Category: AI

New scripts: Headless SharePoint and Exchange Online connections on Linux, built for agents

Cartoon of a relaxed IT professional with a coffee while a laptop and small server work on their own

I’ve just added two new scripts to my Office365 repository on GitHub. One connects PowerShell to SharePoint Online using PnP PowerShell. The other connects to Exchange Online. Both run on Linux, and both use certificate-based, app-only authentication. There’s no browser, no typed password and no MFA prompt at connection time.

Why bother building Linux versions? Mostly because of agents.

Built for machines that nobody is sitting at

More and more of my admin work now gets done by autonomous agents like Grok Bot, running on a Linux computer that no person is logged into. An agent like that can write and run PowerShell happily enough. Where it gets stuck is sign-in. A pop-up browser window, a device code that someone has to type in, or an MFA approval on a phone all stop it in its tracks. Automation that needs a human to tap “approve” isn’t really automation.

Certificate-based app-only authentication fixes that. You register an app in Entra, upload the public half of a certificate, keep the private key on the machine, and the script connects as the app. I’ve covered the Windows side before in Certificate-Based Authentication for SharePoint Online: The Bit Everyone Avoids and A Cleaner Way to Connect PowerShell to Exchange Online. These new scripts are the Linux counterparts, built so an agent’s computer can connect and get on with the job unattended.

What the scripts do

Both scripts work the same way and have two main modes:

  • -GenerateLocalCertificate creates an RSA-2048/SHA256 certificate, a public .cer file and an encrypted .pfx using .NET, so you don’t need OpenSSL.
  • -UseCertificateAuth connects with the encrypted PFX: PnP.PowerShell for SharePoint, ExchangeOnlineManagement for Exchange.
  • -ProvisionEntraApp (optional) creates or reuses an Entra app, uploads the public certificate, grants the required permissions and saves a connection profile. This setup step uses a one-off device-code sign-in by an administrator.

For true headless runs, use -noprompt (alias -Headless). Supply the PFX password through a SecureString parameter, or name an environment variable with -CertificatePasswordEnvironmentVariable. The scripts never print or save that password. Saved profiles mean that, once set up, an agent can connect with little more than -UseCertificateAuth -ProfileName Contoso -Headless.

You’ll need Linux and PowerShell 7.4 or later (7.4.6+ for the PnP script), plus PnP.PowerShell 3.0.0+ or ExchangeOnlineManagement 3.5.0+. Missing modules install for the current user, with no sudo needed. Use -noupdate to skip update checks.

A word on security

Unattended access is powerful, so treat it with respect. The SharePoint provisioning grants Sites.FullControl.All, which means full control of every site. The Exchange provisioning grants Exchange.ManageAsApp and adds the app to Organization Management, which means full Exchange administration. The scripts keep certificates and profiles in dedicated folders locked to mode 700, with files at mode 600, and they refuse symbolic links there. Even so, that .pfx is effectively an admin key. Guard it, keep its password in a vault or a protected environment variable, and only put it on machines you trust. If your scenario needs less, trim the app’s permissions.

Get the scripts

To me, this is where Microsoft 365 administration is heading. More of the routine work will be done by agents on machines that nobody watches, and the bottleneck is getting them connected securely without a human in the loop. Take the scripts, try them in a test tenant, and let me know how you go.

Why Everyone Needs Basic Technology Troubleshooting Skills

image

A few weeks ago, I was talking with a business owner who told me their entire morning had been derailed because they couldn’t print a document. Not because the printer was broken. Not because the network was down. The printer had simply been switched off.

That conversation stuck with me. Not because it was unusual, but because I see versions of it all the time. We live and work with technology every day, yet many people still treat it as some kind of mysterious black box. The moment something doesn’t work exactly as expected, productivity stops and someone else gets called in to fix it.

I think that’s a problem.

I’m not suggesting everyone needs to become an IT professional, write PowerShell scripts, or manage cloud infrastructure. What I am suggesting is that every modern worker should be able to perform basic technology troubleshooting. In much the same way we expect people to know how to change a light bulb or check whether a door is locked, we should expect a basic level of technology self-sufficiency.

Start With The Simple Things

One of the biggest lessons I’ve learned over the years is that many technology issues have surprisingly simple causes.

The application may need to be restarted. The internet connection might have dropped. A browser tab may have frozen. A file could be stored in the wrong location.

Yet many people jump straight to “it’s broken”.

Good troubleshooting starts with slowing down and asking simple questions. Has anything changed? Does the problem happen everywhere or just in one application? Can someone else reproduce it? What happens if you close and reopen the program?

These aren’t advanced technical skills. They’re logical thinking skills applied to technology.

The people who develop this habit often solve their own problems in minutes rather than waiting hours for assistance.

Technology Is Now Part Of Every Job

There was a time when technology sat on the edge of the business. Today, it sits at the centre.

Whether you’re creating documents in Word, collaborating in Teams, managing email in Outlook, or analysing data in Excel, your ability to use technology effectively directly impacts your productivity.

What’s interesting is that Microsoft 365 Copilot is making troubleshooting even more accessible. Rather than immediately opening a support ticket, users can now ask Copilot questions such as:

“Why won’t this Excel formula work?”

or

“Help me understand this Outlook error.”

The person still needs enough troubleshooting awareness to describe the problem, test the suggestions, and determine whether they’re heading in the right direction. Copilot can assist, but it can’t replace basic curiosity and problem-solving skills.

The organisations getting the most value from AI aren’t replacing thinking. They’re using AI to support people who already know how to think systematically.

The Cost Of Helplessness

One thing I notice when working with organisations is how expensive technology helplessness can become.

If every minor issue requires escalation, support queues grow. Staff become frustrated. Work slows down. Simple interruptions turn into significant productivity drains.

Now multiply that across dozens or hundreds of employees.

On the other hand, when people can resolve common issues themselves, support teams can focus on genuinely complex problems. Everyone wins.

The goal isn’t to eliminate support. The goal is to reserve support resources for situations where they’re genuinely needed.

The best IT teams I’ve worked with aren’t the ones fixing every problem. They’re the ones helping people become more capable.

A Skill Worth Developing

As technology becomes more deeply embedded into every role, basic troubleshooting is no longer just an IT skill. It’s a workplace skill.

The ability to observe, test, question, and methodically work through a problem is becoming as important as knowing how to write an email or create a spreadsheet.

In my experience, the people who thrive with new technologies such as Microsoft 365 Copilot aren’t necessarily the most technical. They’re the people who are willing to experiment, investigate, and learn from what happens.

Technology will continue to evolve. New tools will arrive. AI will become more capable.

What won’t change is the value of someone who can look at a problem, stay calm, and work through it logically.

That’s a skill worth building, regardless of your role.

GPT 6.1 beats Gemini 4 Argon

image

Yes, you guessed it, another week another new model to test. This time I’m pitting the latest and greatest from Google, Gemini 4 Argon, against the incumbent GPT 6.1 Sol in Copilot Cowork. Gemini Argon 4 is also a model that is not available via Copilot in Microsoft 365. The previous round of my tests is here:

https://blog.ciaops.com/2026/09/30/gpt-6-1-sol-is-our-new-champ/

Unfortunately for Argon, there is no other way to say this but GPT 6.1 whipped its butt as you can see from the report here:

https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20261014-Argonv61Sol-Grok-eval.md

with a score of 9.15 versus 7.55.

This of course doesn’t mean Argon is a bad model, it just means that in my ‘benchmark’ testing, using the same prompt, it’s score was will below what GPT 6.1 scored.

Of course, your mileage will vary but hopefully this ‘benchmarking’ of mine gives you some indicate of how model compare. Does that really matter if you leave Copilot set to Auto? Not really I believe, but interesting to compare, none the less.

Remember, Gemini 4 Argon is not part of Microsoft 365 Copilot and requires a separate subscription from Google to access.

Need to Know podcast–Episode 371

In this episode I cover the latest Microsoft news, including Office moving into the new Copilot app, the new Copilot with Home, Code and Autopilot, usage-based Copilot billing for partners starting 1 December (initially not available in Australia), new partner margin and a Business Premium security promotion, Entra ID blocking script injection at sign-in, Outlook blocking MSIX attachments, deepfake detection coming to Teams, an Exchange Server security update, the 2027 Windows Update certificate expiry and the Microsoft Digital Defense Report 2026.

In my editorial I look at agent autopilots like Grok Bot, Microsoft Autopilot (formerly Scout) and Meta Muse, and how I’m using a team of Grok Bot bots to post to social media, monitor my Microsoft 365 tenant with a read-only global admin reader, make phone calls and even produce the intro and news segment of this episode in a clone of my voice. Did you notice? Love your feedback.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-371/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

Resources

CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS

X – https://www.twitter.com/directorcia

director@ciaops.com

CIAOPS Blog

Join my Teams Shared Channel – CIAOPS

CIAOPS Merch store – CIAOPS

Become a CIAOPS Patron

CIAOPS AI Dojo

CIAOPS weekly news update – CIA Brief – CIAOPS

CIAOPS Labs – The Special Activities Division of the CIAOPS

Support CIAOPS

Get your M365 questions answered via email

Join my email list

A special thanks to the CIAOPS Patron community for making this podcast possible. You can find the benefits of a subscription to the community and become a member at https://www.ciaopspatron.com

Updates

Copilot

Introducing Office in the new Microsoft Copilot app Microsoft is bringing Word, Excel and PowerPoint into the Copilot app so you can create, edit and collaborate on documents without leaving Chat or Cowork. It is rolling out to Frontier customers from 9 October, so think pilots rather than mass rollout. https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/introducing-office-in-the-new-microsoft-copilot-app/4561230

Microsoft 365 Copilot release notes The latest release notes, covering 22 September to 6 October, show Copilot Search now embeds chat so users can search and then ask follow-up questions in the same place.https://learn.microsoft.com/en-us/microsoft-365/copilot/release-notes

Introducing the new Copilot with Home, Code and Autopilot Microsoft’s 25 September announcement of the new Copilot: Home brings Chat and Cowork together, Code lets people build small apps and automations in a sandbox hosted in your tenant, and Autopilot (previously Scout) is a persistent agent with its own identity, in private preview. Also covers the plugin registry, Copilot Managed Runtime and spend controls in Agent 365. https://blogs.microsoft.com/blog/2026/09/25/introducing-the-new-copilot-with-home-code-and-autopilot/

Money and partners

Partner Center announcements: October 2026 Usage-based billing becomes default-on for new Microsoft 365 Copilot Business licences bought through CSP from 1 December 2026, with a default cap of 4,000 Copilot Credits per user per month. It is initially not available in Australia. Also from 1 October, a 7.5% promotional pricing offer on Defender Suite and Purview Suite for Business Premium (customers under 300 seats) and new growth margin for Copilot, Microsoft 365 E5/E7, Defender Suite, Purview Suite and Windows 365 Enterprise. Link: https://learn.microsoft.com/en-us/partner-center/announcements/2026-october

Security and admin changes

Microsoft to block Entra ID script injection attacks starting in October Entra ID browser sign-in will enforce a Content Security Policy so only scripts from trusted Microsoft CDN domains run on the sign-in page. Rolling out mid to late October, on by default. Some browser extensions and helper tools that inject code may stop working, so test now. Link: https://www.bleepingcomputer.com/news/security/microsoft-to-block-entra-id-script-injection-attacks-starting-october/

Microsoft Outlook to block MSIX attachments used in attacks MSIX and MSIXBUNDLE attachments are being added to the blocked file types in OWA mailbox policies, starting early November. Admins can allow them via the AllowedFileTypes property if needed.  https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachments-used-in-attacks/

Microsoft Teams to add third-party deepfake detection and impersonation protection New Microsoft 365 Roadmap entries show Teams integrating third-party deepfake detection signals and impersonation protection that warns about suspicious meeting organisers or participants, targeted for November. Roadmap dates can shift and third-party providers may mean extra cost. https://www.bleepingcomputer.com/news/security/microsoft-teams-to-add-third-party-deepfake-detection-impersonation-protection/

MSRC October 2026 security update release notes (CVE-2026-96940) On-premises Exchange Server security update released 5 October for CVE-2026-96940, CVSS 8.8, rated Exploitation More Likely, with no workarounds listed. Read the CVE page for impact details before briefing customers. https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct

Exchange Server SE security update KB5129955 The fix is in Exchange Server SE security update KB5129955 (SU10 V2). If you still run on-premises or hybrid Exchange, patch promptly.

https://support.microsoft.com/en-us/servicing/exchange/server/update/2026/5129955

Microsoft: Outdated Windows devices will lose security protection next year Certificates used to connect to Windows Update expire on 17 May 2027 and 19 June 2027. Devices on unsupported Windows versions will lose Windows Update services, so audit old PCs and servers now.

https://www.bleepingcomputer.com/news/microsoft/microsoft-outdated-windows-devices-will-lose-security-protection-next-year/

Threat landscape

Insights from the 2026 Microsoft Digital Defense Report Microsoft’s 2026 report says threat actors are using AI across reconnaissance, social engineering, malware development and post-compromise activity, mostly within existing attack workflows. The fundamentals still apply: identity, least privilege and monitoring. https://www.microsoft.com/en-us/security/blog/2026/10/01/insights-from-the-2026-microsoft-digital-defense-report/

Editorial: agent autopilots

Grok Bot overview The agent platform I use for my bots: persistent cloud computer per user, skills and routines. https://docs.x.ai/grok-bot/overview Introducing Muse, Meta’s personal AI agent Meta’s consumer personal agent announced in September 2026.  https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/

https://ciaops.podbean.com/e/episode-371/

GPT 6.1 Sol Copilot battle

If you have been following along you know that I have been comparing LLMs inside the different services in Copilot. Unsurprisingly, the most current and powerful models tend to be the winner, but what about the same LLM between different services?

Screenshot 2026-10-10 080747

Recently, GPT 6.1 Sol appeared in my Copilot Chat as you can see above. Thus, I put it head to head with GPT 6.1 Sol in Cowork and the results are here:

https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20261009-GPT61-Grok-Eval.md

The news is that Copilot Chat won!

Now, I think the real take away here is no so much that Copilot Chat is ‘better’ than Cowork, it is that the same LLM in any Copilot service is equivalent. That leads to the following rule of thumb:

‘You DON’T need to use Cowork for everything! Copilot Chat is the best place to start’

For validation I repeated the test but with Opus 5.5 in Chat and Cowork here:

https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20261009-Opus55-Grok-Eval.md

and again Chat came out on top. So, I am pretty confident that my rule of thumb above is valid.

The big different is that Cowork require PAYG billing. Thus, for these tests:

Cowork GPT Sol 6.1 = US$101

Cowork Claude Opus 5.5 = US$234

Not cheap at all! But if you use these same LLMs, in Copilot Chat instead you pay NO MORE than the flat monthly M365 Copilot license.

That’s the real message here I feel, start with the included services BEFORE moving to the paid option because from what I see they produce the same result.

GPT 6.1 Sol is our new champ

image

Another week, another new model. This time it is GPT Sol 6.1 arriving, so I’ve put it to the test against the current champion GPT Astra 6 and found:

GPT Sol 6.1 beats Astra 6 – https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20260930-Cowork-GPT61Sol-Grok-eval.md

but it is more expensive than Astra 6:

Opus 5.5 = 23,494 credits

GPTSol 6.1 = 10,173 Credits

GPT Astra 6 = 6,067 credits

Fable 5.1 = 3,453 credits

Fable 5 (Preview) = 3,387 credits [Model no longer shown]
Fable 5 (Copilot)(Preview) = 3,373.8 credits [Model no longer shown]

GPT 5.6 Sol = 2,800.50 credits [Model no longer shown]
Sonnet 5 = 2,509.3 credits [Model no longer shown]
Opus 4.8 = 2,487 credits [Model no longer shown]

GPT Sol 6 = 2,243 credits [Model no longer shown]

Opus 5 = 2,240 credits [Model no longer shown]

GPT 5.5 = 1,200 credits
GPT 5.6 Terra = 260 credits [Model no longer shown]

Interestingly, Sol 6.1 generated a 73 page report while Astra 6 was only 35! That’s 2 x the output. Stop and think about that, 73 detailed pages with a single prompt! Amazing!

I also compared it to its predecessor, GPT Sol 6 and found – https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20260930-Cowork-GPT6-61Sol-Grok-eval.md

GPT 6.1 Sol is also the clear winner here as the results show. Again, an amazing improvement jump by my comparison from only Sol 6.0 to Sol 6.1! Where is this going to end?

The summary of the all the outputs produced is here:

https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20260816-File-paramters.md

while the results, including outputs are here:

https://github.com/directorcia/general/tree/master/Copilot/Comparisons

How much better can these models get? We’ll know shortly, I’ll bet.

Astra still wins but not on cost

image

With GPT 6 Sol now also available in Copilot, it is time for the LLM battle to continue and the results are in.

Astra 6 beats Sol 6 – https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20260923-Cowork-GPT6Sol-Grok-eval.md

However, GPT 6 Sol is very cheap at 2,243 credits and that ranks towards the bottom of costs in Cowork as seen here.

Opus 5.5 = 23,494 credits

Astra 6 = 6,067 credits

Fable 5.1 = 3,453 credits

Fable 5 (Preview) = 3,387 credits [Model no longer shown]
Fable 5 (Copilot)(Preview) = 3,373.8 credits [Model no longer shown]

GPT 5.6 Sol = 2,800.50 credits
Sonnet 5 = 2,509.3 credits
Opus 4.8 = 2,487 credits [Model no longer shown]

GPT 6 Sol = 2,243 credits

Opus 5 = 2,240 credits

GPT 5.5 = 1,200 credits
GPT 5.6 Terra = 260 credits

I also decided to pit the recent Claude models against each other and found:

Opus 5.5 beats Fable 5 – https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20260923-Cowork-F51vO55-Grok-eval.md

and it did so quite significantly if you look at the report. Opus 5.5 is clearly superior to Fable 5 according to my rudimentary benchmark. So it is really good but also really (really) expensive.

Remember, all the reports and created documents are here so you can judge for yourself:

https://github.com/directorcia/general/tree/master/Copilot/Comparisons

Let me know what you find.