Skip to content
← All topics

Security & Identity

13articles

Identity is where most solutions quietly break. Notes on SSO and authentication flows, Microsoft Graph permissions, least-privilege design, and the security trade-offs that show up once something real hits production.

  • SSO, authentication, and token flows
  • Microsoft Graph scopes and least-privilege permissions
  • Securing agents, apps, and endpoints by default

Articles about Security & Identity

Newest first

  1. 12 min readPower Platform

    See Every CSP Violation in Your Power Platform Apps

    Power Platform sends CSP violation reports from code, model-driven, and canvas apps. Here's the small open source collector I built to triage them.

  2. 26 min readAI

    InfiniAIBook: A Self-Hosted AI Research Notebook

    A field guide to InfiniAIBook, the AI research notebook you host yourself: cited chat, live voice discussions, Studio formats, videos, and Azure deployment.

  3. 8 min readPower Platform

    Microsoft Communications Portal: One Feed for Every Microsoft Update

    What the Microsoft Communications Portal is, how it aggregates Power Platform, Microsoft 365, Azure, and Fabric update feeds into one dashboard, its defense-in-depth security model, deployment options with Azure Developer CLI or Docker, and how to contribute on GitHub.

  4. 15 min readPower Platform

    The Power Platform API Grew Up. Here's What That Looks Like in Production

    A technical tour of every Power Platform and Copilot Studio API surface behind Portal 360° — BAP, api.powerplatform.com, RBAC, the inventory query endpoint, Dataverse, and the tenant-scoped usage host — with real, sanitized calls and screenshots.

  5. 49 min readAzure

    An Hour with Azure SRE Agent

    What Azure SRE Agent is, what setup actually looks like, and what happened when I pointed it at my own repo, my Application Insights telemetry across Dataverse, Copilot Studio, and Foundry, and then asked it for a health check on everything at once. Plus what connecting an incident platform buys you — autonomous mitigation, a verification loop, and a handoff straight to the GitHub Copilot coding agent — the five switches worth flipping that you don't get turned on by default, and what the newly published Zero Ops framework recommends, including the two governance layers above per-tool Allow and Ask and three details worth verifying against the current docs.

  6. 9 min readPower Platform

    Power Apps Code Apps: Your Code, Power Platform's Guardrails

    Code apps let you build a React or Vue app in your own IDE and run it on Power Platform, with Entra ID sign-in, 1,400+ connectors, and DLP handled for you.

  7. 12 min readCopilot Studio

    Finding GitHub Copilot Harness Agents Before PPAC Shows Them

    The Power Platform admin center still doesn't flag which Copilot Studio agents run on the GitHub Copilot harness. The isCLIAgent property does, and Microsoft has now published governance guidance built on it.

  8. 14 min readMicrosoft Foundry

    Publish Foundry Agents to Teams Behind a Private Endpoint

    Disabling public network access removes the Foundry portal's Teams publish button. Here's the REST path that replaces it and the inbound design you now own.

  9. 23 min readCopilot Studio

    Add ServiceNow to Copilot Studio with User Login SSO (So ServiceNow Permissions Are Respected)

    Connect ServiceNow to Copilot Studio with Microsoft Entra ID User Login so requests honor each user's roles, ACLs, and audit trail.

  10. 21 min readVibe Coding

    Vibe Code Your Blog, Part 2: Build It, Then Ship It to Azure

    Create an Astro blog with GitHub Copilot, put it on GitHub, and deploy it to Azure Static Web Apps with OIDC and least-privilege access.

  11. 5 min readCopilot Studio

    The Copilot Studio Auth Trap: Turning On SSO Changes Your Client

    Turning on authentication breaks the Copilot Studio SDK with EnvironmentSettingViolation. Here's why Direct Line and a server-side token exchange are the fix.

  12. 6 min readIntune

    The Intune Permission Trap: Your Graph Scope Is Only Half the Story

    A field report on diagnosing an Intune Graph 403 after granting DeviceManagementManagedDevices.Read.All, with instrumentation patterns for missing access.

  13. 20 min readAzure

    Portal of Portals: One Console for Every Admin Portal

    A tour of Portal 360°: multi-tenant admin, config drift, CVE tracking, and the BFF-secured Next.js architecture behind one Microsoft cloud console.

Explore related topics