But Will a Password Expiration Report be Obsolete Soon? The advice not to force users to change passwords regularly comes from both Microsoft and independent security agencies. Forcing people to change passwords creates friction for people without delivering better security. The consensus is that better security is attained by moving away from passwords to protect accounts with stronger authentication methods like multifactor authentication or passkeys. Evidence of progress in this direction is Microsoft’s recent announcement of support in Entra ID for device-bound passkeys based on the Authen ..read more

SMTP AUTH Deprecated in 2025 Along with a New External Recipient Rate Limit The Exchange development team has clearly been busy lately. On April 15, 2024, they announced two major changes: The deprecation of basic authentication for client submission (SMTP AUTH) in September 2025. The imposition of a new external recipient rate limit (ERR limit) from January 1, 2025. Microsoft says that both announcements are part of the work to protect Exchange Online. SMTP AUTH and Basic Authentication The announcement about the demise of SMTP AUTH is not unexpected. For the past several years, Microsoft ..read more

A Community-Driven Security Configuration Analyzer for Entra ID Tenants The irrepressible Merill Fernando, a product manager in the Microsoft Entra ID organization, came together with Security MVPs Faben Bader and Thomas Naunheim to create the Maester tool. Announced on April 10, Maester is labeled as a “Microsoft Security test automation framework” and installation instructions are available here. It is a great example of a community-driven project. Maester is built using Pester and Microsoft Graph APIs. Basically, it runs a bunch of tests against an Entra ID tenant (usually a Microsoft 365 t ..read more

Standard Group Chat Pictures Instead of Avatars The announcement in message center notification MC717970 (last updated 4 April 2024) that Microsoft is introducing “custom avatars for group chats” is not what you think. No mesh avatars are involved. Microsoft 365 roadmap item 119305 clarifies the situation by saying that the avatars referred to in MC717970 are no more than the profile picture for group chats. What’s happening is that any member of a group chat (including guest accounts) can choose from a set of “pre-selected illustrations” (no doubt selected to communicate what happens in typic ..read more

Aspects of Monarch Client Security and Privacy Highlighted, Especially Data Held in Azure An April 4 posting on the respected security blog hosted by Bruce Schneier hyped the claim by Proton that the new Monarch client (aka the new Outlook for Windows) is “Microsoft’s new data collection service.” It’s repeats some of the overhyped shock and horror story that appeared in Germany in November 2023. In this instance, it seems like a great deal of uninformed commentary intended to convince people to ditch Monarch and use another email client. That’s absolutely a choice that people are entitled to ..read more

Azure Transitions Administrative Roles to Azure RBAC Roles On March 11, Microsoft sent a note to Azure administrators titled “Transition to role-based access control (RBAC) in Azure by 31 August 2024.” The note pointed to an article explaining that Microsoft will retire Azure’s classic deployment model on the same date in favor of Azure Resource Model. Microsoft 365 Consumes a Surprising Amount of Azure Like many Microsoft 365 administrators, I labor under the illusion that I don’t use Azure all that much. Then I realized that I use: Azure Automation accounts and managed identities to run Pow ..read more

Blocking Sub-Domains in the Tenant Federation Configuration The publication of message center notification MC770792 (5 April 2024) describing a new Teams tenant federation setting to block all sub-domains of a blocked domain seems like a very good idea. After all, if you decide to block inbound connections from “malware.com.” it’s likely that you also want to block sub-domains like “marketing.malware.com.” Microsoft says that the update should be in all tenants by mid-April. From an administrator perspective, the change becomes active with version 6.1 of the Microsoft Teams PowerShell module ..read more

Report More than 200 Loop Workspaces Requires Fetching Pages of Data In November 2023, I wrote about a PowerShell script I developed to report the storage consumed by Loop workspaces. The script worked. That is, it worked until a tenant had more than 200 workspaces at which point the script ceased to report details for any more workspaces. This point was recently made to me by a reader after they discovered that the script didn’t produce the desired results in their tenant. Obviously, I didn’t do enough testing to encounter the limit. Investigation (reading the documentation for the Get-SPOCon ..read more

Make Sure You Have the Right Information Protection Licenses According to Microsoft 365 message center notification MC736438 (13 March 2024), Microsoft plans to take a more robust attitude to requiring administrators and users to have premium licenses to apply sensitivity labels automatically via policies or by defining a default sensitivity label for SharePoint Online document libraries. Until now, Microsoft has had a published license requirement that administrators should have complied with. In early April 2024, software checks will ensure that the right license is in place before automati ..read more

New Version of the MSCommerce PowerShell Module Released Microsoft’s drive to liberate the great downtrodden masses of Microsoft 365 users from the baleful oversight of tenant administrators continues and there are now 25 different licenses available for self-purchase. That’s all very well if you buy into the theory that it’s good for people to buy their own licenses for products like Python on Excel or Viva Learning. It’s less welcome in organizations that like to exert control over licenses to keep monthly charges within reasonable boundaries. It’s a while since I looked at self-purchase li ..read more