Practical Microsoft infrastructure, identity and security guidance from Palanikumar Annamalai.https://www.palanikumar.net/en-gbhttps://www.palanikumar.net/articles/two-node-hyper-v-cluster-without-san/https://www.palanikumar.net/articles/two-node-hyper-v-cluster-without-san/How a small business or remote office can combine two Windows servers into a highly available Hyper-V cluster without purchasing a separate shared-storage appliance.Thu, 24 Sep 2026 00:00:00 GMTStorage Spaces DirectWindows ServerHyper-VHigh Availabilitymail@palanikumar.nethttps://www.palanikumar.net/articles/active-directory-administrative-tiering/https://www.palanikumar.net/articles/active-directory-administrative-tiering/Tiering fails as a diagram and succeeds as an enforcement mechanism. This is the dependency order that decides which one you end up with.Sun, 20 Sep 2026 00:00:00 GMTActive DirectoryPrivileged accessSecurity architecturemail@palanikumar.nethttps://www.palanikumar.net/articles/active-directory-dns-design-decisions/https://www.palanikumar.net/articles/active-directory-dns-design-decisions/Namespace, zone storage and forwarder choices are made once and inherited for twenty years. These are the ones that are expensive to reverse, and the ones that are not.Sun, 20 Sep 2026 00:00:00 GMTActive DirectoryDNSArchitecturemail@palanikumar.nethttps://www.palanikumar.net/articles/active-directory-forest-recovery-planning/https://www.palanikumar.net/articles/active-directory-forest-recovery-planning/Forest recovery is not restoring a domain controller. It is rebuilding the authentication layer that every other recovery plan quietly assumes is already working.Sun, 20 Sep 2026 00:00:00 GMTActive DirectoryDisaster recoveryResiliencemail@palanikumar.nethttps://www.palanikumar.net/articles/attack-surface-reduction-rules/https://www.palanikumar.net/articles/attack-surface-reduction-rules/ASR rules block the behaviours malware relies on — and some of the behaviours a twenty-year-old line-of-business application relies on. Audit mode is the entire deployment strategy.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft DefenderEndpoint securityHardeningmail@palanikumar.nethttps://www.palanikumar.net/articles/azure-backup-tested-restore/https://www.palanikumar.net/articles/azure-backup-tested-restore/A backup job reporting success is a claim about a job. The only evidence that matters is a restore you performed, timed, and validated against what the business actually needs.Sun, 20 Sep 2026 00:00:00 GMTAzureBackupResiliencemail@palanikumar.nethttps://www.palanikumar.net/articles/azure-hub-and-spoke-networking/https://www.palanikumar.net/articles/azure-hub-and-spoke-networking/Peering is not transitive, which is the fact the whole topology is built around. Knowing why it is chosen also tells you the point at which Virtual WAN replaces it.Sun, 20 Sep 2026 00:00:00 GMTAzureNetworkingArchitecturemail@palanikumar.nethttps://www.palanikumar.net/articles/azure-landing-zones-small-team/https://www.palanikumar.net/articles/azure-landing-zones-small-team/The reference architecture assumes a dedicated platform function. Most organisations do not have one. The subset that still earns its keep is smaller than the diagram suggests.Sun, 20 Sep 2026 00:00:00 GMTAzureLanding zonesArchitecturemail@palanikumar.nethttps://www.palanikumar.net/articles/azure-policy-as-guardrail/https://www.palanikumar.net/articles/azure-policy-as-guardrail/Policy is the only control that stops a permitted action producing an unacceptable resource. Deploying it in the wrong order is how you break a platform team's deployments on a Monday.Sun, 20 Sep 2026 00:00:00 GMTAzureGovernanceAzure Policymail@palanikumar.nethttps://www.palanikumar.net/articles/azure-private-endpoints-and-dns/https://www.palanikumar.net/articles/azure-private-endpoints-and-dns/A private endpoint is a network interface and a DNS problem. Almost every failure I have seen was the DNS half, resolving the public address from somewhere nobody checked.Sun, 20 Sep 2026 00:00:00 GMTAzureNetworkingDNSmail@palanikumar.nethttps://www.palanikumar.net/articles/azure-rbac-scope-decisions/https://www.palanikumar.net/articles/azure-rbac-scope-decisions/Role assignments inherit downward and there is no deny. Where you assign a role matters more than which role you assign, and the subscription limit is closer than you think.Sun, 20 Sep 2026 00:00:00 GMTAzureRBACArchitecturemail@palanikumar.nethttps://www.palanikumar.net/articles/certificate-autoenrolment-failures/https://www.palanikumar.net/articles/certificate-autoenrolment-failures/Auto-enrolment fails silently until certificates expire and authentication breaks. A read-only script that finds the certificates about to lapse, tests the certification authorities and reports who actually holds enrol rights.Sun, 20 Sep 2026 00:00:00 GMTActive DirectorySecurityPowerShellTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/co-management-workload-sliders/https://www.palanikumar.net/articles/co-management-workload-sliders/Co-management lets Configuration Manager and Intune manage the same device. Each workload has exactly one authority, and moving a slider transfers it for every device in scope.Sun, 20 Sep 2026 00:00:00 GMTIntuneConfiguration ManagerCo-managementmail@palanikumar.nethttps://www.palanikumar.net/articles/conditional-access-baselines/https://www.palanikumar.net/articles/conditional-access-baselines/A policy set that works in a demo tenant and locks out a real organisation is the normal outcome. Report-only mode, exclusion design and a deliberate rollout order prevent it.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft Entra IDConditional AccessZero Trustmail@palanikumar.nethttps://www.palanikumar.net/articles/defender-xdr-and-sentinel-collection/https://www.palanikumar.net/articles/defender-xdr-and-sentinel-collection/Two products that overlap enough to confuse the boundary. Defender XDR covers the Microsoft estate; Sentinel is for everything else and for correlation across it.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft DefenderMicrosoft SentinelSecurity operationsmail@palanikumar.nethttps://www.palanikumar.net/articles/directory-sync-error-triage/https://www.palanikumar.net/articles/directory-sync-error-triage/A user exists on-premises, does not exist in the cloud, and sync reports success. A read-only triage script that finds the objects Entra ID quarantined and explains which attribute caused it.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft Entra IDHybrid identityMicrosoft GraphPowerShellTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/entra-app-credential-expiry/https://www.palanikumar.net/articles/entra-app-credential-expiry/Application secrets expire quietly and fail loudly, usually out of hours. A read-only script that lists every credential in the tenant with its expiry, owner and blast radius.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft Entra IDMicrosoft GraphPowerShellTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/entra-application-consent-permissions/https://www.palanikumar.net/articles/entra-application-consent-permissions/Delegated and application permissions are not two settings on the same dial. One is bounded by the signed-in user and one is not, and the difference decides your exposure.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft Entra IDMicrosoft GraphSecuritymail@palanikumar.nethttps://www.palanikumar.net/articles/entra-connect-sync-versus-cloud-sync/https://www.palanikumar.net/articles/entra-connect-sync-versus-cloud-sync/Two provisioning engines with overlapping names and genuinely different architectures. The decision turns on transformation complexity and forest topology, not on which is newer.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft Entra IDHybrid identityArchitecturemail@palanikumar.nethttps://www.palanikumar.net/articles/entra-emergency-access-accounts/https://www.palanikumar.net/articles/entra-emergency-access-accounts/Break-glass accounts fail for the same reason everything else fails during an incident: they were configured once and never exercised. The controls that keep them usable are specific.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft Entra IDPrivileged accessResiliencemail@palanikumar.nethttps://www.palanikumar.net/articles/exchange-5-5-to-exchange-online/https://www.palanikumar.net/articles/exchange-5-5-to-exchange-online/Six generations of Exchange, and the same four problems each time. The products changed completely; the design questions barely moved.Sun, 20 Sep 2026 00:00:00 GMTExchangeMicrosoft 365Architecturemail@palanikumar.nethttps://www.palanikumar.net/articles/exchange-hybrid-in-2026/https://www.palanikumar.net/articles/exchange-hybrid-in-2026/The last Exchange server is no longer a licensing footnote. Subscription Edition, the dedicated hybrid app and the Graph transition have changed what hybrid coexistence actually requires.Sun, 20 Sep 2026 00:00:00 GMTExchangeMicrosoft 365Hybridmail@palanikumar.nethttps://www.palanikumar.net/articles/failover-cluster-witness-choices/https://www.palanikumar.net/articles/failover-cluster-witness-choices/Quorum is a voting problem, and the witness is the vote that breaks ties. Each of the three options fails in a different way, and the right choice depends on what you expect to lose.Sun, 20 Sep 2026 00:00:00 GMTWindows ServerFailover clusteringArchitecturemail@palanikumar.nethttps://www.palanikumar.net/articles/graph-powershell-authentication-and-scopes/https://www.palanikumar.net/articles/graph-powershell-authentication-and-scopes/The SDK asks for the permissions you name, and most people name too many. Two discovery cmdlets tell you exactly what a command needs, which makes least privilege straightforward.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft GraphPowerShellAutomationmail@palanikumar.nethttps://www.palanikumar.net/articles/graph-sign-in-and-risk-reporting/https://www.palanikumar.net/articles/graph-sign-in-and-risk-reporting/The sign-in log answers questions the portal makes awkward: legacy authentication by application, failures by error code, and which accounts are risky right now.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft Entra IDMicrosoft GraphPowerShellmail@palanikumar.nethttps://www.palanikumar.net/articles/group-policy-processing-order/https://www.palanikumar.net/articles/group-policy-processing-order/A setting that does not apply is rarely a broken GPO. It is usually a GPO that applied and was then overwritten by one you forgot was linked. Here is how to prove which.Sun, 20 Sep 2026 00:00:00 GMTActive DirectoryGroup PolicyTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/hybrid-identity-failure-modes/https://www.palanikumar.net/articles/hybrid-identity-failure-modes/Directory synchronisation works for years and then fails in a way the pilot never covered. These are the failures I check for, and the evidence that identifies each one.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft Entra IDHybrid identityTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/hybrid-join-failure-triage/https://www.palanikumar.net/articles/hybrid-join-failure-triage/Hybrid join failures are diagnosed by a tool that prints eighty lines of state nobody reads. A script that parses it, names the failing phase and checks the service connection point.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft Entra IDHybrid identityWindowsPowerShellTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/hyper-v-live-migration-failures/https://www.palanikumar.net/articles/hyper-v-live-migration-failures/Live migration fails in a small number of reproducible ways. The most confusing one is authentication, where migrating from the console works and migrating remotely does not.Sun, 20 Sep 2026 00:00:00 GMTHyper-VWindows ServerTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/identity-controls-for-ai-agents/https://www.palanikumar.net/articles/identity-controls-for-ai-agents/An agent acting on a user's behalf inherits that user's access, including everything they could reach but never did. The oversharing problem stops being theoretical.Sun, 20 Sep 2026 00:00:00 GMTAI securityMicrosoft Entra IDGovernancemail@palanikumar.nethttps://www.palanikumar.net/articles/intune-app-deployment-detection-rules/https://www.palanikumar.net/articles/intune-app-deployment-detection-rules/The detection rule is the part that decides whether an application is installed. Get it wrong and Intune reinstalls forever, or reports success for software that is not there.Sun, 20 Sep 2026 00:00:00 GMTIntuneApplication deploymentImplementationmail@palanikumar.nethttps://www.palanikumar.net/articles/intune-compliance-and-conditional-access/https://www.palanikumar.net/articles/intune-compliance-and-conditional-access/Compliance is only a report until Conditional Access reads it. Connecting the two is a single checkbox and the most effective way to lock out your entire organisation.Sun, 20 Sep 2026 00:00:00 GMTIntuneComplianceConditional Accessmail@palanikumar.nethttps://www.palanikumar.net/articles/intune-compliance-triage/https://www.palanikumar.net/articles/intune-compliance-triage/The Intune portal tells you a device is non-compliant. It takes several clicks to learn which policy, and there is no clicking your way through nine hundred devices. A script that answers it in one pass.Sun, 20 Sep 2026 00:00:00 GMTIntuneMicrosoft GraphPowerShellTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/intune-policy-conflicts/https://www.palanikumar.net/articles/intune-policy-conflicts/Intune does not arbitrate conflicts. Two policies setting the same value differently means neither applies, which is the opposite of what most administrators assume.Sun, 20 Sep 2026 00:00:00 GMTIntuneDevice managementTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/kerberos-delegation-explained/https://www.palanikumar.net/articles/kerberos-delegation-explained/Three delegation models, one of which should not exist in your directory any more. The differences decide who can impersonate whom, and who gets to configure it.Sun, 20 Sep 2026 00:00:00 GMTActive DirectoryKerberosSecurity architecturemail@palanikumar.nethttps://www.palanikumar.net/articles/key-vault-access-denied/https://www.palanikumar.net/articles/key-vault-access-denied/An Owner who cannot read a secret, a firewall that looks open, and a private endpoint resolving to the wrong address all produce the same status code. A script that separates them.Sun, 20 Sep 2026 00:00:00 GMTAzureSecurityPowerShellTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/ldap-signing-channel-binding-readiness/https://www.palanikumar.net/articles/ldap-signing-channel-binding-readiness/Enforcing LDAP signing and channel binding is a five-minute change that breaks printers, scanners and appliances nobody documented. A script that finds them first, from the domain controllers' own evidence.Sun, 20 Sep 2026 00:00:00 GMTActive DirectorySecurityWindows ServerPowerShellTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/microsoft-365-evidence-collection/https://www.palanikumar.net/articles/microsoft-365-evidence-collection/Audits, incidents and reviews all ask the same questions about a tenant. Collecting the answers the same way every time turns an ad-hoc scramble into a comparable record.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft 365PowerShellSecurity assessmentmail@palanikumar.nethttps://www.palanikumar.net/articles/microsoft-365-tenant-to-tenant-migration/https://www.palanikumar.net/articles/microsoft-365-tenant-to-tenant-migration/A tenant move is an identity project wearing a migration costume. The mailboxes are the easy part; the domain name can only exist in one tenant at a time.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft 365MigrationArchitecturemail@palanikumar.nethttps://www.palanikumar.net/articles/microsoft-purview-permissions-first/https://www.palanikumar.net/articles/microsoft-purview-permissions-first/Classification tells you where sensitive data is. It does not reduce who can reach it. Deploying labels over broken permissions produces an accurate map of a problem you still have.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft PurviewData governanceSecuritymail@palanikumar.nethttps://www.palanikumar.net/articles/ntlm-usage-discovery/https://www.palanikumar.net/articles/ntlm-usage-discovery/NTLM is deprecated, NTLMv1 is already removed from the newest Windows releases, and nobody has an inventory. A read-only script that collects what is actually authenticating with NTLM, from the machines that know.Sun, 20 Sep 2026 00:00:00 GMTActive DirectorySecurityWindows ServerPowerShellTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/powershell-other-admins-can-run/https://www.palanikumar.net/articles/powershell-other-admins-can-run/A script that works is not the same as a script someone else can run at two in the morning. The difference is a small number of habits, and they cost almost nothing to adopt.Sun, 20 Sep 2026 00:00:00 GMTPowerShellAutomationOperationsmail@palanikumar.nethttps://www.palanikumar.net/articles/preparing-entra-id-for-passkeys/https://www.palanikumar.net/articles/preparing-entra-id-for-passkeys/Moving to phishing-resistant authentication is mostly not a passkey problem. It is a recovery, enrolment and exception problem, and those need solving first.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft Entra IDAuthenticationPasskeysmail@palanikumar.nethttps://www.palanikumar.net/articles/privileged-identity-management-in-practice/https://www.palanikumar.net/articles/privileged-identity-management-in-practice/PIM turns standing administrative access into time-bound, justified and reviewable access. Most deployments stall because the role inventory was never done.Sun, 20 Sep 2026 00:00:00 GMTMicrosoft Entra IDPrivileged accessGovernancemail@palanikumar.nethttps://www.palanikumar.net/articles/protecting-lsass-credential-guard/https://www.palanikumar.net/articles/protecting-lsass-credential-guard/Two distinct protections with overlapping names, both now on by default in recent Windows. Knowing which one blocks which attack tells you what remains exposed.Sun, 20 Sep 2026 00:00:00 GMTWindowsCredential protectionSecuritymail@palanikumar.nethttps://www.palanikumar.net/articles/read-only-active-directory-audit/https://www.palanikumar.net/articles/read-only-active-directory-audit/A read-only assessment that collects privileged membership, delegation, stale accounts and password policy exposure — and changes nothing, deliberately.Sun, 20 Sep 2026 00:00:00 GMTActive DirectoryPowerShellSecurity assessmentmail@palanikumar.nethttps://www.palanikumar.net/articles/reading-active-directory-replication-failures/https://www.palanikumar.net/articles/reading-active-directory-replication-failures/Replication rarely fails suddenly. It fails quietly for weeks, then becomes an outage on the day a tombstone lifetime expires. This is how to read the evidence early.Sun, 20 Sep 2026 00:00:00 GMTActive DirectoryReplicationTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/retiring-stale-active-directory-accounts/https://www.palanikumar.net/articles/retiring-stale-active-directory-accounts/Deleting a dormant account is easy. Knowing whether something still depends on it is the actual work, and LastLogonDate will not tell you.Sun, 20 Sep 2026 00:00:00 GMTActive DirectoryIdentity governancePowerShellmail@palanikumar.nethttps://www.palanikumar.net/articles/sharepoint-onedrive-sharing-defaults/https://www.palanikumar.net/articles/sharepoint-onedrive-sharing-defaults/The defaults optimise for collaboration, which is the right default for Microsoft and the wrong one for most organisations. Six settings change the exposure considerably.Sun, 20 Sep 2026 00:00:00 GMTSharePointOneDriveSecuritymail@palanikumar.nethttps://www.palanikumar.net/articles/spf-dkim-dmarc-operational-sequence/https://www.palanikumar.net/articles/spf-dkim-dmarc-operational-sequence/Three DNS records that only work in a specific order. Publishing a strict DMARC policy before the inventory is complete is how organisations stop their own invoices arriving.Sun, 20 Sep 2026 00:00:00 GMTExchange OnlineEmail authenticationDNSmail@palanikumar.nethttps://www.palanikumar.net/articles/storage-spaces-direct-to-azure-local/https://www.palanikumar.net/articles/storage-spaces-direct-to-azure-local/The storage engine is largely the same software. The operating model is not. Separating those two facts is what makes the platform decision answerable.Sun, 20 Sep 2026 00:00:00 GMTAzure LocalStorage Spaces DirectArchitecturemail@palanikumar.nethttps://www.palanikumar.net/articles/storage-spaces-direct-what-breaks/https://www.palanikumar.net/articles/storage-spaces-direct-what-breaks/The cluster reports its own health accurately. The difficulty is that a degraded volume, a stuck repair job and a failing drive produce overlapping symptoms and need different responses.Sun, 20 Sep 2026 00:00:00 GMTStorage Spaces DirectWindows ServerTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/sysvol-dfsr-recovery/https://www.palanikumar.net/articles/sysvol-dfsr-recovery/Group Policy applies differently depending on which domain controller a client used. A read-only health check for DFSR SYSVOL, and the one recovery step that is safe to automate.Sun, 20 Sep 2026 00:00:00 GMTActive DirectoryWindows ServerPowerShellTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/tracing-exchange-online-mail-flow/https://www.palanikumar.net/articles/tracing-exchange-online-mail-flow/Message trace answers where a message went. Getting a useful answer depends on knowing which tool covers which window, and on reading the event sequence rather than the final status.Sun, 20 Sep 2026 00:00:00 GMTExchange OnlineMail flowTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/windows-11-readiness-inventory/https://www.palanikumar.net/articles/windows-11-readiness-inventory/Windows 10 reached end of support in October 2025. A script that reports, per device, which Windows 11 requirement it fails — and says plainly which answers it cannot give you.Sun, 20 Sep 2026 00:00:00 GMTWindowsIntunePowerShellTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/windows-admin-center-operations/https://www.palanikumar.net/articles/windows-admin-center-operations/A browser-based console that replaces a dozen MMC snap-ins, and a gateway that can reach every server you own. The second half is why its placement is a security decision.Sun, 20 Sep 2026 00:00:00 GMTWindows ServerWindows Admin CenterOperationsmail@palanikumar.nethttps://www.palanikumar.net/articles/windows-autopilot-enrolment-failures/https://www.palanikumar.net/articles/windows-autopilot-enrolment-failures/Autopilot failures happen in front of the person receiving the device, which raises the stakes. Almost all of them fall into four categories, distinguishable within minutes.Sun, 20 Sep 2026 00:00:00 GMTIntuneAutopilotTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/windows-event-logs-worth-forwarding/https://www.palanikumar.net/articles/windows-event-logs-worth-forwarding/Ingestion is charged by volume and most of what Windows logs has no investigative value. A small, deliberate set of events answers the questions an incident actually asks.Sun, 20 Sep 2026 00:00:00 GMTSecurity operationsLoggingWindowsmail@palanikumar.nethttps://www.palanikumar.net/articles/windows-laps-implementation/https://www.palanikumar.net/articles/windows-laps-implementation/A shared local administrator password across an estate is one compromised machine away from being every machine's password. Windows LAPS is built in, and the deployment is four steps.Sun, 20 Sep 2026 00:00:00 GMTWindowsLAPSSecuritymail@palanikumar.nethttps://www.palanikumar.net/articles/windows-server-storage-counters/https://www.palanikumar.net/articles/windows-server-storage-counters/Disk queue length is the counter everyone quotes and the one that misleads most often. Latency is the number that corresponds to what users experience.Sun, 20 Sep 2026 00:00:00 GMTWindows ServerPerformanceTroubleshootingmail@palanikumar.nethttps://www.palanikumar.net/articles/windows-server-upgrade-paths/https://www.palanikumar.net/articles/windows-server-upgrade-paths/In-place upgrade is supported, faster and carries forward everything — including the accumulated configuration nobody understands. That last part is usually the deciding factor.Sun, 20 Sep 2026 00:00:00 GMTWindows ServerUpgradesImplementationmail@palanikumar.nethttps://www.palanikumar.net/articles/entra-connect-september-2026-upgrade/https://www.palanikumar.net/articles/entra-connect-september-2026-upgrade/What identity teams should verify before the mandatory Entra Connect Sync upgrade deadline, and how to reduce cutover risk.Sat, 19 Sep 2026 00:00:00 GMTMicrosoft Entra IDHybrid identityOperationsmail@palanikumar.nethttps://www.palanikumar.net/articles/exchange-online-ews-retirement-2026/https://www.palanikumar.net/articles/exchange-online-ews-retirement-2026/A practical readiness plan for discovering EWS dependencies, controlling temporary access and moving Exchange Online integrations forward.Sat, 19 Sep 2026 00:00:00 GMTExchange OnlineMicrosoft 365Microsoft Graphmail@palanikumar.nethttps://www.palanikumar.net/articles/from-radio-experiments-to-cloud-security/https://www.palanikumar.net/articles/from-radio-experiments-to-cloud-security/How electronics, local computer support and successive Microsoft platforms shaped the way I approach infrastructure, identity and security.Sat, 19 Sep 2026 00:00:00 GMTCareerArchitectureTechnical educationmail@palanikumar.nethttps://www.palanikumar.net/articles/from-windows-nt-to-azure-local/https://www.palanikumar.net/articles/from-windows-nt-to-azure-local/An architectural view of what changes across Microsoft platform generations, and the operational questions that still need an answer.Sat, 19 Sep 2026 00:00:00 GMTArchitectureWindows ServerAzure LocalMicrosoft 365mail@palanikumar.nethttps://www.palanikumar.net/articles/securing-enterprise-ai-agents/https://www.palanikumar.net/articles/securing-enterprise-ai-agents/A practical guide to governing AI agents with Entra Agent ID, Conditional Access, Defender and Purview, including PowerShell, Graph requests and validation.Sat, 19 Sep 2026 00:00:00 GMTAI securityMicrosoft Entra IDMicrosoft Defendermail@palanikumar.net