Microsoft’s Continuous Access Evaluation (CAE) can revoke access before a normal one-hour token expires, but its protection is far from universal across Microsoft 365. An analysis of 740 first-party resource tokens found that only 33 included the CAE claim, while some Microsoft clients still request ordinary tokens even when connecting to CAE-capable services.

Source

Microsoft is tracking an active fake software campaign that regenerates malicious archives behind familiar download filenames, then uses Windows components such as `msiexec.exe` to execute payloads from randomized public directories. The Silver Fox-linked activity has compromised organizations in healthcare, manufacturing, gaming, technology, logistics, government, and education, particularly those with China-based operations or Chinese-speaking users.

Source

TerminalFix, a new ClickFix variant, is using fake Cloudflare Turnstile CAPTCHAs to make victims run PowerShell commands that install a persistent reverse tunnel. Unlike campaigns focused mainly on infostealers, this attack can turn one compromised Windows PC into a gateway to domain controllers, database servers, backup systems, and other internal targets.

Source

A PowerShell script can now compare Microsoft Graph’s current permissions with a stored baseline and alert administrators when Microsoft adds narrower or new access options. The automation also uncovered a problem in Azure Automation: Microsoft Graph Files cmdlets were unavailable in the PowerShell 7.4 runtime, forcing a switch to direct Graph API requests.

Source

Microsoft is preparing to eliminate browser-based delegated sign-ins for interactive Microsoft Graph PowerShell sessions that use the Microsoft Graph Command Line Tools application. Administrators who rely on this workflow should move to the Web Account Manager (WAM), app-only authentication, or tenant-specific app registrations before Microsoft applies the service-side enforcement.

Source

Microsoft is asking customers how they use `ObjectGuid`, `SamAccountName`, and `DistinguishedName` before deciding whether to continue supporting all three in Exchange Online. The directory modernization review could affect scripts, provisioning systems, reporting, integrations, and administrative workflows, but Microsoft has not yet decided.

Source

Microsoft published the WindowsBackupAdmin 1.0.0 module on 19 August 2026. The module wraps Microsoft Graph beta windowsSetting APIs so you can view, export, and delete Windows settings backup data without building Graph requests yourself. Microsoft Graph is the REST interface Microsoft 365 uses for tenant data. These scripts do not back up files, disks, or mailboxes. They only manage the cloud copy of Windows user settings and backup profiles.

Source

Microsoft’s `Invoke-ChangeMeetingOrganizer` cmdlet can move the Exchange calendar event while leaving the Teams online meeting tied to the former organizer. A new Microsoft Graph and PowerShell workaround now recreates the Teams meeting for the replacement owner, building on the earlier discovery that the organizer-transfer cmdlet leaves Teams links behind.

Source

Microsoft’s free Delivery Optimization Troubleshooter gives Windows administrators a faster way to diagnose failed peer downloads and Microsoft Connected Cache problems. A single PowerShell command gathers service logs, policies, network data, performance counters, and event information, while an optional live-capture mode records the failure as it happens.

Source

Microsoft Purview is expected to add retention-policy support for Planner tasks during August 2026, but administrators can already remove stale tasks with PowerShell. A tenant-wide Microsoft Graph script can find plans, filter old tasks locally, delete them safely, and email a cleanup report.

Source

KB5120998 in the Windows 11 Release Preview channel removes the Windows Management Instrumentation Command-line (WMIC) utility from Windows 11 versions 24H2 and 25H2. With this update, WMIC is gone from those builds, and you cannot add it back. Windows Management Instrumentation (WMI), the service that exposes hardware and operating system data, remains in Windows. Microsoft's documented replacement for typical wmic queries is the PowerShell cmdlet Get-CimInstance.

Source

A PowerShell method now gives administrators a practical way to investigate the Entra Conditional Access licensing-gap warning. It compares accounts covered by enabled policies with users holding an Entra ID P1 or P2 service plan, helping identify possible gaps without assuming that Microsoft has begun blocking sign-ins or automatically charging tenants.

Source

Superviser Windows sans installation de logiciels : découvrez PS-MRTG et d'autres outils PowerShell autonomes, accessibles via le navigateur, même en air‑gap.

Le post Superviser un serveur Windows verrouillé sans rien installer : l’approche d’Eric Guiffault en PowerShell a été publié sur IT-Connect.