What changed in October 2026: Atlassian, Salesforce, Microsoft, Google and Adobe

This is the first edition of What changed, our monthly digest for Australian and New Zealand organisations that run more than one of the big platforms. Each month we read the vendor release notes, licensing pages and regulator announcements, keep only what changes a cost, a deadline or a risk, and say what to do about it. Every item links to the primary source.

Three patterns ran through October. AI is moving from per-seat pricing to metered credits at Atlassian, Microsoft, Google and Salesforce. Vendors are shipping Model Context Protocol (MCP) servers so AI assistants can reach their data. And old authentication methods are being switched off on fixed dates. A fourth, local pattern: several new AI features launched without an Australian data location, or without Australia in the first rollout.

What needs action before the end of the year?

This table pulls every dated deadline from this month's announcements into one list, ordered by date. Use it to check your integration register and renewal calendar.

What changed for Atlassian customers?

Cloud list prices went up on 13 October. The new prices cover Jira, Confluence, Jira Service Management and Service Collection, Teamwork Collection, Jira Product Discovery, Guard, Bitbucket Premium and Government Cloud. Quotes created before 13 October keep the old price until they expire. Monthly customers who asked for an annual quote before that date must pay before it expires, and it can't be extended past 11 November (Atlassian pricing FAQ). Atlassian's FAQ gives no percentages and doesn't mention AUD. Partner Adaptavist reported increases of 7–10% for most Standard and Premium plans. Our guide to Atlassian Cloud pricing in AUD works through what this means per user.

Usage-based billing starts on 3 December. Atlassian announced in September that it will meter three things: Rovo credits (Rovo Chat, Confluence AI slides, the Jira coding agent and Teamwork Graph queries), automation steps (every trigger, condition, action and branch), and AI agent resolutions. In-line summaries, rewrites and Rovo Search stay free. The post doesn't give allowance sizes, so the only way to know your exposure is to look at your own usage before December.

A critical Data Center flaw. On 5 October Atlassian published CVE-2026-21589, rated 9.3 (CVSS 4.0). An attacker without a login can read files in the web application root if they know the exact path. It affects Data Center versions of Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. Fixed versions include Confluence 9.2.26 and 10.2.19, and Jira Software 9.12.40, 10.3.26 and 11.3.12. Cloud was patched by Atlassian. For Data Center, Atlassian says it can't confirm whether instances have been compromised and asks customers to check.

The Atlassian MCP server is generally available. Announced at Team '26 Europe on 6 October, it has more than 220 tools across Jira, Confluence, Bitbucket Cloud, Goals and Loom, with Jira Service Management "coming soon". It uses OAuth 2.1 with PKCE, respects each user's existing permissions, separates read, write and destructive actions, and gives admins domain and IP allowlists and audit logs. This is the supported way to connect Claude, ChatGPT or other assistants to Jira and Confluence. Our MCP integration page covers how we approach it.

Service Collection gained features. Workforce management in Jira Service Management and AI change risk assessment became generally available, with Solution Composer in open beta (Atlassian, 7 October).

Firewall teams: a new IP range. Atlassian Cloud adds 131.162.88.0/21 from 1 January 2027 (developer changelog). Update allowlists before the holidays.

Price rises and metering make it worth checking who actually uses each product. When we rolled out Jira Work Management and Confluence for a global manufacturer, it covered more than 50 teams, and that kind of footprint is where seat counts drift. Our Atlassian licensing team can review yours.

If you're still on Data Center, the vulnerability is another reason to plan the move. Our Data Center to Cloud guide for Australia sets out the 2028 and 2029 deadlines.

What changed for Salesforce customers?

SOAP API login() now has hard dates. Salesforce updated its retirement notice on 9 October:

1. 1 December 2026: SOAP login() only succeeds for users with the Use Any API Auth permission, in every org. Without it, the call fails with INSUFFICIENT_ACCESS.
2. 15 December 2026 (sandboxes) and 31 January 2027 (production): SOAP login() from a broad IP range (larger than /8 for IPv4 or /29 for IPv6) needs a security token or mutual TLS. Orgs with no SOAP login() calls in the previous six months have it switched off in a one-time check.
3. Summer '27: SOAP login() is removed in API versions 31.0 to 64.0.

The risk is the integration nobody remembers: an annual job, a disaster-recovery script, an old middleware connector. Salesforce recommends finding callers in Login History (login subtype "SOAP API") and moving them to external client apps with OAuth, using the JWT bearer or client credentials flow for server-to-server work. Our Salesforce integration team does this kind of audit.

Salesforce is buying Braze. On 20 October Salesforce signed an agreement to acquire the customer engagement platform for about US$5.66 billion in enterprise value, or US$47.50 a share. Closing is expected in Salesforce's fiscal 2028, subject to shareholder and regulatory approval. Salesforce says Braze will strengthen Marketing Cloud's cross-channel personalisation. Nothing has been said yet about contracts or pricing. If you're choosing a marketing platform now, this changes the long-term roadmap of two candidates. It also bears on anyone weighing a move like the one in our Marketing Cloud to Klaviyo migration piece.

Salesforce is also buying Loops for Tableau. Loops monitors KPIs and explains why a metric moved. The deal was announced on 12 October with closing expected in early November.

Contact Center comes to Australia in November. Salesforce's native contact centre became generally available in Europe on 16 October, "with Australia and New Zealand following in November" (Service Cloud fall releases). The same post says RCS messaging reaches general availability in October and confirms the Flex Credits included in the new editions: 500,000 in Core, 1 million in Advanced and 2.75 million in Max.

Dreamforce features are landing. Salesforce's Dreamforce recap lists Agent Optimizer and AI Skills as generally available in October, and long-horizon agents in November. Regional availability and pricing aren't stated, so check them for Australian orgs before planning a rollout.

What changed for Microsoft customers?

Copilot no longer needs a Microsoft 365 base licence from 1 December. New Microsoft 365 Copilot and Copilot Business offers can be bought on their own, at the same price as today (Partner Center, 14 October). Since 16 October the current offers carry "(add-on)" in their names, and they end sale in CSP on 1 December. Existing subscriptions don't need to change, but scripts and reports that match on offer names will break. Microsoft says to use product and SKU IDs instead.

Usage-based billing for Copilot Business won't be on by default in Australia. From 1 December, new Copilot Business licences bought through CSP have pay-as-you-go billing switched on, with a default limit of 4,000 Copilot Credits per user per month. Microsoft says the change "will initially not be available" in Australia and 10 other markets (same page). Australian customers who want usage-based features such as Copilot Cowork will still need to set billing up themselves.

AI Builder add-ons retire on 1 November. AI Builder capacity add-ons come off sale, and Microsoft points customers to Copilot Credits. Existing credits last until the end of the current term, so turn off auto-renew before the next renewal date.

Dynamics 365 agents in preview. On 8 October Microsoft put the Sales Development Agent, the Service Agent and "CRM in the flow of work" (Dynamics 365 data inside Teams) into public preview. It also made 30 Dynamics 365 sales and service skills generally available in Copilot (Dynamics 365 blog). Copilot Studio agent accounts, which give an agent its own identity and permissions, entered private preview on 15 October.

The October Power Platform update reached Australia on 23–26 October. Australian environments moved to database version 9.2.26093, and the update can't be postponed (deployment schedule). If something broke on Monday morning, that's the first place to look.

Office LTSC 2021 is out of support. Office, Project and Visio LTSC 2021 stopped receiving security fixes on 13 October. Copilot doesn't work with on-premises Office.

What changed for Google Workspace and Gemini customers?

New Gemini models launched without an Australian data location. Gemini 4 Argon became generally available in Gemini Enterprise on 13 October and is switched on by default from 27 October. Its data residency and in-region processing are offered only in the US and EU multi-regions (Gemini Enterprise release notes). Claude Opus 5.5 and Sonnet 5.5 became available in the Gemini Enterprise app on 15 October, billed per use, with the same location limits. If your data handling relies on Australian processing, check which models your users can pick.

New spending controls. Admins can now cap how much of a pooled quota any one user consumes (generally available 22 October), and pay-as-you-go usage above quota opened for Frontline, Education and Emerging Market editions on 7 October.

Gemini 2.5 Flash retired on 20 October on Google's agent platform (model page). Anything still calling it from the Sydney region needs to move to a current model.

Google Meet now uses post-quantum cryptography on the web and meeting room hardware, rolling out from 12 October, with no admin action needed (Workspace Updates).

Offboarding: secondary calendars are now deleted with their owner (Workspace Updates, 9 October). Move shared team calendars to a new owner before deleting a departing user's account.

Our Gemini page covers how we set up Gemini Enterprise for Australian organisations.

What changed for Adobe customers?

Adobe's big announcements will come at Adobe MAX, which runs 10–12 November, so October was mostly release notes.

• AEM as a Cloud Service 2026.9.0 made AEM's agent features generally available and added canary deployments. Environments still using deprecated Java APIs stopped receiving critical release updates from 28 September (AEM release notes).
• Journey Optimizer now applies a 90-day profile store and 13-month data lake retention limit to existing sandboxes, from 1 October (release notes).
• Workfront's Q4 release (22 October) replaces the AI Assistant with Adobe's Coworker in a phased rollout. The billing and cost-per-hour rate fields leave the API in January 2027, so integrations and reports that read them need updating (Workfront Q4 overview).
• Adobe Analytics added a read-only MCP permission from 6 October, so admins can give AI tools access to report data without write rights (Analytics release notes).

What changed in Australian privacy and AI regulation?

The automated-decision rules start in six weeks. On 30 September the OAIC published a fact sheet, a flowchart and updated APP 1 guidelines for the new transparency rule (OAIC). From 10 December 2026, if a computer program makes, or does something substantially and directly related to making, a decision that could significantly affect someone, your privacy policy must name the kinds of personal information used and the kinds of decisions involved. Lead scoring, case routing and agent-driven approvals in Salesforce, Dynamics 365 or Jira Service Management can all be in scope. Our guide to automated decisions and the Privacy Act has a checklist.

The OAIC is busier and enforcing harder. Its 2025–26 annual report, released on 22 October, shows 5,268 privacy complaints, up 60%. It finalised 1,327 data breach notifications, published findings on pixel tracking, and saw the Federal Court order Australian Clinical Labs to pay $5.8 million in civil penalties over a 2022 breach. The pixel-tracking findings matter to anyone running Adobe, Google or other tracking tags on pages that collect personal information.

Offshore suppliers are in scope. On 7 October the OAIC opened a formal investigation into the Chinese maker of the app behind smart glasses sold at Kmart, after the company didn't answer preliminary inquiries. Due diligence on third-party apps and their data handling is a live risk, not paperwork.

Government AI policy updated. The Digital Transformation Agency published version 2.1 of its policy for the responsible use of AI in government on 21 October, with minor updates. Its core requirements (accountable officials, transparency statements, registers of AI use cases and impact assessments) apply to vendors' features as much as to agencies' own builds.

What does October mean for an organisation running several platforms?

Read together, October's changes point to three jobs for the next quarter.

1. Build one view of AI consumption. Atlassian, Microsoft, Google and Salesforce now each meter AI in their own credit, with their own allowances and caps. Nobody will see the total unless someone puts the four reports side by side each month.
2. Keep an integration register with authentication methods. The Salesforce SOAP login() dates and Atlassian's new IP range are both easy to handle if you know what connects to what, and painful if you find out from a failed job. Our connected enterprise guide explains how to build that register.
3. Check data location model by model. Australian data residency used to be a question you asked once per platform. With Gemini Enterprise offering some models only in the US and EU, and Microsoft and Salesforce rolling features out to Australia later than other markets, it's now a question per feature.

What should we watch in November?

• 1 November: Microsoft's price list preview with the new standalone Copilot SKU IDs, and AI Builder add-ons come off sale.
• 10–12 November: Adobe MAX, where Firefly, GenStudio and Experience Cloud announcements are expected.
• November: Salesforce's native Contact Center reaches Australia and New Zealand.
• 11 November: last day to pay an annual Atlassian quote at pre-13 October prices.

The November edition of What changed follows at the end of the month. If one of these changes lands on your desk and you'd like a second opinion on what it means for your platforms, talk to us.