The May 2026 cumulative update KB5089549 added a new C:\Windows\SecureBoot\ExampleRolloutScripts folder containing seven PowerShell scripts. These scripts are part of Microsoft's sample toolkit for managing Secure Boot certificate migration across enterprise environments. This article explains what each script does, how to run it, and its limitations.

Source

GitHub Copilot CLI—GitHub's AI assistant for the terminal—introduced an experimental feature called Rubber Duck that pairs your primary AI model with an independent reviewer from a completely different AI vendor. The goal is to catch early planning mistakes before they compound into harder-to-fix downstream errors, a known weakness of single-model AI agents. In performance testing on real-world coding problems, combining Claude Sonnet with Rubber Duck closed 74.7% of the performance gap between Sonnet and the more capable Opus tier.

Source

Microsoft announced a breaking change to the Microsoft Graph API affecting Exchange Online: from December 31, 2026, applications that modify sensitive email properties -- such as the subject, body, or recipients -- on delivered messages must hold elevated Mail-Advanced.ReadWrite permissions. Until now, the standard Mail.ReadWrite permission was sufficient for these operations. The new permissions require explicit approval from the tenant administrator ("admin consent"). If you operate Microsoft 365 and have custom applications or third-party tools that interact with email via the Graph API, you need to audit and potentially update these apps before the enforcement date.

Source

VS Code transitioned to a weekly stable release schedule starting with version 1.111 in March 2026, moving away from its previous monthly cadence. Versions 1.112 and 1.113 are the second and third releases under this new schedule, introducing integrated browser debugging, MCP (Model Context Protocol) server sandboxing, Copilot CLI agent permissions, and chat workflow improvements. This article details the most significant technical changes in both releases.

Source

PowerShell 7.6 introduces several new features as part of Microsoft's latest Long-Term Support (LTS) release. With three years of support, it's a strong choice for production servers. Among the key new features in PowerShell 7.6 are improvements that address long-standing annoyances with autocomplete and enhance reliability for common administrative tasks. If you've ever been frustrated by tab completion not working in certain situations or noticed that PowerShell is missing obvious suggestions, this release addresses many of those issues. This article also covers installing PowerShell 7.6 on Windows and upgrading from earlier versions using winget or the MSI installer.

Source

Microsoft's original Secure Boot certificates from 2011 begin expiring in June 2026. Windows devices that still rely on these certificates will no longer receive security updates for boot components, leaving them out of compliance. To address this, Microsoft is rolling out new 2023 certificates for the UEFI Secure Boot Signature Database (DB). Administrators can deploy these certificates to domain-joined machines using Group Policy, PowerShell, or the Windows Configuration System (WinCS). This article covers the technical background, the registry-based deployment mechanism, and Microsoft's sample automation framework for enterprise rollouts.

Source

Windows Terminal Preview 1.25 was released in March, after a brief pause in the quarterly release cycle to focus on reliability and performance. The update introduces a Settings search UI, a rewritten Actions editor for key binding configuration, built-in support for Kitty's Keyboard protocol, two new community translations, and several miscellaneous improvements and bug fixes. You can install it from the Microsoft Store, the GitHub releases page, or via winget.

Source

Windows 11 Insider Preview builds introduce a new secure processing mode for batch files and CMD scripts. IT administrators can enable it via a registry value named LockBatchFilesWhenInUse, which prevents batch files from being altered while they execute. The feature also improves performance when Windows Defender Application Control (WDAC) code integrity policies are active. It is currently available in the Dev Channel build 26300.7939, and the Beta Channel build 26220.7934.

Source

Microsoft Secure Boot certificates issued by the 2011 Certificate Authorities (CAs) are expiring starting June 2026. Every Windows device with Secure Boot enabled must be updated to trust the 2023 certificates before expiration to retain security update support. Microsoft provides a monitoring-only approach using Intune Remediations that runs a PowerShell detection script on enrolled devices and reports Secure Boot and certificate status back to the Intune admin center — without making any changes to devices. This article explains the prerequisites, deployment steps, data collected, and how to read the results.

Source

Library management is a new feature in Microsoft Defender for Endpoint that provides security operations teams with a centralized interface for uploading, organizing, and reviewing scripts and files before a live response session begins. Previously, analysts had to upload tools during an active investigation, which delayed response times. The feature is now generally available for enterprise customers and integrates with Microsoft Security Copilot for automated script analysis.

Source

Microsoft has published its planned team investments for PowerShell 7.7, Windows OpenSSH, and Desired State Configuration (DSC) v3.2. The roadmap for PowerShell 7.7 includes relocating PSUserContentPath, non-profile-based module loading, Bash-style aliases, and a Model Context Protocol (MCP) server. For Windows OpenSSH, the primary addition under evaluation is support for Entra ID authentication. Desired State Configuration (DSC) v3.2 will include a new Python adapter to enable the creation of DSC resources on Linux.

Source

Microsoft announced on February 12, 2026, a significant change to its Exchange Online PowerShell module: the deprecation of the -Credential parameter for the Connect-ExchangeOnline cmdlet. This change represents part of a broader initiative to enhance security across Microsoft 365 administrative interfaces by eliminating authentication methods that do not support multifactor authentication.

Source