{"generated":"2026-10-18T00:33:42.391Z","source":"https://azureblog.co.uk","count":60,"posts":[{"slug":"azure-arc-servers-complete-setup","title":"Azure Arc for servers: the complete setup guide, and why it changes how you run everything outside Azure","url":"https://azureblog.co.uk/posts/azure-arc-servers-complete-setup/","date":"2026-10-17","updated":"2026-10-17","tags":["Azure","Security","Governance"],"summary":"One agent turns any Windows or Linux server, in your datacentre, a branch office or another cloud, into an Azure resource you can patch, protect, monitor and govern from one place. How it works, how to plan it, every onboarding method, what to switch on, day-two operations and troubleshooting, plus a planner that builds your firewall list and onboarding script.","minutes":18,"json":"https://azureblog.co.uk/open/v1/posts/azure-arc-servers-complete-setup.json"},{"slug":"entra-default-user-permissions-review","title":"Every Entra default user permission, what it does, and how to check yours in one command","url":"https://azureblog.co.uk/posts/entra-default-user-permissions-review/","date":"2026-10-16","updated":"2026-10-16","tags":["Entra ID","Security","Governance"],"summary":"The agent blueprints toggle is the newest switch under Default user role permissions, but it isn't the only one. Here's what each setting controls, its Graph name, and a short PowerShell check to see where your tenant stands.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/entra-default-user-permissions-review.json"},{"slug":"users-can-create-agent-blueprints","title":"From November, every user can create agent blueprints in Entra unless you turn it off","url":"https://azureblog.co.uk/posts/users-can-create-agent-blueprints/","date":"2026-10-14","updated":"2026-10-14","tags":["Entra ID","Security","What's new"],"summary":"Message Center MC1506733: starting in early November 2026, default users can create agent identity blueprints unless an admin switches off a new user setting. What a blueprint controls, who's affected, and how to turn it off before the rollout.","minutes":3,"json":"https://azureblog.co.uk/open/v1/posts/users-can-create-agent-blueprints.json"},{"slug":"inside-an-azure-region","title":"What's actually inside an Azure region? From the planet to one server, then we break it","url":"https://azureblog.co.uk/posts/inside-an-azure-region/","date":"2026-10-13","updated":"2026-10-13","tags":["Azure","Security"],"summary":"Pick UK South from a dropdown and you're choosing a real place: zones, buildings, fences, generators, racks and hosts. Here's what's inside, layer by layer, using only what Microsoft publishes. Then choose how your app is deployed, knock out a server, a zone or the whole region, and see what survives.","minutes":6,"json":"https://azureblog.co.uk/open/v1/posts/inside-an-azure-region.json"},{"slug":"secure-boot-certificates-and-october-retirements","title":"Microsoft's deadline week: four products retire tomorrow, and Secure Boot's last 2011 certificate expires next Monday","url":"https://azureblog.co.uk/posts/secure-boot-certificates-and-october-retirements/","date":"2026-10-12","updated":"2026-10-12","tags":["Intune","Security","What's new"],"summary":"13 October 2026 ends support for Windows 11 24H2 Home and Pro, Windows 10 2016 LTSB and Office LTSC 2021, and moves Windows Server 2022 into extended support. On 19 October the Windows Production PCA 2011 certificate expires. Pick what you run for your own action list, and check any device's Secure Boot status in seconds.","minutes":8,"json":"https://azureblog.co.uk/open/v1/posts/secure-boot-certificates-and-october-retirements.json"},{"slug":"windows-server-2012-esu-ends","title":"Windows Server 2012 and 2012 R2: the last security update ships tomorrow","url":"https://azureblog.co.uk/posts/windows-server-2012-esu-ends/","date":"2026-10-12","updated":"2026-10-12","tags":["Azure","Security","What's new"],"summary":"Extended Security Updates for Windows Server 2012 and 2012 R2 end with the October 2026 Patch Tuesday. There's no fourth year, not even on Azure. Here's what stops, who's still running these servers and why, how to find yours, and what to do with them.","minutes":8,"json":"https://azureblog.co.uk/open/v1/posts/windows-server-2012-esu-ends.json"},{"slug":"governing-ai-agent-identities-in-entra","title":"Governing AI agent identities in Entra: sponsors, access packages and expiry","url":"https://azureblog.co.uk/posts/governing-ai-agent-identities-in-entra/","date":"2026-10-11","updated":"2026-10-11","tags":["Entra ID","Governance","Security"],"summary":"Every AI agent with an Entra Agent ID needs a human who answers for it, access that runs out, and a plan for when its sponsor leaves. Here's how to set up sponsors, access packages and Lifecycle Workflows so agents don't become the next generation of orphaned service principals.","minutes":8,"json":"https://azureblog.co.uk/open/v1/posts/governing-ai-agent-identities-in-entra.json"},{"slug":"domainless-saml-federation-b2b","title":"Domainless SAML federation: let partners sign in with their own IdP, whatever their email domain","url":"https://azureblog.co.uk/posts/domainless-saml-federation-b2b/","date":"2026-10-10","updated":"2026-10-10","tags":["Entra ID","Security"],"summary":"SAML/WS-Fed federation for B2B guests used to depend on the guest's email domain matching the partner's IdP. Domainless federation is now generally available, and it routes sign-in by the IdP's Issuer URI instead.","minutes":4,"json":"https://azureblog.co.uk/open/v1/posts/domainless-saml-federation-b2b.json"},{"slug":"how-a-tube-gate-gets-paid","title":"How a Tube gate gets paid: half a second at the edge, the maths in the back office","url":"https://azureblog.co.uk/posts/how-a-tube-gate-gets-paid/","date":"2026-10-10","updated":"2026-10-10","tags":["Azure"],"summary":"You tap a bank card, the gate opens, and your bank hasn't approved anything yet. Here's how London's contactless system works, why it's built that way, and the cloud design lesson inside it.","minutes":7,"json":"https://azureblog.co.uk/open/v1/posts/how-a-tube-gate-gets-paid.json"},{"slug":"entra-soc-identity-responder-role","title":"SOC Identity Responder: contain a compromised account without handing out admin roles","url":"https://azureblog.co.uk/posts/entra-soc-identity-responder-role/","date":"2026-10-09","updated":"2026-10-09","tags":["Entra ID","Security","Governance","What's new"],"summary":"A new built-in Entra role lets security analysts disable users, revoke sessions and reset passwords from Microsoft Defender, and nothing else. Here's what it can and can't do, and how to set it up with PIM.","minutes":5,"json":"https://azureblog.co.uk/open/v1/posts/entra-soc-identity-responder-role.json"},{"slug":"road-to-50-running-this-blog-for-1-a-month","title":"Road to 50: how this blog runs for about £1 a month","url":"https://azureblog.co.uk/posts/road-to-50-running-this-blog-for-1-a-month/","date":"2026-10-08","updated":"2026-10-08","tags":["Azure"],"summary":"Fifty posts in, here's exactly how azureblog.co.uk is built, hosted and published, and why the whole thing costs less than a coffee each month.","minutes":3,"json":"https://azureblog.co.uk/open/v1/posts/road-to-50-running-this-blog-for-1-a-month.json"},{"slug":"intune-september-2026-roundup","title":"Intune in September: deployment rings, faster compliance and stricter automation","url":"https://azureblog.co.uk/posts/intune-september-2026-roundup/","date":"2026-10-06","updated":"2026-10-06","tags":["Intune","Windows","What's new"],"summary":"Five recent Intune changes that affect how you roll out, how quickly devices become compliant, and whether your automation keeps working.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/intune-september-2026-roundup.json"},{"slug":"admin-consent-workflow-and-user-consent","title":"Lock down app consent without blocking your users","url":"https://azureblog.co.uk/posts/admin-consent-workflow-and-user-consent/","date":"2026-09-23","updated":"2026-09-23","tags":["Entra ID","Security","Governance"],"summary":"Illicit consent grants are a favourite way to steal mailbox data. Restricting user consent and turning on the admin consent workflow closes the door without making life miserable.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/admin-consent-workflow-and-user-consent.json"},{"slug":"graph-powershell-app-only-certificate","title":"Unattended Graph PowerShell scripts with certificate authentication","url":"https://azureblog.co.uk/posts/graph-powershell-app-only-certificate/","date":"2026-09-16","updated":"2026-09-16","tags":["PowerShell","Entra ID","Security"],"summary":"Scheduled scripts can't answer an MFA prompt. App-only authentication with a certificate is the right way to run Microsoft Graph PowerShell unattended.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/graph-powershell-app-only-certificate.json"},{"slug":"entra-sms-voice-mfa-retirement","title":"Microsoft is retiring its own SMS and voice MFA. Here's your plan.","url":"https://azureblog.co.uk/posts/entra-sms-voice-mfa-retirement/","date":"2026-09-04","updated":"2026-09-04","tags":["Entra ID","Security","Passkeys","What's new"],"summary":"Microsoft-provided text and phone call authentication in Entra ID ends for most users on 1 February 2027. Passkeys are already being switched on. What changes, when, and what to do now.","minutes":4,"json":"https://azureblog.co.uk/open/v1/posts/entra-sms-voice-mfa-retirement.json"},{"slug":"intune-august-2026-roundup","title":"Intune in August: unattended Remote Help, DDM app installs and eSIM","url":"https://azureblog.co.uk/posts/intune-august-2026-roundup/","date":"2026-09-02","updated":"2026-09-02","tags":["Intune","What's new"],"summary":"Helpdesk agents can now support Windows devices with nobody at the keyboard, Apple VPP apps can install through declarative device management, and corporate Android gets eSIM control.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/intune-august-2026-roundup.json"},{"slug":"azure-budgets-and-cost-anomaly-alerts","title":"Stop surprise Azure bills with budgets and anomaly alerts","url":"https://azureblog.co.uk/posts/azure-budgets-and-cost-anomaly-alerts/","date":"2026-08-26","updated":"2026-08-26","tags":["Azure","Governance"],"summary":"Azure won't stop you spending, but it will tell you early if you set it up. Two features take five minutes and catch most surprises.","minutes":3,"json":"https://azureblog.co.uk/open/v1/posts/azure-budgets-and-cost-anomaly-alerts.json"},{"slug":"private-endpoints-dns","title":"Private endpoints and DNS: why your private endpoint isn't being used","url":"https://azureblog.co.uk/posts/private-endpoints-dns/","date":"2026-08-19","updated":"2026-08-19","tags":["Azure","Security"],"summary":"You created a private endpoint, but traffic still goes to the public IP. It's almost always DNS. How private endpoint name resolution works and how to fix it.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/private-endpoints-dns.json"},{"slug":"key-vault-rbac-vs-access-policies","title":"Key Vault: move from access policies to Azure RBAC","url":"https://azureblog.co.uk/posts/key-vault-rbac-vs-access-policies/","date":"2026-08-12","updated":"2026-08-12","tags":["Azure","Security"],"summary":"Key Vault has two permission models. Azure RBAC is the recommended one, and switching is simpler than it looks if you plan the role mapping first.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/key-vault-rbac-vs-access-policies.json"},{"slug":"intune-july-2026-roundup","title":"Intune in July: macOS custom compliance and Defender settings that finally win","url":"https://azureblog.co.uk/posts/intune-july-2026-roundup/","date":"2026-08-05","updated":"2026-08-05","tags":["Intune","Security","What's new"],"summary":"Custom compliance comes to macOS, a preview stops Group Policy overriding your Defender settings, and Store app search goes regional.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/intune-july-2026-roundup.json"},{"slug":"windows-laps-with-intune","title":"Windows LAPS with Intune: unique local admin passwords in minutes","url":"https://azureblog.co.uk/posts/windows-laps-with-intune/","date":"2026-07-29","updated":"2026-07-29","tags":["Intune","Windows","Security"],"summary":"If every PC shares the same local administrator password, one compromised machine means all of them. Windows LAPS fixes that, and it's built into Windows and Intune.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/windows-laps-with-intune.json"},{"slug":"authenticator-jailbreak-root-detection","title":"Microsoft Authenticator now blocks jailbroken and rooted devices","url":"https://azureblog.co.uk/posts/authenticator-jailbreak-root-detection/","date":"2026-07-22","updated":"2026-07-22","tags":["Entra ID","Security","What's new"],"summary":"Authenticator now refuses to add or use work and school accounts on jailbroken or rooted phones. There's nothing to configure, but your service desk should know.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/authenticator-jailbreak-root-detection.json"},{"slug":"byod-windows-entra-registration-ga","title":"BYOD Windows access with Entra registration is now GA","url":"https://azureblog.co.uk/posts/byod-windows-entra-registration-ga/","date":"2026-07-15","updated":"2026-07-15","tags":["Entra ID","Windows","What's new"],"summary":"Users, partners and internal guests can now reach corporate resources from personal Windows devices using Entra registration, without joining them to anything.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/byod-windows-entra-registration-ga.json"},{"slug":"connect-sync-to-cloud-sync","title":"Entra Connect Sync is on its way out. Start planning for Cloud Sync.","url":"https://azureblog.co.uk/posts/connect-sync-to-cloud-sync/","date":"2026-07-08","updated":"2026-07-08","tags":["Entra ID","Hybrid identity","What's new"],"summary":"Microsoft has started a phased move of identity sync from Entra Connect Sync to Cloud Sync, and has closed a privilege takeover route in hybrid sync. Here's what both changes mean for you.","minutes":3,"json":"https://azureblog.co.uk/open/v1/posts/connect-sync-to-cloud-sync.json"},{"slug":"intune-suite-in-m365-e3-e5","title":"Intune's advanced features are coming to Microsoft 365 E3 and E5","url":"https://azureblog.co.uk/posts/intune-suite-in-m365-e3-e5/","date":"2026-07-02","updated":"2026-07-02","tags":["Intune","Microsoft 365","What's new"],"summary":"Remote Help, Endpoint Privilege Management, Cloud PKI and more are moving into the main Microsoft 365 licences. If you've been holding off because of the add-on cost, it's time to look again.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/intune-suite-in-m365-e3-e5.json"},{"slug":"entra-backup-and-recovery","title":"Entra Backup and Recovery is here: an undo button for your tenant","url":"https://azureblog.co.uk/posts/entra-backup-and-recovery/","date":"2026-06-24","updated":"2026-06-24","tags":["Entra ID","What's new"],"summary":"Entra ID now keeps daily backups of your critical directory objects and lets you compare and roll back changes. It's on by default, but you need to know how it works before you need it.","minutes":3,"json":"https://azureblog.co.uk/open/v1/posts/entra-backup-and-recovery.json"},{"slug":"entra-account-discovery-ga","title":"Account Discovery: find the accounts your SaaS apps forgot to tell you about","url":"https://azureblog.co.uk/posts/entra-account-discovery-ga/","date":"2026-06-17","updated":"2026-06-17","tags":["Entra ID","Governance","What's new"],"summary":"Account Discovery reports the accounts that exist inside connected applications, including orphaned ones that nobody in Entra was ever assigned. It's now generally available.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/entra-account-discovery-ga.json"},{"slug":"entra-device-soft-delete-preview","title":"Soft delete for Entra device objects: a safety net for device clean-ups","url":"https://azureblog.co.uk/posts/entra-device-soft-delete-preview/","date":"2026-06-10","updated":"2026-06-10","tags":["Entra ID","Windows","What's new"],"summary":"Deleted device objects can now go into a recoverable state instead of disappearing instantly. A small preview feature that takes the fear out of stale device clean-ups.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/entra-device-soft-delete-preview.json"},{"slug":"cross-tenant-group-sync-ga","title":"Cross-tenant group sync is GA: one group, many tenants","url":"https://azureblog.co.uk/posts/cross-tenant-group-sync-ga/","date":"2026-06-03","updated":"2026-06-03","tags":["Entra ID","Governance","What's new"],"summary":"Multi-tenant organisations can now sync security groups from a source tenant into target tenants, alongside the users already synced with cross-tenant sync.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/cross-tenant-group-sync-ga.json"},{"slug":"system-preferred-first-factor-passwordless","title":"System-preferred authentication now picks the first factor too","url":"https://azureblog.co.uk/posts/system-preferred-first-factor-passwordless/","date":"2026-05-27","updated":"2026-05-27","tags":["Entra ID","Passkeys","What's new"],"summary":"Users with a passkey may now sign in without being asked for a password at all, and registration campaigns can prompt for passkeys. Two changes that quietly push tenants towards passwordless.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/system-preferred-first-factor-passwordless.json"},{"slug":"rolling-out-require-compliant-device","title":"Rolling out \"require compliant device\" without a flood of tickets","url":"https://azureblog.co.uk/posts/rolling-out-require-compliant-device/","date":"2026-05-20","updated":"2026-05-20","tags":["Intune","Conditional Access","Entra ID"],"summary":"Requiring a compliant device is one of the strongest Conditional Access controls you can apply. It's also one of the easiest to get wrong. A step-by-step rollout.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/rolling-out-require-compliant-device.json"},{"slug":"win32-app-packaging-detection-rules","title":"Packaging Win32 apps for Intune: detection rules and return codes","url":"https://azureblog.co.uk/posts/win32-app-packaging-detection-rules/","date":"2026-05-13","updated":"2026-05-13","tags":["Intune","Windows"],"summary":"Most Win32 app failures in Intune come down to two things: a detection rule that doesn't match reality, and return codes Intune doesn't understand.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/win32-app-packaging-detection-rules.json"},{"slug":"entra-agent-id-identities-for-ai-agents","title":"Entra Agent ID: giving AI agents real identities","url":"https://azureblog.co.uk/posts/entra-agent-id-identities-for-ai-agents/","date":"2026-05-06","updated":"2026-05-06","tags":["Entra ID","Security","Governance","What's new"],"summary":"AI agents now get first-class identities in Entra, with Conditional Access and lifecycle controls following. Here's why identity teams should get involved early.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/entra-agent-id-identities-for-ai-agents.json"},{"slug":"configurable-token-lifetimes-ga","title":"Configurable token lifetimes are GA: when to shorten them (and when not to)","url":"https://azureblog.co.uk/posts/configurable-token-lifetimes-ga/","date":"2026-04-29","updated":"2026-04-29","tags":["Entra ID","Security","What's new"],"summary":"You can now set the lifetime of access, ID and SAML tokens per application. Useful for sensitive apps, but there are better tools for most session problems.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/configurable-token-lifetimes-ga.json"},{"slug":"pim-activation-conditional-access-context","title":"Require phishing-resistant MFA on every PIM activation","url":"https://azureblog.co.uk/posts/pim-activation-conditional-access-context/","date":"2026-04-22","updated":"2026-04-22","tags":["Entra ID","Governance","Conditional Access","What's new"],"summary":"PIM can now require a Conditional Access authentication context every time someone activates a role, and it's generally available. Here's how to set it up properly.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/pim-activation-conditional-access-context.json"},{"slug":"intune-remediations-scripts","title":"Intune Remediations: find and fix problems before users notice","url":"https://azureblog.co.uk/posts/intune-remediations-scripts/","date":"2026-04-15","updated":"2026-04-15","tags":["Intune","Windows","PowerShell"],"summary":"Remediations pair a detection script with a fix script and run them on a schedule. It's one of the most useful and underused features in Intune.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/intune-remediations-scripts.json"},{"slug":"entra-tenant-configuration-management","title":"Tenant configuration management: snapshot your Entra config and catch drift","url":"https://azureblog.co.uk/posts/entra-tenant-configuration-management/","date":"2026-04-08","updated":"2026-04-08","tags":["Entra ID","Governance","What's new"],"summary":"New APIs let you snapshot tenant configuration as JSON and monitor it for drift. Configuration as code for Entra just got much more practical.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/entra-tenant-configuration-management.json"},{"slug":"hybrid-join-with-entra-kerberos-preview","title":"Hybrid join without Entra Connect: hybrid join using Entra Kerberos","url":"https://azureblog.co.uk/posts/hybrid-join-with-entra-kerberos-preview/","date":"2026-04-01","updated":"2026-04-01","tags":["Entra ID","Hybrid identity","Windows","What's new"],"summary":"A new preview lets Windows devices become Entra hybrid joined during provisioning, without device sync through Entra Connect or AD FS.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/hybrid-join-with-entra-kerberos-preview.json"},{"slug":"guest-access-reviews","title":"Clean up guest accounts with access reviews","url":"https://azureblog.co.uk/posts/guest-access-reviews/","date":"2026-03-25","updated":"2026-03-25","tags":["Entra ID","Governance"],"summary":"Guest accounts pile up quietly. Access reviews ask the right people whether each guest still needs access, and can remove them automatically if nobody says yes.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/guest-access-reviews.json"},{"slug":"synced-passkeys-and-passkey-profiles","title":"Synced passkeys and passkey profiles are now GA in Entra ID","url":"https://azureblog.co.uk/posts/synced-passkeys-and-passkey-profiles/","date":"2026-03-18","updated":"2026-03-18","tags":["Entra ID","Passkeys","What's new"],"summary":"Entra ID now supports passkeys stored in password managers and phone platforms, and lets you set different passkey rules for different groups. Here's how to use both sensibly.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/synced-passkeys-and-passkey-profiles.json"},{"slug":"kql-queries-for-entra-sign-in-logs","title":"Six KQL queries for Entra sign-in logs every admin should keep","url":"https://azureblog.co.uk/posts/kql-queries-for-entra-sign-in-logs/","date":"2026-03-11","updated":"2026-03-11","tags":["Entra ID","Azure","Security"],"summary":"Once sign-in logs flow into Log Analytics, a few queries answer most of the questions you'll get. Copy these into a workbook or saved searches.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/kql-queries-for-entra-sign-in-logs.json"},{"slug":"edge-switched-language-intune-language-pack","title":"Why Edge suddenly switched language on a whole office","url":"https://azureblog.co.uk/posts/edge-switched-language-intune-language-pack/","date":"2026-03-04","updated":"2026-03-04","tags":["Intune","Windows"],"summary":"Users in one office reported Edge and LinkedIn appearing in another language. Nobody had touched Edge. The cause was an Intune app assignment.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/edge-switched-language-intune-language-pack.json"},{"slug":"external-mfa-ga","title":"External MFA is GA: third-party MFA without giving up Conditional Access","url":"https://azureblog.co.uk/posts/external-mfa-ga/","date":"2026-02-25","updated":"2026-02-25","tags":["Entra ID","Security","What's new"],"summary":"Entra ID now officially supports external MFA providers, with Entra still evaluating policy and risk. It's the proper replacement for custom controls.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/external-mfa-ga.json"},{"slug":"azure-resource-locks","title":"Resource locks: a cheap insurance policy against the wrong click","url":"https://azureblog.co.uk/posts/azure-resource-locks/","date":"2026-02-18","updated":"2026-02-18","tags":["Azure","Governance"],"summary":"A delete lock takes seconds to add and can save a production outage. Here's how locks work, and the ReadOnly gotchas to avoid.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/azure-resource-locks.json"},{"slug":"group-based-licensing-errors","title":"Group-based licensing: finding and fixing assignment errors","url":"https://azureblog.co.uk/posts/group-based-licensing-errors/","date":"2026-02-11","updated":"2026-02-11","tags":["Entra ID","Microsoft 365"],"summary":"Group-based licensing is the right way to assign Microsoft 365 licences, until a user silently doesn't get one. Here's where the errors hide.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/group-based-licensing-errors.json"},{"slug":"azure-policy-allowed-locations-and-guardrails","title":"Azure Policy guardrails every subscription should have","url":"https://azureblog.co.uk/posts/azure-policy-allowed-locations-and-guardrails/","date":"2026-02-04","updated":"2026-02-04","tags":["Azure","Governance"],"summary":"A handful of built-in Azure Policy assignments stop the most common mistakes before they happen. Start with these at the management group level.","minutes":3,"json":"https://azureblog.co.uk/open/v1/posts/azure-policy-allowed-locations-and-guardrails.json"},{"slug":"convert-synced-users-to-cloud-source-of-authority","title":"Converting synced users to cloud-managed: Source of Authority is GA","url":"https://azureblog.co.uk/posts/convert-synced-users-to-cloud-source-of-authority/","date":"2026-01-28","updated":"2026-01-28","tags":["Entra ID","Hybrid identity","What's new"],"summary":"You can now switch an individual Active Directory-synced user to be managed in the cloud, without deleting and recreating it. A big step towards shrinking on-premises AD.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/convert-synced-users-to-cloud-source-of-authority.json"},{"slug":"github-actions-to-azure-without-secrets","title":"Deploy from GitHub Actions to Azure without storing a single secret","url":"https://azureblog.co.uk/posts/github-actions-to-azure-without-secrets/","date":"2026-01-21","updated":"2026-01-21","tags":["Azure","Entra ID","Security"],"summary":"Workload identity federation lets GitHub Actions sign in to Azure with short-lived tokens instead of a stored client secret. Here's the full setup.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/github-actions-to-azure-without-secrets.json"},{"slug":"aadsts75011-requested-authn-context","title":"AADSTS75011: when the app insists on how you signed in","url":"https://azureblog.co.uk/posts/aadsts75011-requested-authn-context/","date":"2026-01-14","updated":"2026-01-14","tags":["Entra ID"],"summary":"Users click a link in an email, land on a SAML app, and get an error page. The fix is not in Entra at all.","minutes":3,"json":"https://azureblog.co.uk/open/v1/posts/aadsts75011-requested-authn-context.json"},{"slug":"managed-identities-vs-service-principals","title":"Managed identities vs service principals: which should your workload use?","url":"https://azureblog.co.uk/posts/managed-identities-vs-service-principals/","date":"2026-01-07","updated":"2026-01-07","tags":["Azure","Entra ID","Security"],"summary":"Both let code authenticate to Azure and Microsoft Graph. One needs you to manage secrets; the other doesn't. A simple guide to choosing.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/managed-identities-vs-service-principals.json"},{"slug":"named-locations-in-conditional-access","title":"Named locations: getting IP ranges and countries right in Conditional Access","url":"https://azureblog.co.uk/posts/named-locations-in-conditional-access/","date":"2025-12-17","updated":"2025-12-17","tags":["Entra ID","Conditional Access"],"summary":"Named locations look simple, but trusted IPs and country blocks are easy to get subtly wrong. What they can and can't do, and how to use them well.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/named-locations-in-conditional-access.json"},{"slug":"authentication-strengths-explained","title":"Authentication strengths: requiring the right kind of MFA","url":"https://azureblog.co.uk/posts/authentication-strengths-explained/","date":"2025-12-10","updated":"2025-12-10","tags":["Entra ID","Conditional Access","Passkeys"],"summary":"Requiring MFA treats an SMS code and a passkey as equals. Authentication strengths let you say which methods are good enough for which resources.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/authentication-strengths-explained.json"},{"slug":"defender-cspm-at-scale","title":"Turning on Defender CSPM across a landing zone","url":"https://azureblog.co.uk/posts/defender-cspm-at-scale/","date":"2025-12-03","updated":"2025-12-03","tags":["Azure","Security"],"summary":"Foundational CSPM is free and already on. Defender CSPM adds attack paths and agentless scanning. Here's how I'd roll it out across many subscriptions.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/defender-cspm-at-scale.json"},{"slug":"conditional-access-report-only-and-what-if","title":"Test Conditional Access safely with report-only mode and What If","url":"https://azureblog.co.uk/posts/conditional-access-report-only-and-what-if/","date":"2025-11-26","updated":"2025-11-26","tags":["Entra ID","Conditional Access"],"summary":"Most Conditional Access outages come from a policy that did something nobody expected. Two built-in tools let you see exactly what a policy would do before it does it.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/conditional-access-report-only-and-what-if.json"},{"slug":"scim-one-app-per-library","title":"SCIM provisioning when every target is its own app","url":"https://azureblog.co.uk/posts/scim-one-app-per-library/","date":"2025-11-19","updated":"2025-11-19","tags":["Entra ID"],"summary":"Some SaaS platforms need a separate Enterprise App for each instance or library. A few habits keep that manageable.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/scim-one-app-per-library.json"},{"slug":"break-glass-accounts-done-right","title":"Break-glass accounts done right","url":"https://azureblog.co.uk/posts/break-glass-accounts-done-right/","date":"2025-11-12","updated":"2025-11-12","tags":["Entra ID","Security","Conditional Access"],"summary":"Emergency access accounts are the one thing you hope never to use and must never get wrong. A practical checklist for setting them up and keeping them safe.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/break-glass-accounts-done-right.json"},{"slug":"activate-pim-roles-with-powershell","title":"Activate PIM roles from PowerShell with Microsoft Graph","url":"https://azureblog.co.uk/posts/activate-pim-roles-with-powershell/","date":"2025-11-05","updated":"2025-11-05","tags":["Entra ID","PowerShell","Governance"],"summary":"The portal is fine for occasional use, but if you activate roles every day, a few lines of Graph PowerShell are faster. Here's how to list eligible roles and activate one.","minutes":4,"json":"https://azureblog.co.uk/open/v1/posts/activate-pim-roles-with-powershell.json"},{"slug":"find-expiring-app-secrets-graph","title":"Find expiring app secrets and certificates before they bite","url":"https://azureblog.co.uk/posts/find-expiring-app-secrets-graph/","date":"2025-10-29","updated":"2025-10-29","tags":["Entra ID","PowerShell"],"summary":"Expired client secrets cause some of the most avoidable outages in Entra. A short Graph script shows what's about to expire across the tenant.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/find-expiring-app-secrets-graph.json"},{"slug":"saml-certificate-rollover","title":"Rolling a SAML signing certificate without an outage","url":"https://azureblog.co.uk/posts/saml-certificate-rollover/","date":"2025-10-22","updated":"2025-10-22","tags":["Entra ID"],"summary":"Entra SAML signing certificates expire after three years by default. Here's the cutover plan I use so nobody notices the change.","minutes":2,"json":"https://azureblog.co.uk/open/v1/posts/saml-certificate-rollover.json"},{"slug":"temporary-access-pass-onboarding","title":"Temporary Access Pass: onboarding users without a password","url":"https://azureblog.co.uk/posts/temporary-access-pass-onboarding/","date":"2025-10-15","updated":"2026-10-09","tags":["Entra ID","Passkeys","Security"],"summary":"A Temporary Access Pass lets a new starter, or someone who's lost their phone, sign in once and set up a passkey or Authenticator. No temporary passwords sent by email.","minutes":3,"json":"https://azureblog.co.uk/open/v1/posts/temporary-access-pass-onboarding.json"}]}