The custom Apple OIDC connector is dead. The built-in provider won.
Apple identity federation is now generally available in Entra External ID. Here’s the name-claim gotcha that cost me a week in production.
Continue Reading
Still tracking GovCloud subnets in spreadsheets? Azure finally has a better answer
IP address management is now GA in Azure sovereign clouds. For federal agencies and regulated workloads, that means one fewer third-party appliance to accredit inside the boundary.
Continue Reading
macOS 27 Beta 6 Has No New Identity APIs—Settled in June
Three commands prove Beta 6 added no identity APIs—but the real risk this late in the cycle isn’t in the headers. It’s in the behavior changes under a frozen surface.
Continue Reading
Three things break the day you find the MikroTik you forgot you owned
There’s always one router nobody remembered to lock down—the site router installed by a contractor in 2019, still humming, still reachable from the internet on port 22. That’s the box being hijacked right now through a pre-authentication SSH bypass in MikroTik RouterOS.
Continue Reading
Native Authentication moves the password prompt off Microsoft’s domain and into your SPA
For fifteen years, you didn’t handle the password—you redirected to Microsoft and got back a token. Native Authentication for Entra External ID changes that: your SPA now collects credentials and drives sign-in through API calls.
Continue Reading
Azure OpenAI is now cleared for Top Secret data — what that word means
Intelligence analysts working with classified data couldn’t legally use the best language models — their data lived where those models couldn’t go. That gap just closed, but ‘authorized’ and ‘deployed’ are very different words.
Continue Reading
The Invisible Unicode Block That Moved From AI Jailbreaks to Spam
The gap between what humans see and what machines ingest is the whole attack. A Unicode block that jailbroke LLMs has migrated to spam toolkits.
Continue Reading
Someone Is Backdooring Magento Stores Through a Door Adobe Hasn’t Locked Yet
A zero-day in Magento and Adobe Commerce gives attackers unauthenticated remote code execution—and there’s no patch yet. Sansec reports active exploitation to plant backdoors in production e-commerce stores.
Continue Reading
Three Things That Broke When We Let Copilot Loose on the Finance Tenant
Copilot inherits every permission your users have, then indexes everything Microsoft Graph says they can technically open. That SharePoint site shared with ‘Everyone’ since 2021 just became searchable.
Continue Reading
Three Things That Break the First Time You Ship a Conditional Access Policy as Bicep
Microsoft’s Bicep extension for Entra ID went GA in July 2025. Here’s what actually happens when you try to version-control a Conditional Access policy for the first time.
Continue Reading