// FIELD_INTEL

Blog.

Insights, guides, and thought leadership on IAM, Microsoft Entra, DevSecOps, and Agentic AI security.

AboutCloud a new home for the tech blog

The blog has moved off Ghost and into aboutcloud.io itself. Here's the actual story of why, and what this whole thing has quietly turned into.

By Antonio Russo

Aug 25, 2026 · 7 min read

Running a community security baseline in CI: adding Maester to a Terraform and Entra ID GitHub Actions pipeline

Keeping Microsoft Entra ID secure requires constant vigilance. As security configurations, Conditional Access policies, and Privileged Identity Management (PIM) rules evolve, configuration drift becomes an inevitable risk. Manual quarterly reviews leave too much room for silent m

By Antonio Russo

Aug 12, 2026 · 11 min read

Entra Tenant Governance hits GA: what it actually solves and where it sits in your 2026 stack

A practical read for engineering and governance teams , the actual API surface, the limits that shape your design, and an honest comparison against Microsoft365DSC | Tenant Configuration Management APIs, Maester, ScubaGear and Azure Policy. If you run identity for an organization of any size, you have two lists. The list of tenants you manage, and the list of tenants that exist. They are not the same list, and the gap between them is where incidents start. On 10 August, Microsoft moved Entra T

By Antonio Russo

Jul 16, 2026 · 12 min read

Agent Blueprints in Entra: Your Governance Layer Is Also Your Attack Surface

Preview note. Microsoft Entra Agent ID and agent blueprints are evolving quickly. The admin center navigation, the manifest editor, and the classic-vs-modern agent distinction were all in preview when this was written. Screenshots are timestamped; treat the UI as a moving target and verify against current Microsoft Learn docs before acting on anything here. AI agents are already in your tenant. Not as a roadmap item. Right now. A sales manager wires up a Copilot Studio agent that reads SharePoi

By Antonio Russo

Jul 8, 2026 · 9 min read

PKI for Entra ID Professionals: The Skill Job Listings Assume You Have

Open ten job listings for "Entra ID Engineer" or "IAM Specialist" and count how many mention certificates, PKI, or AD CS. In my experience it's most of them usually buried in the "nice to have" section, sometimes as a hard requirement. Yet PKI is exactly the topic most identity professionals have learned to route around: it lived with the "certificate person," some server team, or a vendor. That arrangement is ending. Identity teams now own certificate-based authentication, passwordless rollout

By Antonio Russo

Jun 29, 2026 · 6 min read

Crossed: A summer crossword to help learn Microsoft Cloud security.

Try Crossec now . . . Some side projects start with a problem. This one started with a feeling: it is summer, security learning is usually dry, and a crossword is a genuinely fun way to drill the vocabulary of a field. So I built crossec , a browser crossword game about Microsoft Cloud security that generates a fresh puzzle every time you play, runs on four difficulty levels, and hands you a shareable badge when you finish. It is free, there is nothing to install, and it works on your phone, y

By Antonio Russo

May 26, 2026 · 8 min read

Why I Replaced OpenClaw With a Self-Hosted Hermes Agent and My Own Honcho

I run an always-on AI agent in my private and public cloud infrastructure. It lives on Telegram or WhatsApp, it remembers who I am between conversations, and it has a sysadmin's hands — terminal, code execution, the works. For a while, the engine behind that was OpenClaw. It isn't anymore. This is the story of why I tore it down and rebuilt on Hermes Agent from Nous Research, backed by a self-hosted Honcho memory layer. Two things forced the decision: a billing change that exposed how fragile m

By Antonio Russo

May 20, 2026 · 17 min read

Five layers of prompt injection defense: a production implementation guide

A sales engineer drops a PDF into the company's RAG-backed chatbot. "Summarize this proposal for me." The model reads the document, calls the CRM connector to verify customer references, generates a competent two-paragraph summary, and returns it. The conversation ends. The engineer moves on. Three minutes later, an email leaves the building. It contains 4,200 customer email addresses, sales-stage tags, and last-contact dates. Nobody at the company sent it. The CRM connector did, on behalf of t

By Antonio Russo

May 17, 2026 · 18 min read

Announcing EntraPass: a passkey readiness scanner that refuses to lie about your tenant

When Microsoft pushed passkeys from future direction to deploy now, I started getting the same question from every IT lead I spoke to: Who in our tenant can actually adopt passkeys this week? And who can't, and why? It's a deceptively simple question. The tooling situation around it is not. The Entra admin portal has the answer spread across four blades. The Microsoft Graph API has the right primitives, but no single endpoint that combines them. The hosted SaaS scanners want either a privilege

By Antonio Russo

May 5, 2026 · 9 min read

Meet "Ask AboutCloud" . An AI chatbot for the blog and the ENTRA ID Community , with safety receipts

This is nothing new in the Tech world.....but if you've visited the blog in the last few days, you've probably noticed a small chat bubble in the bottom-right corner. That's Ask AboutCloud Bot, a new feature I've been quietly cooking up: a semantic search engine and RAG (Retrieval Augmented Generation) chatbot that can answer questions about every post on this blog, plus the three free Entra ID tools I maintain. As well anything related to ENTRA ID in general and Internet searches . It runs end

By Antonio Russo

May 1, 2026 · 3 min read

From One Admin to the Community: Open-Sourcing Two Zero-Cost Entra ID Tools

Two free, open-source tools for the Microsoft Entra ID community: AADSTS Entra Errors (349 error codes) and Entra Tracker (live retirement & breaking change monitoring). Cloudflare Workers, €0/month, MIT licensed.

By Antonio Russo

Apr 24, 2026 · 18 min read

Zero Trust MCP: Exposing Securely a Remote MCP Server and authenticate with Windows Hello Passkey

A practical guide to building a secure, passkey-authenticated Model Context Protocol gateway , with real infrastructure, real code, and real lessons learned on Windows 11 with PowerShell and a Terminal Session Why This Matters Claude Code is a powerful agentic coding assistant. Out of the box, MCP servers run locally via STDIO , meaning your GitHub tokens, API keys, and credentials sit on every machine where you run Claude. Scale that across workstations, add a second developer, or run Claude

By Antonio Russo

Apr 23, 2026 · 10 min read

How to Securely Manage Any Firewall With an AI Agent and GitHub Action

Firewalls haven’t changed much in 20 years. They still expose a web UI, expect humans to click buttons, and rely on manual rule updates. What has changed is how we automate infrastructure — and how AI can reason about network events faster than any human. AI‑assisted infrastructure is no longer a future concept — it’s here. But when it comes to firewalls, the stakes are higher than anywhere else in your stack. A misconfigured rule can take down production, expose internal systems, or break VPNs

By Antonio Russo

Apr 22, 2026 · 5 min read

From WhatsApp to Multi-Cloud in 20 Minutes

The "Magic" Moment I sent a single WhatsApp message, 20 minutes later, a live, multi-cloud status dashboard (prototype Demo) was public at status.aboutcloud.io. It features two global vantage points, zero stored secrets, a fully automated pipeline, and—crucially—a monthly infrastructure cost of exactly €0. Here is the blueprint of how I built it. Video 👇 0:00 /27:42 1× The Vision: Why aboutcloud.io? aboutcloud.io isn't just a domain; it’s

By Antonio Russo

Apr 21, 2026 · 10 min read

The AI Co-Admin: Building a Zero-Trust, Multi-Cloud Vending Machine on the GitHub Free Tier

The promise of an autonomous AI "Co-Admin" is often overshadowed by a terrifying reality: How do you give an agent the keys to your kingdom without risking the kingdom itself? So, I have passed the Rubicon.... In this project, I have successfully onboarded OpenClaw—an AI agent—as a co-platform engineer. I moved beyond simple code generation into autonomous execution across Azure, ENTRA and Cloudflare, all while enforcing a Zero-Trust architecture that operates within the strict constraints of t

By Antonio Russo

Apr 16, 2026 · 10 min read

When My AI Engineer Replied to My Wife ...And Why That's a Problem

The Incident..... On April 16, 2026, at 07:24 UTC, my wife sent me two Facebook links via WhatsApp. Cat videos 😸, probably. She never got a reply from me. She got a reply from my AI assistant (OpenClaw | Anthropic Haiku Engine) instead. She didn't know that. I didn't know it was happening. By the time I found out, she'd already had a small conversation with a system she thought was me. Of course, she noted immediately that things were a bit off 😄 That's the incident. And it's worth examini

By Antonio Russo

Apr 15, 2026 · 8 min read

I built a free Microsoft Entra ID tool that finds roles Microsoft hasn't documented yet

Update 17th April 2026: deeper permissions, new roles, smarter search Since the original post, Entra RoleLens has been updated significantly. Here is what changed and what we found along the way. New roles surfaced by the Graph API By expanding the permissions granted to the pipeline's service principal, the tool now surfaces roles that were previously invisible. The most interesting discoveries: The Entra Backup family — Entra Backup Administrator and Entra Backup Reader — roles for managin

By Antonio Russo

Apr 3, 2026 · 14 min read

Microsoft Agent 365: What Entra Admins and SecOps Teams Need to Know

There is a lot of noise about Microsoft Agent 365 right now. Most of it is aimed at MSPs, partners, and IT decision makers asking, "what is it and should we buy it." That is a fair question, but it is not the one I want to answer here. The question I want to answer is the one that lands on the desk of the Entra administrator and the SecOps analyst: what does this mean for identity security, who is responsible for governing these agents, and what controls actually exist today? Because here is t

By Antonio Russo

Apr 1, 2026 · 5 min read

AADSTS Error Code Reference Auto-Updating for the Entra ID Community

If you have ever Googled an AADSTS error code at 11pm during an incident, you know the experience. You land on a Microsoft Learn page with a flat table, a one-line description, and no indication of whether you need to call the user, fix your app, or wait for Microsoft to sort itself out. You copy the code number, paste it somewhere else, cross-reference three tabs, and eventually figure it out on your own. I wanted something better. So, I built it and made it completely free, auto updating, and

By Antonio Russo

Mar 31, 2026 · 7 min read

I Built a Live Microsoft Entra Change Tracker for the Community: Here Is How and Why

The Microsoft identity community is one of the most active and generous technical communities I know. People share KQL queries, Conditional Access templates, migration notes, and lab write-ups freely. Tools like AzAdvertizer, the Entra ID exporter, and dozens of community GitHub repositories exist because practitioners wanted to give something back , not because there was a gap nobody else noticed. This tracker is built in that same spirit. Microsoft publishes Entra changes across several chan

By Antonio Russo

Mar 31, 2026 · 7 min read

Who Governs the AI Agents? New Microsoft Entra Roles for the Agentic Era

Introduction AI agents are proliferating inside enterprise Microsoft tenants faster than identity teams can govern them. Copilot Studio, Azure AI Foundry, Security Copilot, and Agent 365 are all creating agent identities — each with permissions, service principals, and access to organizational data. The question nobody is asking loudly enough is: who has the right to create, manage, and approve these agents — and with what permissions? Until recently the honest answer was: whoever has Applica

By Antonio Russo

Mar 30, 2026 · 5 min read

PIM Iteration 2 API Retirement on October 28, 2026: What You Need to Do Now

TL; DR Microsoft will retire the Microsoft Entra Privileged Identity Management (PIM) Iteration 2 (beta) APIs on October 28, 2026. Any automation, scripts, or integrations using the /beta/privilegedAccess endpoints will stop working after this date. If you manage privileged access using automation, you must migrate to Iteration 3 (Generally Available) APIs to avoid service disruption. * The Break: Any script using /beta/privilegedAccess will fail. * The Fix: Move to /v1.0/roleManagement/dir

By Antonio Russo

Mar 30, 2026 · 4 min read

Your Entra Risk Policies Are Retiring in October 2026: Here Is How to Migrate Before They Break

Introduction If you configured your risk policies directly in Microsoft Entra ID Protection — User risk policy and Sign-in risk policy, they are already read-only since July 2025. On October 1, 2026, they stop enforcing entirely. Silently. No warning at runtime. Users who should be blocked or challenged will not be. This post is the direct follow-up to the Unified Risk Signals article. In that post we made the risk engine smarter by feeding Defender signals into the Identity Risk Score. Now we

By Antonio Russo

Mar 26, 2026 · 3 min read

Synced passkeys and passkey profiles are now available. Completing the Phishing Resistant Loop

Entra Passkey Profiles: Why You Need to Intercept the 2026 Migration Now If you’ve logged into your Entra portal lately, you’ve seen the banner. Microsoft is pushing us toward a "new experience" for Passkeys. While the prompt looks like just another UI update, there is a massive architectural shift happening under the hood. Between March and May 2026, Microsoft will auto-migrate every tenant to Passkey Profiles. If you stay on the sidelines, you’re letting Microsoft set your defaults—and that

By Antonio Russo

Mar 26, 2026 · 11 min read

Don’t Let Microsoft Set Your Passkey Defaults: A Hands-on Guide to Entra Passkey Profiles

By May 2026, every Entra tenant will be migrated to the new Passkey Profiles model. If you haven't opted in, Microsoft will apply its own defaults, potentially enabling synced passkeys for your entire org. This lab-proven guide shows you how to intercept the migration, configure high-assurance profiles, and leverage Microsoft Authenticator for hardware-bound security. The March 2026 Countdown Most Microsoft announcements are just "features." This one is a mandatory shift in architecture. Sta

By Antonio Russo

Mar 25, 2026 · 4 min read

Beyond the Network Layer: Unified Risk Signals for Identity Protection in Microsoft Entra (Preview)

The problem this solves — the signal gap Microsoft Entra ID Protection has always been good at detecting identity-specific risks — leaked credentials, impossible travel, anonymous IP addresses, suspicious sign-in patterns. But there was a blind spot. A user's device could be actively compromised, flagged as high risk in Microsoft Defender for Endpoint, and Entra ID Protection would have no idea. Your Conditional Access policies would not react. The user would continue accessing resources uninte

By Antonio Russo

Mar 24, 2026 · 31 min read

Protect enterprise generative AI applications with Prompt Shield (Preview)

As organizations accelerate the adoption of generative AI tools, a new class of security risk has emerged — one that traditional network controls were never designed to handle. Employees are interacting daily with large language models like ChatGPT, Gemini, Copilot, and Claude, often sharing sensitive business context as part of their prompts. Without visibility into that traffic, security teams are effectively blind. Microsoft Entra Internet Access addresses this gap through Prompt Shield — a

By Antonio Russo

Mar 13, 2026 · 9 min read

The cost trap: Running Claude as Your 24/7 Admin: How to Keep It Affordable

When most people think about AI assistants, they imagine a chat interface on a browser tab. I went a different route: I wanted an AI agent that lives on my own infrastructure, responds on WhatsApp, and can actually do things . SSH into servers, restart services, check logs, perform security audit, firewall management and manage Ghost blog, Mail stack, Next Cloud and the Hypervisor | Containers stack (LXC) — all without me opening a single terminal. That's OpenClaw. And after running it in produ

By Antonio Russo

Mar 11, 2026 · 9 min read

How I Built a Private Cloud Automated Platform on Proxmox from Zero to Production with Openclaw

When most people think about launching a blog or a company website, the default answer is a managed SaaS platform or a shared hosting provider. I went a different way. This post documents the architecture I built to run aboutcloud.io — a fully self-hosted, production-grade blog platform running on Proxmox, with Cloudflare at the edge and Ghost as the CMS. This is not a tutorial. It's an architectural overview — the kind of post I would have wanted to read before starting. Why S

By Antonio Russo