LoginSign Up
← Back to all sparks
M

ManageEngine M365 Manager Plus

ANALYTICS
Velocity5.0

Microsoft 365 management, reporting, and auditing tool for administrators.

www.manageengine.com/microsoft-365-management-reporting ↗

Steady administrative depth for M365, punctuated by a run of serious security fixes.

microsoft-365identity-managementon-premisesautomationsecurity-fixesreporting
◆Current state
M365 Manager Plus handles reporting, management, and automation for Microsoft 365 tenants from an on-premises install, shipping numbered builds that share a train with its sibling M365 Security Plus — the two carry overlapping notes at the same build numbers. Recent builds mix genuine administrative additions with security work: shared, guest, and resource mailboxes now count as free across all modules, group memberships can be assigned from template rules, and mailbox management actions became available inside automation policies. Builds 4817 and 4818 fixed a predictable-SSO-ticket CVE, a privilege escalation in delegated technician administration, and remote code execution via PowerShell embedded in CSV input.
◆Where it's heading
The product's direction is administrative depth rather than new surface — more reports, more attributes exposed to bulk operations, more management tasks reachable from automation policies rather than clicked one at a time. That is the right axis for the buyer, who is a tenant administrator doing the same operation across thousands of objects. Running underneath it is a security-hardening pass that has surfaced three distinct classes of flaw in two builds, all of them in the delegation and integration machinery that lets one console administer a whole estate.
◆Prediction
Automation policies have absorbed mailbox tasks and template rules now drive group membership, so the next candidates are the remaining manual bulk operations — license assignment and user lifecycle actions are the ones the reports keep pointing at.

◆Recent moves

  1. 20d ago

    Build 4821: Java 11 runtime and a license quota column

    The bundled JRE moves from Java 8 to 11 alongside 7-Zip and Jackson upgrades, with a License Quota Used percentage column added to the License Details Report. Platform hygiene plus one small column.

  2. 1mo ago

    Build 4820: free shared mailboxes and rule-driven group membership

    The densest build in the window: shared, guest, and resource mailboxes are treated as free across all modules, group membership can be driven by User Creation Template rules, the All Groups report exposes on-premises sync state, and the Backup module gains NAS repositories and PST splitting. The licensing change is the one customers feel directly.

  3. 1mo ago

    Build 4818: privilege escalation and CSV code execution fixed

    Two serious fixes: delegated technician permissions could extend beyond their intended scope, and CSV inputs carrying embedded PowerShell could execute during processing. Both sit in the delegation and bulk-import paths this product is built around, which makes them worth an unscheduled update.

  4. 2mo ago

    Build 4817: CVE-2026-11374 predictable SSO tickets fixed

    CVE-2026-11374: SSO tickets in the inter-product CustomSSO flow across the AD360 suite could be predicted by an unauthenticated user, potentially leading to account takeover. The same build clears the Microsoft-side change that blocked tenant configuration.

  5. 4mo ago

    Build 4816: room mailbox event report and faster group removal

    A Room Mailbox Event Details report arrives with schedule, organizer, and attendee detail, the User Last Logon report gains creation-date columns, and Remove from All Groups gets faster. Incremental reporting depth of exactly the kind this product accumulates.

  6. 6mo ago

    Build 4814: mailbox actions reach automation policies

    A long list of Exchange mailbox actions — permissions, forwarding, delegation, SMTP address changes, conversions — become available inside automation policies, alongside a deadline-bound Duo SDK update. The automation additions are the substantive half: these were per-user tasks before.