Enterprise IT, rewritten in real time.

Field notes on Azure, identity, security and the AI shift, from someone shipping the fixes, not just the takes.

The latest

I Hunted Every Apache Server in My Azure Estate. Resource Graph Lied to Me. Resource Graph knows you have a VM. It has no idea whether Apache is running on it. When a critical RCE drops, that gap becomes your problem, here's how to inventory exposure…
Three Things That Break When You Pull a Month of Entra Sign-In Logs Your tenant now logs hundreds of thousands of authentication events daily. Here's what breaks when you try to pull all of them, and how to fix it before your next investigation.
Would You Hand a Service Principal to a Model You Can’t Vouch For? Microsoft proved that fewer than ten neuron edits can turn an AI agent into a sleeper, and your service principal comes along for the ride.
Three Things That Broke When Attackers Gave Their Secret-Hunting a Brain Your detection window didn't just shrink, it disappeared. The only way to win the race against autonomous secret-hunting agents is to delete what they're hunting.
Someone You Never Added Is Reading the Thread iOS 27.2.1 shipped less than two weeks after 27.2 to patch an iMessage flaw that let unauthorized parties join group conversations. Here's how to verify every device in your fleet actually took…
Hackers Rode Qubole’s AWS Access Into Customer Accounts, Audit Your Cross-Account Roles Now Between October 14 and 26, attackers with control of a Qubole-owned AWS account used cross-account IAM roles to breach multiple customer environments. The attack window is known, so you can hunt your…
Three Things That Break When Static Web Apps Move to .NET 10 Your Static Web App didn't crash when .NET 8 and 9 support ended today, it just stopped getting security patches. The harder problem: Azure's API can't tell you which apps are exposed,…
Three Things Microsoft Didn’t Replace When It Killed Prioritize My Inbox Microsoft is retiring Copilot's Prioritize My Inbox by March 2027 with no announced replacement, leaving paid users with the free Focused Inbox everyone else already has. Admins have four months to prepare.
I killed SMS for password reset before Microsoft did. Here’s what broke. Microsoft is retiring SMS as a self-service password reset method. I disabled it in my lab tenant to find out what actually breaks and where the real exposure lives.
You Deployed a Whole NVA to Drop One Subnet. Route Maps Just Made That Embarrassing. Filtering one subnet from your hybrid BGP routes used to mean deploying a whole VM, licensing it, and keeping it patched. Route maps on Azure Route Server just made that entire appliance…
Anthropic Just Took a 38% Haircut to Go Public. Should Your Roadmap Flinch? Anthropic is going public at up to $750 billion less than it hoped. That's not a crisis for your Claude deployment, but it is a signal about foundation-model unit economics that should…
I Went Hunting for .claude Files on GitHub. The Passwords Were Sitting in Plaintext. Claude Code's 'don't ask again' feature saves complete commands, including passwords typed inline, to a local config file. 1,122 public GitHub repos were found leaking those files with credentials in plaintext.
I Read the Exchange Admin API Announcement So You Don’t Have To Panic Microsoft's new Exchange Admin API sounds like a big deal. It's actually a narrow migration tool for EWS developers, and if you're not one of them, you can probably keep scrolling.

Enterprise IT, rewritten in real time.

The latest

Topics