diff --git a/css/styles.css b/css/styles.css
index f1dd3e8..ad6f31e 100644
--- a/css/styles.css
+++ b/css/styles.css
@@ -582,4 +582,149 @@ main {
   background: var(--brand-primary);
   border-color: var(--brand-primary);
   color: white;
-}
\ No newline at end of file
+}
+/* ---------------------------------------------------------------------------
+   Full post viewer
+
+   Only articles carrying a complete body (currently Microsoft Message Center
+   posts) get an expand button, because a Message Center permalink only opens
+   for someone with tenant admin access. Showing the post inline is the point.
+   Uses the native <dialog>, so focus trapping and Escape come from the
+   platform. Both themes are driven by the existing custom properties.
+--------------------------------------------------------------------------- */
+
+.expand-btn {
+  margin-top: 1rem;
+  padding: 0.5rem 1rem;
+  font-size: 0.85rem;
+  font-weight: 600;
+  font-family: inherit;
+  color: var(--text-primary);
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border-color);
+  border-radius: var(--radius-sm);
+  cursor: pointer;
+  transition: var(--transition);
+}
+
+.expand-btn:hover {
+  border-color: var(--brand-accent);
+  color: var(--brand-accent);
+}
+
+.expand-btn:focus-visible {
+  outline: 2px solid var(--brand-accent);
+  outline-offset: 2px;
+}
+
+.article-dialog {
+  padding: 0;
+  border: none;
+  background: transparent;
+  max-width: min(760px, 92vw);
+  max-height: 88vh;
+  overflow: visible;
+}
+
+.article-dialog::backdrop {
+  background: rgba(0, 0, 0, 0.65);
+  backdrop-filter: blur(2px);
+}
+
+.dialog-panel {
+  position: relative;
+  max-height: 88vh;
+  overflow-y: auto;
+  padding: 2rem;
+  background: var(--bg-secondary);
+  border: 1px solid var(--border-color);
+  border-radius: var(--radius-md);
+  box-shadow: var(--shadow-lg);
+}
+
+.dialog-close {
+  position: sticky;
+  top: 0;
+  float: right;
+  width: 2rem;
+  height: 2rem;
+  font-size: 1.4rem;
+  line-height: 1;
+  font-family: inherit;
+  color: var(--text-secondary);
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border-color);
+  border-radius: 50%;
+  cursor: pointer;
+  transition: var(--transition);
+}
+
+.dialog-close:hover {
+  color: var(--text-primary);
+  border-color: var(--brand-accent);
+}
+
+.dialog-tags {
+  display: flex;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+  margin-bottom: 1rem;
+}
+
+.dialog-title {
+  margin: 0 0 0.75rem;
+  font-size: 1.4rem;
+  line-height: 1.35;
+  color: var(--text-primary);
+}
+
+.dialog-text {
+  margin-top: 1.25rem;
+  color: var(--text-secondary);
+  line-height: 1.7;
+}
+
+.dialog-text p {
+  margin: 0 0 1rem;
+}
+
+.dialog-subheading {
+  margin: 1.5rem 0 0.75rem;
+  font-size: 1rem;
+  color: var(--text-primary);
+}
+
+.dialog-links {
+  margin: 0;
+  padding-left: 1.2rem;
+  color: var(--text-secondary);
+}
+
+.dialog-links li {
+  margin-bottom: 0.4rem;
+}
+
+.dialog-links a,
+.dialog-source-link {
+  color: var(--brand-accent);
+  overflow-wrap: anywhere;
+}
+
+.dialog-source-link {
+  display: inline-block;
+  margin-top: 1.5rem;
+  padding-top: 1.25rem;
+  border-top: 1px solid var(--border-color);
+  font-size: 0.9rem;
+  font-weight: 600;
+}
+
+@media (max-width: 600px) {
+  .dialog-panel {
+    padding: 1.25rem;
+  }
+
+  .dialog-title {
+    font-size: 1.2rem;
+  }
+}
diff --git a/index.html b/index.html
index 6c49515..6cd0b79 100644
--- a/index.html
+++ b/index.html
@@ -178,6 +178,19 @@ <h1>Security News</h1>
 </main>
 
 <div id="toast" class="toast"></div>
+
+<!--
+  Full post viewer. Native <dialog> so focus trapping, Escape to close and the
+  backdrop come from the platform rather than hand-rolled JS. The content is
+  built entirely by app.js with DOM methods, so nothing from the feed is ever
+  parsed as markup.
+-->
+<dialog id="article-dialog" class="article-dialog" aria-labelledby="dialog-body">
+    <div class="dialog-panel">
+        <button id="dialog-close" class="dialog-close" type="button" aria-label="Close">×</button>
+        <div id="dialog-body" class="dialog-body"></div>
+    </div>
+</dialog>
 <script
         src="js/app.js"
         defer
diff --git a/js/app.js b/js/app.js
index 3c57f06..b43f166 100644
--- a/js/app.js
+++ b/js/app.js
@@ -25,6 +25,13 @@
     const MAX_SUMMARY_LENGTH = 2000; // guard against absurdly long feed content
     const MAX_TITLE_LENGTH = 500;
 
+    // Full post bodies (currently only Message Center carries one) are shown in
+    // the expand dialog. Capped here as well as in the feed pipeline, so a
+    // tampered feeds.json still can't push an unbounded string into the DOM.
+    const MAX_BODY_LENGTH = 20000;
+    const MAX_LINKS = 15;
+    const MAX_LINK_LABEL_LENGTH = 200;
+
     const productColors = {
         "defender-xdr": "#7C3AED",
         "defender-endpoint": "#9333EA",
@@ -43,6 +50,7 @@
         "cisa-advisories": "#B91C1C",
         "ncsc-guidance": "#0F766E",
         "general-security": "#64748B",
+        "message-center": "#0EA5E9",
     };
 
     // Allowlist of valid product IDs — rejects unexpected values injected via
@@ -65,6 +73,9 @@
     const totalCount = document.getElementById("total-count");
     const toastEl = document.getElementById("toast");
     const bookmarksToggle = document.getElementById("bookmarks-toggle");
+    const articleDialog = document.getElementById("article-dialog");
+    const dialogBody = document.getElementById("dialog-body");
+    const dialogClose = document.getElementById("dialog-close");
 
     // ---------------------------------------------------------------------------
     // Initialisation
@@ -196,6 +207,22 @@
             author: truncate(article.author || "", 200),
             vendor: truncate(article.vendor || "", 200),
             published: article.published || "",
+            // The full post body, plain text only. The pipeline strips markup
+            // before it ever reaches here and the dialog renders it with
+            // textContent, so there is no path from feed content into HTML.
+            body: truncate(typeof article.body === "string" ? article.body : "", MAX_BODY_LENGTH),
+            // Links lifted out of the body. Each one is re-checked here rather
+            // than trusted from the feed, because these become real anchors.
+            links: (Array.isArray(article.links) ? article.links : [])
+                .filter((l) => l && typeof l.url === "string" && isSafeUrl(l.url))
+                .slice(0, MAX_LINKS)
+                .map((l) => ({
+                    url: l.url,
+                    label: truncate(
+                        typeof l.label === "string" && l.label ? l.label : l.url,
+                        MAX_LINK_LABEL_LENGTH
+                    ),
+                })),
             // Filter products to known IDs so rogue product IDs can't be used
             // to inject unexpected values into data-* attributes or inline styles.
             products: (Array.isArray(article.products) ? article.products : [])
@@ -471,9 +498,131 @@
         summary.textContent = article.summary;
 
         card.append(cardHeader, h3, meta, summary);
+
+        // --- expand ---
+        // Only shown when the article actually carries a full body. Most sources
+        // are RSS with nothing beyond the summary, so an expand button on those
+        // would promise more than it could deliver.
+        if (article.body) {
+            const expandBtn = document.createElement("button");
+            expandBtn.className = "expand-btn";
+            expandBtn.dataset.action = "expand";
+            expandBtn.dataset.link = article.link;
+            expandBtn.setAttribute("aria-label", `Read the full post: ${article.title}`);
+            expandBtn.textContent = "Read full post";
+            card.appendChild(expandBtn);
+        }
+
         return card;
     }
 
+    // ---------------------------------------------------------------------------
+    // Full post dialog
+    // ---------------------------------------------------------------------------
+
+    /**
+     * Renders the whole post into the dialog. Every string goes in via
+     * textContent and every URL through isSafeUrl, so nothing from the feed is
+     * ever parsed as markup.
+     */
+    function openArticleDialog(article) {
+        if (!articleDialog || !dialogBody) return;
+
+        dialogBody.innerHTML = "";
+
+        // Tags, matching the card so the dialog reads as the same object.
+        const tags = document.createElement("div");
+        tags.className = "dialog-tags";
+        (article.products || []).forEach((product) => {
+            const color = productColors[product.id] || "#64748B";
+            const tag = document.createElement("span");
+            tag.className = "blog-tag";
+            tag.style.background = `${color}22`;
+            tag.style.color = color;
+            tag.style.border = `1px solid ${color}44`;
+            tag.textContent = product.name;
+            tags.appendChild(tag);
+        });
+
+        const heading = document.createElement("h2");
+        heading.className = "dialog-title";
+        heading.textContent = article.title;
+
+        const date = new Date(article.published);
+        const meta = document.createElement("div");
+        meta.className = "article-meta";
+        [
+            `🏢 ${article.vendor || "Security"}`,
+            `📰 ${article.source}`,
+            `📅 ${isNaN(date.getTime()) ? "Unknown date" : date.toLocaleDateString("en-GB")}`,
+        ].forEach((text) => {
+            const span = document.createElement("span");
+            span.textContent = text;
+            meta.appendChild(span);
+        });
+
+        // Body, one paragraph per blank line so a wall of text stays readable.
+        const body = document.createElement("div");
+        body.className = "dialog-text";
+        article.body
+            .split(/\n\s*\n|(?<=\.)\s{2,}/)
+            .map((part) => part.trim())
+            .filter(Boolean)
+            .forEach((part) => {
+                const p = document.createElement("p");
+                p.textContent = part;
+                body.appendChild(p);
+            });
+
+        dialogBody.append(tags, heading, meta, body);
+
+        // Links lifted out of the original post, already scheme-checked twice.
+        if (article.links && article.links.length) {
+            const linkHeading = document.createElement("h3");
+            linkHeading.className = "dialog-subheading";
+            linkHeading.textContent = "Links in this post";
+
+            const list = document.createElement("ul");
+            list.className = "dialog-links";
+            article.links.forEach((link) => {
+                const li = document.createElement("li");
+                const a = document.createElement("a");
+                a.href = link.url;
+                a.target = "_blank";
+                a.rel = "noopener noreferrer";
+                a.textContent = link.label;
+                li.appendChild(a);
+                list.appendChild(li);
+            });
+
+            dialogBody.append(linkHeading, list);
+        }
+
+        // The canonical source, kept last and labelled honestly: a Message
+        // Center permalink only opens for someone with admin access to the
+        // tenant it was published to.
+        const sourceLink = document.createElement("a");
+        sourceLink.className = "dialog-source-link";
+        sourceLink.href = article.link;
+        sourceLink.target = "_blank";
+        sourceLink.rel = "noopener noreferrer";
+        // Keyed off the product id rather than the source name: the id is
+        // allowlisted, so a source rename cannot silently mislabel the link.
+        const isMessageCentre = (article.products || []).some(
+            (p) => p.id === "message-center"
+        );
+        sourceLink.textContent = isMessageCentre
+            ? "Open in the Microsoft 365 admin centre (tenant admins only)"
+            : "Open the original post";
+        dialogBody.appendChild(sourceLink);
+
+        articleDialog.showModal();
+    }
+
+    function closeArticleDialog() {
+        if (articleDialog && articleDialog.open) articleDialog.close();
+    }
+
     // ---------------------------------------------------------------------------
     // Bookmarks
     // ---------------------------------------------------------------------------
@@ -598,8 +747,37 @@
             if (btn.dataset.action === "bookmark") {
                 // Read link directly from dataset — no decodeURIComponent needed.
                 toggleBookmark(btn.dataset.link);
+                return;
+            }
+
+            if (btn.dataset.action === "expand") {
+                // Look the article up by its link rather than stashing an index,
+                // so re-filtering between render and click can't open the wrong
+                // post. The already-sanitised object is what gets rendered.
+                const article = filteredArticles.find(
+                    (a) => a.link === btn.dataset.link
+                );
+                if (article) openArticleDialog(article);
             }
         });
+
+        if (dialogClose) {
+            dialogClose.addEventListener("click", closeArticleDialog);
+        }
+
+        if (articleDialog) {
+            // Click on the backdrop (the dialog element itself, outside the
+            // inner panel) closes it, matching what people expect from a modal.
+            articleDialog.addEventListener("click", (e) => {
+                if (e.target === articleDialog) closeArticleDialog();
+            });
+
+            // Drop the rendered post on close so a stale one is never briefly
+            // visible when the dialog is reopened.
+            articleDialog.addEventListener("close", () => {
+                if (dialogBody) dialogBody.innerHTML = "";
+            });
+        }
     }
 
     // ---------------------------------------------------------------------------
diff --git a/scripts/fetch_feeds.py b/scripts/fetch_feeds.py
index 0c115e1..8b8a831 100644
--- a/scripts/fetch_feeds.py
+++ b/scripts/fetch_feeds.py
@@ -52,6 +52,15 @@
 # a general reader can follow.
 MESSAGE_CENTER_LINK = "https://admin.microsoft.com/#/MessageCenter/:/messages/"
 
+# Because that link is useless to anyone without admin access to the tenant, the
+# full post body travels with the article so the site can show it inline. Stored
+# as PLAIN TEXT, never HTML: the front end renders everything with textContent,
+# and shipping markup would hand upstream feed content a route into the DOM.
+# Any links in the body are extracted separately and re-rendered as anchors
+# after a scheme check.
+MAX_BODY_LENGTH = 6000
+MAX_BODY_LINKS = 12
+
 # The audience GitHub must mint its OIDC token for. It has to match the audience
 # on the federated identity credential in terraform/main.tf.
 ENTRA_TOKEN_AUDIENCE = "api://AzureADTokenExchange"
@@ -508,6 +517,14 @@ class Source:
         "weight_threshold": 1,
         "patterns": [],
     },
+    # Assigned by source rather than by text matching, so it is a reliable "this
+    # came from the Message Center" marker rather than a guess. The unreachable
+    # threshold keeps the classifier from ever awarding it on wording alone.
+    "message-center": {
+        "name": "Microsoft Message Center",
+        "weight_threshold": 999,
+        "patterns": [],
+    },
 }
 
 
@@ -880,6 +897,35 @@ def parse_graph_datetime(value: str) -> str:
     return parsed.isoformat()
 
 
+def extract_links(html: str) -> List[dict]:
+    """
+    Pull the anchors out of a Message Center body so they survive the strip to
+    plain text. Only http(s) is kept, and the label is stripped of markup, so
+    what reaches the front end is a plain label and a scheme-checked URL.
+    """
+    links: List[dict] = []
+    seen = set()
+
+    for href, label in re.findall(
+        r"<a\s[^>]*href=[\"']([^\"']+)[\"'][^>]*>(.*?)</a>",
+        html or "",
+        re.IGNORECASE | re.DOTALL,
+    ):
+        url = unescape(href).strip()
+
+        if not url.lower().startswith(("http://", "https://")) or url in seen:
+            continue
+
+        seen.add(url)
+        text = clean_html(label) or url
+        links.append({"label": truncate(text, 120), "url": url})
+
+        if len(links) >= MAX_BODY_LINKS:
+            break
+
+    return links
+
+
 def normalize_message(message: dict, source: Source) -> Optional[dict]:
     """Turn one Graph serviceAnnouncement message into an article."""
     message_id = (message.get("id") or "").strip()
@@ -897,10 +943,19 @@ def normalize_message(message: dict, source: Source) -> Optional[dict]:
     )
 
     # The services a post applies to are the strongest classification signal it
-    # carries, so they are fed to the classifier alongside the body text.
+    # carries, so they are fed to the classifier alongside the body text. The
+    # Message Center marker is then prepended by hand: it is a fact about where
+    # the post came from, not something to infer from its wording.
     products = classify_products(
         title, f"{summary_raw} {' '.join(services)}", source.name
     )
+    products = [
+        {
+            "id": "message-center",
+            "name": PRODUCTS["message-center"]["name"],
+            "score": 10,
+        }
+    ] + [product for product in products if product["id"] != "general-security"]
 
     return {
         "title": title,
@@ -917,6 +972,10 @@ def normalize_message(message: dict, source: Source) -> Optional[dict]:
         "board_id": source.board_id,
         "message_id": message_id,
         "services": services,
+        # The whole post as plain text, so the site can show it inline rather
+        # than sending readers to an admin centre they cannot open.
+        "body": truncate(summary_raw, MAX_BODY_LENGTH),
+        "links": extract_links(body),
         "products": products,
         "tags": [product["name"] for product in products],
     }