Enterprise IT, rewritten in real time.

Field notes on Azure, identity, security and the AI shift, from someone shipping the fixes, not just the takes.

The latest

Three Permission Mistakes That Let Multi-Tenant Apps Quietly Own Your Directory Application permissions where delegated would do, overly broad scopes, and no way to list what's already consented. Here's the five-step audit to find which external apps are sitting in your tenant right…
The PostgreSQL API Version in Your Bicep Is Already a Year Behind The compliance team wants WORM backups by Friday, and the new PostgreSQL API version 2026-10-01 can deliver them. But first you need to find which API version your Bicep is actually pinned…
81 Firefox Bugs, 948 Kernel Exploits, and the Number OpenAI Left Off the Slide OpenAI's GPT-6 Cyber found 81 Firefox bugs and wrote 948 kernel exploits. But the number that determines whether that's a breakthrough or a triage tax is the one they didn't put on…
I Sent a 300-Byte Password at a Key-Only Account. It Let Me In. A key-only SSH account should be immune to password guessing. On Alpine Linux, a 300-byte password bypasses authentication entirely, no key, no credential, just the right string length.
OneDrive Sync Finally Has a Command-Line Tool. It’s Called odcli. For years, the only supported way to check OneDrive sync status was to ask users to describe the color of a cloud in their system tray. Microsoft just shipped odcli, the official…
MFA Won the Human War. Your Service Principals Never Got the Memo. Human identities got Conditional Access, MFA, and risk scoring. Service principals got a 24-month client secret and zero monitoring. Count what's running in your tenant before someone else does.
Agents Are Scraping GitHub for OAuth Secrets. I Hunted Mine That Morning. A secret committed to a public repo used to have a grace period measured in days. Microsoft just documented threat actors using agentic frameworks to collapse that window to zero, and the…
You No Longer Have to Rebuild the Whole VM to Get One File Back Until now, recovering a single file from an Azure VM with Premium SSDv2 or Ultra Disk meant restoring the entire machine. Item-Level Recovery is now generally available for both disk types and…
Volume Purchasing in Apple Business Manager Now Covers Subscriptions, Not Just Licenses Enterprise IT can now buy app subscriptions through the same volume purchasing workflow used for one-time licenses, ending the reimbursement-and-workaround era.
Shared Passwords Are Dead for Agents. Scoped Delegation Won, the Banks Just Said So When an agent logs in with your password, it gets all of your authority, not just the slice it needs. Major banks just started blocking that pattern, and if you're building agent…
Patch Tonight Won: Why “Mitigate and Wait” Loses the PHP RCE Fight Two unauthenticated RCE bugs in PHP affect every version before today's emergency patches, and working exploits already exist. Here's why the 'mitigate and wait' strategy fails against a bug with no login…
Your Riskiest Account Is the One Everyone Tells You to Exclude Microsoft's updated break-glass guidance requires two cloud-only Entra ID accounts excluded from Conditional Access, creating the exact security gap auditors flag. The checklist takes an afternoon; the monitoring and restraint to never…
Microsoft Hands Your SMS and Voice MFA to Third Parties on October 30 Starting October 30, Microsoft stops delivering SMS and voice MFA codes itself, forcing every tenant still using telephony methods to configure a third-party provider or face lockouts.

Enterprise IT, rewritten in real time.

The latest

Topics