Microsoft 365, cybersecurity and AI security for admins, security engineers and MSPs. We skip feature news and cover only changes that affect your attack surface: what changed, who acts, by when, and the command that proves you are done.
A poisoned LiteLLM 1.107.0 on PyPI and Docker ran on every Python start and sent cloud, AI and developer credentials to the attackers. It was online for about two hours on 21 October 2026. How to check and what to rotate.
Read the briefWhen a change needs real work, a kit turns it into a project: the controls in order, what each one does to users, how to roll it back, and checks that only read. Jira import and Excel plan included. Every kit starts with a free Top 5 (Top 10 for Microsoft 365 hardening).
Where to start
This is a real control from the Conditional Access kit, shortened. Controls in every kit follow this layout, so a reviewer, a change board or a client can read them the same way. Impact and rollback are still being added to the two oldest kits.
Legacy protocols (IMAP, POP, SMTP AUTH from old clients, Exchange ActiveSync with basic credentials) cannot do MFA, so a stolen password is enough. A single Block policy on the legacy client app types closes that path.
Run the read-only check: it lists block policies on legacy client types and groups the last 7 days of sign-ins by client app.
Apps and devices that sign in with legacy protocols stop working (old mail clients, scanners using SMTP AUTH with basic credentials, scripts).
Set the policy to Report-only or Off; add a temporary exclusion for one account while it is migrated.
$p = Get-MgIdentityConditionalAccessPolicy -All
$b = $p | Where-Object { $_.GrantControls.BuiltInControls -contains 'block' -and ($_.Conditions.ClientAppTypes -contains 'exchangeActiveSync' -or $_.Conditions.ClientAppTypes -contains 'other') }
"Legacy-auth block policies: $(@($b).Count)"
$b | ForEach-Object { "$($_.DisplayName) | $($_.State)" }
$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString('yyyy-MM-ddTHH:mm:ssZ')
Get-MgAuditLogSignIn -Filter "createdDateTime ge $since" -Top 1000 | Group-Object ClientAppUsed | Sort-Object Count -Descending | ForEach-Object { "Client app '$($_.Name)': $($_.Count) sign-ins (last 7 days, first 1000)" }Keep them. They tell you what is off. A kit is the project to fix it: an ordered backlog with owners, what each change breaks and how to undo it.
No. They only read: Get-* and Search-* cmdlets and Microsoft Graph GET requests. Every kit is checked for write commands before release.
A security practitioner with 15 years in IT and cybersecurity: at a systems integrator, then as a Big 4 consultant, now as a cybersecurity expert at a regulated EU bank. Drafting is AI-assisted. Every fact is checked against its primary source: Microsoft Learn, the message center or the vendor's own advisory. How we check.
Yes, in your own organisation and in your clients' tenants. Don't resell the files.