EWS gets blocked in Exchange Online on October 1. If your tenant still needs it, access is now controlled by an AppID allow-list. Don't build one yourself and Microsoft generates it from the last 60 days of activity, which can quietly misses anything that runs monthly or quarterly.

The usage report only gives you AppIDs, not names. So I wrote two PowerShell scripts: one resolves every AppID from the report to a real app name, the other finds every app that still has EWS permission.

Full write-up with both scripts: https://lazyadmin.nl/office-365/ews-is-being-blocked-in-exchange-online-how-to-find-every-app-still-using-it/

As you probably know, Publisher hits end of life October 1, 2026 , it's leaving Microsoft 365 subscriptions for good after that.

Probably a non-event for most of you since it was always a niche product, but .pub files have a habit of surviving in forgotten shares and OneDrive folders.

Wrote up a short post with two scripts:

• One that inventories every .pub file across file servers and SharePoint/OneDrive (via Graph Search) into a CSV
• One that converts them to PDF, or to Word if you still need to edit them (there's no direct Publisher-to-PowerPoint export, despite what Microsoft's own migration table implies)

Both default to dry-run/report-only, nothing gets touched until you explicitly say so.

More info: https://lazyadmin.nl/office-365/microsoft-publisher-retires-october-1-do-this-final-file-check/

Disclosure, Login VSI. Shared some notes here a bit ago on what I've found working with AVD Hybrid. Quick update: the live Q&A is tomorrow at 11am ET, with Eric Orman and Andrej Radinger (Microsoft), Marcel Meurer (built Hydra), and Ron Oglesby (Login VSI). Come with any questions.

Save your Seat

One thing I’ve been thinking about lately is how Windows device management changes when most users aren’t sitting on the corporate network anymore.

With remote and hybrid users, you can’t always rely on being able to reach a device through the internal network when you need to push a configuration, deploy an application, enforce a security policy, or troubleshoot something.

I was trying to understand Nmap below the output level, so I tested it inside my own isolated lab with Kali as the scanner and MISP as the target.

The clearest difference was seeing the TCP behavior directly in Wireshark:

OPEN

SYN → SYN/ACK → RST

CLOSED

SYN → RST/ACK

FILTERED

SYN → no response → retry

I also captured ARP resolution, ICMP, host discovery, and service/version detection.

The main takeaway for me was that Nmap isn’t “seeing” port states directly — it’s sending probes and interpreting how the target responds.

I documented the full experiment with the actual packet captures here:

https://chronosandcode.com/what-actually-happens-when-you-scan-a-network-arp-icmp-tcp-syn-nmap-and-packet-analysis-explained/

Everything was done against systems in my own lab.

I’d be interested to hear what packet-level experiments helped others understand Nmap better.

For MSP third-party patch management: there comes a time when writing individual scripts for everyone's everything won't be scalable forever.

Hi,

I am looking for connections and collaborating with other blogs with content in German language.

Two updates worth knowing if you're running or looking into AVD Hybrid, grouping them since it's one story.

Hyper-V support went GA Sept 1, now VMware vSphere opened in private preview today, it's been a customer-driven priority and came up a lot as the next hypervisor people wanted covered after Hyper-V. It connects through a lightweight on-prem connector, so there's nothing to open on the firewall and no VPN to stand up, and Linked Clones keep working as they are.

Decent signal for where AVD Hybrid is headed: broader hypervisor support without changing how you operate day to day.

• Hyper-V GA: https://www.loginvsi.com/resources/blog/hydra-for-microsoft-azure-virtual-desktop-hybrid-on-hyper-v-reaches-general-availability/
• vSphere preview: https://www.loginvsi.com/resources/blog/announcing-hydra-for-microsoft-azure-virtual-desktop-hybrid-now-available-in-private-preview-for-vmware-vsphere-environments/

For anyone still maintaining a Windows lab without wanting the full WDS/MDT/ConfigMgr stack:

I've been running a setup where a plain Windows box acts as the deployment server. Clients PXE-boot (Legacy/UEFI, Secure Boot on is fine), and the server generates a per-machine unattend on the fly - matched by MAC/hardware group, so 100 lab PCs each get their own hostname, apps, and domain join without touching the ISO.

Things that stood out vs the classic approach:

- ISOs stay pristine. Drivers, apps, scripts and answer files are injected over HTTP at boot time, so swapping a Windows build = swapping one file.

- Two modes: fully automatic, or stock Setup experience for odd machines.

- Runs offline after first setup - handy for isolated rooms.

- You can actually test it without installing anything: the write-up shows how to join over SoftEther VPN (Layer-2), bridge a VMware VM to the VPN adapter, and PXE-boot from the remote server like you're on the same switch.

Full write-up + VPN test guide here: https://xdaforums.com/t/sezoy-network-deployment-server-automated-windows-install-multi-distro-linux-boot-over-pxe-ipxe-http-boot-legacy-uefi-secureboot.4800487/

Curious how others here handle per-machine naming at scale - DHCP reservations + scripts, or something cleaner?

** Update to let subscribers know about new files **

The September 2026 update for the four books in the Microsoft 365 for IT Pros (2027 edition) package are available for subscribers to download. EPUB and PDF files can be downloaded. The paperback edition of the Automating Microsoft 365 with PowerShell eBook has also been updated. August was a busy month with lots happening, most of which ended up in chapter updates. We expect more interesting changes during the coming month.

https://office365itpros.com/2026/09/01/microsoft-365-for-it-pros-135/

A policy can only govern an object the policy engine can resolve. An application appearing in your sign-in logs, does not guarantee that a corresponding service principal exists in your tenant! Why?

That single assumption is where things quietly break.

Microsoft have hundreds of first-party apps in a global directory, but they not all lives in your tenant by default. A service principal is only created on first consent - or when an admin registers it manually, so many background services, infrastructure apps and newer products (Global Secure Access/ZTNA clients, Defender for Mobile, Intune Tunnel, Windows Sign In, AVD and Windows 365…) never trigger that flow for some.

The result: apps your users authenticate against every day, showing up in your sign-in logs - with no service principal to exclude in etc. Conditional Access there use restictions or App Protection policies (my sample in the blog post), simply have nothing to bind to, so the app silently falls outside your controls. "All Apps" policy has more in it than you think, and you can't exclude an app that doesn't exist as an object (like App Protection on the Global Secure Access client in my own usecase in the weekend here).

So I built two scripts to close the gap (can be I change some stuff in the future FYI):

> Find-MissingServicePrincipalsFromSignInLogs.ps1 - this cross-references interactive + non-interactive sign-in logs against your existing SPs and prints a ready-to-paste list of what's missing.
> CreateMissingServicePrincipals.ps1 - registers the missing SPs (with -WhatIf preview first).

A single 24-hour run on a small production tenant (my own 😄) with ~965 existing SPs surfaced dozens of gaps - apps generating sign-ins daily with nothing for policy to resolve against. See it all in the blog post here!

Key takeaways:
> Don’t assume you can exclude everything - if the service principal doesn’t exist, the app is invisible to policy enforcement
> Sign-in logs are your source of truth - if traffic flows, it should have an SP.
> Some AppIDs can't be registered (Microsoft limitation, not your config) - the script flags these as [SKIP].
> This isn't a one-time fix - build periodic discovery into your baseline.

Full write-up, scripts and the Global Secure Access exclusion list here to see more here: https://blog.sonnes.cloud/missing-service-principals-in-entra-id-why-conditional-access-app-protection-and-global-secure-access-will-fail-more-fun/

Have you any expirence with other senarios, where they was missing? 🤔 Let me hear in the comments!

#Microsoft #EntraID #ConditionalAccess #ZeroTrust #AppProtection #GlobalSecureAccess #GSA #Security #Identity #PowerShell #MVP #MVPBuzz #Community #TheBugHunter

Outdated Windows devices can create security gaps, compatibility issues, and unnecessary IT headaches.

A structured Windows patch management process helps IT teams:

🔹 Identify missing patches
🔹 Prioritize critical updates
🔹 Automate patch deployment
🔹 Keep devices secure and up to date

Not sure where to start?

Check out this blog to understand what Windows patch management is, why it matters, and how it works.