Microsoft 365 Admin Tool Exposes Pitfalls in Graph, Exchange PowerShell and Intune Management
An experienced Microsoft 365 administrator has published a detailed account of the technical obstacles encountered while developing an open-source management layer on top of Microsoft Graph and Exchange Online.
The project, now at version 2.0 and called SwissKnife for MS Graph, evolved from a simple utility for adding users to group chats into a full engine that can preview any change before applying it through Microsoft Graph, Exchange Online PowerShell or LDAP.
Because the native Microsoft 365 and Graph interfaces lack a reliable “what-if” mode, every action in the tool is split into two explicit steps: a read-only planning phase that lists every object, field and value change, followed by an apply phase that executes only the approved list and records the outcome in an audit log.
The author highlights several persistent limitations in Microsoft services. Microsoft Graph still does not cover many common Exchange operations such as full mailbox access, Send As permissions or transport rules, forcing the tool to fall back to the preview-stage Exchange Admin API or to Exchange Online PowerShell module version 7.6.
On macOS and Linux the Security & Compliance endpoint is unavailable, so the solution introduces a Windows-based worker that executes only whitelisted cmdlets over mutual TLS without storing tokens locally.
Configuration rollback proved even harder than snapshot creation. Named locations referenced by Conditional Access policies receive new IDs when recreated, Intune returns secrets as null or masked values, and some Intune fields change automatically, creating perpetual drift. Transport rules also lack sufficient detail in Get-TransportRule output to be reliably recreated from a snapshot.
To mitigate risks from community scripts, every package declares its required cmdlets in advance. The host parses the script with the PowerShell AST, rejects undeclared commands or dynamic invocation, and runs the code in Constrained Language mode. Packages from the official catalog are signed with minisign; others require explicit digest approval before execution.
The tool additionally offers natural-language task search via Ctrl+K, access mirroring between users, Entra sign-in failure analysis, and read-only profiles for on-call staff. It is available for Windows, macOS and Linux with MIT license and requires administrators to register their own Entra application with least-privilege permissions.
Related articles
Neuromorphic Processors Lag Behind GPUs for Large AI Models Despite Energy Advantages
Neuromorphic chips such as Intel Loihi promise major energy savings by activating only when events occur, yet data centers remain dominated by GPUs optimized for dense matrix operations in generative AI. The mismatch arises because modern large language models rely on high-precision linear algebra, massive memory bandwidth, and mature software stacks that neuromorphic architectures currently lack. Researchers are exploring spiking transformers and on-chip plasticity via mechanisms like STDP, but scaling to billions of parameters remains challenging. Companies including BrainChip, SynSense, and SpiNNaker2 have released commercial neuromorphic hardware, yet the absence of standardized tools and clear performance gains for mainstream workloads slows adoption. Hybrid approaches combining neuromorphic blocks with in-memory computing, analog circuits, and photonic accelerators may define future heterogeneous systems rather than outright replacement of GPUs.
Russia Expands Digital Birth Certificates via MAX App for Transport, Healthcare and Public Services
The Russian government has broadened the list of situations where parents can use the electronic version of a child’s birth certificate stored in the Digital ID section of the MAX service. The digital document can now be presented when buying transport tickets, claiming free or discounted travel, boarding public transport, receiving medical care under OMS, visiting MFC offices, museums, cultural and sports events, and purchasing discounted tickets. The measure also covers any other services requiring proof of a minor’s identity. Use of the QR code remains voluntary, and the paper certificate continues to be valid. The service activates gradually as organizations connect their systems, with more than 3,000 hotels already integrated.
PT AF Cloud Uses Machine Learning to Detect Shifts in Web Attack Patterns from Millions of WAF Events
Positive Technologies has detailed how its PT AF Cloud service applies anomaly detection to WAF events, turning tens of millions of daily security events into actionable weekly alerts for SOC teams. The system builds traffic profiles based on the distribution of triggered protection rules for each tenant and compares current hourly or daily profiles against a weighted historical baseline using Jensen-Shannon distance. This approach identifies meaningful changes in attack composition even when overall event volume remains stable, catching the start of scans, exploitation of newly published vulnerabilities, or post-release application changes that trigger new rules. Two detection modes operate in parallel: an hourly mode for rapid spikes and a daily mode for gradual shifts distributed across multiple hours. Alerts include comparative tables of top rules, unique attack vectors, and direct links to the relevant events in the PT AF interface. Over four weeks the detector surfaced roughly 1,100 anomalies across the cloud, with expert review confirming that 69 percent indicated either an attack or a protection misconfiguration.
How to Prepare Your Website for Data Center Outages: Business Resilience Checklist
Following strikes on Yandex data centers, many businesses discovered that their sites and all backups were stored in a single location, leading to complete outages. The article provides a detailed checklist to mitigate such risks by separating critical components across different providers. Key recommendations include moving DNS to an independent provider, lowering TTL values, maintaining a live mirror site on separate hosting, and isolating corporate email. Additional steps cover local backups, monitoring, access management, and CDN usage. The guidance differentiates between virtual hosting, VPS or dedicated servers, and website builders like Tilda, while emphasizing compliance with Russian data localization laws such as 152-FZ.