iiinova — where your digital self keeps evolving

Merill Fernando 💚 @merill.net · 03/10/2026

Squeezing out the last bits of my Fable quota for Maester 3.0 research, planning and design. 🔥 Maester 3.0 is going to be huge when it comes out next quarter.

060

Merill Fernando 💚 @merill.net · 28/09/2026

Self-hosted Maester Cloud is ready 🔥 You can now buy it and deploy it into your own Azure subscription with guided setup. → Scheduled Maester runs with the built-in runner → Drift tracking, test by test → Email reports and drift alerts from your own mailbox

140

Merill Fernando 💚 @merill.net · 28/09/2026

This week's entra.news is out!

121

Merill Fernando 💚 @merill.net · 25/09/2026

Folks, phishers have figured out rage bait. Got this today from "SendGrid HR". They're adding a trans youth message to my email footer this month. Don't want it? Just click the button to remove it. Sender is noreply@billkill.no Rage is the new urgency.

192

Merill Fernando 💚 @merill.net · 17/09/2026

Developers wouldn't ship without tests. Identity teams ship changes to a 30-year-old directory every single day with nothing but a change ticket and hope. 269 checks. Read-only. Runs from your workstation. There's no good reason not to have a baseline for AD 🎙️ entra.chat

000

Merill Fernando 💚 @merill.net · 06/09/2026

Issue #165 of Entra News is out and its a bumper issue. Get it at entra.news/p/entra-n...

030

Merill Fernando 💚 @merill.net · 01/09/2026

We just sent out this week's Microsoft AI news roundup. Get it at msai.ms Subscribe today!

021

Merill Fernando 💚 @merill.net · 31/08/2026

General Motors is ~200,000 people into its passkey rollout. Andrew Cameron on Windows Hello at scale, factory floors, and the guest accounts that make it hard. Watch / Listen to the full episode on Entra Chat. entra.news/p/how-gen...

010

Merill Fernando 💚 @merill.net · 30/08/2026

We just sent out this week's Entra newsletter - Issue #164 Get it at entra.news

030

Merill Fernando 💚 @merill.net · 28/08/2026

👋 Folks after year long hiatus the community powered database of aka•ms is back!! Bookmark it 👇 akams.fyi PS. I made some updates to the site, including a much simpler experience to contribute aka•ms links to the database.

152

Merill Fernando 💚 @merill.net · 28/08/2026

👋 Folks, I’ll be joining Sam and Mike to show how you can go beyond security baselines and build custom security tests with Maester across Entra ID, on-prem AD, and your entire hybrid estate. 📅 September 10 at 11:00 AM Hope to see you there!

020

Merill Fernando 💚 @merill.net · 27/08/2026

👋 PSA - M365 admins: quick heads up myaccount.microsoft.com 👇 myaccount.cloud.micr...

030

Merill Fernando 💚 @merill.net · 27/08/2026

"If it ain't broke, don't fix it" is why AD groups still run licensing in a lot of Entra tenants. On 3 November, part of that setup stops working. The clip explains the habit. The episode covers the fix. Gregor Reimling, René Wasel + Eric Woodruff. 🎧 entra.chat

141

Merill Fernando 💚 @merill.net · 26/08/2026

Folks, I just re-started MSAI weekly, your weekly round up of the Microsoft AI updates worth knowing. Including Microsoft 365 Copilot, GitHub Copilot, Azure AI Foundry, Copilot Studio, Security Copilot, Microsoft Fabric, Agent 365, and more. Check it out at msai.ms and subscribe today.

121

Merill Fernando 💚 @merill.net · 22/08/2026

I just sent out issue #163 of the weekly Entra News. Get it today and subscribe if you haven't already! entra.news

050

Merill Fernando 💚 @merill.net · 21/08/2026

Today I accidentally wandered into the wrong neighbourhood on X. PS. I’m loving it 😂

150

Merill Fernando 💚 @merill.net · 18/08/2026

Folks, I'm excited to announce something for all the die hard Intune fans. Check out daily.intune.admin.news today! + bookmark it. BONUS: Sign up for the email newsletter to get the updates delivered straight to you inbox daily.

181

Merill Fernando 💚 @merill.net · 17/08/2026

He copied a value out of the Windows Event Log. Pasted it into his special browser. And he was signed into Microsoft Entra as the user who had just authenticated. No password. No phishing link. No stolen private key. @MGrafnetter's Black Hat USA 2026 research Watch at entra.chat

070

Merill Fernando 💚 @merill.net · 14/08/2026

Did you know your Entra dynamic groups could be granting AI agents access to apps and services without you realizing it? You might even be assigning them licenses and running out of licenses for your human users. Find out how to fix at merill.net/blog

An agent's user account is a subtype of user identity within Microsoft Entra. An agent's user account is evaluated by user-based membership rules and can be included in a dynamic user group when it satisfies the rule.

By default, an agent's user account isn't distinguished from other user identities. To exclude these accounts, include a condition in the membership rule. You can also create rules that include only agents' user accounts or target accounts associated with a specific agent identity blueprint. Agent identities, which are service principals, aren't supported as members of dynamic membership groups.

020

Merill Fernando 💚 @merill.net · 11/08/2026

Now I can find and fix vulnerabilities in my own code. I'm glad to see OpenAI making these model's available to help make our app's secure. FYI For those who want to get access to Daybreak Blue 👇 openai.com/index/exp...

030

Merill Fernando 💚 @merill.net · 11/08/2026

Microsoft-managed SMS and voice MFA retires in 2027. In Episode 70 of Entra.Chat, Jai Maharaj shares a practical path from SMS to passkeys covering profiles, rollout, Conditional Access, secure onboarding and account recovery. Watch or listen: entra.chat

070

Merill Fernando 💚 @merill.net · 09/08/2026

A busy week in Microsoft Entra 👀 The announcements are one thing. Understanding what they actually mean for admins is another. This week, the Entra community has been digging into the memberOf retirement, passkey changes, managed policy updates & more Lots of practical guidance and analysis 👇

030

Merill Fernando 💚 @merill.net · 06/08/2026

I start each day with a concise “Day in brief.” It gives you one clear headline, a plain English overview and the key Microsoft Entra changes worth knowing. Perfect for answering: “What changed today?”

000

Merill Fernando 💚 @merill.net · 06/08/2026

Love the weekly Entra.News? Meet its over-caffeinated sibling → Daily.Entra.News 👀💥🙀 Today I’m launching a new resource for truly hardcore Entra fans A faster way to see what changed on Microsoft Entra

100

Merill Fernando 💚 @merill.net · 03/08/2026

🚨 Entra Conditional Access gotcha from Andres Canello Selecting every device platform ≠ “Any device.” An attacker can spoof the browser user-agent, get no platform match, and that CA policy condition won’t apply. Watch Entra.Chat with for more nuggets 👇 entra.news/p/the-ult...

072

Merill Fernando 💚 @merill.net · 02/08/2026

Issue #160 of Entra.News is out! Get it at entra.news/p/entra-n...

040

Merill Fernando 💚 @merill.net · 29/07/2026

Insider Risk Is a Business Decision - Bring HR In Early

031

Merill Fernando 💚 @merill.net · 28/07/2026

I’ll be honest. Purview has always felt like someone else’s part of the Microsoft security stack. I’m an Entra person. Ray Reyes isn’t, and that’s why I wanted him on Entra.Chat The lines between our products and teams are disappearing.

130

Merill Fernando 💚 @merill.net · 28/07/2026

Folks, Maester 2.2 is here!! It was just a couple of months ago when we launched Maester 2.0 and the amazing Maester community has been SUPER busy.

262

Merill Fernando 💚 @merill.net · 26/07/2026

We just sent out the latest Entra News for the week. Check it out! entra.news/p/entra-n...

061

Merill Fernando 💚 @merill.net · 25/07/2026

Putting the final touches on the upcoming 🔥 Maester 2.2 release and look at this! A new Contributors page dedicated to the awesome community of folks that make Maester what it is today. Check it out and click through to the detail page of each author. maester.dev/contribu...

140

Merill Fernando 💚 @merill.net · 20/07/2026

I was explaining how Microsoft Entra Staged Rollout works and realised it would make a great video especially the under-the-hood details that aren’t in the docs. A quick 7-minute walkthrough is coming soon. What would you like me to cover? 👇

032

Merill Fernando 💚 @merill.net · 19/07/2026

Huge Entra News this week. Microsoft announced plans to phase out SMS and Voice from Entra and passkeys becoming the default. 1/3

282

Merill Fernando 💚 @merill.net · 13/07/2026

We just added GitHub to the list of products that Maester monitors the security configuration for. These are CIS tests too!

061

Merill Fernando 💚 @merill.net · 13/07/2026

Here's a snapshot of the custom Maester tests that I got Sol to write for me as it helps me configure the new Entra External ID tenant. It monitors ✅ Sign-up/sign-in user flows ✅ Email OTP + passkey policies ✅ Conditional Access for the portal ✅ Service principal credentials & permissions 2/3

110

Merill Fernando 💚 @merill.net · 13/07/2026

The best time to set up security tests for your Entra tenant is when you create it The next best time is today 😉 I'm spinning up Entra External ID tenants for maester.cloud (my SaaS solution), & every one gets Maester baked in from day one 🔥 Maester monitoring Maester Cloud. As it should be 1/3

200

Merill Fernando 💚 @merill.net · 12/07/2026

One compromised Agent ID blueprint can become a multitenant blast radius. That is the most important idea in my latest conversation with Katie Knowles, Senior Security Researcher at Datadog, about her three-part security analysis of Microsoft Entra Agent ID. Watch or listen: entra.chat

030

Merill Fernando 💚 @merill.net · 10/07/2026

Me teaching Entra Workload ID Federation to Sol. Fable made the same mistake too. All those badly coded auth code is tripping up the LLMs. For reference this is the article I linked to devblogs.microsoft.c...

wouldn't this be the way to do it withtout certs? https://devblogs.microsoft.com/identity/access-cloud-resources-across-tenants-without-secrets/

13:23

Worked for 1m 2s

Yes. You found the missing piece, and my earlier conclusion was too restrictive.
The app registration and managed identity stay together in the Azure workforce tenant. The app is made multitenant, then its service principal is provisioned into each External ID tenant and attached to the user flow.

110

Merill Fernando 💚 @merill.net · 05/07/2026

👋 We just sent out this week's Entra newsletter. Check it out at entra.news/p/entra-n...

040

Merill Fernando 💚 @merill.net · 04/07/2026

Thomas's point: attackers do not need sci-fi autonomous hacking to win. If your agent blindly installs a package, connects to an untrusted MCP server, or follows a malicious skill, the boring path works first. 2/8

100

Merill Fernando 💚 @merill.net · 04/07/2026

AI agent risk is not just attackers using AI. It is attackers targeting the agent ecosystem most orgs cannot see yet: MCP servers, skills, packages, API keys, tool calls, and prompts. I talked with Thomas Roccia about the new blind spot: 1/8

264

Merill Fernando 💚 @merill.net · 28/06/2026

👋 Folks "passkeys won't save you." Vince Smith, who leads Agent ID at Microsoft Entra, explains why: squeeze one end of the balloon (users) and attackers move to the other 👉 NHI + workloads. New Entra Chat 👇 entra.news/p/from-wi...

041

Merill Fernando 💚 @merill.net · 25/06/2026

Tiny AI workflow hack that saves me every day Pin your top 3 active chats and give each one an emoji. Now you can switch contexts instantly without hunting through old threads. Works with ChatGPT, Codex, Claude, Cursor, GitHub CP or any tool where projects pile up. Simple, but underrated.

110

Merill Fernando 💚 @merill.net · 20/06/2026

Not every admin in your tenant is a person. 👀 Erica Zelic and I break down the "shadow admins" apps, service principals & agent identities quietly holding the keys to your Entra tenant. New Entra Chat episode: entra.news/p/shadow-...

050

Merill Fernando 💚 @merill.net · 15/06/2026

AI agents should not get a blank check to your tenant. I added experimental Guardrails to Lokka.dev so you can limit model-driven Microsoft Graph/Azure calls by HTTP method, API path, tenant, or specific resources. ➕ When something is blocked, Lokka shows exactly why and where to fix it.

120

Merill Fernando 💚 @merill.net · 14/06/2026

This week's Entra News is out. Get it at entra.news

010

Merill Fernando 💚 @merill.net · 13/06/2026

3 things from chat w/ Nikhil→ 10+yrs in Microsoft identity, there for the birth of Conditional Access → The only recommended CA control for agents today is block & that's good for your users → Compromise now shows up first from agents, not humans → LLMs confidently recommend insecure defaults 2/3

120