Security
- SCKit abuses ScreenConnect to deploy remote access and target technician sessions
This one is aimed squarely at MSPs. Attackers are hijacking cloud-hosted ScreenConnect instances to silently install a second remote client, then using a worm (SCKit) to attack technician workstations and push payloads through the MSP’s own console. Removing the rogue client isn’t enough: check technician machines, persistence and web sessions, and run the hunting queries Microsoft provides.
https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/ - ARTEX abuse expands as cybercriminals target financial sector
A Cambodia-based crew Microsoft tracks as Storm-3358 is using the agentic AI attack framework ARTEX, alongside conventional automated tools, to scan for and exploit internet-facing systems at financial organisations. Attacks that used to need skilled operators are being automated. Good reminder to keep your clients’ internet-exposed attack surface small and patched quickly.
https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/ - Trained to betray: How post-training supply chain attacks hijack coding agents
Microsoft’s Defender Research and AI Red Team show how poisoned training datasets and tampered model checkpoints can make a coding agent run malicious code when it sees a trigger. If you or your clients are pulling fine-tuned models from public hubs, check where they came from. Controls that watch what an agent does matter more than trusting the model.
https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/ - Detecting sleeper agents hiding in AI model neurons
Editing fewer than 10 neurons can turn a capable agent model into a sleeper agent that passes every evaluation, then runs an attacker’s command when a trigger shows up. Because agents increasingly run unattended with privileged access, model weight integrity is now a security issue. The good news is that frontier models were able to spot the anomalous weight edits.
https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/ - Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents
This is the Microsoft Research paper behind the sleeper agent story. The ‘Lazarus’ technique backdoors a model without retraining it, so a triggered agent with terminal access could download code, steal secrets or run destructive commands. Still early, but it’s another reason to give agents least privilege and only use models from trusted sources.
https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/ - Hackers plunged dozens of European supermarkets into chaos. It should worry Australians how easy it was
Attackers remotely turned up the temperature on freezers in supermarkets across at least 11 European countries. The refrigeration controllers were sitting on the open internet, some still using factory default passwords. The same kit runs cold rooms in hospitals and data centres, so ask your clients what operational tech they have plugged into the internet.
https://www.smh.com.au/technology/hackers-plunged-dozens-of-european-supermarkets-into-chaos-it-should-worry-australians-how-easy-it-was-20261110-p61axl.html - Enhancements to the Protection and Posture Insights report
The Defender for Office 365 Protection & Posture Insights report now shows URL click protection across email, Office apps, Teams and Copilot, plus a ‘Filtering Overrides’ view of the phish and malware your allow lists and transport rules let through. Worth a look for every tenant you manage, because old overrides quietly weaken protection. More insights also now open straight into Advanced Hunting.
https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/enhancements-to-the-protection-and-posture-insights-report/4568163 - What’s new in Microsoft Entra: November 2026
This month’s Entra roundup covers lifecycle policies for agent and guest identities, access package drift detection, continuous access evaluation that reacts to device and user risk within minutes, and phishing-resistant sign-in from the very first MFA method. Some items need Entra ID Governance or Entra Suite, so check licensing before you promise anything. Agent and guest lifecycle controls are the ones most SMBs need now.
https://techcommunity.microsoft.com/blog/microsoft-entra-blog/what%E2%80%99s-new-in-microsoft-entra-november-2026/4556457
Microsoft 365 & Windows
- Microsoft’s attempts to resolve major outage ‘not working as expected’
Friday’s Microsoft 365 outage hit Outlook hardest from about 5am Sydney time, with Downdetector peaking near 20,000 reports a minute across 74 countries. Teams mostly kept working while mail stayed patchy well into the evening. Good reminder to have a client communication plan and an out-of-band contact channel ready before the next big outage.
https://www.smh.com.au/technology/microsoft-hit-by-widespread-outage-20261113-p61duy.html - How I used Grok Bot to watch the 13 November 2026 Microsoft 365 outage
My write-up of how I used Grok Bot to track Friday’s outage as it happened, pulling together Microsoft’s status updates, @MSFT365Status and Downdetector into one running timeline. It covers what broke (mostly anything that touched Exchange Online), what kept working, and where Microsoft missed a scheduled update. Useful if you want to automate outage monitoring for your clients.
https://blog.ciaops.com/2026/11/14/how-i-used-grok-bot-to-watch-the-13-november-2026-microsoft-365-outage/ - CIAOPS Microsoft 365 Outage Status
I’ve set up a public page that summarises major Microsoft 365 outages in plain English, with times in Sydney time. Grok Bot updates it automatically from Microsoft’s service status, @MSFT365Status and Downdetector Australia. Bookmark it and share it with clients who can’t see the admin centre health dashboard.
https://blog.ciaops.com/m365-outage-status/ - MC1546354 – Discover usage-based billing (UBB) experiences like Cowork, Code, and Autopilot
Users with a Microsoft 365 Copilot licence will see entry points for usage-based billing experiences like Cowork, Code and Autopilot even if the tenant hasn’t enabled them, with an option to request access. A new admin setting arrives mid-November, a custom ‘Learn more’ URL option in mid-December, and enforcement at the end of January 2027 (end of February for deferred release). Only Copilot-licensed tenants are affected, but set the policy now or expect requests your clients didn’t budget for.
https://mc.merill.net/message/MC1546354 - Microsoft Copilot Connectors Update: October 2026
Copilot connectors now sit in one catalogue across Copilot Chat, Word, Excel, PowerPoint and Researcher. There are new connectors (Trello Enterprise, Galileo and 25+ healthcare and life sciences sources), connector ‘skills’ starting with HubSpot and Notion, and richer Salesforce, ServiceNow and Confluence answers. Copilot gets more useful when it can reach the systems your clients already use, so it’s worth reviewing.
https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/microsoft-copilot-connectors-update-october-2026/4572240 - Available today: Anthropic Claude Fable 5.2 in Microsoft Copilot
Claude Fable 5.2 is rolling out in Copilot Cowork and Copilot Studio, grounded in tenant files, meetings and chats through Work IQ within existing permissions. More model choice is good, but it also means more decisions about which model to use for which job. Check whether Anthropic models are enabled in your clients’ tenants before people go looking for it.
https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/available-today-anthropic-claude-fable-5-2-in-microsoft-copilot/4571829 - We have a new LLM in Copilot winner: Opus 5.5 edges Fable 5.2
My latest head-to-head of the models in Copilot Cowork. Fable 5.2 beat Fable 5.1, but Opus 5.5 still edged it 8.9 to 8.6, mainly on evidence and detail. Fable 5.2 was the more polished, executive-friendly read. If you’re choosing a default model for research-style work, the comparison and outputs are all linked.
https://blog.ciaops.com/2026/11/13/we-have-a-new-llm-in-copilot-winner-opus-5-5-edges-fable-5-2/ - Use connected financial intelligence with Copilot in real financial workflows
Microsoft shows Copilot connectors bringing specialist financial research and data into Copilot alongside a firm’s own files and conversations through Work IQ, for jobs like credit briefings and client reviews. People still sign off on the recommendations and decisions. Nothing groundbreaking, but it’s a useful pattern if you support accounting or advisory clients.
https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/use-connected-financial-intelligence-with-copilot-in-real-financial-workflows/4571099
Cloud & AI
- Introducing Claude Fable 5.2 and Claude Mythos 5.2
Anthropic has upgraded its top-end Fable and Mythos models, with gains in coding, reasoning and vision and some big claims from pre-release testing. For most SMBs the practical impact will come through Copilot and Foundry rather than direct use. Worth tracking because these models are changing quickly and turning up in Microsoft tools within days.
https://www.anthropic.com/claude-fable-and-mythos-5-2 - Claude Fable 5.2 and Mythos 5.2 bring frontier intelligence to Microsoft Foundry
Fable 5.2, Fable 5.2 Fast and Mythos 5.2 are now available in Microsoft Foundry, aimed at engineering, research and finance work. If you build agents or solutions on Azure for clients, you can use these models under your existing Azure governance and billing. Good option to test against the OpenAI models you already use.
https://techcommunity.microsoft.com/blog/azure-ai-foundry-blog/claude-fable-5-2-and-mythos-5-2-bring-frontier-intelligence-to-microsoft-foundry/4564282 - Introducing Gemini 4 Hydrogen
Google’s new Gemini 4 Hydrogen is a fast, cheaper model for everyday coding and agent work, priced at a flat US$1.50 per million input tokens and US$7.50 per million output tokens across a 1 million-token context. Google says it slightly beats its own Argon model on the Artificial Analysis index. The real story is cost: small, fast models are getting good enough for most agent workloads.
https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-hydrogen/ - Building always-on agents
Anthropic’s guide to agents that run indefinitely, keep context between sessions and act without being prompted. It covers the building blocks: what wakes the agent, what carries over between runs, and how it acts. Worth a read if you’re thinking about agents that watch tenants or tickets for clients around the clock, which is where MSP automation is heading.
https://claude.com/resources/articles/building-always-on-agents - How to Set Up MCP Connectors in Grok Bot with Microsoft Learn
My step-by-step walkthrough for connecting Grok Bot to Microsoft’s free Learn MCP server, so it answers from current Microsoft documentation instead of stale training data. It needs no tenant sign-in and is useful on day one. A simple first connector for any MSP trying AI agents.
https://blog.ciaops.com/2026/11/10/how-to-set-up-mcp-connectors-in-grok-bot-with-microsoft-learn/ - KT ‘Meisters’ and Microsoft engineers build AI agents to spot network issues before customers do
Korean telco KT is using AI agents to pull monitoring data from different systems together, so engineers can work out the cause of network alarms within minutes. It’s a large-enterprise story, but the pattern carries straight over to MSP NOC and help desk triage. AI agents take on the investigation and engineers make the call.
https://news.microsoft.com/source/features/digital-transformation/kt-meisters-and-microsoft-engineers-build-ai-agents-to-spot-network-issues-before-customers-do/
Other
- Lead every SMB conversation with Frontier Transformation
Microsoft’s channel chief sets out an SMB playbook built around five customer priorities, from security with Business Premium to Copilot Business and Business Central agents. The stat to remember is that 40% of SMBs surveyed by IDC have no full-time IT staff. That’s the opening for MSPs: start with one use case, measure it, and turn it into ongoing managed services.
https://partner.microsoft.com/en-US/blog/article/CSP-SMB-Frontier-Transformation-2026 - November update: What’s new for partners in AI Business Solutions
This month’s partner roundup covers Ignite 2026 (17–20 November), new customer signals in partner tools, incentives and go-to-market guidance. One practical item: on-premises Business Central v28 and later now uses a single ’28+’ licence key, so confirm customers have it before upgrading. Mostly useful for planning, but skim it for incentive changes.
https://techcommunity.microsoft.com/blog/partnernews/november-update-what%E2%80%99s-new-for-partners-in-ai-business-solutions/4571823
After hours
Watch Starship’s First DOUBLE CATCH!!! – https://www.youtube.com/watch?v=QJFdKoKNn2M
Editorial
If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.
If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.
Watch out for the next CIA Brief next week
