Joe Stocker

Christian Family Man, Founder of Patriot Consulting (Cybersecurity Partner) Author of "Securing Microsoft 365" and Microsoft MVP (Security) (2020-2026).

[Joe Stocker @ITguySoCal]

"I'm not what I do. I'm not what I have. I'm not what people say about me. I am the beloved of God. It's who I am. No one can take it from me. I don't have to worry. I don't have to hurry. I can trust my friend Jesus and share his love with the world."

This is the “The Creed of the Beloved,” by pastor Bobby Schuller, inspired by theologian Henri Nouwen and Dallas Willard.

[Joe Stocker @ITguySoCal]

@AdamGell Safe to assume you are asking due to your new gig? DM me we would love to share loads of tips

[Adam G @AdamGell]

Off tomorrow. New job next week. Ordered pizza.

[Joe Stocker @ITguySoCal]

Did you know that there are 2 million people incarcerated in the US, and 97% will return to society, and 61% will re-offend within 10 years? That percentage drops to less than 5% with The Last Mile technical training, incarcerated men and women can evolve into highly skilled, motivated, and valuable professionals who deliver a return to those who invest in them. TLM training is now offered in 13 facilities across eight states, but they need your help.
Please consider donating to the Last Mile, and I will match your gift.
Learn more https://t.co/byv9vmAIvq

[International Cyber Digest @IntCyberDigest]

‼️ An admin using the password "123456" led to the breach of 8.8 million people's data in Denmark, the hacker told.

At least three accounts used it at Pays ApS, a two-person private IT firm with lawful access to the national population register.

[The LAST MILE @TLM]

Our students are preparing for tomorrow’s workforce on computers that date back to 2014. We need to change that.

Across The Last Mile’s classrooms, approximately 300 students are building the skills they need for careers and successful reentry. Now, we’re working to replace aging classroom computers with modern, workforce-ready technology.

And right now, every contribution can go twice as far.

@ITguySoCal and @PatriotExperts will match every donation dollar-for-dollar, up to $100,000. If our community raises the full amount, together we can create $200,000 in total impact for TLM classrooms nationwide.

If you’ve been looking for a meaningful moment to support The Last Mile, this is it.

👉 Visit the campaign page to watch the video, learn more, and join us:

https://t.co/CwfXLQZyZz

[Joe Stocker @ITguySoCal]

Patriot Consulting and I are matching donations to help @TLM modernize technology classrooms inside correctional facilities, giving students skills to build meaningful careers and a new life after release. Learn more & please consider donating.
https://t.co/0d7bU40r3K

[Joe Stocker @ITguySoCal]

@HackingLZ I’m trying all of them to see the differences. Muse scheduled me Jiu Jitsu sessions in a town I was visiting.

[Joe Stocker @ITguySoCal]

@merill @NasirStylin Very wise

[Joe Stocker @ITguySoCal]

@j2k3k

[Joe Stocker @ITguySoCal]

In this blog I compare OpenAI Dots vs Meta Muse vs Grok Bot vs Microsoft Autopilot (Scout) vs Open Claw Enterprise vs Hermes!! Feedback is welcome!
https://t.co/Nl8ijBWwFE

[Merill Fernando @merill]

Folks, you might have been caught out by this but it's what Microsoft said they would do, according to the docs.

Since Sept 1, tenants with an attestation-enforced or AAGUID-restricted passkey policy are suddenly seeing users register synced and browser passkeys. Admins are asking "why isn't Microsoft respecting my FIDO2 policy?"

Here's what's going on.

The "Passkeys by default" retirement page on Learn (published July 14) says this in its Important box:

"Users enabled for SMS or Voice ... will be auto-enabled for passkeys in AMP. These in scope users will be put into a passkey profile allowing ALL types of passkeys. Your Registration Campaign settings will be set to Microsoft Managed state targeting passkeys."

Two important notes:

1. Passkey profiles are a union. If a user is in more than one profile, a passkey only has to satisfy ONE of them. So your attestation-enforced profile is still there. Microsoft just added a second, unrestricted profile next to it for every SMS/voice user, and that one wins for registration.

2. Your registration campaign state doesn't protect you. Disabled, Enabled, doesn't matter. The doc says it gets set to Microsoft Managed regardless, which is why some of you saw your campaign config wiped with Microsoft in the audit log. Even with the campaign off, the new profile lets users self-register a non-attested passkey from My Security Info.

The ONLY way to avoid this was the opt-out flag on the authentication methods policy:

PATCH https://t.co/scTWmsxlTH
{ "optOutSettings": { "passkeyDynamicMigration": true } }

Or moving users out of SMS and voice before Sept 1.

Where Microsoft dropped the ball: the Message Center post (MC1426371) only says "passkeys will be automatically enabled for users currently enabled for SMS or voice." It never mentions a new unrestricted profile or that your attestation/AAGUID restrictions would be bypassed. And MC1469555 says the campaign "does not override configured passkey policies", which is technically true and practically misleading. The passkey profile part is only on Learn.

So: not a bug, but a really important detail buried in one paragraph on a docs page.

What to do now:
- Look at your passkey profiles for a Microsoft-created one with both passkey types and no restrictions, and check who's targeted.
- Set the opt-out flag if you need attestation to hold, then clean up that profile. Note the doc says the flag stops working Feb 1, 2027.
- If you already had the flag set and it still changed, that IS a bug. Open a case.

Docs: https://t.co/tMo1OMpj9B

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: A 16-year-old hacker broke into an internal Microsoft analytics service with a forged, unsigned login token and ran SQL as admin, reaching databases that held over 17 trillion rows, including Bing search analytics and 17,990 employee email records.

The service, called Titan, checked every field on the token except its signature, so just claiming to be "admin" got him in, writes the researcher, who goes by Faav.

He says he only pulled metadata and two single rows of Bing data, never touched customer data, and reported the flaw to Microsoft the same night.

Microsoft locked the endpoint four days later, paid him $5,000, and had editorial control over his write-up, cutting sections and figures and reshaping how the impact was described before it went public.

[Polymarket @Polymarket]

JUST IN: Florida judges warn of a flood of AI-generated “lawslop” clogging court dockets & threatening the administration of justice.

[Nathan McNulty @NathanMcNulty]

I understand not wanting to triage AI garbage Issues and PRs... but this is a horrible mistake

Opening issues and PRs was the best way to communicate with the Learn documentation team (many of whom were laid off recently...)

Nobody wants to submit feedback they can't track 😡

[Joe Stocker @ITguySoCal]

@gharshenin @NathanMcNulty

[Joe Stocker @ITguySoCal]

@OmarShahine Do you have a cost estimator tool or calculator?

[Joe Stocker @ITguySoCal]

@OmarShahine @ryanyates1990 Did you get approval from @MSIntune ?! Autopilot is the name of a major feature already and this creates confusion. Now every time someone says “Autopilot” no one will know if they are talking about Intune Autopilot or AI Autopilot

[Joe Stocker @ITguySoCal]

latency. How long does it take for R7 to get the log and then their triage and response time to then contain. At some point this needs to be done by an agent because the volume of attack from AI bots will be too high, at that point the cracks could appear and this justify the cost.

[Joe Stocker @ITguySoCal]

@TylerTylerOsu @reprise_99 Yes this price of $2.40 per GB is just below the Google Chronicle pricing which AI tells me is about $2.50 per GB.
Microsoft offers an even lower cost DL tier at 5 cents per GB ingestion.

[Joe Stocker @ITguySoCal]

ISOC in Microsoft Defender is a benefit for M365 E5 and E7 customers, it is not a new product. Those lucky customers will save 44% off 3P security log ingestion.
I spent all day reading and broke it down here to bring it to you straight:
https://t.co/goKE8zSnUI

[Microsoft Security @msftsecurity]

XDR and SIEM now in one platform. Meet the new ISOC in Microsoft Defender—a SOC built for agentic security. Here to help you investigate and respond more efficiently. https://t.co/lVwzuITH5H