Need to Know podcast – Episode 372

This episode covers the latest Microsoft 365, Copilot, security, OneDrive and Intune updates, along with some thoughts on what we can expect from Microsoft Ignite. I also look at recent MSP security concerns around ConnectWise and SkyKick and why better logging, auditing and monitoring should be a priority.

The bigger topic, however, is where AI is taking the MSP industry. AI will increasingly automate traditional Tier 1 work, while customers will expect IT providers to deliver faster, more consistent services at a lower cost. But putting AI into individual PSA, RMM and security products only creates more intelligent silos. The real opportunity is orchestration: an AI layer across the entire technology stack that can bring these systems together and act more like a digital employee. I share what I’ve been doing with Grokbot and why I think this orchestration model is where MSPs need to be heading.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-372-orchestration/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

Resources

CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS

X – https://www.twitter.com/directorcia

director@ciaops.com

CIAOPS Blog

Join my Teams Shared Channel – CIAOPS

CIAOPS Merch store – CIAOPS

Become a CIAOPS Patron

CIAOPS AI Dojo

CIAOPS weekly news update – CIA Brief – CIAOPS

CIAOPS Labs – The Special Activities Division of the CIAOPS

Support CIAOPS

Get your M365 questions answered via email

Join my email list

A special thanks to the CIAOPS Patron community for making this podcast possible. You can find the benefits of a subscription to the community and become a member at https://www.ciaopspatron.com

Updates

News and links mentioned in this episode

Copilot & AI

Security

Partners/MSP

Admin

CIAOPS Need to Know October webinar – AI M365 Administration automation

Prefer Grease Over Gloss

Cartoon of a coach leaving a cluttered workshop with stained sleeves and a sticky-note prototype, colleagues leaning in

I scroll past another perfect feed and feel that familiar sour taste. Neat theories. Spotless creators. Slide decks that look like they have never met a real tenant. I do not learn much from people who only polish. I learn from people who still have grease under their sleeves.

I want the residue of making. Campaigns that actually shipped. Workshops that ran long because someone asked a hard question. Odd little experiments with clients where half the room shrugged and the other half leaned forward. What worked. What failed in spectacular fashion. The soot, not the lab coat. If the work left a mark on your day, I want to hear about that mark.

What I actually look for

In Microsoft 365 land the polished story is endless. Another AI deck. Another thread about how Copilot will change everything if you just adopt the mindset. Fine. I still want the artefacts. Screenshots with the edges showing. Notes scribbled beside a failed run. The version of the story you tell after the meeting, not the one you rehearsed before it.

Show me the Copilot prompt you tried in Word that spat out a policy draft with three confident wrong facts, and how you fixed the grounding. Show me the Outlook draft that saved you twenty minutes on a reply chain until it politely invented a deadline that never existed. Show me the Teams meeting summary that missed the one decision that mattered, so you had to go back into the recording like a detective with a coffee that had gone cold.

I care about the imperfect Power Automate flow that emailed the wrong SharePoint library for a week before someone noticed the condition was upside down. I care about the SharePoint build with three views too many and a permissions model you had to redraw on a whiteboard while the client watched. I care about the workshop demo that half-worked on the day — Copilot Chat answering beautifully until someone asked about their own retention labels and the room went quiet while we dug through the admin centre together.

That quiet is useful. That stumble is useful. The residue of a real session is useful. Perfect creators rarely leave residue. Practitioners leave trails you can follow.

Content theatre versus leftover evidence

Plenty of content is theatre. Lights up. Script tidy. No fingerprints. I am not interested in performing usefulness. I am interested in doing useful work and then talking about it. The difference sounds small until you have sat through both kinds of session and realised which one changed how you configure a tenant the next morning.

The best posts I have written for CIAOPS were not born as content calendars. They came from a messy Tuesday: a Copilot experiment in Word that surprised me, a flow that broke overnight, a Teams rollout where the chat etiquette mattered more than the licence SKU. I made something. Then I showed the leftovers. Colleagues remembered the leftovers longer than the slides.

When I stagger out of a workshop still holding a sticky-note laptop and a prototype that looks like it lost a fight with a highlighter, that is the signal. Not a victory lap. Just: we figured something out, and here is the board if you want to try it yourself. Bring your own stains. Ask awkward questions. Prefer the workshop mess over the feed glow.

In a world of perfect creators and AI slide decks, I would rather be the practitioner with dirty hands. Coach the work. Share the stains. Prefer makers over gloss.

Do something useful and talk about it. Make something and show it. That is enough.

CIA Brief 20261024

Security

Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Attackers got hold of the ConnectWise Cloud Backup (formerly SkyKick) application identities and signed straight into customer tenants as the app, so MFA never came into play. Some service principals then gave themselves Exchange Administrator or even Global Administrator and added credentials to other apps. If you’ve ever used SkyKick or ConnectWise Cloud Backup, search every tenant for the listed application IDs, check app secrets and certificates added since 13 October, and remember that disabling the app doesn’t kill tokens that were already issued.
https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Microsoft attributes the ConnectWise compromise to Storm-0940, a China-aligned actor using the open-source agentic pen-testing framework ARTEX to try signing in to more than 2,250 tenants, sometimes reaching privileged cloud access in under three hours. Worth a look for the investigation guidance, including the advice not to delete the apps before you’ve reviewed their sign-ins. The bigger lesson is that attacks now run at machine speed through apps you’ve already trusted, so least privilege on multi-tenant apps and alerting on app credential and role changes matter more than ever.
https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/

M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress tracked attackers replaying stolen post-MFA tokens from the 193.26.115.0/24 range against 79 organisations, then registering rogue Entra devices, swapping out MFA methods and hiding inbox rules ahead of payroll fraud. Good reminder that a password reset alone won’t clean this up: revoke sessions, remove rogue devices and MFA methods, and lock down device-code flow with Conditional Access. Then audit every mailbox for hidden inbox rules.
https://www.huntress.com/blog/token-replay-spray

Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
A poisoned LiteLLM release on PyPI and in official container images dropped Python startup files that steal AI, cloud, browser and SSH credentials whenever Python starts, even if LiteLLM is never imported. If you or your clients run AI gateways or dev boxes with Python, check for this version, rebuild the environment rather than just uninstalling, and rotate every reachable secret from a clean machine. It’s another sign that AI tooling is now a prime supply-chain target.
https://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks/

Agents are your newest insiders. Security must move at their speed.
Microsoft’s identity team lays out how it wants agents secured: each gets its own Entra Agent ID, starts with no standing access, and receives task-scoped, time-limited Dynamic Permissions, with Dynamic Conditional Access tightening things as an agent’s risk rises. Discovery is also expanding to 60 local agent types, including Claude Code, Codex and GitHub Copilot. Still early, but this is the model to plan around, and the clear message is that agents should never simply inherit everything their user can reach.
https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/

Securing the agentic insider
This is the executive framing of the same story: Microsoft says frontier models can’t be trusted by default and pitches “Guardian Agents” in Project Perception to supervise every agent action in real time. Nothing groundbreaking, but it’s a useful piece to put in front of SMB owners who assume the agents they switch on are automatically safe. Expect agent governance to become a standing line item in security conversations.
https://blogs.microsoft.com/blog/2026/10/19/securing-the-agentic-insider/

Microsoft 365 & Windows

Cloud Update allows more rollout waves with custom gaps
Now launched: you can set up more than three update waves using Entra ID groups and choose the delay between each one. That makes proper pilot groups for Office updates much easier to run. Worth a look if you’ve been stuck with a one-size-fits-all update ring for clients.
https://www.microsoft.com/microsoft-365/roadmap?id=558251

Archive mailboxes can now grow past 1.5TB
Rolling out now. Until now an archive stopped working once it hit 1.5TB, so this helps the clients with huge, long-retained archives. Check which licences qualify before you promise it to anyone.
https://www.microsoft.com/microsoft-365/roadmap?id=560820

Troubleshooting playbook for Auto labelling in SharePoint and OneDrive
A practical symptom-to-fix guide for Purview auto-labelling policies that run without labelling anything, covering missing prerequisites, simulation quirks, label priority and failure codes. It also confirms limits are rising tenant by tenant to 500,000 auto-labelled files a day and 20 million simulation matches. Worth bookmarking, but note it needs E5-tier licensing, so it applies to fewer SMB tenants than you’d hope.
https://techcommunity.microsoft.com/blog/microsoft-purview-blog/troubleshooting-playbook-for-auto-labelling-in-sharepoint-and-onedrive/4564103

Create guidelines for a workbook with Copilot in Excel rules
You can now add a visible “.Rules” worksheet that tells Copilot in Excel how to format, lay out and calculate in that workbook, and the rules travel with the file when it’s shared. Good reminder that a bit of structure beats re-prompting every time. It’s an easy win for clients with standard reporting templates, though it’s only fully supported in English.
https://support.microsoft.com/en-us/excel/copilot/copilot-in-excel-rules

MC1515927 – Microsoft 365 Copilot: Critique and Council preview experiences will retire
The Critique and Council previews in Researcher will be retired between late October and mid-November 2026, while Researcher and Analyst themselves stay. This only affects Frontier program users who had access to those previews, so most SMB tenants won’t notice. If you’ve trained anyone on them, update your guidance and give the help desk a heads-up.
https://mc.merill.net/message/MC1515927

Copilot Code: Make the power of coding accessible to everyone
Copilot Code is a new tab in the Copilot app where users describe a tracker, dashboard or app in plain English and Copilot builds it, grounded in their work data, then publishes it to the Microsoft-managed Copilot Managed Runtime. It’s rolling out through the Frontier program and needs a Microsoft 365 Copilot licence plus a usage-based spending policy, with local coding on PCs turned off by default. Still early, but expect a wave of citizen-built apps, so decide now who gets a spending policy.
https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/copilot-code-make-the-power-of-coding-accessible-to-everyone/4562358

What’s New in Cowork: Expanded plugins and role-based skills
Cowork now has ready-made role plugins for Sales, Service, Education and Legal, plus federated MCP connectors for live data from outside systems, with Power Platform connectors rolling out over the coming weeks. It can also kick off tasks automatically when a connected system changes, and admins control which plugins are available. Worth a look as a faster route to real Copilot value than building agents from scratch, but review those connectors before you turn them on.
https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/what%E2%80%99s-new-in-cowork-expanded-plugins-and-role-based-skills/4566221

Cloud & AI

Advancing digital sovereignty with greater control and choice
Microsoft is extending its Sovereign Cloud range: a Sovereign Control Panel goes into preview at Ignite, external key management with Azure Managed HSM is now generally available, and Azure Local adds multitenancy, Foundry Local and GitHub Enterprise Local. Nothing groundbreaking for most SMBs, but it’s useful ammunition when a client in a regulated sector worries about who controls their data. Azure Local multitenancy also opens up hosted sovereign services for larger MSPs.
https://blogs.microsoft.com/blog/2026/10/20/advancing-digital-sovereignty-with-greater-control-and-choice/

Copilot Studio agents will be able to browse the web on their own
Copilot Studio agents will be able to use Computer Use to browse the web on their own, visiting sites, pulling out data and downloading files, and it’s in development for January 2027. It’s powerful, so put guardrails in place before clients start using it. Given this week’s security news, think hard about what those agents can reach.
https://www.microsoft.com/en-us/microsoft-365/roadmap?id=576272

Microsoft empowers more than 330,000 Volkswagen Group employees with Copilot
Volkswagen has rolled Copilot out to more than 330,000 staff after a phased start with Copilot Chat, and it now has more than 26,000 agents active across the group in the past month alone. Nothing groundbreaking, but it’s a handy reference for SMB owners who want to see that Copilot works at scale. The phased approach of starting with free Chat and then moving to licensed Copilot is the same one I’d recommend for smaller clients.
https://news.microsoft.com/source/2026/10/21/microsoft-empowers-more-than-330000-volkswagen-group-employees-with-copilot

An AI-cloned free tool is being dubbed ‘the end of software’
The ABC looks at developers using AI to build near-identical free clones of Microsoft Office and Adobe Creative Suite, and at Reverse Engineer Anything, a trending GitHub tool that helps AI agents take apart and replicate existing software. Still early, and the legal ground is shaky, but expect clients to ask whether they can ditch paid licences for these clones. The real answer for business is support, security and compliance, not just features.
https://www.abc.net.au/news/science/2026-10-22/reverse-engineer-anything-ai-software-cloning/107271480

After hours

The Sixty-Year Mission Trailer – https://www.youtube.com/watch?v=HWQTlYjJf1c

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

Clear the Runway. Then Cross the Gap.

Warm cartoon office scene with a person at a desk facing a blank document and a colleague cheerfully narrowing a messy whiteboard of sticky notes into three simple cards

I have a habit when someone tells me they are stuck. A client, a mate, a team member staring at a half-finished brief. My first instinct is almost always the same: strip friction out of the process. Make the first step smaller. Hand them a simple framework. Cut a few steps so starting feels less heavy.

That instinct is usually right. Most creative stuckness is external. Too many options. No clear place to put the work. A blank page that asks for a masterpiece before it will accept a rough sentence. In Microsoft 365 we spend a lot of time removing exactly that kind of friction, and we should.

Tools that clear the runway

Copilot in Word is a clean example. The blank document used to be the whole problem. Now you can point Copilot at a previous proposal, a Teams thread, or a SharePoint folder and ask for a first pass. The page is no longer empty. Outlook is similar — a reply draft appears before you have argued with the empty compose window for ten minutes.

Teams and Planner do the framework job. Instead of “we should write something,” you get a channel, a few checklist cards, and an owner. Power Automate cuts the busywork between systems so the human only shows up for the judgement call. SharePoint stops the scavenger hunt for last quarter’s file. External friction falls away. People move.

I have watched this pattern work again and again. Clear the runway and most people take off.

When the gap is inside

Sometimes they don’t. They know exactly what to write. They want to write it. The brief is sitting in SharePoint, the Word outline is already there, Copilot even offered a draft — and still nothing happens. The gap is not between them and the tool. It is between wanting and starting.

That is internal friction, and no amount of Microsoft 365 polish removes it on its own. You can have Copilot ready in Outlook, a Planner board tidy enough to make a project manager smile, and a Power Automate flow that files the finished piece. The document still stays closed.

People invent odd personal tricks for this. A side quest before the real work. A particular playlist. Opening the file and typing one deliberately bad sentence so the page is no longer sacred. Rewriting the same bullet three times in Teams before pasting it into Word. From the outside it looks inefficient. From the inside it is charm and coping mechanism mixed together — a private on-ramp the process diagram never shows.

Make it worth wanting

Here is the part I used to resist. If it is not fun, or at least interesting, it often will not get done. Sometimes the answer is not to make the work easier. Sometimes you make a small part harder on purpose, because that hardness makes you want to engage.

I will pick a fancier Word template than I need. I will draft the hard paragraph by hand first and only then ask Copilot in Word to tidy the rest. I will turn a dull status update into a short story for the Teams channel, even though a bullet list would have been faster. The extra friction is the point. It pulls me over the start line.

So when someone is stuck, I still reach for the external fixes first. Copilot, Planner, Power Automate, a cleaner SharePoint path — clear the runway. Then I ask a quieter question: are they blocked by the process, or by the private gap between wanting and starting? Tools handle the first. The second needs a personal tactic, and occasionally a little deliberate difficulty, so the work feels worth beginning.

Don’t Just Automate the Process. Build the Factory.

Cartoon of people organising matching binders on a workshop line with tidy shelves behind them

I still catch myself doing the clever version of the wrong thing. Someone shows me a pain point — a weekly report, a client onboarding checklist, a pile of the same Outlook replies — and the itch is to automate that path. One Power Automate flow. One Copilot prompt saved in a notebook. One private script that only I know how to run.

It works. Once. Then the process changes, the person who owned it leaves, or a second team needs the same outcome, and you’re back to heroic effort. You didn’t build a factory. You built a one-off machine in a corner of the shed.

A process is a recipe. A factory is how you ship.

When I say factory, I don’t mean a heavy program or a six-month transformation. I mean the boring layer that lets the same kind of work repeat without you reinventing it: where the inputs live, what “good” looks like, who can trigger it, and how Copilot or automation reaches the same materials every time.

In Microsoft 365 that usually looks unglamorous. A SharePoint library with a real structure instead of a dumping ground. A Teams channel where the working files and decisions actually sit. A Word or Loop template that already carries the sections you always need. Then Copilot in Word, Outlook, or Teams has something solid to work against — not a blank chat window and a hope that someone remembers the steps.

Automating a messy process just makes the mess faster. Building the factory means you fix the shape of the work first, then put Copilot and Power Automate on top of something stable.

What I watch people skip

The skip is almost always the same. They open Copilot Chat, describe the job in a long prompt, get a decent draft, and feel productive. Next week they write a slightly different long prompt. The week after, a junior asks how they did it, and the answer is a shrug and a screenshot.

Compare that to a factory move: the standard brief lives in SharePoint. The output template is a Word doc everyone can find. Power Automate drops a Planner task or a Teams message when a new request lands. Copilot is pointed at those artefacts — “draft from this template using the intake form in this library” — not at thin air.

I’ve seen MSP teams do the first version for client reporting and burn a Saturday. The ones who get time back are the ones who turned the second and third report into a product line: same intake, same store of evidence, same review checklist, Copilot filling the skeleton so humans only judge the exceptions.

Build once, run many

The test I use on myself is simple. If only I can run it, it isn’t a factory yet. If the knowledge is trapped in my chat history, it isn’t a factory yet. If swapping one person breaks the chain, we automated a habit, not a system.

So when someone asks me to “just automate this,” I try to answer with a smaller, harder question: where will the inputs live next month, and can Copilot find them without me? Until that answer is clear in SharePoint, Teams, or a shared template, I hold off on the clever flow.

Don’t just smooth one process. Build the factory for the thing — the place, the pattern, and the Copilot-ready materials — so the next ten times cost a fraction of the first.

The Quiet Value of AI as a Watchdog

Cartoon of a person at a desk with a watchdog dog watching over documents

Most of the AI talk I hear is about speed. Draft faster. Summarise faster. Clear the backlog faster. Fair enough — I use that side of it every day. What I talk about less, and what I think is underrated, is the other job AI is quietly good at: sitting beside the work and barking when something looks off.

A watchdog doesn’t write the proposal for you. It notices the clause that drifted from your standard, the share link that went wider than it should, the meeting decision that never made it into the record. In a Microsoft 365 world, that kind of attention is where a lot of real risk and rework lives.

Speed without a second set of eyes

I’ve sat with founders and MSP leads who are thrilled that Copilot in Word or Outlook gets them to a first draft in minutes. Then I ask what catches the miss — the wrong customer name left in a template, the permission that opened a SharePoint library to “everyone”, the Teams reply that promised something Finance never agreed to.

Often the answer is still “me, later, if I have time.” That’s not a process. That’s hope with a calendar invite.

Copilot can help you produce more. Without a watchdog habit, you also produce more chances to ship a quiet mistake.

What “watchdog” looks like in the flow of work

I’m not talking about a sci-fi control room. I mean small, repeatable checks inside the tools people already open.

Before a sensitive Word doc leaves the building, ask Copilot to compare it against the last approved version or the policy page you keep in SharePoint — not for prose polish, for drift. Before you hit send in Outlook, have it flag attachments, recipients, or wording that doesn’t match how your organisation usually handles that kind of mail. In Teams, use meeting recap and action capture so “we decided X” doesn’t evaporate, then spot when the follow-up never landed in Planner or the channel.

On the governance side, Microsoft Purview and the sharing reports in SharePoint and OneDrive are the boring cousins of the same idea. AI that helps you see oversharing, odd access, or content that shouldn’t sit in a public Team is doing watchdog work — even when the interface looks like a report, not a chat.

The point isn’t to automate judgment away. It’s to put a consistent second pass in front of human judgment, every time, not only on the days when someone remembers.

The value shows up as fewer ugly surprises

The payoff is rarely a dramatic dashboard. It’s the near-miss you never have to explain to a client. It’s the junior who doesn’t learn the hard way because the check caught the loose link. It’s the founder who stops being the only person who “just knows” something felt wrong in a draft.

I’ve started treating Copilot less like a typist and more like a colleague whose job is to ask, “Are you sure about this bit?” That shift changes what I ask it to do. Fewer “write me a long email.” More “what in this draft conflicts with our standard terms?” More “summarise what we committed to in that Teams meeting and what still has no owner.”

If your AI stack only makes you faster, you’re using half of it. The quieter half — the watchdog — is what keeps the extra speed from multiplying the mess. Build that habit into Outlook, Word, Teams, and SharePoint, and you get something rarer than another productivity tip: confidence that someone, or something, is actually watching the work while it moves.

ConnectWise Breach: Proving What an App Did with Microsoft Graph Activity Logs

IT security analyst tracing activity across glowing monitors in a dark operations room

The ConnectWise supply-chain attack on Microsoft 365 tenants has raised a question I keep hearing from MSPs: if an attacker’s app signed in to a tenant, how do you prove what it did, or didn’t, do?

The honest answer is that Microsoft doesn’t publish one definitive list of “Graph activity that isn’t in the UAL”. What it does document is which log records what. Put those side by side and the gaps become clear. I’ll cover what each log tells you, where the blind spots are, how to switch on Microsoft Graph activity logs, and how to scope the blast radius if you didn’t have them on.

What GCIT showed

Credit to Elliot and the team at GCIT, whose write-up of the ConnectWise Cloud Backup compromise is a model of how to be open about an incident. Their tenant had one successful service principal sign-in from the Cloud Backup app (15 Oct, 144.172.64.128, Python user agent). They proved nothing was done with that token by matching its identifier against 13,682 requests in their Microsoft Graph activity logs. The UAL on its own could never have proved that. They also note that Graph activity logs need Entra ID P1 and have to be switched on before the event.

The three logs and what each one tells you

Sign-in logs (service principal and managed identity sign-ins are kept separately from interactive sign-ins) tell you that a token was issued, and from where. They don’t tell you what was done with it. One sign-in can mean hundreds of API calls, or none at all, as GCIT found. Retention is 7 days on Entra ID Free and 30 days on P1/P2, so export them. https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention
The unified audit log records audited actions in each workload. It isn’t a record of every API request. A good example is mail: MailItemsAccessed covers all protocols, including REST/Graph and EWS, but it’s only on by default for E3/E5 users. Check your mailbox audit configuration everywhere else. Bind accesses are also aggregated and de-duplicated. https://learn.microsoft.com/en-us/purview/audit-log-investigate-accounts
Microsoft Graph activity logs (MicrosoftGraphActivityLogs) record every HTTP request Graph processes for your tenant: app ID, service principal, IP, request URI, method, response size, and the token and sign-in identifiers. That’s what lets you join requests to sign-ins. They need Entra ID P1 or P2 and a diagnostic setting that sends them to Log Analytics, Storage or Event Hub. They aren’t retroactive, and delivery usually takes up to 30 minutes, occasionally 2 hours. https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview

So where are the blind spots?

Anything read through Graph that the workload doesn’t audit as an action, such as directory and user reads, will only show up in Graph activity logs. And full_access_as_app over EWS isn’t Graph at all, so it won’t appear in Graph activity logs. It would only appear in mailbox auditing. If you don’t have Graph activity logs turned on, “sign-in but no UAL entries” doesn’t prove nothing happened. It means you can’t tell.

On audit retention: Audit Standard is 180 days. Audit Premium (E5) keeps Exchange, SharePoint, OneDrive and Entra records for one year, and up to 10 years with the add-on. https://learn.microsoft.com/en-us/purview/audit-log-retention-policies

What an attacker could do without Graph activity logs

The short answer is anything the app’s granted permissions allow. Without Graph activity logs, most read-only activity leaves no trace at all.

Likely to leave no trace (reads)

Directory reconnaissance: listing users, groups, admin role holders, devices, apps, Conditional Access policies and licences (Directory.Read.All, Policy.Read.All). Reads like these aren’t recorded in the UAL, which makes them perfect for mapping a tenant before a bigger attack.
Org intel: org charts, managers, phone numbers and email addresses, all useful for phishing and business email compromise.
Teams/chat and calendar reads, and some file reads, depending on permissions and audit coverage. SharePoint and OneDrive FileAccessed events usually do appear in the UAL, but bulk reads by an app can be patchy.

Probably visible, if auditing was on

Mail reads (Mail.Read): these show as MailItemsAccessed, but only if mailbox auditing records that action for the affected mailboxes. If it doesn’t, they’re invisible.
Writes and changes: sending mail, creating inbox rules, adding app credentials or owners, consenting to new apps, creating users or changing roles, and changing CA policies. These normally appear in the Entra audit log or the UAL, because they’re audited actions rather than reads.

What actually determines the blast radius

The app’s application permissions. Check Enterprise applications > the app > Permissions. Something like Mail.Read or Files.Read.All is tenant-wide.
The service principal sign-ins: times, IP addresses and how many tokens were issued.
The Entra audit log: look for any new credentials, owners or consents on that or other apps, which would show persistence.

The honest bottom line is that without Graph activity logs, a sign-in followed by no UAL entries means you can’t prove what was read. Treat anything that app could read as potentially exposed, rotate its secrets, and remove or scope down its permissions. Then turn on Graph activity logs so next time you can prove it either way.

How to turn on Microsoft Graph activity logs

It takes about 10 minutes per tenant.

Before you start

Licensing: Microsoft Entra ID P1 or P2 in the tenant (Business Premium includes P1).
Role: Security Administrator is the least privileged Entra role Microsoft supports for creating diagnostic settings. You also need Azure rights on the destination.
An Azure subscription with a destination that already exists: a Log Analytics workspace (best for querying), a storage account (cheap long-term archive) or an Event Hub (to stream to a third-party SIEM).
Cost: P1 doesn’t cover the Azure side, so you pay for what you ingest and store. Microsoft’s rough guide is about 15 GiB a month into Log Analytics per 1,000 users, but it varies a lot with the apps in the tenant. Check the Azure Monitor pricing page and consider a workspace transformation or the Basic table plan to cut costs.
The logs are NOT retroactive. You only see activity from the moment you switch them on, so do it before you need them.

Step 1: Create a Log Analytics workspace

In the Azure portal, go to Log Analytics workspaces > Create.
Pick the subscription, a resource group, a name and a region, then Review + Create.

Step 2: Turn on the diagnostic setting (GUI)

Sign in to the Microsoft Entra admin centre as at least a Security Administrator.
Browse to Entra ID > Monitoring & health > Diagnostic settings.
Select Add diagnostic setting and give it a name.
Tick MicrosoftGraphActivityLogs. While you’re there, also tick ServicePrincipalSignInLogs, SignInLogs and AuditLogs, so you can correlate them.
Tick Send to Log Analytics workspace and choose your subscription and workspace.
Save.

Step 2 (alternative): PowerShell

There’s no dedicated Entra cmdlet for this. New-AzDiagnosticSetting targets Azure resources, not the tenant. Instead, you PUT to the Azure Resource Manager endpoint for microsoft.aadiam/diagnosticSettings with Invoke-AzRestMethod:

			
Connect-AzAccount
$ws = "/subscriptions/<SUB-ID>/resourceGroups/<RG>/providers/Microsoft.OperationalInsights/workspaces/<WORKSPACE>"
$body = @{
  properties = @{
    workspaceId = $ws
    logs = @(
      @{ category = "MicrosoftGraphActivityLogs"; enabled = $true },
      @{ category = "ServicePrincipalSignInLogs"; enabled = $true }
    )
  }
} | ConvertTo-Json -Depth 5
Invoke-AzRestMethod -Method PUT -Payload $body `
  -Uri "https://management.azure.com/providers/microsoft.aadiam/diagnosticSettings/GraphActivity?api-version=2017-04-01"

		

The Azure CLI equivalent is az rest --method put --url "<same URL>" --body @body.json.

Step 3: Check it’s working

Microsoft says delivery is usually within 30 minutes, but allow time for the table to first appear (Entra’s docs allow up to three days). Then run:

			
MicrosoftGraphActivityLogs
| where TimeGenerated > ago(1d)
| summarize Requests = count() by AppId, ServicePrincipalId
| sort by Requests desc

To tie Graph calls back to a service principal sign-in, which is exactly the GCIT approach:

			
MicrosoftGraphActivityLogs
| where TimeGenerated > ago(7d)
| join kind=leftouter (AADServicePrincipalSignInLogs | where TimeGenerated > ago(7d))
    on $left.SignInActivityId == $right.UniqueTokenIdentifier
| project TimeGenerated, AppId, ServicePrincipalName, IPAddress, RequestMethod, RequestUri, ResponseStatusCode

		

Tips

Set retention on the workspace (or per table) to suit your incident response needs. If you need it for years, also archive to storage.
Do this per customer tenant. A Graph activity log only covers the resource tenant, so you won’t see a multitenant app’s activity in other tenants.
Diagnostic settings can’t filter Graph logs. Use a workspace transformation if volume is an issue.

References: Graph activity logs overview and Configure Entra diagnostic settings.

What I’d do today, with the tools we have

Turn on Graph activity logs now in every tenant with P1 (Business Premium has it). It’s cheap insurance.
Export sign-in logs, including service principal sign-ins, beyond 30 days.
Confirm MailItemsAccessed is being audited on every mailbox.
Cut app permissions down. Use Exchange RBAC for Applications and Sites.Selected instead of tenant-wide Mail.* and Sites.* grants. https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac
Use Defender for Cloud Apps app governance where you have it, so you get alerts on unusual app behaviour. https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-manage-app-governance

Shared responsibility

This is the shared responsibility point again. The vendor protects its credential, Microsoft provides the logs, and we as MSPs own the decision to let that app in, which means having the logging on before we need it. My cw-skykick-exposure-check.ps1 script will help you with the exposure side. Graph activity logs are what answer “what did it actually touch?”

Why Your Next Sales Experience Should Feel Like an Open Home

Nobody wants to sit across a desk from a real estate agent for a private appointment.

The reason is obvious. You know what they want. They know you know what they want. Every question feels like it has a destination, and that destination is a contract.

Now compare that with an open home. Same agent. Same property. Same commercial objective. Completely different experience.

You can walk in without committing to anything. Other people are moving through the rooms. You can inspect the kitchen, look inside a cupboard, ask about the neighbourhood, or simply nod politely and leave. The buyer has control.

That difference matters well beyond real estate.

People resist pressure, not information

Many businesses still design customer engagement like a private sales appointment. Book a discovery call. Sit through a presentation. Explain your budget. Tell us who makes the decision. Agree to the next meeting before this one ends.

The business calls it a process. The customer experiences it as pressure.

Most buyers are not avoiding information. They are avoiding a situation in which every question becomes a buying signal. They want room to learn without being chased.

An open home works because participation can be light. Someone can be curious without declaring intent. They can observe other people asking questions. They can discover what matters to them while they are there. Most importantly, leaving is easy.

Low-friction exits create higher-confidence entrances.

Build the digital equivalent of an open home

I think this is a useful way to rethink how we use Microsoft 365 and Copilot with prospects and clients.

Instead of making every interested person book an appointment, create a place where they can explore. A well-structured Microsoft Teams webinar can let people listen, ask a question in chat, or remain quiet. A SharePoint site can hold practical guides, short demonstrations and answers to common concerns. A Copilot Studio agent can help visitors navigate approved information without forcing them into a sales conversation.

The point is not to remove people from the process. It is to let the customer decide when a person should enter it.

Imagine an MSP running a monthly Microsoft 365 security clinic. There is a short demonstration, a few common configuration mistakes, and an open question period. Attendees are not pushed into individual assessments. Afterward, the presentation and supporting material are available through SharePoint, and questions can be submitted through Teams.

Some people will ask something immediately. Some will return to the material a week later. Some will never make contact. That is fine. The environment still creates value, trust and familiarity.

Give people something to inspect

An open home is useful because there is something tangible to explore. You can test the doors, gauge the room size and notice details that no brochure would reveal.

Business content should work the same way.

Do not just tell people you understand Copilot adoption. Give them a readiness checklist. Show them an anonymised governance example. Let them ask Copilot to summarise a sample policy in Word, then explain what good source material looks like. Make the expertise visible before asking for a commitment.

This also changes the sales conversation. When someone eventually requests a private meeting, they arrive with context. They know how you think. They have already examined the cupboards.

The best customer experiences do not trap people in a funnel. They create a useful space, make exploration safe and allow curiosity to do some of the work.

That is what I would build: fewer forced appointments, more open doors.