Part 2 of "Disabled Isn't Safe": how we took a hybrid onboarding script from Domain Admin and Global Administrator down to a standard user account, one step at a time

What a routine least-privilege project turned up when we went looking for proof, and the five-minute audit you can run in your own tenant today

Somebody on the dev team finally said it out loud in standup: “Can we stop killing my VM at ten o’clock? I’m still working.” Fair enough. The nightly auto-shutdown has been humming along at 10:00 PM Eastern for two years, saving a genuinely embarrassing amount of money, and now the…

Part 2 of a two-part series. Part 1 built this as an Azure Automation PowerShell runbook. In Part 1 we built a nightly VM shutdown with an Automation Account and about 120 lines of PowerShell. It works, it’s testable, and it lives in source control where it belongs. Now let’s…

Part 1 of a two-part series. Part 2 builds the same solution as a low-code Azure Logic App. Here’s a number that should bother you: a dev/test VM that nobody turns off runs 168 hours a week. Your team uses it for about 45 of them. You’re paying for 123…

SPF, DKIM, and DMARC work together as a three-layer authentication shield that determines whether your ACS emails get delivered or dumped. You set up ACS Email, sent a test message, and it worked. Great. But here’s the uncomfortable truth: your emails are one inbox provider update away from landing in…

The ABSPATH bug sends WooCommerce email attachments down the wrong path inside the Azure App Service container — this fix routes them correctly using WP_CONTENT_DIR. The Setup If you’re running WordPress on Azure App Service with WooCommerce and the Microsoft App Service Email plugin (v1.2.1) connected to Azure Communication Services…

Stop fighting with Exchange SMTP relay for scan-to-email and application notifications. This step-by-step guide walks you through setting up Azure Communication Services Email in under 30 minutes — from creating resources to configuring copiers with a verified custom domain and secure SMTP authentication.

Most organizations still rely on SMTP relay through Microsoft Exchange or Microsoft 365 (which is just Exchange Online on the backend) to send application and device-generated email. While this approach technically works, it introduces security risks, operational complexity, and scalability limitations that are increasingly problematic in modern environments. Azure Communication Services (ACS)…

Welcome back! Last week in Part 1, we covered what Temporary Access Passes (TAP) are, why they’re a game-changer for employee onboarding, and how to enable TAP in your Microsoft Entra ID tenant. If you missed it, go back and read Part 1 first – we’ll wait! This week, we’re…