All articles

  1. Governance & security

    Documentation is a claim until the system is read against it

    A configuration document governs a Microsoft 365 or Azure estate only while it is bound to the system it describes: an owner, a documented reading of the actual state, a comparison and a date to read it again. What NIST SP 800-53 and Microsoft's guidance ask of documentation, how Compliance Manager keeps a recorded status apart from a read one, and three Microsoft 365 settings where the document and the tenant can disagree unnoticed.

    ·12 min read

    Keep reading →
  2. Governance & security

    The last Graph page is not proof of tenant coverage

    A successful response, an exhausted page chain and a complete population are three different claims. A small offline experiment shows where an apparently reliable collector can silently change one into another.

    ·4 min read

    Keep reading →
  3. Governance & security

    SharePoint HTML pages are governed by a setting your custom script audit does not read

    HTML pages run JavaScript inside a sandbox, are on by default, and are switched off site by site by each site owner. Microsoft states there is no tenant-level restriction, and the custom script setting is not part of the answer. What the sandbox stops, what it leaves to governance, and what to measure before general availability reaches your tenant.

    ·9 min read

    Keep reading →
  4. Governance & security

    A report can look complete and still be impossible to verify

    A report that looks complete and a report that can be verified are different objects. The three things a report has to carry so that its reader can check it without its producer, and the specimen we publish that carries them.

    ·2 min read

    Keep reading →
  5. Governance & security

    The confident wrong answer is worse than missing evidence

    A governance report told us a site had external sharing disabled. The site permitted anonymous links. Nothing was broken: a correct API returned a default value for a property it had never populated, and the default happened to be the safest word in the enum. Here is the mechanism, the code that reproduces it, Microsoft's own documentation of it, and the discipline that catches the whole class.

    ·7 min read

    Keep reading →
  6. Governance & security

    A cookie banner you can prove, with Azure Tables and Functions

    The banner you copy from a vendor can itself be a tracker. Build your own instead, with no third parties, and the hard part turns out not to be the banner: it is keeping the proof that the person consented. Here is all of it, from the browser to the Azure Table, step by step.

    ·7 min read

    Keep reading →

Categories

Send us a message

or write to hello@ph7x.com

Contact