Nothing matches your search.
All articles
- Governance & security
Automatic external forwarding in Exchange Online: three controls, and one value that tells you nothing
Whether mail can leave a Microsoft 365 organisation by automatic forwarding is decided by three separate controls, and the default value of the first one means On in some tenants and Off in others. How to read each control with PowerShell, how to find the mailboxes that forward today, and how to block forwarding with named exceptions.
Keep reading → - Governance & security
Giving an application access to specific SharePoint sites with Sites.Selected
An application needs one SharePoint site and the request on the table is Sites.Read.All or Sites.FullControl.All for the whole tenant. This article sets out what Sites.Selected grants on its own, who can create the per-site grant, the Microsoft Graph and PnP PowerShell calls that create, list and remove it, and where the documentation stops.
Keep reading → - Development & automation
A hybrid SharePoint integration needs more than a successful sign-in
A Java or .NET API can authenticate a caller while the downstream SharePoint operation still has the wrong authority. Compare the identities, contracts and failure boundaries before choosing a gateway or extracting legacy functionality.
Keep reading → - Microsoft 365 & SharePoint
Installing a SharePoint Server Subscription Edition update without downtime, step by step
Microsoft documents zero downtime patching for Subscription Edition: binaries on half the farm at a time, then the build-to-build upgrade one server at a time, while people keep working. What the farm must have before it is possible, every step with Microsoft's commands, the three places Microsoft's own pages disagree, and what zero downtime does not cover.
Keep reading → - Governance & security
SharePoint HTML pages are governed by a setting your custom script audit does not read
HTML pages run JavaScript inside a sandbox, are on by default, and are switched off site by site by each site owner. Microsoft states there is no tenant-level restriction, and the custom script setting is not part of the answer. What the sandbox stops, what it leaves to governance, and what to measure before general availability reaches your tenant.
Keep reading → - Migrations
What a SharePoint 2016 or 2019 farm stops receiving
Support for SharePoint Server 2016 and 2019 ended on 14 July 2026. One more security update for each followed on 11 August 2026, nothing has followed it, and Microsoft documents no Extended Security Update programme for either. What stopped, what the last updates changed, and what to decide while the farm still runs.
Keep reading → - Development & automation
Migrating privileged SharePoint server-side code requires an authorization design
A WSP that deploys on Subscription Edition has not proved its authorization boundary. Review caller intent, elevated object lifetime, external identities and business acceptance before retaining, refactoring, extracting or eliminating server-side code.
Keep reading → - Governance & security
The confident wrong answer is worse than missing evidence
A governance report told us a site had external sharing disabled. The site permitted anonymous links. Nothing was broken: a correct API returned a default value for a property it had never populated, and the default happened to be the safest word in the enum. Here is the mechanism, the code that reproduces it, Microsoft's own documentation of it, and the discipline that catches the whole class.
Keep reading → - AI & agents
A Copilot agent manifest is a security boundary. Here is the linter for it.
Every scoping property in a Microsoft 365 Copilot agent manifest is optional, and in six places omitting one grants the widest scope instead of the narrowest. A JSON Schema validator approves those manifests, because nothing in them is invalid: something optional is missing. So we wrote the check that does catch it. It finds six problems in a manifest that passes every other test.
Keep reading → - AI & agents
One agent is an integration. A hundred is a governance problem.
Agents got production identities before they got a stable way to record what they did. Microsoft Entra Agent ID is generally available, with sponsors and expiry dates. The OpenTelemetry conventions for agent traces are still experimental. That gap is not a detail: it decides what you can responsibly put into production this year, and it turns an AI question into a governance one.
Keep reading → - AI & agents
Agents decide. Code executes. Knowing the line is the job.
The promise is that agents replace applications. In the systems we build, they do not. An agent is very good at understanding a request, weighing options and choosing a tool. It is the wrong place for a payment, a tax rule or a permission check. This is where the line falls, and why putting it in the wrong place is expensive.
Keep reading → - AI & agents
AI solved syntax. It did not solve judgement.
Three independent measurements, taken between 2025 and 2026, all point the same way: AI-generated code passes over 95% on syntax and 55% on security, and that second number has not moved in two years. The part you write got cheap. The part you decide did not.
Keep reading → - AI & agents
Can your AI assistant read documents the user cannot see?
A badly built RAG searches with the application's identity, not the asker's, and the assistant answers with what the person should not see. The fix is not a filter someone can forget to write: it is passing the user's token and letting Azure AI Search enforce permissions inside the engine.
Keep reading → - Microsoft 365 & SharePoint
Windows 10 has ended: Windows 11 is the minimum, not the plan
Support ended in October 2025. Whether a fleet is already on Windows 11, paying for Extended Security Updates, or simply exposed, the decision underneath is the same: swap the PCs, or use the forced move to modernise the workplace behind them. This is the how, with the Intune, Autopilot and Azure commands, and the reason the same Windows 10 is free to keep alive in the cloud.
Keep reading → - Development & automation
Sending email from an application, without a single password
Microsoft turned off SMTP with a password. The answer is not to store a better secret: it is to store no secret at all. Managed identity, Microsoft Graph, and Mail.Send tied to a group of mailboxes. Here is the whole configuration, mistakes included.
Keep reading → - AI & agents
What to put in order before switching Copilot on
Copilot does not create permission problems. It makes the ones already there findable, and you no longer need to know what you are looking for.
Keep reading →
Categories
- Keep reading →
AI & agents
6 - Keep reading →
Azure & Cloud
4 - Keep reading →
Company
1 - Keep reading →
Development & automation
24 - Keep reading →
Governance & security
8 - Keep reading →
Microsoft 365 & SharePoint
3 - Keep reading →
Migrations
5
Send us a message
or write to hello@ph7x.com