🗂️ The Tenant Desk

Tuesday, August 18, 2026

12 stories · Standard format

Generated with AI from public sources. Verify before relying on for decisions.

🎧 Listen to this briefing or subscribe as a podcast →

We are continuing to monitor the fallout from the 'TheHatman' Azure directory leaks, as threat actors weaponize pre-mapped corporate privilege data. Alongside these identity governance challenges, Microsoft is pulling the plug on legacy PowerShell cmdlets to force compliance with its new Agent 365 control plane.

Microsoft 365 & SharePoint

Microsoft Retires Set-FederatedConnectorToggle Cmdlet Ahead of Agent 365 Shift

Microsoft announced Monday that it is deprecating the Set-FederatedConnectorToggle PowerShell cmdlet on August 25, 2026. Administrative management of Federated Copilot Connectors is moving directly into the 'Allowed agent types' configuration inside Agent 365, with full tenant enforcement taking effect on October 5, 2026.

Automated administration scripts relying on the Connector module will fail if not updated before the August 25 deadline. Consultants managing enterprise Copilot deployments should review existing PowerShell runbooks immediately to align search connector governance with the unified Agent 365 admin plane.

Verified across 1 sources: Topedia Blog

EWS-to-Graph Migration Mandate Hits Cross-Tenant Exchange Federation

Technical guidance published Monday highlights necessary migration steps for Exchange Online cross-tenant federation ahead of the Exchange Web Services (EWS) retirement. Administrators utilizing the Microsoft.Graph.Beta PowerShell module must carefully handle pre-existing trust relationships to avoid HTTP 409 conflict errors during tenant reconfiguration.

Tenant-to-tenant migrations and cross-organization sharing policies in regulated tenants face sudden breakage if EWS dependencies are not remediated before the October cutoff. M365 architects should inventory legacy cross-tenant trusts now.

Verified across 1 sources: GetPS.dev

Cactus Life Sciences Reports 50% Efficiency Gain in Phased M365 Copilot Rollout

Cactus Life Sciences published details Monday on its phased deployment of Microsoft 365 Copilot, which integrated over 30 custom agents for scientific writers while enforcing strict GxP data boundaries. The company reported a 35% to 50% increase in structured data extraction efficiency.

This offers a validated blueprint for life sciences consultants advising highly regulated tenants. It demonstrates that structured agent permissions combined with a formal champions program can satisfy strict regulatory validation while delivering measurable ROI.

Verified across 1 sources: Free Tech Blog from LogicCloud IT

Enterprise AI

xpander.ai Emerges From Stealth with Universal Harness for Agent Governance

Startup xpander.ai launched Monday with $7.5 million in seed funding and a generally available vendor-neutral control plane designed to manage autonomous AI agent sprawl. The platform uses a Universal Harness to enforce permission limits, observability, and execution policies across multi-framework enterprise deployments.

As enterprises accumulate disparate AI agents built across LangChain, Copilot Studio, and custom Python harnesses, centralized runtime governance is becoming a mandatory architecture layer to prevent fragmented access control and unmonitored execution.

Verified across 1 sources: VentureBeat

Politics, Fact-Checked

DOJ Files Appeal After District Courts Reject Voter Roll Requests 23 Times

Moving forward with the potential Supreme Court escalation we noted yesterday, the Department of Justice filed a notice of appeal Monday after federal district courts consistently ruled against its requests to compel states to surrender unredacted voter registration rolls. The DOJ's trial court record on the issue now stands at 0-23, and officials indicated they may seek direct Supreme Court review under the Civil Rights Act of 1960.

With lower courts uniformly rejecting federal access claims and the multi-year audit initiative yielding limited prosecutions, a direct Supreme Court petition under the Civil Rights Act of 1960 will ultimately define the jurisdictional limits of the Justice Department's voter file data-matching efforts.

Verified across 1 sources: Democracy Docket

Working-Class Economy

Maricopa County Launches Targeted Rental Assistance Pilot to Curb Evictions

Maricopa County launched an $800,000 Eviction Prevention Pilot Program on Tuesday, providing one-time rental relief of up to $3,200 for low-income families. Administered in high-eviction zip codes by HOM, Inc. and the City of Phoenix, landlords must agree that payments fully settle outstanding rent arrears to participate.

Targeted emergency cash interventions aim to stabilize housing without the administrative overhead of long-term subsidy vouchers, offering a practical trial case for municipal housing policy seeking to reduce emergency shelter and legal costs.

Verified across 1 sources: Maricopa County News

Cybersecurity

Threat Actor Lists Exfiltrated Directory Data from Fortune 500 Azure Tenants

Following yesterday's disclosure of the 'TheHatman' Azure directory leaks targeting McDonald's and Vodafone, the threat actor now claims to have exfiltrated 3.6 million employee records, adding Gap to the list of targeted firms. While the companies maintain the data is legacy or non-sensitive, researchers report the exfiltration relied on Graph API enumeration and compromised credentials to map directory attributes.

Exposed tenant directory structures provide threat actors with pre-mapped target lists for high-yield social engineering and spear-phishing campaigns. For M365 consultants, this underscores the necessity of auditing default Graph API read permissions and restricting user access to tenant directory data.

Verified across 2 sources: BleepingComputer · GovInfoSecurity

SpecterOps Research Details 'Pass-the-Passkey' Credential Impersonation Risks

Security researcher Michael Grafnetter detailed 'Pass-the-Passkey' attack vectors on Monday, showing how active local malware on Windows and macOS can capture WebAuthn signatures and replay authentication tokens. The research highlights edge-case vulnerabilities where unmitigated local process access compromises phishing-resistant authentication.

While passkeys remain vastly superior to legacy passwords, they are not immune to endpoint-level session hijacking. Security architects must combine FIDO enrollment mandates with strict endpoint privilege management and EDR controls to prevent token extraction.

Verified across 2 sources: Entra.News · SpecterOps

EVs & Charging

Multi-Fleet Telematics Study Shows EV Battery Degradation Averaging 2% Annually

Multi-fleet telematics research published Monday by Geotab, Generational, and Arval analyzing tens of thousands of commercial electric vehicles found that battery capacity degrades at an average rate of 2.0% to 2.3% per year, comfortably outlasting typical fleet operating lifecycles.

Empirical telematics data directly refutes persistent market concerns regarding premature battery failure, providing necessary analytical backing to stabilize used EV residual values and lower corporate fleet financing costs.

Verified across 2 sources: Fleet News · Fleet News

New England Beat

Millennium Partners Secures $281M Record PACE Loan for Boston's Winthrop Center

Developer Millennium Partners closed $281 million in Commercial Property Assessed Clean Energy (C-PACE) financing Monday for the residential component of the 62-story Winthrop Center in downtown Boston. Administered via MassDevelopment and Nuveen Green Capital, the transaction represents the largest PACE financing deal in regional history.

The deal illustrates how commercial real estate developers are leveraging specialized green financial structures to navigate high interest rates while funding deep energy efficiency and building decarbonization in core New England urban markets.

Verified across 1 sources: REBusinessOnline

Science & Space

KAIST Researchers Utilize Memristor Current Noise for Ultra-Low-Power Edge AI

Engineers at KAIST published research Monday introducing a neuromorphic artificial neuron that utilizes intrinsic current noise in memristors as a computational resource. By tuning resistance states, the hardware encodes time-series data dynamically, achieving high accuracy in speech recognition at micro-watt power levels.

Harnessing physical device noise rather than attempting to filter it out offers a biological-like hardware path for edge AI chips, dramatically cutting thermal and battery overhead for local sensory processing.

Verified across 1 sources: Tech Xplore

Consumer Tech Quirks

Apple Patches 30 Security Vulnerabilities Across iOS 26.6.1 and macOS 26.6.2

Apple released out-of-band updates on Monday—including iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2—fixing nearly 30 security flaws across WebKit, core image rendering, and cellular stack components. Several reported bugs were discovered using automated vulnerability analysis tools.

The rapid cadence of out-of-band OS patches highlights increasing automation in zero-day discovery. IT managers supporting mixed Apple environments should push these security updates immediately to protect personal and corporate devices.

Verified across 1 sources: MacRumors


The Big Picture

Directory Attributes Emerge as High-Value Reconnaissance Targets Large-scale exfiltrations of Azure and Entra tenant directories highlight how attackers prioritize organizational mapping over raw credential theft to fuel targeted spear-phishing.

Microsoft Enforces Centralized Governance Across Legacy Cmdlets Deprecating standalone PowerShell toggles in favor of Agent 365 frameworks marks a broader shift toward unified, policy-driven control of enterprise AI connectors.

Non-Human Identity Governance Extends to Runtime Execution As autonomous agents gain broad cross-SaaS authority, enterprise security teams are shifting focus from static API secrets to real-time action auditing.

Local Housing Policy Pivots to Micro-Infill Strategies Municipalities across the country are increasingly turning to accessory dwelling units and localized eviction diversion funds to cushion escalating rent pressures.

Green Capital Structures Expand Into Dense Urban Development Record PACE financing for landmark developments in Boston demonstrates how energy-efficiency capital tools are anchoring major commercial real estate deals.

What to Expect

2026-08-22 Power Platform public preview launches for granular Copilot credit tracking and PAYG caps.
2026-08-25 Microsoft officially deprecates the Set-FederatedConnectorToggle cmdlet in Exchange/Connector module.
2026-08-31 Power Platform native GitHub source code integration enters public preview.
2026-09-01 Entra ID begins automatic passkey registration prompts for users relying on SMS/voice MFA.
2026-10-05 Microsoft 365 tenants fully enforce Agent 365 settings for federated search connectors.

Every story, researched.

Every story verified across multiple sources before publication.

🔍

Scanned

Across multiple search engines and news databases

382
📖

Read in full

Every article opened, read, and evaluated

84

Published today

Ranked by importance and verified across sources

12

— The Tenant Desk

🎙 Listen as a podcast

Subscribe in your favorite podcast app to get each new briefing delivered automatically as audio.

Apple Podcasts
Library tab → ••• menu → Follow a Show by URL → paste
Overcast
+ button → Add URL → paste
Pocket Casts
Search bar → paste URL
Castro, AntennaPod, Podcast Addict, Castbox, Podverse, Fountain
Look for Add by URL or paste into search

Spotify isn’t supported yet — it only lists shows from its own directory. Let us know if you need it there.