Android dark mode enhancements over the past weeks and months — and that, put together into a single power-pack bundle, these small-seeming items can add up to create a pretty dramatic difference in your Android-using experience, whether you’re a full-fledged dark mode convert or a more light-preferring vampire skeptic.

Here, specifically, are five easy ways to make Android’s dark mode meaningfully better for you.

[Keep the nerdy knowledge coming with my free Android Intelligence newsletter — something new and useful in your inbox every Friday!]

Android dark mode power-up #1: The app expansion

Up first is a feature that arose as part of our Android 17 discussion and sparked the entire idea for this collection — and that’s the one-tap switch in the latest Android version that forces every app on your phone to follow your dark mode preference, whether the program technically supports such a setting or not.

In Android 17, finding and flipping that switch will make every app turn dark whenever the system-wide dark mode is active. It eliminates the irksome exceptions that’ve traditionally stayed stubbornly light (due to developer laziness) even when your dark theme is on.

If you’ve got Android 17 on your phone already, it couldn’t be much easier to make it happen. Just look in the Display section of your system settings, tap the words “Dark theme,” then change the setting that shows up next from “Standard” to “Expanded.”

No Android 17? No problem: On devices with reasonably recent pre-Android-17 system software, you can actually find a switch buried deep in some developer settings that’ll let you enable the exact same option without any waiting.

Follow these instructions and enjoy your new universally consistent darkened dynamic.

Android dark mode power-up #2: A darkened web

That first trick fixes the issue of certain apps not following your dark mode preference — but what about the web? Most of us spend a fair amount of time in our browsers these days, and most websites won’t follow a dark mode setting and adjust their interfaces accordingly.

They absotively can, though. With the flip of a single switch buried within your browser’s bowels, you can force every website into a darkened motif whenever your system-level dark mode is up and running.

See?

Here’s the secret:

• Open up Chrome on whatever Android device you’re using. (And note that this will also work with any Chromium-based Chrome alternative, like Brave, Edge, or Vivaldi.)
• Type chrome:flags into the address bar.
• Type darken into the search box at the top of the screen that comes up next.
• See the line labeled “Darken websites checkbox in themes setting”? Tap the “Default” box beneath it, and change its setting to “Enabled.”
• Tap the blue “Relaunch” button at the bottom of the screen.

Now, when Chrome comes back a second or so later…

• Tap the three-dot menu icon in its upper-right corner.
• Tap “Settings” in the next menu.
• Scroll down until you see “Appearance.” Tap it, then tap “Theme.”
• Make sure the newly added box for “Apply dark theme to sites, when possible” — which we just magically made appear via our last little modification — is checked and active.

And that’s it: From that moment onward, whenever your Android device is switched into its dark mode, any website you’re viewing within Chrome will automatically follow suit. Nothing more to it, and no further thought or action ever required on your part.

Not bad, eh?!

Android dark mode power-up #3: A dark mode schedule

Even as someone who isn’t into dark mode as a 24/7 sort of thing, I can definitely appreciate the presence of a dimmer, less glary look on my device in certain specific scenarios.

It’s incredibly easy to overlook or forget, but Google’s actually got a way to handle that for you. In fact, it’s been built into Android itself since 2020’s Android 11 release.

Just look in the Display section of your system settings and tap the line for either “Dark theme” or “Dark mode settings.” If you see a toggle alongside that line, make sure you’re tapping the actual words next to it — not the toggle itself.

Then look for the option to create a schedule.

You can create a time-based rule for when your device’s dark mode turns on and back off again, or — more intelligent yet — you can set it to automatically activate at sunset, wherever you are at any given moment, and then turn itself back off and switch you back over to light mode at sunrise.

You can also integrate dark mode into Android’s rarely noticed Bedtime Mode so that the screen getting dimmer is part of your pre-sleep winddown routine, if you really wanna get wild.

Or — ahem…

Android dark mode power-up #4: Contextual dark mode

A dark mode schedule is pretty forkin’ sensible. But the reality is that even with a time-based setup or a sunset-driven activation approach, you’ll still be using your phone in bright rooms with dark mode active and vice-versa.

And if you want Android’s dark theme present only when you’re actually in a dark room — as makes the most sense in my mind — there’s an even more intelligent option.

It comes our way via a handy little free app called Adaptive Theme. That app does one thing and only thing only: It automatically adjusts your device’s dark mode setting based on the actual ambient light around you, using your phone’s sensors rather than an arbitrary time or a not-always-relevant sunset status as a guide. It makes so much sense, you’ll find yourself wondering why your phone didn’t just work that way from the get-go.

The app does unavoidably have a slightly complex one-time setup, which I outline step-by-step here. It’s perfectly safe to do, though, and it shouldn’t take you more than a couple minutes to pull off.

And once you’ve done that, your Android dark mode will just work for you — flipping on when the lighting around you is dim (to your exact specifications) and flipping back off when you’re in brighter surroundings.

Yes, please — and thank you. Last but not least…

Android dark mode power-up #5: The wallpaper wizard

Superficial as it may seem, the one piece of the puzzle we haven’t yet addressed — that isn’t ordinarily affected by Android’s dark mode setting — is your home screen wallpaper.

By default, whatever wallpaper you set at the system level stays the same even as your interface moves between its dark and light states — and when you’re anglin’ for a dimmer, less glary look in dark environments, that can be pretty darn jarring.

An app called, rather aptly, Dark/Light Wallpaper Scheduler is the answer you never knew you needed. It’s pretty self-explanatory — you tell it which wallpaper you want when your phone is in dark mode and light mode, then it automatically switches ’em out for you based on that status — but I wrote about it in detail here, if you’re interested in reading more about how exactly it works and how you can make the most of it.

And with that, my fellow Android-appreciating animal, your dark mode power-pack is complete. Now, would someone please turn off the lights? I don’t know about you, but all this talk of darkness has me hankering for a nap.

Wake up to even more useful Android wisdom every Friday with my free Android Intelligence newsletter — one practical new trick to try each week, straight from me to ye.

Forty million UK iCloud users could be owed up to $100 (£77) each after a $3.9 billion (£3 billion) class action lawsuit against Apple was cleared for trial — and the company’s problems may be just getting started. 

For Apple, the worry is that this case could snowball to become yet another existential regulatory problem. The action was brought by consumer group Which?, which accused Apple of breaching UK competition law by giving its iCloud storage service preferential treatment and “trapping” customers with Apple devices into using iCloud. 

Trapping happy customers

Apple achieves this by encouraging its customers to sign up to iCloud for storage of photos, videos and other data while also making it difficult for them to use alternative providers to backup key data. The company also squeezes extra dollars out of customers by providing a stingy 5GB of storage for free, while putting important data including messages and photos inside that allocation. Even Google provides 15GB of storage in its free tier.

The problem is that the scale of Apple makes it difficult for competitors to reach customers with alternative solutions, while Apple’s control over the operating system gives it integration advantages third-party competitors don’t get. 

While there may well be justifications for constraining access to some personal data, those privacy and security challenges don’t apply to all of it. 

You are the product

When it originally filed the claim, Which? explained that Apple could resolve the claim without litigation by offering consumers their money back and opening up iOS to allow users a real choice for cloud services. This is unlikely to happen.

This case has been slowly making its way through the Competition Appeal Tribunal, which last week finally gave permission for the case to go to trial.

Apple won’t be looking at a hefty fine just yet. The first available trial date is in October 2028 and the legal fight is expected to last nine weeks, which might, or might not, equate to a Christmas surprise for Apple’s then CEO. There’s no time to sit back, however, as the company must still file its defense papers with the court by the end of next month, July 31.

The snowball factor

The UK is not alone. Italy has launched its own antitrust probe into Apple’s iCloud dominance under the EU’s Digital Markets Act (DMA). The problem with that litigation is that since Italy has commenced the probe, other nations across the bloc might also act.

Italy is looking to see whether Apple has failed to open up its iOS and iPadOS ecosystems to rival cloud services, arguing that third-party providers are unable to access the same system components as iCloud. The DMA insists competitors should enjoy the same degree of access as iCloud because Apple is seen as a gatekeeper, which means it is required to meet a higher set of standards.

Apple, of course, will inevitably — and rightly — argue that customer privacy needs to be protected, and that open, free, access to some of the data its trusted iCloud service can use is not in the consumer interest. 

The company has already proposed one way in which it can provide third-party services with access to confidential data with a trusted intermediary system that anonymizes that information in use. 

Why we need a Trusted System Agent model

That’s precisely what it offered Europe when it proposed a solution called Trusted System Agent — an intermediary that would allow virtual assistants to safely access the same features and capabilities as Siri AI for devices in the EU. Unfortunately, EU regulators didn’t accept Apple’s justification concerning the need to protect customer privacy, which is why Apple Intelligence won’t be available in Europe for a while, if at all.

In the event Apple’s iCloud service falls short of the Italian probe and therefore the DMA, the danger is that if EU regulators take the same evangelically hard-line stance with iCloud services as they have done so far with AI, customers might find themselves losing access to the service. 

First blood

That’s in Europe, of course. But the UK case is likely to get to court long before litigation processes in Europe get going, making the UK action an important test case in which yet another important component of Apple’s offering to consumers is up for trial.

Please join me on social media at BlueSky,  LinkedIn, or Mastodon, even better, please subscribe to The Core for your daily fix of human-curated Apple News.

Microsoft 365 (and Office 365) subscribers get more frequent software updates than those who have purchased Office without a subscription, which means subscribers have access to the latest features, security patches, and bug fixes. But it can be hard to keep track of the changes in each update and know when they’re available. We’re doing this for you, so you don’t have to.

Following are summaries of the updates to Microsoft 365/Office 365 for Windows over the past year, with the latest releases shown first. We’ll add info about new updates as they’re rolled out.

Note: This story covers updates released to the Current Channel for Microsoft 365/Office 365 subscriptions. If you’re a member of Microsoft’s Office Insider preview program or want to get a sneak peek at upcoming features, see the Microsoft 365 Insider blog.

Version 2605 (Build 20026.20182)

Release date: June 16, 2026

This build includes, in the words of Microsoft, “various fixes to functionality and performance.”

Get more info about Version 2605 (Build 20026.20182).

Version 2605 (Build 20026.20168)

Release date: June 9, 2026

This build offers “various fixes to functionality and performance,” according to Microsoft.

Get more info about Version 2605 (Build 20026.20168).

Version 2605 (Build 20026.20140)

Release date: June 3, 2026

This build fixes a single bug, in which images didn’t display when using top and bottom text wrapping in classic Outlook.

Get more info about Version 2605 (Build 20026.20140).

Version 2605 (Build 20026.20112)

Release date: May 26, 2026

This build offers “various fixes to functionality and performance,” according to Microsoft.

Get more info about Version 2605 (Build 20026.20112).

Version 2605 (Build 20026.20076)

Release date: May 20, 2026

This build fixes several bugs, including one in which Excel or PowerPoint closed unexpectedly in rare cases while the user was actively co-authoring, particularly when opening a document for the first time.

Get more info about Version 2605 (Build 20026.20076).

Version 2604 (Build 19929.20172)

Release date: May 14, 2026

This build fixes a bug in Outlook in which sending mail failed when multiple Exchange accounts were configured.

Get more info about Version 2604 (Build 19929.20172).

Version 2604 (Build 19929.20164)

Release date: May 12, 2026

The build plugs a number of security holes. For details, see Release notes for Microsoft Office security updates.

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about Version 2604 (Build 19929.20164).

Version 2604 (Build 19929.20136)

Release date: May 5, 2026

This build fixes a bug in which Outlook closed unexpectedly after replying to a mail item with labels.

Get more info about  Version 2604 (Build 19929.20136).

Version 2604 (Build 19929.20106)

Release date: April 29, 2026

This build includes “various fixes to functionality and performance,” according to Microsoft.

Get more info about Version 2604 (Build 19929.20106).

Version 2604 (Build 19929.20090)

Release date: April 21, 2026

This build includes “various fixes to functionality and performance,” according to Microsoft.

Get more info about Version 2604 (Build 19929.20090).

Version 2603 (Build 19822.20182)

Release date: April 14, 2026

In this build, Copilot can now edit your PowerPoint documents. Copilot can start a new presentation or build on an existing one, generate slides, update content, improve layouts, and polish design, while preserving formatting, structure, and branding. 

The build also plugs a number of security holes. For details, see Release notes for Microsoft Office security updates.

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about Version 2603 (Build 19822.20182).

Version 2603 (Build 19822.20168)

Release date: April 9, 2026

This build fixes several bugs, including one in Outlook in which users could not close the Copilot chat pane using a keyboard. Users can now close the pane by navigating to the Close button using a keyboard or by using the assigned keyboard shortcut.

Get more info about Version 2603 (Build 19822.20168).

Version 2603 (Build 19822.20142)

Release date: March 31, 2026

This build includes “various fixes to functionality and performance,” according to Microsoft.

Get more info about Version 2603 (Build 19822.20142).

Version 2603 (Build 19822.20114)

Release date: March 24, 2026

This build fixes a single bug in which PowerPoint sometimes closed unexpectedly when opening a newly created empty file from the OneDrive folder.

Get more info about Version 2603 (Build 19822.20114).

Version 2602 (Build 19725.20190)

Release date: March 18, 2026

This build fixes an Outlook bug in which updating a single instance of a recurring meeting in a Microsoft 365 group calendar updated the entire series.

Get more info about Version 2602 (Build 19725.20190).

Version 2602 (Build 19725.20172)

Release date: March 10, 2026

This build introduces agent mode in Word, which adds a conversational chat experience that helps create, edit, and refine document content as you work. In addition, the build fixes a bug that impacted the rendering of extended characters in calendar items, causing certain characters to appear as question marks.

The build also plugs a number of security holes. For details, see Release notes for Microsoft Office security updates.

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about Version 2602 (Build 19725.20172).

Version 2602 (Build 19725.20152)

Release date: March 3, 2026

This build fixes a bug in which closing a document sometimes remained in progress indefinitely after the Office app resumed from sleep or hibernation.

Get more info about Version 2602 (Build 19725.20152).

Version 2602 (Build 19725.20126)

Release date: February 24, 2025

This build fixes several bugs, including one that caused OneNote to close unexpectedly upon startup.

Get more info about Version 2602 (Build 19725.20126).

Version 2601 (Build 19628.20214)

Release date: February 17, 2025

This build includes, in Microsoft’s words, “various fixes to functionality and performance.”

Get more info about Version 2601 (Build 19628.20214).

Version 2601 (Build 19628.20204)

Release date: February 10, 2026

This build fixes a bug that sometimes prevented users from opening emails with the Encrypt Only label in Outlook.

It also plugs a number of security holes. For details, see Release notes for Microsoft Office security updates.

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about Version 2601 (Build 19628.20204).

Version 2601 (Build 19628.20166)

Release date: February 3, 2026

This build includes, in Microsoft’s words, “various fixes to functionality and performance.”

Get more info about Version 2601 (Build 19628.20166).

Version 2601 (Build 19628.20150)

Release date: January 27, 2026

In this build, OneNote applies your chosen proofing language more consistently, so you don’t have to reset it for every paragraph when writing in multiple languages. In addition, the build fixes several bugs, including one that caused Office applications to become unresponsive when profile card-related activities were performed.

Get more info about Version 2601 (Build 19628.20150).

Version 2512 (Build 19530.20184)

Release date: January 21, 2026

This build includes, in Microsoft’s words, “Various fixes to functionality and performance.”

Get more info about Version 2512 (Build 19530.20184).

Version 2512 (Build 19530.20144)

Release date: January 13, 2026

This build fixes a number of bugs, including one that caused Excel, PowerPoint, and Word to become unresponsive when profile card-related activities were performed.

It also plugs a number of security holes. For details, see Release notes for Microsoft Office security updates.

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about Version 2512 (Build 19530.20144).

Version 2512 (Build 19530.20138)

Release date: January 8, 2026

This build offers, in Microsoft’s words, “Various fixes to functionality and performance.”

Get more info about Version 2512 (Build 19530.20138).

Version 2511 (Build 19426.20218)

Release date: December 16, 2025

This build offers, in Microsoft’s words, “Various fixes to functionality and performance.”

Get more info about Version 2511 (Build 19426.20218).

Version 2511 (Build 19426.20186)

Release date: December 9, 2025

This Patch Tuesday build offers, in Microsoft’s words, “Various fixes to functionality and performance.” The build also has a variety of security updates (see details).

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about Version 2511 (Build 19426.20186).

Version 2511 (Build 19426.20170)

Release date: December 3, 2025

This build includes, in Microsoft’s words, “Various fixes to functionality and performance.”

Get more info about Version 2511 (Build 19426.20170).

Version 2510 (Build 19328.20244)

Release date: November 20, 2025

This build fixes a bug in Outlook that caused users to see “Contacting the server for information” repeatedly when loading some emails.

Get more info about Version 2510 (Build 19328.20244).

Version 2510 (Build 19328.20232)

Release date: November 18, 2025

This build includes, in the words of Microsoft, “various fixes to functionality and performance.”

Get more info about Version 2510 (Build 19328.20232).

Version 2510 (Build 19328.20190)

Release date: November 11, 2025

This Patch Tuesday build fixes a bug in Outlook that caused some recipients to be unable to access OneDrive links shared with them via email. The build also has a variety of security updates (see details).

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about Version 2510 (Build 19328.20190).

Version 2510 (Build 19328.20178)

Release date: November 4, 2025

This build fixes a single bug, in which @mention searches produced no results in Office apps.

Get more info about Version 2510 (Build 19328.20178).

Version 2510 (Build 19328.20158)

Release date: October 30, 2025

This build introduces a new Get Data dialog in Windows that simplifies finding and using external data, and adds Analyze Data to the Data tab.

The build also fixed an bug in Outlook that prevented users from downloading web add-ins in some virtualized environments.

Get more info about Version 2510 (Build 19328.20158).

Version 2509 (Build 19231.20216)

Release date: October 21, 2025

This build has, in Microsoft’s words, “various fixes to functionality and performance.”

Get more info about Version 2509 (Build 19231.20216).

Version 2509 (Build 19231.20194)

Release date: October 14, 2025

This build has a variety of security updates (see details), along with various fixes to functionality and performance.

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about Version 2509 (Build 19231.20194).

Version 2509 (Build 19231.20172)

Release date: October 7, 2025

This build has, in Microsoft’s words, “various fixes to functionality and performance.”

Get more info about Version 2509 (Build 19231.20172).

Version 2509 (Build 19231.20156)

Release date: October 1, 2025

This build fixes two bugs, one in Excel in which ribbon controls were not rendered when rejoining Office sessions in a virtual machine, Azure Virtual Desktop, or remote desktop environment, and another that caused Outlook to terminate unexpectedly when starting.

Get more info about Version 2509 (Build 19231.20156).

Version 2508 (Build 19127.20264)

Release date: September 23, 2025

This build has, in Microsoft’s words, “various fixes to functionality and performance.”

Get more info about Version 2508 (Build 19127.20264).

Version 2508 (Build 19127.20240)

Release date: September 16, 2025

This build has, in Microsoft’s words, “various fixes to functionality and performance.”

Get more info about Version 2508 (Build 19127.20240).

Version 2508 (Build 19127.20222)

Release date: September 9, 2025

This build has multiple security updates (see details), along with various fixes to functionality and performance.

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about Version 2508 (Build 19127.20222).

Version 2508 (Build 19127.20192)

Release date: September 3, 2025

This build fixes a bug in which some Outlook add-ins were getting “Office.auth.getAccessToken is not a function” errors.

Get more info about Version 2508 (Build 19127.20192).

Version 2508 (Build 19127.20154)

Release date: August 26, 2025

This build fixes a bug that caused Outlook to terminate unexpectedly when sending a meeting invite with an encryption label. It also adds support for pixelated rendering of embedded images in SVG assets for the entire Office suite.

Get more info about Version 2508 (Build 19127.20154).

Version 2507 (Build 19029.20208)

Release date: August 19, 2025

This build fixes a variety of bugs.

Get more info about Version 2507 (Build 19029.20208).

Version 2507 (Build 19029.20184)

Release date: August 12, 2025

This build fixes a bug which required users to restart Outlook to open a .msg file after initially accessing it once. The build also includes a variety of security updates (see details).

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about Version 2507 (Build 19029.20184).

Version 2507 (Build 19029.20156)

Release date: August 5, 2025

This build fixes a single bug, in which users had to restart Outlook to open a .msg file after initially accessing it once.

Get more info about Version 2507 (Build 19029.20156).

Version 2507 (Build 19029.20136)

Release date: July 30, 2025

This build fixes a wide variety of bugs, including in which Outlook closed unexpectedly shortly after launch, and another in Word in which the word count sometimes displayed incorrectly.

Get more info about Version 2507 (Build 19029.20136).

Version 2506 (Build 18925.20184)

Release date: July 22, 2025

This build fixes two bugs, one that caused the Copilot Command Center to continue to be visible after disabling the Copilot user interface, and another in which when creating handouts in PowerPoint, certain characters (full-width numbers) couldn’t be properly transferred to the handout.

Get more info about Version 2506 (Build 18925.20184).

Version 2506 (Build 18925.20168)

Release date: July 15, 2025

This build fixes two bugs, one that caused Visio 32-bit to close unexpectedly when using the Drawing control, particularly in setups involving COM components or .NET integrations, and another in Word in which copying and pasting content between documents sometimes changed the applied style unexpectedly.

Get more info about Version 2506 (Build 18925.20168).

Version 2506 (Build 18925.20158)

Release date: July 8, 2025

This Patch Tuesday build fixes several bugs in Outlook, PowerPoint, Word, and the whole Office suite, including one that caused the Copilot icon to unexpectedly display in Outlook when Copilot had been disabled by the admin in government cloud.

The release also includes a variety of security updates (see details).

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about Version 2506 (Build 18925.20158).

Version 2506 (Build 18827.20176)

Release date: July 1, 2025

This build fixes a wide variety of bugs, including one in Word in which print preview sometimes stopped working when printing long emails.

Get more info about Version 2506 (Build 18827.20176).

Version 2505 (Build 18827.20176)

Release date: June 26, 2025

This build introduces several new features, including one in Excel in which the PivotTables dialog box interface has been replaced by a redesigned panel, making it easier to view all of your options and simpler to change your data selection before inserting a recommended PivotTable.

Get more info about Version 2505 (Build 18827.20176).

Version 2505 (Build 18827.20164)

Release date: June 17, 2025

This build fixes a bug that caused the “Try the new Outlook” toggle to be enabled when working in Classic Outlook side by side with the new Outlook.

Get more info about Version 2505 (Build 18827.20164).

Version 2505 (Build 18827.20150)

Release date: June 10, 2025

This build fixes several bugs, including one for the entire Office suite in which a Save As attempt on an existing file didn’t complete successfully, and subsequent attempts continued to encounter issues when trying to save to a file that no longer existed.

This Patch Tuesday release also includes a variety of security updates: see details.

What IT needs to know: Because this is a security update, it should be applied relatively soon. Over the next few weeks, check for reports about problematic issues, and if all seems well, apply the update.

Get more info about  Version 2505 (Build 18827.20150).

Version 2505 (Build 18827.20140)

Release date: June 3, 2025

This build offers a variety of bug and performance fixes.

Read about Version 2505 (Build 18827.20140).

Microsoft Office users may find that some of their applications are failing to open when called on by third-party applications. It’s an issue that has emerged after the latest round of Microsoft updates.

The problem affects Word, Excel, and other Office applications opened from third-party offerings including CCH Engagement, Workpaper Manager, Zotero, or dental office software such as Dentrix or Softdent.

The update issued on June 9 appears to have triggered problems with the OLE automation that these third-party applications use to interact with Office. Users have reported that files are failing to open, with no error message indicating what has gone wrong,

According to one Windows user forum, the issue is particularly frustrating because of this lack of error message. As one user put it, “‘Word won’t open from our workpaper system’ is functionally the same as ‘Word is broken.’ To an administrator, the difference determines whether the next hour is spent repairing Office, rolling back Windows, calling a line-of-business vendor, or opening a Microsoft support case.”

Microsoft has said that it is aware of the issue and is working towards a resolution.

Deleting mystery file

The company is also looking to fix a minor issue that has emerged from this latest round of updates: Users are finding that when items are deleted, the confirmation dialog box displays the internal Recycle Bin file name (for example, $Rxxxxx.ext) instead of the original file name. However, Microsoft stressed that in the Recycle Bin, the item still appears with its original name.

One of the most commonly used Microsoft programs, Excel is highly useful for data collecting, processing, and analysis. To fully harness Excel’s powers, though, you need to make use of formulas.

Excel formulas allow you to perform calculations, analyze data, and return results quickly and accurately. The usefulness of formulas is even greater once you start dealing with large data sets. With the correct formula, Excel can process vast amounts of information in a matter of seconds.

In this article we’ll look at five useful types of formulas and functions that will get you started performing data analysis in Excel. Along the way, you’ll learn several different ways to enter formulas and functions in Excel.

We’ll demonstrate using Excel for Windows under a Microsoft 365 subscription. If you’re using a different version of Excel, you might not have exactly the same interface and options, but the formulas and functions work the same.

If you have the right kind of M365 subscription, you can have Microsoft’s generative AI assistant, Copilot, create formulas for you. This requires an M365 Personal, Family, or Premium plan for individuals or an M365 business or enterprise plan with a paid Copilot add-on subscription — which means not everybody has access to Copilot in Excel. Even if you do, it’s helpful to know what formulas can do and how to work with them so you can write better prompts for Copilot. We’ll cover using Copilot to create Excel formulas later in this story, but first we’ll give you a solid understanding of how to work with formulas and functions.

In this article:

• What is a formula in Excel?
• What is a function in Excel?
• Basic mathematical formulas and functions
• The IF function
• The SUMIF and COUNTIF functions
• The CONCAT function
• The VLOOKUP function
• Using Copilot to create Excel formulas

What is a formula in Excel?

A formula is an expression that operates on values in a range of cells in Excel. Using formulas, you can perform calculations and data analysis on the contents of the cells. Formulas can be as simple as adding a column of numbers together or as complex as returning the kurtosis of a data set. They can be incredibly useful when you want to turn spreadsheet data into meaningful information for driving business decisions.

What is a function in Excel?

A function is a built-in formula in Excel — basically, a shortcut for performing a calculation or other operation on cell data. There are around 500 Excel functions, and the list continues to grow every year. Fortunately, most of the actions that a typical business user would want to perform can be done with just a handful of functions.

1. Basic mathematical formulas and functions

We’re going to group these formulas together since they are very simple and have similar syntax. All formulas in Excel start with the equal sign (=) and build from there.

Adding, subtracting, multiplying, and dividing

To add the numbers in two cells together, first click the on the target cell where you want the total to appear. Then type = in the cell to start the formula.

Next, click on the cell that contains the first number you want to add, and its cell reference (such as A2) will appear next to the equal sign in the formula.

Type + next to the first cell reference. Then click the cell that contains the second number you want to add, and its cell reference (such as A3) will appear next to the + sign. The full syntax for the formula to add the values in cells A2 and A3 is:

=A2+A3

Note that in addition to appearing in the target cell, the formula also appears in the formula bar directly above the worksheet. Once you’ve inserted the initial = sign in the target cell, you can type your formula in the formula bar. It’s sometimes easier to see the whole formula and work with it in the formula bar than down in the worksheet page.

If you wanted to add additional numbers to your total, you’d type another + sign, select another cell, and so on. Once your formula is complete, press Enter, and the result appears in the target cell.

Subtraction, multiplication, and division calculations work the same way. You simply change the operator — the symbol that tells Excel what math operation you want to perform — from the + sign to the – sign for subtraction, the * sign for multiplication, or the / sign for division.

Adding numbers with the SUM function

There’s a quicker way to add together a group of numbers. This is where Excel’s built-in SUM function comes in.

First click on the target cell where you want the total to appear. Then type =SUM to start the function.  A list of options will come up. Click the first option, SUM. You’ll now see =SUM( in the target cell.

Just underneath the cell with the SUM function is a tooltip showing the SUM syntax:

=SUM(number 1, [number2],…)

To add individual cells together, select a cell, type a comma, select another cell, and so on. (Alternatively, you can type a cell reference, type a comma, type another cell reference, and so on.)

If you want to add consecutive cells (such as in a row or column), select the first cell, then hold down the Shift key and select the final cell in the group. (Or you can type in the cell references for the first and last cells separated by a colon — for instance, A2:A7 selects A2, A7, and all the cells in between.)

Once all the cells you want to add together are selected, hit Enter.

Now you should see the final result, which is the sum of the numbers you highlighted. If you highlight that target cell again, you’ll see the full formula in the formula bar — in our example, it’s:

=SUM(A2:A7)

One important thing to note for all Excel formulas is that they produce relative values. This simply means that if any of the values in the selected cells changes, then the final number will change to reflect that.

If you want to make it an absolute value, a number that will not change even if the cells that were used to calculate it change, then you need to right-click the cell and select Copy from the pop-up menu. Then right-click the cell again and, under Paste Options, select the Values button (the icon of a clipboard with 123).

Now when you select that cell you’ll just see the plain number, not a formula, in the formula bar.

Tip: Excel provides a SUM shortcut in certain circumstances. If you have a series of numbers in a row or a column, Excel assumes you want to add them together. So if you place your cursor in the cell to the right of a row of numbers and click the AutoSum (Σ) button toward the right end of the Ribbon’s Home tab, Excel automatically selects the numbers in the row, then adds them together when you press Enter. Likewise, if you place your cursor in the cell below a column of numbers, click AutoSum, and hit Enter, Excel totals up the numbers in the column.

Calculating the average with the AVERAGE function

To calculate the average of a group of numbers, repeat the same steps but using the syntax =AVERAGE and highlighting the cells containing the numbers that you want to use in the calculation.

Tip: As with SUM, there’s a shortcut for using the AVERAGE function if you have a series of numbers in a row or a column. Place your cursor in the cell to the right of a row of numbers or in the cell below a column of numbers. Click the tiny down arrow at the right side of the AutoSum button, select Average from the menu that appears, and hit Enter. Excel calculates the average of the values in that row or column.

Find more details, examples, and best practices for these functions at Microsoft’s SUM function and AVERAGE function support pages.

2. The IF function

This function helps you automate the decision-making process by applying if-then logic to your data. Using this function, you can have Excel perform a calculation or display a certain value depending on the outcome of a logical test. For example, you can create a test that checks if the value of a cell is greater than or equal to the value of 18 and enter “Yes” or “No” accordingly.

While we’re learning this function, we’ll cover another way to enter functions in Excel: by using the Formulas tab on the Ribbon. Here you’ll find buttons that provide quick access to functions by category: AutoSum, Financial, Logical, Text, Date & Time, and so on. Being able to browse through functions by category can be helpful if you can’t remember the exact name of a function or aren’t sure how to spell it.

To enter the IF function, select the target cell, and on the Formulas tab, click the Logical button, then select IF from the list of functions that appears.

Alternatively, you can click the Insert Function button all the way to the left of the Formulas tab. An “Insert Function” pane appears, showing a list of commonly used functions.

Select IF from the list and click OK. (If the function you want isn’t in the “Commonly Used” list, select a different category or All to see all available functions.)

The Function Arguments pane appears, and you’ll see =IF() in the target cell.

The IF function syntax is as follows:

=IF(logical_test,”value_if_true”,”value_if_false”)

You’ll notice that the Function Arguments pane for the IF function has fields for Logical_test, Value_if_true, and Value_if_false. In our “greater than or equal to 18” example, the logical test is whether the number in the selected cell is greater than or equal to 18, the value if true is “Yes,” and the value if false is “No.” So we’d enter the following items in the pane’s fields like so:

Logical_test: B2>=18

Value_if_true: “Yes”

Value_if_false: “No”

or just type the full formula into the target cell:

=IF(B2>=18,”Yes”,”No”)

This tells Excel that if the value of cell B2 is greater than or equal to 18, it should enter “Yes” in the target cell. If the value of cell B2 is less than 18, it should enter “No.”

Tip: When using functions like this, rather than entering the function repeatedly for each row, you can simply click and drag the tiny square on the bottom right of the cell that contains the function. Doing so will autofill each of the rows with the formula, and Excel will change your cell references to match. For example, when the formula we used in cell C2 that references cell B2 is autofilled into cell C3, it changes to reference cell B3 automatically.

Find more details at Microsoft’s IF function support page.

3. The SUMIF and COUNTIF functions

SUMIF is a more advanced SUM function that allows you to add up only the values in a range that meet the criteria you specify. To use this function, you must specify the range of cells to apply the criteria to, the criteria for inclusion, and, optionally, the sum range, which is the range of cells to total if that’s different from the initial range. The syntax is as follows:

=SUMIF(range,criteria,[sum_range])

Note that any criteria with text or mathematical or logical symbols must be enclosed in double quotes.

In the sales spreadsheet shown below, for example, suppose you want to total up only the sales that are more than $100. The criteria range is C2 to C9, and the criteria is “greater than 100.” Since you’re adding up the values in that same cell range (C2 to C9), you don’t need to supply a separate sum range. So your formula is:

=SUMIF(C2:C9,”>100″)

What if instead you want to find the total for all sales in the East region only? To do that you’ll have to specify both the criteria range (cells B2 to B9) and the sum range (cells C2 to C9). This is the formula:

=SUMIF(B2:B9,B2,C2:C9)

Note that you don’t have to type out “East” for the criteria. You can simply type B2 or click the cell B2 to have Excel search for the text it contains.

There is a similar function called COUNTIF that lets you create a count of values that meet specified criteria. The syntax is as follows:

=COUNTIF(range,criteria)

So to count the total number of sales in the West region, for instance, you supply the range of cells to apply the criteria to (B2 to B9), followed by the criteria (“West” or cell B3). The formula is:

=COUNTIF(B2:B9,B3)

What if you want to apply multiple criteria to your data, such as calculating total sales for books in the East region, or counting the number of sales over $100 in the West region? Excel can do that too, via functions called SUMIFS and COUNTIFS. These functions use more complex syntax than SUMIF and COUNTIF. For more details, use cases, and best practices for all four of these functions, see Microsoft’s SUMIF, SUMIFS, COUNTIF, and COUNTIFS support pages.

4. The CONCAT function

This function is useful for piecing together text from different cells into one complete string. For instance, maybe you have a worksheet with different columns for people’s first and last names, but you want to put first and last names together. Other common use cases are completing an address, reference number, file path, or URL. The syntax is as follows:

=CONCAT(text1,text2,text3,…)

In this example we will use CONCAT to combine a list of first names and last names into a full name with a space in between. To do so we simply place the cursor in cell C2, type =CON and select CONCAT from the list of options that appears. Next, select the cell that contains the first name (A2) and add a comma, a blank space surrounded by quotation marks, and another comma. Then add the last name by selecting the adjacent cell (B2) and hit Enter. Here’s the full formula:

=CONCAT(A2,” “,B2)

Next, click and drag the bottom right of cell C2 to autofill the formula in all the other rows.

For more details and examples, see Microsoft’s CONCAT function support page.

5. The VLOOKUP function

This is one of the most commonly used functions in Excel and a valuable data analysis tool. VLOOKUP lets you look up a value in a table and return information from other columns related to that value. It’s very useful for combining data from different lists or comparing two lists to find matching items. To use this function, you need to provide three to four pieces of information:

1. The value you want to look for. This is known as the lookup value.
2. The range of cells to look in. This is known as the table array.
3. The column that contains the information you want to return, called the column index number.
4. Optionally, the type of lookup you want to perform: TRUE or FALSE. This is known as the range lookup. FALSE means you want an exact match for the lookup value, while picking TRUE returns the best approximate match. If you don’t specify a range lookup, VLOOKUP defaults to TRUE.

The syntax is as follows:

=VLOOKUP(lookup_value,table_array,column_index_number,[range_lookup])

The lookup value must be in the first column of cells you specify in the table array. The leftmost column in the table array has a column index number of 1, with subsequent columns numbered 2, 3, and so on.

In this example, we’ll look up what region our employees work in. To do so, we first need to specify the value that we are going to search for: the employee name Mike (cell A2). Next, we need to highlight the entire cell range (table array) that we want to look in: cells F2:G8.

Then we specify which column holds the information that we want. Rather than picking the column itself, we count from left to right within the table array. Since the column that contains the region is the second from the left, type in 2.

Lastly, we enter the TRUE (best approximate match) or FALSE (exact match) option. TRUE is typically only used with numbers or when you aren’t sure if the value you want is in the table. Since we know the value we want is in the table, we will pick FALSE. Generally, FALSE is the better option, as it returns more accurate results.

This is the full formula:

=VLOOKUP(A2,F2:G8,2,FALSE)

This is an oversimplified example using a small data set, but when you need to search through a spreadsheet with thousands (or tens of thousands) of cells, VLOOKUP is a huge time-saver and reduces the possibility of errors. For more details and examples, see Microsoft’s VLOOKUP function support page.

Using Copilot to create Excel formulas

Remembering all these different formulas and functions can be difficult, so another good approach for those who have access to Copilot in Excel (see details at the top of this story) is to use the AI tool to dynamically create formulas that meet your needs. Using Copilot, you can describe what you want the formula to do  and have the AI generate the syntax for you. In this section we’ll demonstrate with two sample data sets.

To access Copilot, click the Copilot icon on your ribbon toolbar or at the bottom right of your screen.

The Copilot sidebar opens along the right side of your spreadsheet. Type in a prompt describing the formula you want created — in this example, a simple formula that adds up all the sales values in the data set. Be sure to instruct Copilot where to place the formula:

Create a formula in B7 that sums all of the sales

Click the submit arrow in the chat window, and Copilot will create and insert the formula to give you the result you want.

That was a simple one. Now try a more advanced example working from a more complex data set, as shown in the screenshot below.

Try the following prompt:

Create a formula in G2 that calculates total revenue per unit while accounting for the discount on each purchase. Then fill the formula down for all rows and create a summary table showing total revenue by Region.

Click the submit arrow, and it should create something like this:

(There’s a lot more you can have Copilot can do in Excel besides creating formulas. See our story “11 cool things Copilot can do in Excel.”)

Tip: It’s not required, but it can be helpful to format your spreadsheet as a table when working with Copilot. This helps define more clearly the exact cells for Copilot to use when it creates formulas or takes other actions on your data.

You’re just getting started

In this story you’ve seen how powerful formulas and functions can be in Excel — and we’ve only the scratched the surface of what they can do. Once you get comfortable using them, you can explore some of the myriad prebuilt functions Excel offers and learn how to build more complex formulas (including nesting functions). That’s all beyond the scope of this article, but a great place to start is Microsoft’s “Overview of formulas in Excel” support page, which includes links to several helpful tutorials.

For those who have access to it in Excel, experimenting with Copilot is another great way to learn. You can review the steps it took and the formulas it created to get a better understanding of how formulas work and what they’re capable of.

This story was originally published in May 2023 and updated in June 2026.

More Excel tips and how-tos:

• Excel basics: Get started with tables
• Excel for Microsoft 365 cheat sheet
• 11 cool things Copilot can do in Excel
• How to use PivotTables and PivotCharts in Excel
• Excel basics: Get started with charts and sparklines
• How (and why) to use conditional formatting in Excel
• More Microsoft tips and tutorials