Enterprise IT, rewritten in real time.

Field notes on Azure, identity, security and the AI shift, from someone shipping the fixes, not just the takes.

The latest

You No Longer Have to Rebuild the Whole VM to Get One File Back Until now, recovering a single file from an Azure VM with Premium SSDv2 or Ultra Disk meant restoring the entire machine. Item-Level Recovery is now generally available for both disk types and…
Volume Purchasing in Apple Business Manager Now Covers Subscriptions, Not Just Licenses Enterprise IT can now buy app subscriptions through the same volume purchasing workflow used for one-time licenses, ending the reimbursement-and-workaround era.
Shared Passwords Are Dead for Agents. Scoped Delegation Won — the Banks Just Said So When an agent logs in with your password, it gets all of your authority—not just the slice it needs. Major banks just started blocking that pattern, and if you're building agent workflows,…
Patch Tonight Won: Why “Mitigate and Wait” Loses the PHP RCE Fight Two unauthenticated RCE bugs in PHP affect every version before today's emergency patches, and working exploits already exist. Here's why the 'mitigate and wait' strategy fails against a bug with no login…
Your Riskiest Account Is the One Everyone Tells You to Exclude Microsoft's updated break-glass guidance requires two cloud-only Entra ID accounts excluded from Conditional Access—creating the exact security gap auditors flag. The checklist takes an afternoon; the monitoring and restraint to never reuse…
Microsoft Hands Your SMS and Voice MFA to Third Parties on October 30 Starting October 30, Microsoft stops delivering SMS and voice MFA codes itself—forcing every tenant still using telephony methods to configure a third-party provider or face lockouts.
The Shared Service Account Is Dead. Your Agents Get Their Own client_id Now. One leaked secret, forty compromised agents. That's the reality of shared service account auth—and Auth0's new CIMD support finally gives you a way out.
Three Things Break When Apple Distrusts Your CA — and eMudhra Just Found Out Apple blocked eMudhra certificates across iOS and macOS after Cisco Talos disclosed eight compromised intermediates. Here's what breaks and how to verify your fleet.
Site Collections Didn’t Win—AI Meeting Archives Land in Containers You Can’t See Teams meetings in Copilot tenants are now generating AI archive files that land in SharePoint Embedded containers—a storage model that bypasses the site collections, libraries, and admin visibility you rely on. Here's…
Your Phishing-Resistant Passkeys Fold the Moment Malware Lands on the Device Passkeys still stop remote phishing. Malware on the device defeats them easily—and most MFA rollouts forgot to require device compliance in Conditional Access.
Your MFA Held. The Service Principal Walked Right In. Microsoft reports that Storm-0940 used agentic AI to turn a single vendor compromise into access across hundreds of M365 tenants—not by breaking MFA, but by abusing the application credentials no one had…
Cosmos DB Can Now Tell You Which Account Key You’re About to Break Azure's Safe Key Rotation feature is now GA, and it does exactly one thing well: shows you when each Cosmos DB account key was last used. That timestamp turns key rotation from…
The Build Number Is 26A434. That’s the Only Name on This Release You Can Trust. Apple calls it macOS 27.0.1. The URL still says Tahoe. The build number says 26A434. If you're deploying to a managed fleet, only one of those three matters.

Enterprise IT, rewritten in real time.

The latest

Topics