Microsoft 365 Admin Tool Exposes Pitfalls in Graph, Exchange PowerShell and Intune Management
An experienced Microsoft 365 administrator has published a detailed account of the technical obstacles encountered while developing an open-source management layer on top of Microsoft Graph and Exchange Online.
The project, now at version 2.0 and called SwissKnife for MS Graph, evolved from a simple utility for adding users to group chats into a full engine that can preview any change before applying it through Microsoft Graph, Exchange Online PowerShell or LDAP.
Because the native Microsoft 365 and Graph interfaces lack a reliable “what-if” mode, every action in the tool is split into two explicit steps: a read-only planning phase that lists every object, field and value change, followed by an apply phase that executes only the approved list and records the outcome in an audit log.
The author highlights several persistent limitations in Microsoft services. Microsoft Graph still does not cover many common Exchange operations such as full mailbox access, Send As permissions or transport rules, forcing the tool to fall back to the preview-stage Exchange Admin API or to Exchange Online PowerShell module version 7.6.
On macOS and Linux the Security & Compliance endpoint is unavailable, so the solution introduces a Windows-based worker that executes only whitelisted cmdlets over mutual TLS without storing tokens locally.
Configuration rollback proved even harder than snapshot creation. Named locations referenced by Conditional Access policies receive new IDs when recreated, Intune returns secrets as null or masked values, and some Intune fields change automatically, creating perpetual drift. Transport rules also lack sufficient detail in Get-TransportRule output to be reliably recreated from a snapshot.
To mitigate risks from community scripts, every package declares its required cmdlets in advance. The host parses the script with the PowerShell AST, rejects undeclared commands or dynamic invocation, and runs the code in Constrained Language mode. Packages from the official catalog are signed with minisign; others require explicit digest approval before execution.
The tool additionally offers natural-language task search via Ctrl+K, access mirroring between users, Entra sign-in failure analysis, and read-only profiles for on-call staff. It is available for Windows, macOS and Linux with MIT license and requires administrators to register their own Entra application with least-privilege permissions.
Related articles
Why Complex Password Policies Fail to Protect Companies: Practical Account Security Guidance
Many organizations implement strict password rules requiring at least eight characters with numbers, uppercase letters, and special symbols, plus mandatory changes every 30 days. Employees respond by creating predictable variations such as Company2026!, Company2026@, and Company2026#, which offer little real protection against phishing or credential stuffing. The core issue lies in poor visibility into all accounts across Active Directory, VPN, cloud services, databases, and contractor access rather than password length alone. Effective security begins with full inventory of every account, classification into user, privileged, service, and external types, and clear ownership assignment. Privileged accounts require separate credentials, MFA, minimal rights, and activity logging, while service accounts must avoid hardcoded secrets in configuration files or source code. Password managers must enforce client-side encryption so that even compromised administrator accounts cannot access stored secrets. MFA deployment should prioritize high-risk entry points such as VPN, email, and backup systems, and access revocation must integrate with HR processes to prevent former employees or contractors from retaining credentials.
Wireshark Wi-Fi Traffic Analysis: Diagnosing Connectivity Failures in 802.11 Networks
Wireshark captures help distinguish between radio-layer issues, DHCP failures, and application-layer problems when a device connects to Wi-Fi but cannot load pages. The guide explains how to select the right capture point—client, monitor-mode adapter, or wired side of the access point—and why ordinary Ethernet headers often hide critical 802.11 management and control frames. Detailed sections cover CSMA/CA contention, frame types (Management, Control, Data), EAPOL-Key exchanges for WPA2-Personal, and the limitations of retry flags as loss indicators. Practical Linux commands using iw, dumpcap, and NetworkManager demonstrate how to enable monitor mode on channel 6 HT20 and record a two-minute trace. Filters for wlan.addr, eapol, and wlan.fc.retry allow analysts to isolate association failures, key-handshake problems, or DHCP delays. The article also addresses decryption of WPA2 traffic with a known passphrase and warns that Wireshark cannot replace a spectrum analyzer for detecting non-Wi-Fi interference.
15-Year-Old Developer Restores Social Network After Beget VPS Data Wipe in Cyber Attack
A 15-year-old Russian developer recovered his social network Agora within three hours after hosting provider Beget confirmed that a cyber attack had wiped his VPS, including binary backups. The recovery relied on offsite encrypted PostgreSQL dumps created just one day earlier using pg_dump and GPG, an escrow key for end-to-end encrypted messages, and pre-written migration scripts stored in a repository. The master encryption key stored only in the server environment was lost, rendering old private keys unusable and forcing a full re-encryption of 1218 messages via the escrow mechanism. Additional issues included broken authentication in existing Android builds, dead push notification subscriptions, and a failed monitoring runner hosted on the destroyed server. The incident highlighted the risks of single-provider architecture and insufficient offline key storage while demonstrating effective disaster recovery practices for a self-hosted Supabase stack.
Developer Creates Personal Task Manager Allowing Claude Code and OpenCode Agents to Autonomously Execute Marked Tasks
A developer has built a personal task management system at shar8.app that integrates directly with AI coding agents including Claude Code, Codex CLI, and OpenCode through the Model Context Protocol. Tasks marked with an 'Agent' flag are automatically picked up by scheduled agent runs, executed locally on the user's machine, and results are written back into the task notes for human review. The system supports both browser-based OAuth authentication and persistent bearer tokens for headless cron or CLI usage, with strict separation between human-initiated and agent-initiated actions. Security measures include treating task text as untrusted data rather than instructions, disabling all tools by default, and requiring explicit allow-lists for any external actions such as web search. The implementation uses a custom MCP server exposing fifteen specific tools for listing, creating, editing, and delegating tasks, while a companion plugin for Claude Code handles scheduled execution via native system schedulers like launchd and systemd timers. The author emphasizes that agents never assign work to themselves and that final task closure always remains with the human user.