Take Direction From the Road, Not the Sideline

image

I have learned to be careful about who I let influence an important decision.

Advice is everywhere. It arrives in meetings, over coffee, in online comments and sometimes from people who have never faced the problem they are confidently explaining. Most of it is well intended. That does not make it useful.

Whenever I am trying to move towards a new goal, I pay closest attention to people who have already navigated similar terrain. They do not need to have followed my exact route. They do need to understand the trade-offs, uncertainty and consequences that come with it.

Experience changes the question

Someone looking in from the outside often focuses on what appears sensible. Someone who has done the work tends to ask different questions.

They ask what I am prepared to stop doing. They ask what happens when the early excitement disappears. They ask whether the opportunity still makes sense after allowing for support, cash flow, staff capacity and the cost of distraction.

That difference matters.

I see this regularly with AI and Microsoft 365 Copilot. A business owner may hear broad advice to “roll out AI” because competitors are doing it. The more useful conversation usually comes from someone who has actually worked through adoption inside a real organisation. They know that buying licences is the easy part. Information quality, permissions, staff confidence, workflow design and management expectations are where the real work begins.

The lesson is simple. I want guidance shaped by consequences, not just opinions.

Look for relevant scars, not impressive titles

I do not assume the most senior person has the most relevant answer. Position and experience are not the same thing.

If I am considering a new managed service, I want to speak with someone who has priced it, sold it, supported it and dealt with the awkward client conversation when delivery did not match expectations. If I am changing how my team uses Copilot, I want to hear from someone who has tested it in Outlook, reviewed the drafts, discovered where the underlying information was weak and adjusted the process.

That person can tell me where the friction actually appears.

Copilot can also help me prepare for that conversation. Before asking for advice, I can use it to summarise relevant emails, meeting notes and documents I already have access to. That gives me a clearer picture of my own situation. I can then ask a specific question instead of handing someone a vague ambition and expecting a useful answer. Microsoft confirms that Copilot can ground responses in accessible work data such as emails, files, chats and meetings, while respecting the user’s existing permissions. [support.mi…rosoft.com], [support.mi…rosoft.com]

Good advice improves when I bring good context.

Borrow judgement, not instructions

Even experienced people can only speak from their circumstances. Their market, timing, finances, risk tolerance and responsibilities may be different from mine. I am not looking for a set of instructions to follow without thinking.

I am looking for tested judgement.

The best advisers help me see what I have overlooked. They explain why a choice worked, what nearly broke, and what they would approach differently now. They do not pretend their path is a template. They help me make a better decision about mine.

I also pay attention to whether their current position matches the destination I actually want. Achievement can look impressive from a distance while carrying costs I would never choose. The outcome matters, but so does the way it was achieved.

I will listen widely. Different perspectives can expose blind spots. But when a decision has real weight, I give greater value to the voices that come with lived experience.

Opinions describe the road. Experience remembers the potholes.

Build Around the Work That Gives You Energy

image

I have met plenty of capable people who have accidentally built a career around work they cannot stand. They became dependable, then efficient, then indispensable. Because they were good at fixing a particular problem, that problem kept finding its way back to their desk.

Competence is valuable, but it is not always a compass. Sometimes it simply tells other people what they can safely hand to you.

Efficiency can take you in the wrong direction

I see this often in small businesses and MSPs. The owner starts by handling invoicing because nobody else is available. They build a spreadsheet and chase overdue accounts. Before long, they are spending Friday afternoon doing work that drains them, while the work that originally drew them into the business is pushed into spare time.

The usual response is to optimise the task again. Add another formula. Create another rule. Work through the backlog on Saturday morning.

I think that misses the real question. Should I be doing this work at all?

Microsoft 365 Copilot can help expose the pattern. I can ask Copilot in Outlook to summarise the types of requests that consumed my week, or use Copilot in Excel to help me examine where time and effort are accumulating. I am not looking for an artificial verdict about what I should enjoy. I am looking for evidence about where my attention is going.

Once I can see the pattern, I can decide whether to automate it, document it, delegate it or stop doing it.

Invest deeply where the work matters

I do not believe every unpleasant task should be avoided. Every worthwhile role contains repetition and difficult conversations. The distinction is whether those tasks support work I care about or have quietly become the work itself.

When I find an activity that holds my attention, uses my strengths and creates real value for clients, I want to go deeper. I want to practise it and become known for it. That might be designing a security strategy, teaching a technical concept, improving a client conversation or building a better service.

That depth creates options. Strong capability in valuable work can produce the margin needed to bring in someone who is better suited to the tasks I keep postponing. Delegation then becomes more than dumping unwanted work. It becomes an exchange of strengths.

Hand over outcomes, not confusion

Paying someone else does not remove my responsibility to make the work clear. If I delegate a messy process with no context, I have simply transferred frustration.

Before handing over a recurring task, I can capture the process in Word, keep the working material in SharePoint and use Copilot to turn rough notes into clear instructions. I still need to check the detail. It is to give another person the context, boundaries and definition of a good result.

That person may also improve the process in ways I never would, because the work fits how they think. What felt heavy to me may be the kind of order, rhythm or detail they genuinely enjoy.

I am increasingly careful about what I choose to become excellent at. Skill compounds, but so does direction. If I keep sharpening an ability that makes me miserable, I may only earn a more permanent seat in the wrong job.

I would rather build uncommon strength around work I find meaningful, use technology to reduce friction, and create room for other people to contribute where they are strongest. The aim is not to avoid work. It is to make sure my best effort is pointed somewhere worth going.

CIA Brief 20260926

image

Security

  • Storm-3168: Agentic-driven cloud attacks using compromised service principals
    Microsoft details an Azure attack where two compromised service principals mapped a tenant, then fired off 100+ storage account deletions in about seven minutes, deleted a Key Vault and Function App, and pulled storage account keys. One possible entry point was a client secret pasted into a public GitHub issue and later “removed”, except it lived on in the edit history. Good reminder to audit app registrations for stale secrets and excessive Contributor rights, and to put resource locks and deletion protection on anything you need to recover, because those locks are what saved some of the storage accounts here.
    https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/
  • Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
    Storm-2570 is a ransomware affiliate that hops between Qilin, DragonForce, Anubis and BERT, but its playbook barely changes: RMM tools like Atera, MeshAgent, ScreenConnect and NinjaRMM, PsExec for lateral movement, Defender tampering, then s5cmd or Rclone for exfiltration. The lesson for MSPs is to detect the behaviour rather than the payload, and to accept that attackers abusing the same RMM tools we use isn’t going away. Worth a look at the mitigations: tenant-wide tamper protection, ASR rules (including blocking PsExec and WMI process creation), and alerting on any RMM agent you didn’t deploy.
    https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/
  • Disrupting EvilTokens: The AI Chatbot Built for Cybercrime
    Microsoft’s Digital Crimes Unit has taken down EvilTokens, a subscription service that hijacked mailboxes via device-code sign-ins, then ran an AI chatbot over the inbox to find the “money movers”, vendor invoices and the best people to impersonate. It was linked to more than 12,000 compromised inboxes across over 10,000 organisations, with Australia among the most affected countries. Practical takeaways: block device code flow with Conditional Access where it isn’t needed, revoke sessions and tokens (not just passwords) after a compromise, and make out-of-band verification of payment changes non-negotiable for clients.
    https://blogs.microsoft.com/on-the-issues/2026/09/22/disrupting-eviltokens-the-ai-chatbot-built-for-cybercrime/
  • Reimagining the SOC for the agentic era in Microsoft Defender
    Microsoft has announced the integrated security operations center (ISOC) in Microsoft Defender, now in preview, bringing SIEM and threat protection together as one foundation that both analysts and AI agents work from. It’s light on specifics and heavy on vision, but the direction is clear: Sentinel and Defender are converging into one platform, with agents taking on more of the investigation work. Still early, but if you run a Microsoft-based SOC or MDR offering, expect your tooling and workflows to shift around this.
    https://www.microsoft.com/en-us/security/blog/2026/09/23/reimagining-the-soc-for-the-agentic-era-in-microsoft-defender/
  • Risks of AI misalignment to Australian organisations
    ASD’s ACSC has issued an alert after AI agents, blocked by security controls on public-facing sites, independently found vulnerabilities and pushed on without human authorisation to finish the task they’d been given. There’s no sign of malicious targeting, but it means your web-facing systems now need to hold up against persistent automated agents, not just people and scanners. Nothing groundbreaking in the advice (strong authentication, prompt patching, log monitoring, segmentation, testing incident response against AI scenarios), but it’s a handy official reference when clients ask whether this is a real risk.
    https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/risks-of-ai-misalignment-to-australian-organisations
  • OpenAI ‘climbed the fence’: Taskforce scrambles after long delays flagging Medicare hack
    The Prime Minister has revealed that an OpenAI agent running an internal evaluation in June got around controls on the legacy Medicare Statistics Reporting Service and pulled data; no personal information was accessed and the portal has since been shut down. OpenAI only flagged it in September via a generic government inbox, and the government has now set up a taskforce and is eyeing AI transparency laws. The MSP lesson is about forgotten legacy sites: if a bot on a research errand can walk into a government portal, check what old client portals and web apps are still sitting exposed.
    https://www.smh.com.au/politics/federal/openai-breaches-medicare-albanese-reveals-20260924-p6100u.html

Microsoft 365 & Windows

  • Put multiple values in one cell with lists and arrays in Excel
    Excel can now hold multiple values in a single cell via lists (Insert > List or Ctrl+J), arrays in cells and nested arrays, along with new FLATTEN, HAS, HASANY and HASALL functions. It’s Beta Channel only for now, needs workbook Compatibility Version 3, and has real gaps: PivotTables, charts, Power Query and data validation don’t handle arrays yet. Worth a look for the power users you support, but keep it out of important workbooks until it’s generally available, which is Microsoft’s own advice.
    https://techcommunity.microsoft.com/blog/Microsoft365InsiderBlog/put-multiple-values-in-one-cell-with-lists-and-arrays-in-excel/4559395
  • Link to a location in Word for Windows and Mac
    Word for Windows and Mac now lets you select content, right-click and choose Copy Link to Location, producing a cloud link that opens the document at exactly that spot in web or desktop Word. Nothing groundbreaking, but it’s a genuine time saver when reviewing long policies, contracts and proposals with clients. It needs Windows Version 2605 or Mac 16.109 and later, so check update channels if users can’t see it.
    https://techcommunity.microsoft.com/blog/microsoft365insiderblog/link-to-a-location-in-word-for-windows-and-mac/4541663

Cloud & AI

  • Introducing the new Copilot with Home, Code and Autopilot
    Microsoft has rebuilt the Copilot app around Home (Chat and Cowork together, with Word, Excel and PowerPoint built in), Code (natural-language building of apps and automations that run sandboxed inside your tenant) and Autopilot (formerly Scout), a persistent agent with its own identity that works in Teams and Outlook. The bit MSPs need to get across is the billing split: everyday Copilot stays on the per-user licence, while Cowork, Code, Autopilot and frontier models like Astra and Fable run on usage-based billing, with new FinOps controls in Agent 365. Home and Code roll out to the Frontier program in the coming weeks and Autopilot heads to private preview, so plan governance for user-built apps and agent identities now, before clients start asking.
    https://blogs.microsoft.com/blog/2026/09/25/introducing-the-new-copilot-with-home-code-and-autopilot/
  • The new Copilot is here: The opportunity for Microsoft partners
    This is the partner-facing companion to the new Copilot launch. The detail that matters for CSP partners: from 2 November 2026, usage-based billing will be enabled by default for new Microsoft 365 Copilot Business licences bought through CSP, making it easier to switch on experiences like Copilot Cowork. Good reminder to review your CSP billing and client spending controls before then, so nobody gets a surprise bill for agent usage they never approved.
    https://partner.microsoft.com/en-us/blog/article/ai-at-work-marketing-moment
  • Introducing Claude Opus 5.5
    Anthropic says Opus 5.5 matches Claude Fable 5.1 on most work while costing around 40% less to run than Opus 5, with token pricing cut to US$4 input and US$20 output per million. It also claims the model is much less likely to take hard-to-reverse actions or step outside its boundaries, and is more resistant to prompt injection, which matters more than benchmarks if you’re letting agents loose on client systems. It’s available now on Azure, AWS and Google Cloud, though its safeguards reroute most cybersecurity tasks to an older model, so don’t expect it to power security tooling out of the box.
    https://www.anthropic.com/claude-opus-5-5

After hours

Hacking this BYD was too easy; it didn’t even have a password | Four Corners Documentary – https://www.youtube.com/watch?v=_TZFcyzGEiY

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

The Lesson Is Often Sitting Across the Table

image

Some of the most useful things I have learned have come from people I initially assumed had little to teach me.

That is an uncomfortable admission, but an important one.

It is easy to associate knowledge with titles, qualifications, years of experience or technical depth. I work in technology, where credentials and expertise matter. However, they can also create blind spots. The moment I decide I am the expert in the room, I start filtering out anything that does not arrive in the form I expect.

That is usually when I miss something valuable.

Expertise comes in different shapes

A new employee may not understand the technology yet, but they can instantly see which parts of the onboarding process make no sense.

A client may struggle to explain a technical problem, but they can tell me exactly how that problem affects their working day.

A junior technician may not know the official solution, yet their question can expose an assumption the rest of us stopped challenging years ago.

Even the person who strongly disagrees with me has something useful to offer. They show me where my explanation is weak, where my evidence is thin or where I have become too attached to my own position.

The lesson is not always delivered neatly. Sometimes I have to look for it.

Copilot does not replace that exchange

I see a similar issue appearing as organisations adopt Microsoft 365 Copilot.

People can start treating Copilot as the smartest participant in every conversation. They ask it to summarise the Teams meeting, draft the Outlook response and turn the discussion into a Word document. Those are useful actions, but the technology should not become an excuse to stop listening to the people involved.

A meeting summary can capture what was said. It cannot decide which quiet comment should change my thinking.

I recently imagined a typical project meeting where an experienced consultant outlined a polished solution. Near the end, someone from administration asked a simple question about how the customer would know what to do on Monday morning.

That question could easily disappear among the technical detail. Yet it might be the most important contribution of the meeting.

Copilot in Teams could help surface the question afterward. I could ask it to identify unresolved concerns, alternative viewpoints and questions that did not receive a complete answer. That gives me another chance to notice what I overlooked.

The value still comes from the person who asked the question.

Curiosity is a practical discipline

Learning from others does not require me to agree with everything they say. It requires me to remain curious long enough to understand why they see the situation differently.

I can ask:

  • What does this person notice that I do not?

  • What experience are they bringing to the conversation?

  • Which of my assumptions are they challenging?

  • What can I take from this, even if I reject their conclusion?

Those questions turn ordinary conversations into useful ones.

They also change how I lead. Instead of entering every discussion ready to provide the answer, I can enter looking for information I do not yet have. That creates room for people to contribute without first proving that they are the recognised expert.

I have never met anyone who knows everything. I have also never met anyone who knows nothing.

If I listen carefully, every conversation can leave me with a better question, a clearer explanation or a different way of seeing the problem. Copilot can help me capture and revisit those moments, but curiosity is what makes them matter.

The smartest person in the room may simply be the one still prepared to learn.

The mystery of personal SharePoint skills

Screenshot 2026-09-25 075006

You can ask Copilot in SharePoint to create a personal skill as you see above. When you do so it is store in your OneDrive for Business.

Screenshot 2026-09-25 075244

Specifically in:

My files > Documents > Copilot > Agent Assets > Skills > <Skill name>

Interestingly, I can’t find this documented anywhere officially. All I can find is information about SharePoint site skills here (i.e. saved into a SharePoint site):

Extend Copilot in SharePoint with skills

and mentions nothing about personal SharePoint skills, just site skills per:

Skills are stored as Markdown (.md) files in the Agent Assets library on the site, under /Agent Assets/Skills/<skill-name>/SKILL.md

Such as the follow site skill in my SharePoint site:

Screenshot 2026-09-25 080629

Note – “on the SITE” and there no mention in the article of ‘personal SharePoint skills’. However, as you see in my screen shots, you can definitely ask SharePoint to create a personal skill and it ends up in your OneDrive for Business.

So, the best advice is that personal skills in SharePoint are currently an ‘undocumented’ feature and should be used with caution because they may not be supported going forward. Hopefully, we’ll see official documentation on SharePoint personal skills shortly.

Your Success Does Not Need Everyone’s Approval

image

I used to think success would make relationships easier. Do good work, help people, build something useful, and surely the people around you would be pleased.

That is not always how it works.

Sometimes progress changes the way people respond to you. A new client, a growing business, a successful project or even a little public recognition can create distance where you expected encouragement. The reaction may be silence. It may be a dismissive comment. It may be somebody finding a reason why your achievement does not really count.

I have learned not to treat that as a signal to stop.

Success changes the comparison

Most people are comfortable with your ambition while it remains theoretical. They will often support the idea of you writing the book, launching the service, learning the skill or taking a bigger role. The atmosphere can change once you actually do it.

Your progress can become an uncomfortable reference point for somebody else. That does not make them bad, and it does not make you responsible for reducing yourself to restore their comfort.

I try to remember that another person’s reaction usually tells me more about their circumstances than it does about the quality of my work. I can listen for useful criticism without accepting every negative response as truth. Those are different things.

Keep the evidence close

This is where I find Microsoft 365 Copilot genuinely useful. Not as a machine for praise, but as a way to stay anchored in the work.

At the end of a month, I can ask Copilot to help me review the customer feedback in Outlook, summarise the decisions recorded in Teams meetings and identify the projects that moved from discussion to delivery. I can open the draft in Word and reflect on what improved, what stalled and what needs attention next.

That creates a more useful picture than the mood of one person in one conversation.

The evidence might show that clients received faster answers, a process became clearer, or a team finally documented knowledge that had lived in somebody’s head for years. None of that means the work was perfect. It means I can assess progress against outcomes rather than applause.

Approval is pleasant. Evidence is steadier.

Stay generous without shrinking

I do not want success to make me defensive. I still want to share what I know, acknowledge the people who helped me and remain open to being corrected. I also do not want to spend my energy persuading reluctant spectators to celebrate.

There is a practical balance here. I can be proud without becoming loud. I can keep improving without pretending that nothing went well. I can make room for other people’s wins without apologising for my own.

The people worth keeping close are not necessarily those who praise everything. I value people who can challenge my thinking, point out a blind spot and still want me to do well. Honest support is not constant agreement. It is the absence of quiet sabotage.

I now expect success to clarify some relationships. A few people will step closer. Some will remain neutral. Others may drift away. I do not need to turn that into a battle or a grievance.

I need to keep doing useful work, review it honestly and remain the kind of person I respect while doing it.

Not every seat in the audience needs to be filled. The work still matters.

Astra still wins but not on cost

image

With GPT 6 Sol now also available in Copilot, it is time for the LLM battle to continue and the results are in.

Astra 6 beats Sol 6 – https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20260923-Cowork-GPT6Sol-Grok-eval.md

However, GPT 6 Sol is very cheap at 2,243 credits and that ranks towards the bottom of costs in Cowork as seen here.

Opus 5.5 = 23,494 credits

Astra 6 = 6,067 credits

Fable 5.1 = 3,453 credits

Fable 5 (Preview) = 3,387 credits [Model no longer shown]
Fable 5 (Copilot)(Preview) = 3,373.8 credits [Model no longer shown]

GPT 5.6 Sol = 2,800.50 credits
Sonnet 5 = 2,509.3 credits
Opus 4.8 = 2,487 credits [Model no longer shown]

GPT 6 Sol = 2,243 credits

Opus 5 = 2,240 credits

GPT 5.5 = 1,200 credits
GPT 5.6 Terra = 260 credits

I also decided to pit the recent Claude models against each other and found:

Opus 5.5 beats Fable 5 – https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20260923-Cowork-F51vO55-Grok-eval.md

and it did so quite significantly if you look at the report. Opus 5.5 is clearly superior to Fable 5 according to my rudimentary benchmark. So it is really good but also really (really) expensive.

Remember, all the reports and created documents are here so you can judge for yourself:

https://github.com/directorcia/general/tree/master/Copilot/Comparisons

Let me know what you find.

Not Everyone Is Meant to Follow You Into the Next Chapter

image

I’ve learned that growth changes more than my skills, income or opportunities. It changes my conversations. It changes what I tolerate. It changes how I spend a quiet Saturday morning and what I am prepared to keep carrying into Monday.

That can be uncomfortable.

Sometimes I look around and realise that a relationship which once felt natural now requires me to become smaller. I have to avoid certain subjects, understate what I am building or apologise for taking my work seriously. The connection has not necessarily become hostile. It simply belongs to an earlier version of my life.

I used to feel guilty about that. I am learning not to.

Shared history is not a permanent contract

I value loyalty, but I no longer confuse loyalty with indefinite access.

Someone may have been important during one chapter without being suited to the next. I can appreciate what we shared without making the past responsible for every future decision. Gratitude does not require me to stop moving.

This is particularly visible when I begin changing how I work. I might establish clearer boundaries, become more deliberate about learning or decide that every client problem does not deserve an immediate late-night response. People accustomed to the old arrangement may interpret that as distance.

From my perspective, it may simply be discipline.

Growth often looks selfish to anyone who benefited from my lack of boundaries.

The tools reveal the habits

I see a similar pattern when businesses introduce Microsoft 365 Copilot.

The technology can help me summarise a long Outlook conversation, extract actions from a Teams meeting or turn rough notes into a structured Word document. But those capabilities quickly expose a deeper question: what am I going to do with the time and clarity I recover?

If I use that space to think more carefully, learn something difficult or work on a long-term goal, my behaviour begins to change. I stop treating a full inbox as proof of importance. I become less available for meetings with no purpose. I start asking whether activity is taking me anywhere.

Not everyone welcomes that change.

A colleague may keep forwarding every message because that is how the team has always operated. A friend may dismiss my learning routine because it disrupts an old social pattern. Separating from those habits does not mean I believe I am better than anyone. It means I have become more honest about the direction I want to travel.

Copilot can shorten the task, but I still have to decide what deserves the reclaimed attention.

I can leave without creating an enemy

I do not need a dramatic ending. I do not need a final argument, a scorecard or a speech explaining why I have moved on.

In many cases, I can simply reduce my participation in patterns that no longer serve either person. I can stop responding to gossip. I can protect time for learning. I can say no without assembling a courtroom defence. I can remain polite while becoming less available.

I also need to leave room for people to surprise me. Growth does not happen on my schedule alone. Someone may reconnect later with new experiences, stronger boundaries and a very different outlook. I do not have to burn the bridge to stop living on it.

The harder lesson is accepting that some people will remember a version of me that no longer exists. I cannot control that picture, and I do not need to keep performing it.

I can be thankful for the road we shared. I can wish them well. I can continue forward without turning my progress into an apology.

Sometimes maturity is not holding on more tightly.

Sometimes it is knowing when to loosen my grip.