All articles

  1. Governance & security

    SharePoint HTML pages are governed by a setting your custom script audit does not read

    HTML pages run JavaScript inside a sandbox, are on by default, and are switched off site by site by each site owner. Microsoft states there is no tenant-level restriction, and the custom script setting is not part of the answer. What the sandbox stops, what it leaves to governance, and what to measure before general availability reaches your tenant.

    ·9 min read

    Keep reading →
  2. AI & agents

    A Copilot agent manifest is a security boundary. Here is the linter for it.

    Every scoping property in a Microsoft 365 Copilot agent manifest is optional, and in six places omitting one grants the widest scope instead of the narrowest. A JSON Schema validator approves those manifests, because nothing in them is invalid: something optional is missing. So we wrote the check that does catch it. It finds six problems in a manifest that passes every other test.

    ·6 min read

    Keep reading →
  3. AI & agents

    What to put in order before switching Copilot on

    Copilot does not create permission problems. It makes the ones already there findable, and you no longer need to know what you are looking for.

    ·2 min read

    Keep reading →

Categories

Send us a message

or write to hello@ph7x.com

Contact