** Update to let subscribers know about new files **

The September 2026 update for the four books in the Microsoft 365 for IT Pros (2027 edition) package are available for subscribers to download. EPUB and PDF files can be downloaded. The paperback edition of the Automating Microsoft 365 with PowerShell eBook has also been updated. August was a busy month with lots happening, most of which ended up in chapter updates. We expect more interesting changes during the coming month.

https://office365itpros.com/2026/09/01/microsoft-365-for-it-pros-135/

A policy can only govern an object the policy engine can resolve. An application appearing in your sign-in logs, does not guarantee that a corresponding service principal exists in your tenant! Why?

That single assumption is where things quietly break.

Microsoft have hundreds of first-party apps in a global directory, but they not all lives in your tenant by default. A service principal is only created on first consent - or when an admin registers it manually, so many background services, infrastructure apps and newer products (Global Secure Access/ZTNA clients, Defender for Mobile, Intune Tunnel, Windows Sign In, AVD and Windows 365…) never trigger that flow for some.

The result: apps your users authenticate against every day, showing up in your sign-in logs - with no service principal to exclude in etc. Conditional Access there use restictions or App Protection policies (my sample in the blog post), simply have nothing to bind to, so the app silently falls outside your controls. "All Apps" policy has more in it than you think, and you can't exclude an app that doesn't exist as an object (like App Protection on the Global Secure Access client in my own usecase in the weekend here).

So I built two scripts to close the gap (can be I change some stuff in the future FYI):

> Find-MissingServicePrincipalsFromSignInLogs.ps1 - this cross-references interactive + non-interactive sign-in logs against your existing SPs and prints a ready-to-paste list of what's missing.
> CreateMissingServicePrincipals.ps1 - registers the missing SPs (with -WhatIf preview first).

A single 24-hour run on a small production tenant (my own 😄) with ~965 existing SPs surfaced dozens of gaps - apps generating sign-ins daily with nothing for policy to resolve against. See it all in the blog post here!

Key takeaways:
> Don’t assume you can exclude everything - if the service principal doesn’t exist, the app is invisible to policy enforcement
> Sign-in logs are your source of truth - if traffic flows, it should have an SP.
> Some AppIDs can't be registered (Microsoft limitation, not your config) - the script flags these as [SKIP].
> This isn't a one-time fix - build periodic discovery into your baseline.

Full write-up, scripts and the Global Secure Access exclusion list here to see more here: https://blog.sonnes.cloud/missing-service-principals-in-entra-id-why-conditional-access-app-protection-and-global-secure-access-will-fail-more-fun/

Have you any expirence with other senarios, where they was missing? 🤔 Let me hear in the comments!

#Microsoft #EntraID #ConditionalAccess #ZeroTrust #AppProtection #GlobalSecureAccess #GSA #Security #Identity #PowerShell #MVP #MVPBuzz #Community #TheBugHunter

Outdated Windows devices can create security gaps, compatibility issues, and unnecessary IT headaches.

A structured Windows patch management process helps IT teams:

🔹 Identify missing patches
🔹 Prioritize critical updates
🔹 Automate patch deployment
🔹 Keep devices secure and up to date

Not sure where to start?

Check out this blog to understand what Windows patch management is, why it matters, and how it works.

A really nice improvement is making its way to the Microsoft Global Secure Access client for Windows: the client will soon be able to receive updates directly through Windows Update.

And this is one of those features where I’ve had the privilege of being involved well before most people get to see it. 👀

Read more about it all in my newest blog post!

Disclosure, I work at Login VSI. Sharing some notes on what we've found so far working with AVD Hybrid, and where it's headed next as it matures.

We're discussing all of it live Thursday, September 10 at 11am ET with Steve Downs and Andrej Radinger (Microsoft), Marcel Meurer (built Hydra), and Ron Oglesby (Login VSI). Come with any questions or leave them here and we can discuss.

Register Here

Hello IT Professionals,

I am a Doctor of Information Technology candidate at Walden University conducting an IRB-approved doctoral research study exploring strategies IT managers use to integrate data analytics platforms with automated reservation systems.

I am seeking U.S.-based IT managers who have relevant professional experience with the integration of data analytics platforms and automated reservation systems.

Participation involves a confidential research interview conducted for academic research purposes. There is no commercial solicitation.

If your professional experience may be relevant and you are interested in learning more about the study, please send me a private message. I will be happy to provide additional information about the research and participation.

Thank you for your consideration.

Respectfully,
Stephen Kato Katende
Doctor of Information Technology Candidate
Walden University
Doctoral Researcher

Remote onboarding can produce five signals that appear to agree: a resume, identity document, video interview, US IP address, and an enrolled company laptop. The problem is that all five can come from the same coordinated chain. Agreement is not independent verification.

Nisos reported that one DPRK-linked cell submitted 166,893 applications, reached more than 21,645 interviews, and received at least 76 job offers. These were offers, not 76 confirmed hires. A separate DOJ case involved at least 80 stolen identities and work at more than 100 US companies, so the figures should not be merged.

For sysadmins and IAM teams, the useful control boundary is the joiner flow:

1. verify identity out of band from the interview channel;

2. verify device custody and the shipping recipient before enrollment;

3. compare tax and payment destinations for unexplained mismatches;

4. bind endpoint enrollment to a fresh identity check;

5. stage privileges and review early access behavior, using impossible-travel or location anomalies as investigation triggers rather than automatic verdicts.

Laptop farms are why a familiar US IP address or company-shipped device should not be treated as proof of operator identity. Accent, nationality, camera quality, or reluctance to appear on video are not evidence of fraud.

I made a 10-minute Veil Decoded documentary that follows the source trail through Nisos, DOJ, FBI, Microsoft and Google:

https://www.youtube.com/watch?v=-DMzL-0UXfU

Which team owns the independent check in your environment: HR, IAM, endpoint engineering, or SecOps?

Selecting the right remote device management tool is crucial for optimizing device control, security, and productivity. From managing mobile and desktop devices to handling IoT systems and providing remote troubleshooting, each tool type serves specific business needs. Here’s a detailed guide to help you choose the best fit for your organization.

Praxis is a self hosted linux fleet management application. It keeps inventory of packages and system configuration across your linux systems. It will tell you whats out of date, compares systems to baselines you can customize and patches in staged rollout rings with custom patch policies and plans with approvals.

Its for the shop needing organization and configuration management assistance. Its for catching drift when you dont have enough eyes or experienced hands to manage it all. Its for access control and approval.

This runs completely offline if you want to. This is not a cloud service, no call home and for 15 hosts or less its free.

It also has SSH access governance for both automated access and individual access. As an admin you can connect to system using Praxis and get short lived one time signed certs from OpenBao. This is so audit records, recording and remediation all land in one place, one app.

https://praxisfleet.com
https://github.com/cytechlabs/praxis