Microsoft 365 · Entra ID · Intune · Security
All about
Microsoft 365
Practical security guidance across Microsoft 365, from Message Center changes to tenant misconfigurations.
Latest
All updates
-
Entra Agent ID explained: who gets to create AI agents?
Entra Agent ID gives AI agents their own identity. What blueprints and agent identities are, why the setting 'Users can create agent blueprints' matters, and when to leave it on or switch it off.
-
Entra Connect Sync needs version 2.6.84.0 and application-based authentication by April 7, 2027
From April 7, 2027, Entra Connect Sync servers must run 2.6.84.0 or later and use application-based authentication, or synchronization fails. Here is how to check, switch and keep the new certificate rotating.
-
SSPR stops accepting directory-sourced contact info on November 7
MC1325414: SSPR stops accepting directory-sourced phone numbers and emails on November 7, 2026. Authenticator + OATH count as one method, FIDO2 doesn't count at all, SMS/voice is retiring in 2027.
-
Intune adds deployment plans for staged app and policy rollouts (Preview)
Intune can now roll out a Win32 app, Settings catalog profile, or endpoint security policy in timed rings instead of all at once. Useful, but pausing or cancelling doesn't roll anything back, and the payload isn't locked while the rollout runs.
-
Intune adds client-driven compliance evaluation for Windows (Preview)
Seven specific compliance signals on Windows devices now trigger a re-evaluation in near real time instead of waiting for the next scheduled check-in. Everything else still runs on the old cycle, and there's built-in throttling most write-ups have missed.
-
User.ReadBasic.All loses access to app roles and license data this month
User.ReadBasic.All has quietly exposed app role assignments and license details since it shipped. That access closes in a rollout completing late September 2026. What breaks, and one discrepancy in Microsoft's own migration guidance worth checking before you act on it.
-
Require approved client app is retired on June 30: migrate now
Require approved client app is deprecated June 30. After that date, existing policies stop enforcing. Here is what to configure before the deadline.
Risky User Analyzer
Point it at one Microsoft 365 user account and see within minutes whether sign-in activity, MFA status, or mailbox rules show the early warning signs of a hijacked account.
Learn more