Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Reloj de pared de esfera oscura en una pared gris de oficina
11 min read

Cyber Resilience Act: 24 hours to report, and the clock does not start with the CVE

Article 14 of the Cyber Resilience Act starts to apply today: 24 hours for the first warning about an actively exploited vulnerability. Two details almost nobody is covering: it is the only article the regulation stretches backwards, reaching what you have already sold, and the deadline runs not from the CVE being published but from the moment you "become aware". That turns a legal obligation into an instrumentation problem: telemetry, a watched mailbox and who declares the time.

Regulation Compliance Cybersecurity
Read more →
Fila de puestos de trabajo vacíos en una oficina
10 min read

Entra ID retires memberOf on 3 November: after that date, membership stops being recalculated

Message centre post MC1448379, published on 5 August, has been read as a deadline. Read it the other way round: if you run a memberOf rule in production, you already have the problem it describes, and the preview documentation says so in a paragraph almost nobody reads. What happens on 3 November is not an outage or an error: memberships stay "in their last known state". That is where licences, Conditional Access and Teams membership hang from.

Identity Microsoft 365 Licensing
Read more →
Sala de celdas de media tensión de una subestación eléctrica
12 min read

"Resilience" is in the title of Spain's data centre decree. It is not in the articles

The consultation window closed today at 17:00. The draft is called "energy and environmental sustainability, resilience and digital sovereignty requirements applicable to data centres", and its article 5 carries "resilience" in the heading. Read in full, it creates not a single resilience requirement: it defers them to whatever regulation already applies to you. We think that is sound legislative technique and bad news for anyone hoping somebody would hand them availability. It does not bind you — the threshold is 1 MW of grid access capacity — but it will reach you anyway, through the contract of whoever hosts you.

Regulation Datacenter Colocation
Read more →
Cajas de archivo numeradas en estanterías de un depósito documental
9 min read

One checkbox will protect a whole workload in Microsoft 365 Backup. What it bills is not what you see in the usage report

Full Workload Backup reaches general availability from mid-September: one policy per workload protecting every SharePoint site, or every OneDrive account, or every mailbox, including the ones created later. List price is $0.15 per GB per month, applied to a base that adds in the second-stage recycle bin and online archives. Microsoft warns that its own usage report includes neither, "and is thus incomplete", and offers a calculator that does ask for them. The problem is that the report is what everybody looks at.

Backup Microsoft 365 Costs
Read more →
Priority Cleanup de Microsoft Purview: borrar por encima de la retención en Microsoft 365
9 min read

Deleting above retention: three approvals in Exchange, one in SharePoint

Microsoft Purview Priority Cleanup deletes Microsoft 365 content by overriding retention policies, labels and eDiscovery holds, and the documentation says what it deletes cannot be restored by users, by admins, or by Microsoft. Mailboxes always demand three approvals; SharePoint and OneDrive, one — and none from the retention owner. What stops it, what to switch off beforehand, and what it asks of your backup.

Microsoft 365 Backup Compliance
Read more →
Sala de espera de oficina en penumbra con tres sillas grises alineadas contra la pared
8 min read

Guest Wi-Fi is a database of people (and it is not in your inventory)

Manchester Airports Group confirmed on 27 August that an unauthorised third party took customer data: email addresses, phone numbers, vehicle registrations and postcodes, from car park, lounge and Fast Track bookings and from in-airport Wi-Fi sign-ups. The company has not published how many people are affected; reporting puts it at around 8.7 million. Operations were unaffected, and that is precisely the problem: the system holding the most people is almost never at the top of your criticality list. Why the number plate is the field to watch, and the six questions worth one afternoon of inventory at your own front desk.

Privacy Zero Trust Networking
Read more →
Rincón de oficina con una papelera metálica desbordada de papel y una destructora con el depósito lleno
9 min read

Recoverable Items: 14 days, 30 GB and the day the mailbox can no longer delete

The folder that saves you when someone empties the deleted items does not show up in Outlook, keeps things for 14 days by default and holds 30 GB. Put the mailbox on hold and the ceiling rises to 100 GB — in exchange for never draining again: things only go in. And on the day it hits that ceiling, per Microsoft's own documentation, the user cannot delete, versions stop being kept and audit entries stop being written. How to measure your headroom with two commands, how to open the drain that ships disconnected, and why a folder deleted with Shift+Delete does not come back even under litigation hold.

Microsoft 365 Backup Compliance
Read more →
Sala de archivo con estanterías metálicas llenas de cajas de cartón y una caja sacada a medias del estante
8 min read

Microsoft 365 Archive is coming to retention policies: compliance up, availability down

This autumn, a Purview retention policy will be able to move SharePoint files into the cold tier (roadmap 561208: preview in September, GA in October). Microsoft promises cost, compliance and search; its own documentation adds that archived content is "no longer directly accessible to anyone" and lists the apps that break: Word and PowerPoint online, the mobile apps, the macOS sync client and Office builds not updated since March. A reactivated file cannot be archived again for 120 days.

Microsoft 365 Compliance Backup
Read more →
Percha de pared en la entrada de personal de una oficina con decenas de tarjetas de acceso colgadas de cordones y varios ganchos vacíos
8 min read

The directory holds more records than the company has employees

McDonald's reports just over 150,000 employees in its annual filing. The batch of its corporate directory put up for sale this week holds 1.7 million records. We placed the leaked counts next to the declared headcounts of seven companies, and the result is not a story about carelessness: it is about what a Microsoft Entra ID directory actually contains, who can read all of it with any ordinary password, and why the switch that closes it is one the vendor itself advises against touching.

Microsoft 365 Identity Security
Read more →
Paso fronterizo vacío con la barrera levantada: la frontera de datos europea sigue dibujada y el tráfico pasa igual
8 min read

Three settings decide whether Claude processes your documents in Copilot, and one was decided by your tenant's creation date

Microsoft turned Anthropic models on by default in Microsoft 365 Copilot, but not in the EU. There are three separate settings with three different defaults, one of them depends on whether the tenant was created before or after 25 March 2026, and Microsoft's own documentation sends you to the Message Center to find out yours. What each source says, what cannot be inferred from them, and the twenty-minute review.

AI Microsoft Regulation
Read more →
Primer plano de papel triturado con restos de texto: el recall en la nube borra el mensaje del buzón del destinatario, y ahora podrá ordenarlo otra empresa
8 min read

Cross-tenant recall: Exchange Online lets another company delete mail from your mailboxes

In mid-August Microsoft starts rolling out cross-tenant message recall in Exchange Online (MC1423106). It ships switched off, and you do not turn it on to recover your own emails: you turn it on so senders in another tenant can delete messages already delivered to your people's mailboxes. What cloud recall does today (hard delete, read messages included, retrying for up to 24 hours), why the allow list looks far too much like the list of domains invoice fraud uses, what actually protects you (retention, not the checkbox), and the logging gap almost nobody has read.

Exchange Microsoft Compliance
Read more →
El AI Act ya aplica desde el 2 de agosto de 2026: qué obligaciones entraron de verdad, qué aplazó el Ómnibus digital sobre IA y el checklist de inventario de everyWAN
8 min read

The AI Act already applies to you — and not for the reason the headlines gave

On 2 August the bulk of the EU AI Act became applicable. Six days earlier, the Digital Omnibus on AI (Regulation EU 2026/1744, in force since 27 July) pushed high-risk obligations to December 2027 and August 2028. What does apply from 2 August is Article 50 — transparency — with fines of up to €15M or 3% (the lower amount for SMEs) and a date almost nobody wrote down: 2 December 2026. What actually changed, where Article 25 really bites, and the inventory checklist we run on a Microsoft 365 tenant.

AI Compliance Regulation
Read more →
La nueva retención por último acceso de Microsoft Purview borra ficheros de SharePoint y OneDrive y deja 93 días de papelera como único margen
7 min read

What nobody opens gets deleted: Purview, last accessed, and the 93 days to notice

By mid-August 2026 Microsoft finishes rolling out a Purview retention rule that deletes SharePoint and OneDrive files nobody has opened for a given period, justified on the grounds that Copilot will answer better. It deletes nothing on its own: somebody has to configure it. But it is the first deletion trigger that measures not a property of the document but the absence of human activity, and the file nobody opens in three years may well be the one you need in year four. What is actually shipping, the 93 recycle-bin days that are your only margin, why version history will not save you, and what we would do before touching that button.

Microsoft Backup SharePoint
Read more →
NIS2 en España: la ley sin publicar y el cuestionario de proveedor que ya está en tu correo
8 min read

NIS2 in Spain: the law is not here yet, your customer's questionnaire is

As of 29 July 2026 the Spanish law transposing NIS2 still has not been published in the official gazette: the text was approved by the Council of Ministers in January 2025 at first reading and is still a draft bill, and on 8 July the European Commission decided to refer Spain to the Court of Justice of the EU asking for penalties. That does not mean NIS2 is not affecting you: it means it will not arrive via an inspector, but via your largest customer's procurement department. What already applies today with no transposition needed, what those supplier questionnaires really ask, and what we would do with ninety days ahead of us.

NIS2 Compliance Continuity
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN