Learn-it-all | 6X Azure MVP | MCT | Blogger @ https://xitter.cf/t.co/7Xj6BwvEck | Mentor | #a11y | Own views | @ComeCloudWithUs co-host | Husband | Author of https://xitter.cf/t.co/51cbeeoUIp
418 I'm a teapot
Joined September 2008
- Tweets15.2K
- Following4.9K
- Followers2.1K
- Likes26K
Pinned Tweet
I'm honored to have a signed copy of my book Configuring @windowsserver Hybrid Advanced Services Exam Ref AZ-801 entered into the Microsoft library in Redmond during the #MVPSummit! Thanks @MVPAward
a.co/d/iUcCO9O
#Microsoft #AZ801 #CloudComputing #HybridCloud
Chris Gill (@cfgcloud.io - Bsky) retweeted
Microsoft is RETIRING unmanaged Power Platform Developer environments.
Yes, including the ones from the free Power Apps Developer Plan.
> Nov 15, 2026: New creation stops.
> Dec 15, 2026: Existing environments start getting suspended.
> Jan 15, 2027: Deletion starts.
Developer environments survive with Managed Environments enabled.
The catch? The free Developer Plan doesn’t cover Managed Environments usage. Even running your OWN apps and flows requires qualifying premium licensing.
Check your demo environments NOW.
learn.microsoft.com/en-us/po…
Chris Gill (@cfgcloud.io - Bsky) retweeted
I recently wrote about why we need to treat models as insider risks, with security controls sitting outside the model itself.
Today, we're putting that principle into practice by expanding Project Perception with new capabilities to help continuously assess agent risk, adapt permissions, and contain threats.
blogs.microsoft.com/blog/202…
Chris Gill (@cfgcloud.io - Bsky) retweeted
Work IQ in the GitHub Copilot app is amazing! I needed to add a bunch of issues to a GitHub project that all link to M365 files for tracking purposes.
Would've taken me hours to add the issues manually, their titles, descriptions, links in M365, etc. but I got it done in < 30 minutes - which included creating a reusable skill that I can use to sync files to project issues in the future.
Time to get outside. 😀
Work IQ MCP: learn.microsoft.com/en-us/mi…
Chris Gill (@cfgcloud.io - Bsky) retweeted
Today marks a new chapter for Windows, as we bring unmetered intelligence to every desk and every home, and make every PC a place where agents can work securely on your behalf.
Some highlights of what we announced:
• MAI-Code-1.1 Flash: 137B parameter coding model w/ 256K context window, which is now optimized to run on your PC!
• GitHub Copilot now hands off work to local models like MAI-Code-1.1 Flash, helping projects cost a lot less without sacrificing quality.
• With Hybrid Intelligence, Copilot can now take action directly on the PC and keep sensitive work on your device.
• And with Code in Copilot, you can essentially build any software you need on your desktop, without any cloud token spend, and it’s just super at it. You’re no longer limited to what’s in an app store! Your PC becomes an infinite software factory.
• Security is foundational to all this, which is why we are also bringing together Windows and Agent 365 so agents can work within secure boundaries on-device, including MXC a local sandbox for agent execution. Windows becomes your secure agent box!
• All this comes to life on a new generation of devices, like Surface Laptop Ultra, powered by NVIDIA RTX Spark.
Can’t wait to see what you build with all this.
Chris Gill (@cfgcloud.io - Bsky) retweeted
Bring Conditional Access and MFA to your on-prem resources with Microsoft Entra.
Get started. youtu.be/LaDSrwAOszQ
Connect users to on-premises resources while enforcing Conditional Access policies, including MFA, and eliminate the need for VPNs using Secure Access Service Edge with Microsoft Entra.
Route authentication through Microsoft Entra before granting resource access, even within legacy on-premises systems. #SASE #MicrosoftEntra #GlobalSecureAccess
Chris Gill (@cfgcloud.io - Bsky) retweeted
AWS is coming for the cloud architect’s job.
Or at least, a big chunk of it.
They built an AI agent that can audit up to 100 AWS accounts, find architecture problems, and generate the Terraform fixes for them.
The new Well-Architected Agent checks cost, security, performance and resilience across 65+ AWS services.
Feed it Terraform, CloudFormation or CDK, and it can return the IaC changes and CLI commands needed to fix what it finds.
And it doesn’t stop after one review.
AWS says it can automatically re-check your environments every week.
Full announcement: aws.amazon.com/blogs/aws/ann…
Chris Gill (@cfgcloud.io - Bsky) retweeted
Intune can finally tell Windows Update to ignore Group Policy.
I am not talking about the stupid “MDM wins if there is a conflict,” but actually skipping the Windows Update Group Policy path.
The IgnoreWindowsUpdateGroupPolicies setting changes the source selection itself. When enabled, Windows Update can bypass the live GP values and the cached GP fallback, then continue with the managed policy sources instead.
That makes this a very interesting setting for anyone moving from WSUS or legacy Windows Update GPOs to Intune. I took a closer look at how it works on the device and what Windows actually checks before Group Policy gets skipped.
#Intune #MSIntune #WindowsUpdate #Windows11
patchmypc.com/blog/ignore-wi…
Chris Gill (@cfgcloud.io - Bsky) retweeted
I like to test my network connections to see if they’re reliable and what the capacity really is. There’s a PowerShell module for that with some nice options and reporting: Invoke-NetStress
#PowerShell #StressTest
powershellisfun.com/2026/10/…
Chris Gill (@cfgcloud.io - Bsky) retweeted
Microsoft made MicrosoftDocs/memdocs private. 😠
If you track Intune documentation changes, that repo was how you did it. It is 404 now. Not archived, not moved. Gone.
The important part: the docs themselves are fine. Every Intune and Autopilot page still publishes on Microsoft Learn exactly as before. What disappeared was the public git history behind them, and with it every diff, every page history, and every answer to "what actually changed on this page last Tuesday."
That broke Daily Intune News, which I build from that history. Intune just went dark.
I don't like it when Microsoft tells me 'No'.
So here's my workaround 🥰
I crawl the published Learn pages, save each one as Markdown at the path Learn built it from, and commit only what genuinely changed. The history of the crawl becomes the history of the docs.
intune-docs-mirror, the result for Intune and Autopilot. This is the one to watch or clone if you want the diffs.
github.com/merill/intune-doc…
And the part I am happiest about: Docs X-Ray works for Intune again.
On any Microsoft Learn Intune page, add an x after "microsoft" in the address bar:
learn.microsoft.com/en-us/me…...
becomes
learn.microsoftx.com/en-us/m…...
That opens the diff for the page you were just reading
→ microsoftx.com
Daily Intune News is running again on the new source:
✅ daily.intune.admin.news
Chris Gill (@cfgcloud.io - Bsky) retweeted
Intune now supports Deployment Plans: stage rollouts across rings instead of pushing to everyone at once.
Deployments experience + Multiple Admin Approval for safer changes.
Applies to: Win32 apps, Settings catalog, Endpoint security (Windows)
learn.microsoft.com/en-us/in…
🤖 Made with AI
Chris Gill (@cfgcloud.io - Bsky) retweeted
NEW BLOG: How to track browser extension installations with Microsoft Defender.
jeffreyappel.nl/how-to-track…
Chris Gill (@cfgcloud.io - Bsky) retweeted
If your Conditional Access strategy is based on blocking users from accessing specific resources, it is not as effective as you think it is
There are hundreds of resources that are pre-consented to the scopes you are trying to block
This is the only place they are documented 👇
Made some small changes to EntraScopes for a cleaner look and hopefully better usability. Let me know
if you find anything not working as expected.
entrascopes.com/
Chris Gill (@cfgcloud.io - Bsky) retweeted
📣 Right-click an installer in Windows Explorer. Choose "Package as .intunewin". Done.
Point it at an .exe, .msi, .msp or a whole folder.
It confirms what it is about to package, runs the Microsoft Win32 Content Prep Tool, names the package with the detected product version, and opens the output folder when it is finished.
github.com/imabdk/intunewin-…
#Intune #MicrosoftIntune #MSIntune #EndpointManagement #PowerShell #Win32
Chris Gill (@cfgcloud.io - Bsky) retweeted
‼️ BREAKING: OpenAI was hacked by an Anthropic model. A HEIF photo uploaded to OpenAI's public support forum triggered a bug in the site's image decoder, led to code execution on the forum, and, through a second flaw in OpenAI's own login, ended with a pull request in OpenAI's internal GitHub.
The forum runs Discourse, the off-the-shelf software behind countless community sites. Discourse was still shipping an old copy of libheif, the library that decodes iPhone-style photos. The bug in it had already been fixed upstream.
But the fix was never labelled a security fix, so nobody treated it as urgent.
Hacktron's researchers uploaded a HEIF image and got their own code running on community[.]openai[.]com.
Then came the second bug, in OpenAI's own single sign-on, the "log in with OpenAI" button the forum uses. It turned that forum foothold into the actual ChatGPT and Codex accounts of people who had signed in there. OpenAI employees among them.
And a ChatGPT account is no longer just a chatbot. Through Codex, users wire in Gmail, Outlook, Drive, Slack, GitHub.
To prove the access was real, they used one employee account to have Codex open a harmless pull request in OpenAI's internal repo. They say they read no sensitive code.
OpenAI patched the SSO flaw roughly 14 hours after the report and paid a $6,500 bug bounty.
The team says Anthropic's Opus 4.8 found the libheif bug, and Opus 5 turned it into a working exploit.
Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more were also vulnerable and compromised by the same team of researchers.
Chris Gill (@cfgcloud.io - Bsky) retweeted
The executives said the boardroom Wi-Fi “feels slow.”
Speed test: 487 Mbps.
Apparently 487 Mbps has bad energy.
So I created a new network:
EXECUTIVE_PRIORITY_5G
Same access points.
Same internet connection.
Same VLAN.
I just gave it a more expensive name.
Connected the CEO.
He opened a website and immediately said:
“Oh wow, this is way faster.”
By lunch, five VPs had asked for access.
I told them executive bandwidth is limited and I can only approve users with a genuine business requirement.
They are now competing for access to Wi-Fi they already had.
Performance is unchanged.
Satisfaction is through the roof.
Chris Gill (@cfgcloud.io - Bsky) retweeted
This is actually insane 😡
Instead of creating a client policy to disable personal account login to the new unified Copilot app, they are forcing orgs to roll out complex tenant restrictions that requires a proxy server or Global Secure Access.....
mc.merill.net/message/MC1454…
Chris Gill (@cfgcloud.io - Bsky) retweeted
Microsoft Entra ID can look completely locked down and still let you in through an Xbox.
We started with a standard low-privileged account. MFA on. Entra portal blocked. Conditional Access apparently doing its job.
But CA trusts the device platform based on the User-Agent, something the client fully controls. Windows, Linux, iPhone: all blocked. Xbox Series X: access token for Microsoft Graph, no MFA prompt.
From there it's Graph directly, users, groups, roles, and a clear-text password sitting in a group description. It belonged to a break-glass account with Global Administrator.
One policy gap. One badly stored secret. Full cloud compromise.
Want to see how we pulled this off? Read the full breakdown on our blog.
cqureacademy.com/blog/cqure-…
Chris Gill (@cfgcloud.io - Bsky) retweeted
Microsoft releases emergency Windows updates to fix RDS failures
bleepingcomputer.com/news/mi…
bleepingcomputer.com/news/mi…
Chris Gill (@cfgcloud.io - Bsky) retweeted
Microsoft Foundry is the best platform for running agents in the enterprise - and one reason is the observability and governance features to keep your agent within the bounds you define 🔐🔎
Long running agents can reason, act, and use tools to help transform so many parts of a business - but doing so responsibly means you need to be able to confidentially answer: What can it access? What can it influence? Where can data go? Can I reconstruct what it's doing? Can I control and budget costs?
Check out the demo below to see how Foundry provides a platform to answer all of these questions for you, and gives you a slick agentic developer experience to get it all up and running faster than ever before 🎉🧑💻
Chris Gill (@cfgcloud.io - Bsky) retweeted
For all the the IT admins asking, how do I make Active Directory MORE defensible. This is how…
Jerry Devore’s awesome series on Active Directory hardening.
Part 1 - Disabling NTLMv1
Part 2 - Removing SMBv1
Part 3 - Enforcing LDAP Signing
Part 4 - Enforcing AES for Kerberos
Part 5 - Enforcing LDAP Channel Binding
Part 6 - Enforcing SMB Signing
Part 7 - Implementing Least Privilege
Links for each one👇
techcommunity.microsoft.com/…
