Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Portátil abierto sobre una mesa de madera maciza, con el ratón al lado y la silla retirada
11 min read

Outlook leaks your hash, and Microsoft calls it "moderate"

Of the 1,095 vulnerabilities Microsoft patched on 10 November, exactly one is being exploited: CVE-2026-124194, in Outlook, carrying the lowest severity label in the batch. Inside: our own count against Microsoft's API, what its FAQ says word for word, why the Office patch does not arrive through Windows Update, the exact builds per channel, and the switch Windows 11 24H2 already ships to cut outbound NTLM (including when NOT to turn it on).

Workplace Microsoft 365 Patching
Read more →
Bloque de buzones metálicos de una comunidad, con una puertecilla abierta y otra arrancada
10 min read

Your Microsoft 365 backup has stopped seeing three places, and nobody changed the policy

On 1 October Microsoft started blocking EWS in Exchange Online. There are three locations with no Graph replacement you can back up with —public folders, the in-place archive and group mailboxes— and a process that is on by default and moves old mail into one of them at 96% of quota. Inside: what Microsoft says word for word, why the import and export APIs are not a backup, the deletion date set by your vendor rather than your retention policy, the inventory in six read-only commands, and the four questions to send in writing.

Backup Microsoft 365 Exchange
Read more →
Armario de llaves con ganchos numerados tras un cristal: unos ganchos tienen su llave y otros están vacíos
9 min read

They signed in as your app, and Entra ID asked for no MFA

A single IP address hosted in Poland signed 412 sign-in attempts over seven days against Microsoft Entra ID app registrations, according to Todyl, in bursts of 24 sign-ins in 10 seconds; Microsoft saw the first successful ones as early as 28 October. None prompted for a second factor, none hit Conditional Access, and none crossed your firewall. Inside: the numbers with their source, why MFA does not apply to an application sign-in, why the control that would stop it costs $3 a month and still leaves your providers' applications out, what Microsoft says about client secrets in production, the five minutes of ARTEX, and three checks with their commands.

Microsoft 365 Identity Secrets
Read more →
Depósito de archivo con estanterías móviles y cajas de documentos ordenadas por colores
9 min read

Raising the Microsoft 365 Backup window applies today. Lowering it deletes backups

The Microsoft 365 Backup recovery window has four values: 3 months, 6 months, 1 year or 2 years. Raising it applies immediately; lowering it is "a destructive action" that deletes recovery points, with a 30-day grace period. And there is a second way to lower it that does not look like a deletion at all: moving a mailbox into a policy with a shorter window. We go through that dropdown, the two pages of Microsoft's own documentation that disagree about what happens to what you remove from a policy, and why the archive going up from 1.5 to 3 TB is not a backup.

Backup Microsoft 365 Exchange
Read more →
Multifunción de oficina junto a unas bandejas de correo interno y cajas de archivo
8 min read

Exchange turns off basic SMTP in December and its own alternative keeps it until 2028

At the end of December, Exchange Online stops accepting a username and password to send mail by default. The date has already moved three times and the final one has not even been announced; what does not change is that the rejection is permanent, is not queued and warns nobody. We walk through the timeline with Microsoft's own wording, why its official escape hatch still accepts passwords until September 2028, the five alternatives and their small print, and the switches to check in your tenant before it lands.

Microsoft 365 Exchange SMTP
Read more →
Mesa de oficina de madera al final del día, con un portátil abierto, un ratón y una silla vacía ligeramente girada
9 min read

Classic Outlook does not die in 2027: what dies is your COM add-in

The date exists and it is official: March 2027, the opt-out stage for Enterprise environments, announced in Message Center post MC949965 and postponed from April 2026. But opt-out does not mean it is taken away: it is on by default and you can still switch back, with classic Outlook supported "until at least 2029". The public page describing the stages was revised three days after that announcement and still does not carry it. What you do control: the list of what does not cross over — COM add-ins, VBA, custom forms, on-premises Exchange — and the registry key that decides the day.

Microsoft 365 Workplace Migration
Read more →
Tornos de acceso de cristal en el vestíbulo de un edificio de oficinas
9 min read

The connectors that do not exist yet are already approved in your Microsoft 365

On 30 October the Copilot Connectors page starts honouring the publisher-type setting, and the documentation says new connectors of an allowed type "follow the default rollout and are available to everyone included in User access". User access ships set to "All users". What changes with notice MC1454973, who it does not apply to, why the setting is no longer called what the notice calls it, what this is NOT, and six checks.

Microsoft 365 IA Automation
Read more →
Sala de reuniones vacía de oficina con mesa larga, sillas y una pizarra de cristal casi borrada
8 min read

The retention that covered Copilot switches off this month, and nobody touched the policy

Between late October and mid-November 2026, Microsoft converts legacy Teams retention policies into "Teams-only" policies. If one of yours also kept Copilot conversations — and many did without anyone asking, because they shared the same plumbing — it stops. The notice is MC1481313, dated 28 September, and it does not name a single one of your policies. Where there used to be one checkbox there are now eleven AI apps to configure one by one, ChatGPT, Gemini and DeepSeek among them. With an inventory of the six retention clocks in Microsoft 365 and their official deadlines, the line in the documentation where an unpaid invoice outranks a legal hold, and six checks to run before mid-November.

Microsoft 365 Backup Compliance
Read more →
Primer plano de un teclado de portátil oscuro y gastado, con polvo entre las teclas, iluminado de lado
9 min read

The same IP got into 29 companies and bounced off four

From 14 July to 22 September 2026, Huntress counted 497 valid Microsoft 365 sign-ins across 79 organisations without the attacker ever needing a password. The number that interests us is smaller: over four days one address, 193.26.115.72, logged 1,052 blocked sign-ins that all came from four organisations and got into 29 others where "nothing stood in the way". Same attacker, same stolen tokens, same week. With the mechanics of the theft, the two figures the report contradicts itself on, the Microsoft control that does address this and why its browser version is still in preview, and this afternoon's check on your tenant.

Identity Microsoft 365 Zero Trust
Read more →
Torniquetes de control de acceso con lectores de tarjeta en el vestíbulo de un edificio de oficinas
9 min read

The 49 properties Entra is retiring from your login page are not about design

On 26 October 2026 Microsoft Entra ID starts ignoring 49 CSS properties on your organisation's sign-in page, and before the month is out it blocks any script that is not its own with a content security policy. Read end to end, that list — position, z-index, opacity, visibility, clip-path, pointer-events — is not a layout catalogue: it is the toolbox for making a page show one thing and do another. What changes on each date, why the role that can touch it is not listed as privileged in Microsoft's own documentation, and the six checks you can answer this afternoon.

Identity Zero Trust Microsoft 365
Read more →
Parte trasera de un servidor montado en bastidor, con el haz de cables de red y de consola conectados y las etiquetas de aviso del fabricante
8 min read

Exchange fails 24 hours after the October patch, and the mitigation undoes the patch

The Windows Server updates of 13 October 2026 introduced a cap of 512 saved contexts in the RPC Endpoint Mapper. Exchange burns through them at roughly 23.7 an hour, so the server holds for a little over twenty hours and falls over the next day, when nobody connects it to the patch any more. Microsoft's mitigation is a registry value that multiplies the cap by 128 and, in doing so, undoes most of the hardening that cap was there to provide. What you will see in the event log, what to do this week, and why a failure that takes twenty-one hours to show up is never caught by a two-hour change window.

Exchange Microsoft 365 Patching
Read more →
Tablero de madera con decenas de llaves colgadas de clavos, cada una con su etiqueta
9 min read

Your Microsoft 365 backup signs in with a key you do not hold

On 17 October ConnectWise cut access to its Microsoft 365 backup service after detecting unauthorised access to application identities. Huntress counted 162 tenants with unauthorised sign-ins. Nobody stole a password and nobody failed an MFA prompt: the application authenticated with its own credential, which lives in the vendor's tenant and not in yours. The uncomfortable part is written in Microsoft's own documentation: Conditional Access for workload identities — the policy that would block sign-ins from outside your known IP ranges — does not cover third-party multitenant applications. We go through what happened with the timestamps attached, why the control you would reach for does not apply, and the four things you can actually do from your own tenant.

Backup Microsoft 365 Identity
Read more →
Una silla vacía retirada de una mesa de madera con un portátil entreabierto y un ratón encima
9 min read

You can now change a meeting organizer; in a shared mailbox, you cannot

Microsoft is rolling out right now the thing every Microsoft 365 admin has been asking for: handing a meeting over to someone else without cancelling it. It arrives enabled by default, with no tenant configuration, and it does not work in classic Outlook for Windows. The real problem is elsewhere: the case that made you want this feature — the weekly meeting of the person who left — is exactly the one Microsoft's own offboarding procedure rules out, because its step 4 converts the mailbox to shared, and meetings in a shared mailbox are not eligible. And that same step 4 still tells you to cancel them all.

Microsoft 365 Workplace Exchange
Read more →
Mesas de una oficina vacía con una silla, archivadores y un monitor apagado
8 min read

The workaround was to turn off Global Secure Access: the advice your own policy blocks

On 13 October, after almost eleven hours of degradation, the workaround on offer was to turn off Global Secure Access. It arrived eleven minutes before the incident was declared over, and in tenants configured the way the documentation recommends that step does not work: turning off the client and being locked out is, literally, the proof that the compliant network check is correctly in place. The right procedure does exist and Microsoft published it in March, with two scripts; what neither of them tells you is how long each step takes to be felt.

Zero Trust Microsoft 365 Identity
Read more →
Puestos de trabajo con monitores y teclados en una oficina diáfana
8 min read

Mark of the Web: seven ways a file from outside stops looking like one

On Tuesday Microsoft patched a Windows Shell flaw already under exploitation, and its own entry says it let an attacker "evade Mark of the Web (MOTW) defenses". Before getting to that bug it is worth reading the Office documentation: the banner that blocks macros in an attachment depends on a tag which, by Microsoft's own account, has four ways of never being applied and three more of not deciding anything. And the policy that would make it mandatory is not available in every plan.

Windows Workplace Microsoft 365
Read more →
Estantería de archivo con cajas de documentos numeradas y atadas con cinta de tela
9 min read

SharePoint breaks the "Specific people" link, not the "Anyone" link

During October 2026 Microsoft is retiring SharePoint Online one-time passcode authentication in commercial tenants. You cannot pick the date, you cannot opt out, and it cannot be scoped per site. What stops opening is the named link, the one that made you type the recipient's address; the "Anyone with the link" one carries on unchanged. And the report Microsoft points you to in order to find who you are about to lock out excludes, in writing, links that were emailed and never clicked. What to check, what the EnableAzureADB2BIntegration setting no longer means, and why the right fix is not resharing in bulk.

Microsoft 365 SharePoint Identity
Read more →
Pared de buzones metálicos numerados en el vestíbulo de un edificio, con una papelera al fondo
8 min read

Your Exchange Online backup hangs on a single text field

Microsoft flipped the switch today, 10 October, in its multi-tenant cloud: a tenant with EwsEnabled set to $true and an empty allowed-application list stops letting every app through and starts letting none through. On the 8th and 9th Microsoft wrote that list for you, from whatever it saw using EWS over the previous 60 days. If you back up Microsoft 365 mailboxes, your backup now depends on a list you probably did not write, stored in a parameter the documentation declares as a text field that supports no add and no remove: only a full rewrite.

Backup Microsoft 365 Exchange
Read more →
Sala con filas de puestos de trabajo idénticos, mamparas bajas y sillas vacías
12 min read

Microsoft retires Targeted Release: your test ring is now paid for by everyone else

On 7 October 2026 Microsoft published advisory MC1490899 and updated three documentation pages the same day: Targeted release retires in January 2027 and from November 2026 its list can no longer be touched. The coverage reads it as a rename to Standard and Deferred. It is not. Reading the three pages together yields something else: to keep a validation group that runs ahead, Microsoft's own recommendation is not to move the pilot forward but to hold everyone else back by thirty days. Inside: the official mapping table read backwards, the documented cap of 100 users where each member of a security group counts one by one, the two kinds of change Deferred does NOT delay, and the seven checks that fit in half an hour before 31 October.

Microsoft 365 Workplace Compliance
Read more →
Multifunción de oficina junto a una mesa con bandejas de correo entrante y formularios de fax
9 min read

Your SPF passes, your DKIM passes, and DMARC still fails

The header says spf=pass and dkim=pass, and two lines below it says dmarc=fail. That is not a bug: it is alignment, and it is what breaks the mail your applications send. Inside: what DMARC actually compares, the row in Microsoft's own table where onmicrosoft.com fails even in relaxed mode, why your aggregate reports never arrive if you have a gateway in front of the tenant, and the sender inventory to write down before touching DNS.

Microsoft 365 DNS Cybersecurity
Read more →
Interior de una librería de cintas con el mecanismo del lector a la vista y una columna de ranuras vacías al fondo
9 min read

Microsoft deleted data before the window closed, and cannot say which

In late September 2026 it emerged that Microsoft, "due to an error", deleted data from expired subscriptions under its nonprofit programme before the retention and export window had closed. It could not be recovered. And there is a second half: it is currently unable to hand over a list of which data may have been deleted. Inside: the official Microsoft 365 countdown —30 days of Expired plus 90 of Disabled— and its asterisk; the 30 days that counter lost on 9 February 2026 for anyone buying direct under a Microsoft Customer Agreement; the four documented shortcuts that zero it, including the immediate deletion of SharePoint and OneDrive; and why article 33(5) of the GDPR asks you to document facts that, without an independent copy, you cannot enumerate.

Backup Microsoft 365 Compliance
Read more →

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN