Konrad Sagala

Microsoft MVP - M365 Apps & Services, MCT, cloud security architect

[Microsoft Exchange @MSFTExchange]

Addressing Exchange Server May 2026 vulnerability CVE-2026-42897 | Microsoft Community Hub https://t.co/XnocIkjbNe

[Microsoft Exchange @MSFTExchange]

No Exchange Server Security Updates for May 2026 | Microsoft Community Hub https://t.co/5sqYkpEhVw

[Microsoft Exchange @MSFTExchange]

General Availability of Mailbox Import and Export Microsoft Graph APIs | Microsoft Community Hub https://t.co/DH6RnoQp4u

[DevOps on Azure @AzureDevOps]

Agentic DevOps isn’t “AI for coding” — it’s AI agents working across the whole SDLC. Part 1 breaks down the foundations: AI‑native DevOps, agents that collaborate across planning→coding→testing→ops, cloud vs local agents, and when to use subagents.
📖, https://t.co/wEpvm2LS3x

[Microsoft MVP Communities @MVPAward]

🚀 New from Microsoft: IQ Series now live!

Curious about what's next in tech innovation? The IQ Series on GitHub brings together insights, ideas, and real-world expertise to help you explore emerging trends and sharpen your skills.

💡 Whether you're building, learning, or leading in the community—this is a great resource to dive into and share with others.

👉 Explore it here: https://t.co/LO6YPuLuAZ

Let’s keep growing together. What topics are you most excited to see in this series? Drop your thoughts below 👇

#MVPBuzz

[Microsoft Learn @MicrosoftLearn]

From your first role to leadership, AI can help you learn faster, communicate more clearly, and make better decisions.
This blog shows how business users apply AI at every career stage:
• Early career: ramp up faster, build confidence, and draft clearer work
• Mid-career: scale your impact, align stakeholders, and streamline workflows
• Leadership: spot patterns, pressure-test strategy, and coach more effectively

You’ll also find guidance on AI Skills Navigator, with role-based training to keep building the right skills for what’s next.
👉 Read the blog: https://t.co/FgGkuP32zW

[Microsoft Exchange @MSFTExchange]

Modernizing DNS Security for Exchange Online Mail Flow | Microsoft Community Hub https://t.co/pQE4aPNT2u

[Microsoft Learn @MicrosoftLearn]

New AI Certification exams are now in beta.
Build real‑world AI & agentic skills from fundamentals to enterprise‑ready solutions:
🔗 AI‑901 – Implement AI solutions using Microsoft Foundry. https://t.co/FgmVikWVaB
🔗 AI‑103 – Build scalable AI apps & agents on Azure. https://t.co/7fXpSPnoK9
🔗 AB‑620 – Design enterprise‑ready agents in Copilot Studio. https://t.co/xrD8qaqFla

[Tony Redmond @12Knocksinna]

.@Office365 A reader complained that an old #PowerShell script from 2016 no longer worked. Many changes conspired to condemn the old code, which tracked changes to #Microsoft365 Groups in a tenant. New techniques were used to "fix" (aka rewrite) the code.
https://t.co/OkDpgYcr10

[Mark Thompson @SuperSimple365]

🔜 Create and manage tasks with the Copilot Planner Agent.

🔗 Read more: https://t.co/4ESJW87iKV

📆 Due late April to early May 2026.

🆕 See what else is new for #Copilot https://t.co/pFgxUusSl2.

[Microsoft Learn @MicrosoftLearn]

Move beyond basic AI adoption.
This certification helps you build the core skills to manage Copilot and AI agents across your organization.
Start learning here: https://t.co/NjXLo97qT9

[Microsoft Learn @MicrosoftLearn]

How do you build a career that grows with the pace of AI? Microsoft Certifications offer a broad portfolio across technical and business roles, validate the skills employers need, and provide exam prep resources to guide you from learning to certified.

Explore more Microsoft Certifications on AI Skills Navigator: https://t.co/Ghlhzl4V2D

[Microsoft Security @msftsecurity]

Our latest email security benchmarking data is out, revealing how modern email threats are detected and stopped by Microsoft Defender, SEG providers, and ICES solutions.

Learn how this data can inform your security decisions: https://t.co/yC7ss1gaX2

[Tony Redmond @12Knocksinna]

.@Office365 After all the recent fuss about a bug that allowed #Copilot to consume some email that the DLP policy should have blocked, we learn that Microsoft has extended policy protection for Office and PDF files to any storage location: https://t.co/cZwRhVf8wu
#Microsoft365

[Tony Redmond @12Knocksinna]

.@Office365 For all the #PowerShell fans who work with #Microsoft365 across Entra ID, SharePoint, Exchange, OneDrive, Planner, Teams, and so on... we've released update #21 for the Automating Microsoft 365 with PowerShell eBook:
https://t.co/NPNw0BpIL0

[Microsoft Security @msftsecurity]

NEW guide available to put you on the path to proactive defense.

This guide breaks down five levels of exposure management maturity, measuring how organizations identify, prioritize, and act on risk.

Which level are you? Learn more: https://t.co/p4LVfq1yqC

[Merill Fernando @merill]

"Your 13-year-old could set up a phishing kit in 20 minutes."

That's what @ericonidentity, told me about EvilGinx and modern adversary-in-the-middle attacks.

Eric is the Chief Identity Architect at Semperis and a Microsoft MVP who just led something remarkable: taking a 600-person company from scattered MFA to 100% phishing-resistant authentication in just three months.

I had to get him on https://t.co/YTVmebsh6k to share how they did it.

THE PASSKEY PLAYBOOK

The technical part wasn't what kept Eric up at night. Conditional Access policies? Straightforward. Hello for Business, Platform SSO, and passkeys as the only allowed methods? Done.

What made this rollout succeed was the people strategy:

They built a self-enrollment system using Power Platform. Employees could opt-in early and become internal champions. By the time they flipped the switch for everyone, half the company was already converted.

Leadership went first. When the C-suite was using passkeys, middle management resistance evaporated overnight.

They ran office hours. Not webinars, not documentation dumps. Actual humans answering actual questions in real-time.

THE UGLY PARTS

Not everything worked smoothly. Azure VPN client doesn't support passkeys. Some legacy apps were still using old Internet Explorer DLLs. A handful of Android 13 users couldn't use device-bound passkeys at all.

Their solution? Surgical CA policy exceptions for about 5 apps, tracked in a dashboard, with vendors being "encouraged" to fix their implementations.

For the Android holdouts, synced passkeys came to the rescue. Are they as secure as device-bound? No. Are they still infinitely better than passwords and push notifications? Absolutely.

THE ATTACKS THAT STILL WORK

Here's the part that should concern everyone: Even with passkeys deployed, downgrade attacks are a real threat.

The only defense? 100% phishing-resistant conditional access policies with no fallback methods.

nOAuth AND THE DEVELOPER PROBLEM

Eric's security research goes deeper. He walked me through nOAuth, a vulnerability pattern where applications use email claims instead of the subject identifier to identify users.

The problem? Email addresses in Entra ID aren't immutable. An attacker can set their email to match a victim's, and vulnerable apps will grant them full access to that account's data.

Microsoft has guidance to fix this, but developers keep building apps the wrong way. And there's no easy way for admins to detect which apps in their tenant are vulnerable.

BOTTOM LINE

Passkey rollouts are 80% organizational change management, 20% technical implementation.

Your help desk needs training. Your documentation needs to be bulletproof. And you need executive air cover from day one.

The full conversation covers way more: consent phishing, clickfix attacks, reply URL hijacking, and why the Zero Trust Assessment tool takes 24+ hours on large tenants.

Listen here: https://t.co/yo53RRtV3E

#Passkeys #ZeroTrust #CyberSecurity #Infosec

[Microsoft MVP Communities @MVPAward]

Looking to go deeper with agents and Python this February?

Microsoft's Pamela Fox is leading a free, 6-part “Python + Agents” livestream series, where you’ll explore how to:

Build agents with the Microsoft agent-framework
Connect tools and MCP servers
Add context, memory, and human-in-the-loop workflows
Work from real code samples you can reuse

👀 Check out her announcement post and register for the series here:

https://t.co/iHRdR3ImeF

Know someone who’s been curious about agents? Tag them so they don’t miss it.

#MVPBuzz

[Microsoft Exchange @MSFTExchange]

Exchange Online canceling the Mailbox External Recipient Rate Limit | Microsoft Community Hub https://t.co/mTAdM9yYJG

[Tony Redmond @12Knocksinna]

.@Office365 Microsoft clarified the licensing requirement for shared mailboxes when MDO is active in a #Microsoft365 tenant a couple of weeks ago. Here's how to use #POwerShell to check if any of your shared mailboxes need MDO licenses.
https://t.co/tchh7l28CO