3 min read
I audited a ‘three zones everywhere’ estate. Half bought resilience it couldn’t use.
Zone resiliency is a per-component decision, not a per-workload one. Most estates have it backwards: three zones on the tier that didn't…
Azure
Azure
4 min read
Three things that broke when one token could impersonate any admin
Microsoft patched a maximum-severity flaw that let an attacker forge a token in their own tenant and use it to impersonate Global…
4 min read
Three ways a leaked SAS token bites you — user-bound delegation closes one
Azure Storage's new user-bound SAS tokens tie access to a live Entra principal, not just the token string. Revoke the identity and…
7 min read
The 90-Day Secret Rotation Ticket Is Now Optional Across Tenants
Managed identities can now authenticate to app registrations across tenant boundaries using federated credentials. The GA release means you can finally delete…
4 min read
The custom Apple OIDC connector is dead. The built-in provider won.
Apple identity federation is now generally available in Entra External ID. Here's the name-claim gotcha that cost me a week in production.
7 min read
Still tracking GovCloud subnets in spreadsheets? Azure finally has a better answer
IP address management is now GA in Azure sovereign clouds. For federal agencies and regulated workloads, that means one fewer third-party appliance…
7 min read
A service principal gets popped. How long until its token dies?
Traditional token expiry leaves a 60-90 minute window after you disable a compromised service principal. Continuous Access Evaluation closes that gap for…
4 min read
Native Authentication moves the password prompt off Microsoft’s domain and into your SPA
For fifteen years, you didn't handle the password—you redirected to Microsoft and got back a token. Native Authentication for Entra External ID…
7 min read
Azure OpenAI is now cleared for Top Secret data — what that word means
Intelligence analysts working with classified data couldn't legally use the best language models — their data lived where those models couldn't go.…
6 min read
Three Things That Break the First Time You Ship a Conditional Access Policy as Bicep
Microsoft's Bicep extension for Entra ID went GA in July 2025. Here's what actually happens when you try to version-control a Conditional…