project
Microsoft Entra is Microsoft's cloud identity and access management platform (formerly Azure AD), handling authentication, user accounts, and tenant policies.
No evidence-backed relationships are recorded.
Microsoft has switched Windows settings backup on by default for Entra-joined and hybrid-joined PCs upgraded to Windows 11 26H2, released September 29. Tenants that never set the policy now copy users' settings and Store app lists until an admin turns it off.
Reality
Faav, a 16-year-old researcher, reached admin SQL over 17.3 trillion rows on Microsoft's Titan service because it never checked login-token signatures. Microsoft locked the endpoint four days after his report and paid a $5,000 bounty.
Reality
Microsoft is splitting Copilot into Home, Code and Autopilot, with its always-on Autopilot agent entering private preview in late September. Autopilot agents carry their own identities and bill by usage, so tenant admins need access reviews and spend plans ready before the first instances arrive.
Perspective Coverage
5 publishersReality
Microsoft put Copilot Managed Runtime into public preview, hosting code from three Copilot builders and third-party tools like Lovable inside the M365 tenant. For security teams the launch is a policy job over who may deploy code that reads tenant data.
Reality
Microsoft's Execution Containers SDK, previewed at Build 2026, lets a developer state what an agent may touch and leaves Windows to apply that at runtime, with Entra and Intune setting the policy per agent.
Reality
CoreWeave says key custody is what keeps enterprise AI projects sitting in security review, so its new encryption service leaves the key in tooling the customer already runs and takes the provider off the decrypt list.
Reality
Varonis Threat Labs registered its own External Authentication Method in a test Entra tenant and served a copy of Microsoft's password prompt during the second factor. Every sign-in completed, and the passwords landed in a file.
Reality
OAuth always allowed a token narrower than the request. What changes is that the client owner now declares which scopes a user may refuse, and the application has to read the token response to learn what it actually got.
Reality
A single Stormcast episode carries a Keycloak 26.7.2 password-reset fix, a reported N-able password manager leak, and a published LLM safeguard bypass. Most of it sits in the identity and secrets tier.
Reality
Agent 365 pushes agents into the same registry, access policies and e-discovery used for staff. That moves the governance work onto teams you already fund.
Reality
TheHatman's claimed Entra haul and the FortiBleed spraying wave share one detectable seam: a successful authentication landing just behind a spike of failures.
Reality