To find whoever is leaking GTA 6 material, on 20 August 2026 Take-Two filed two DMCA subpoenas asking Microsoft and Discord for the MachineGuid, MSA device identifiers, IP addresses, phone numbers, linked connections and OneDrive contents of every account in three servers. What MachineGuid is, why it identifies the device rather than the account, and why your company generates exactly the same trail every working day.
The Microsoft Learn page on Conditional Access custom controls lists eight things that control cannot do, and the third is satisfying the MFA claim requirement. It is no good for PIM role elevation, device enrollment, SSPR, sign-in frequency or cross-tenant trusts either. From September 2026 they can no longer be created or edited, and "editing" means deleting and creating again. With the Graph query to find out whether you have one.
On Monday 31 August, incident EX1464935 on Exchange Online ended up as MO1465074, with OneDrive, SharePoint Online, Teams, Purview and Defender XDR inside it. Six names, one shared authentication configuration underneath. We go through the hours —including the ones BleepingComputer and Computerworld disagree on, which we say rather than picking one—, why nobody has confirmed the expired-certificate story, and the dependency almost nobody will look at: the security console and the audit layer were inside the thing that had gone down.
Hugging Face published the forensic timeline of the July intrusion and OpenAI closed its report on 26 August: 17,600 reconstructed actions between the 9th and the 13th. Between the first compromised container and the object holding 136 keys there was not one further vulnerability — there were defaults. The token every pod mounts, the metadata endpoint that answers from inside, secrets concentrated in one object, and a connector credential shared across clusters. We walk the chain with the timestamps in front of us, the two CVEs CISA added to its catalogue on 27 August, and the five questions we ask a cluster.
On 30 August it emerged that Anthropic was warning Claude users that an infostealer had taken their browser session. Coverage treated it as an AI story. If somebody at your company got that email, it is something else: it is an infection report for a machine in your estate, signed by a supplier that is not yours and spotted through billing. We go through why MFA never even enters the picture, the five critical events that do cut a session in Microsoft Entra and the one missing from that list, the real arithmetic of revocation (1 hour, 28 hours, up to 15 minutes of latency, up to a day for a group change) and where the purpose-built defence against token theft stands today: in preview precisely in the browser, which is where this happened.
In July we went through the timeline for the retirement of SMS and voice in Microsoft Entra ID. Five days after that post Microsoft published a FAQ, and there are now forty-eight hours to go until the first date. This is the run-through of what is still unanswered: the FAQ's "No" to the lockout question and what it says three lines further down, the self-service password reset that goes with the same move, the declared gap for B2B guests, the break-glass accounts the documentation never mentions, and why the temporary opt-out switch, which lives on the Graph beta endpoint, is not the answer we would give.
On Monday 24 August, at 03:38, a denial-of-service attack began against Norway's shared government digital platform. Ten public services went down and several had nothing wrong with them: the door everyone goes through had jammed. Digdir writes on its status page that <code>eSignering</code> was unavailable "because of the limitations in ID-porten", and also that the services were "stable with the limitations that have been put in place" — part of the outage was put there by the defenders. Why single sign-on is still the right call, what changes when the door becomes infrastructure, and the three questions that reclassify it.
On 10 August Truffle Security re-tested 10,616 AWS credential pairs that had surfaced publicly since August 2022 and 88% still authenticated. Of those traceable to a company, 768 out of 817 granted full control of the account. The median age is 1,831 days and the oldest predates IAM itself. Separately from that tally, Hugging Face holds another 8,482 live keys across 3,394 public datasets.
On 20 August Microsoft published a critical remote code execution flaw in Entra ID, and the next day corrected the exploitation field to "No". There is nothing to install: the record says "customerActionRequired: false". What is yours is the ability to answer "were we affected?", and on an Entra ID Free licence that lasts seven days. How to read the record from Microsoft's own API, and the checklist we apply to the tenant.
McDonald's reports just over 150,000 employees in its annual filing. The batch of its corporate directory put up for sale this week holds 1.7 million records. We placed the leaked counts next to the declared headcounts of seven companies, and the result is not a story about carelessness: it is about what a Microsoft Entra ID directory actually contains, who can read all of it with any ordinary password, and why the switch that closes it is one the vendor itself advises against touching.
Baseline Security Mode puts twenty-one settings in the Microsoft 365 admin center that used to live only in PowerShell: switching off basic authentication, EWS, ActiveX, IDCRL, Publisher. Microsoft's guidance says to turn each one on when its impact report comes back at zero. The detail that changes the reading: the Office app settings are delivered through Cloud Policy, and Windows clients below version 2510 do not send the simulation mode telemetry that feeds that report. What each switch turns off, what actually breaks when you close EWS, and the order we do it in.
On 30 September 2026, any Entra Connect synchronisation running below version 2.5.79.0 stops working. This is not the Cloud Sync migration: it is a separate thing, and it is the only one of the two with a fixed date. The migration runs in waves, allows exceptions and has no announced retirement date. What exactly breaks when sync stops (hint: not email — the offboarding that never reaches the cloud), why auto-upgrade fails to save precisely the servers that need it, and the eight rows in Microsoft's own comparison table that decide whether you can move to Cloud Sync yet.
Sounding convincing is not proof of identity, and in many organisations it is the only thing asked for. On 7 August Levi Strauss told the SEC that corporate information was taken from three company computers through social engineering: the work we use to measure security — patch, update, reboot — would have changed nothing. The joint CISA and FBI advisory on Scattered Spider says the targets are large companies and their contracted IT help desks, and that includes us. Why 65% of initial access now arrives through identity, why passkeys will not save you if the desk can enrol a new factor, and the eight things we ask of a reset procedure.
On 3 August, Unit 42 published three ways into passkey-protected accounts without breaking a single line of cryptography. The worst of them lifts a 32-byte secret out of Chrome's memory that decrypts every passkey synced to the account — and in Google's current implementation that secret cannot be rotated or revoked. All three start the same way: with malware already running on a Windows machine, with no administrator rights and no privilege escalation. We still recommend passkeys, and this post explains why that is not a contradiction.
More than 700 organisations were potentially exposed in August 2025 without a single password being stolen: the attacker took the OAuth tokens of an application they had connected themselves. On 13 July 2026 Microsoft published the map of a full year of that technique: two attack chains and not one suspicious sign-in. The part that fails is not the login, it is consent: how to inventory the applications connected to your tenant with two Graph queries, what each button actually switches off, and why changing the consent setting revokes nothing already granted.
To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list
Microsoft 365
ES 
CAT 
EN