A maximum-severity remote execution vulnerability in Microsoft Entra ID headlines today's issue of The Tenant Desk, alongside a major infrastructure shift as EVgo adopts Tesla's V4 Superchargers across North America.
Microsoft announced on Thursday that Viva Connections multi-home site management will migrate from the M365 admin center to the SharePoint admin center between September 1 and September 15, 2026. Existing instances will automatically convert to full Home sites, and legacy draft management states will be retired while entry points redirect administrators automatically.
Why it matters
: Centralizing Viva Connections portal governance directly into the SharePoint admin center streamlines tenant site administration and priority ordering. Administrators must update internal governance documentation and tenant operational runbooks ahead of the September cutoff to reflect the new management portal path.
Microsoft Message Center update MC1457836 details an automatic transition to Defender Unified RBAC (URBAC) across Defender and Sentinel portals starting late September through December 2026. Tenants receive a 30-day in-portal notification and automated role import before URBAC becomes the default access model, though admins maintain a post-activation opt-out.
Why it matters
: URBAC consolidates permission management across Defender, Sentinel, Entra ID, and device groups into a single governance framework. Security architects must audit auto-imported role mappings during the 30-day window to prevent unexpected permission drifts or broken operational API integrations.
SolarWinds' 2026 State of ITSM report released on Tuesday revealed that while AI tools save IT professionals 2.7 to 3.3 hours weekly, 71% report overall workloads remained static or increased. Over 44% of respondents spend six or more hours weekly maintaining AI connectors, auditing outputs, and supervising model integrations.
Why it matters
: Localized time savings from AI assistants frequently get swallowed by the administrative overhead of connector management and output verification. Enterprise leaders must evaluate AI deployments based on net workflow reduction rather than initial productivity metrics alone.
Former Census Bureau leaders publicly criticized an unsigned agency report on Tuesday that claimed 24,000 noncitizens voted in the 2020 election. Former chief scientist John Abowd noted that the statistical matching methodology lacked unique identifiers, making the match total indistinguishable from standard administrative error rates across a 160-million-vote dataset.
Why it matters
: Applying probabilistic record matching across incomplete government databases without unique keys generates substantial false-positive rates. Fact-checking these methodological limitations preserves statistical integrity and clarifies the distinction between raw administrative data matching and verified voter fraud.
Michigan's Rx Kids initiative announced expansion to over 60 communities on Thursday, supplying pregnant mothers with $1,500 upfront and $500 monthly during an infant's first year. Accompanying health data showed a 2.7 percentage-point drop in preterm births and a 4.2 percentage-point drop in low birthweight infants, with funds primarily covering food, rent, and diapers.
Why it matters
: Unconditional cash transfers during early child development act as direct public health interventions that measurably lower NICU admission rates and stabilize working-class family budgets. This policy expansion provides empirical evidence for municipal leaders considering flexible financial support programs.
Microsoft disclosed and server-side patched a critical remote code execution vulnerability in Entra ID, tracked as CVE-2026-69836 with a maximum CVSS score of 10.0, which was actively exploited in the wild on Thursday. The flaw stems from insecure deserialization of untrusted data (CWE-502) in the backend service, allowing unauthenticated network attackers to execute arbitrary code. Discovered by Principal Security Engineer Robert Fitzpatrick, the bug required no customer-side patching due to Entra ID's cloud architecture.
Why it matters
: Because Entra ID underpins identity and single sign-on across enterprise tenants, a CVSS 10.0 vulnerability at the cloud backend creates severe systemic risk. Although Microsoft remediated the flaw globally, security teams should immediately review historical sign-in telemetry, Conditional Access executions, and privileged role assignments for anomalous activity preceding the patch.
Security researchers at Proofpoint detailed an active OAuth client ID spoofing technique exploited by threat clusters including UNK_CustomCloak against Microsoft Entra ID on Friday. By submitting unregistered or legacy first-party client IDs via HTTP POST requests to the OAuth 2.0 token endpoint, attackers infer valid credentials and perform account enumeration without generating standard failed sign-in events in cloud logs.
Why it matters
: This attack vector bypasses standard Conditional Access policies and sign-in log alerts by exploiting blind spots in OAuth token endpoint telemetry. IT security teams must expand auditing beyond primary sign-in logs to inspect raw token endpoint HTTP requests for anomalous User-Agent strings and unregistered application IDs.
Following our coverage of the 'Kali365' and 'Greatness' toolkits, TrendAI security researchers detailed a business email compromise campaign on Thursday where attackers bypassed Microsoft 365 MFA using similar adversary-in-the-middle (AiTM) phishing relays. After capturing valid session cookies, threat actors replayed them via commercial VPN exit nodes to access Exchange Online and SharePoint, creating hidden inbox rules to divert vendor payments over a three-week window.
Why it matters
: Stolen session tokens completely bypass standard multi-factor authentication, allowing threat actors to manipulate cloud mailboxes using legitimate platform privileges. Security consultants should instruct client IT teams to monitor for sudden inbox-rule modifications paired with commercial VPN sign-ins and deploy FIDO2 passkeys to block AiTM interception.
Continuing the shift toward NACS standardization we noted with General Motors' 2027 fleet, EVgo announced plans on Thursday to deploy hundreds of Tesla-manufactured V4 Superchargers across its U.S. network starting this fall. The EVgo-branded stalls will deliver up to 500 kW charging rates, support native NACS connectivity, and integrate directly into Tesla in-car navigation systems as EVgo targets 15,000 to 17,000 fast-charging stalls nationwide by 2030.
Why it matters
: EVgo's adoption of Tesla's V4 hardware cements NACS as the definitive fast-charging standard across third-party networks in North America. For EV owners, expanding high-amperage 500 kW chargers near major retail corridors significantly reduces charging downtime and improves hardware reliability on long road trips.
The Healey-Driscoll Administration awarded $6.6 million through the MassTech Collaborative's RoboBench program on Thursday to fund shared testing facilities across Boston University, MassRobotics, UMass Amherst, and WPI. The state grants are paired with $1.9 million in private matching funds to help regional startups commercialize industrial, medical, and agricultural robotics.
Why it matters
: Shared hardware testing facilities solve a major capital barrier for Greater Boston technology startups transitioning prototypes into scaled manufacturing. The expanded infrastructure strengthens Massachusetts' competitive position as a regional hub for hard-tech and robotics innovation.
Astronomers analyzing James Webb Space Telescope and Very Large Telescope data from nine early galaxies reported on Tuesday that smaller, low-luminosity stars make early galaxies up to four times more massive than previously estimated. The study, led by Leiden University researchers, indicates that stellar mass accumulated much faster within 1.5 billion years of the Big Bang than existing cosmological models predicted.
Why it matters
: Underestimating low-mass stars led to significant undercounts of total baryonic matter and potential planetary systems in early galactic evolution. The discovery forces astrophysicists to recalibrate galaxy formation models and demonstrates JWST's high-sensitivity infrared advantages over ground-based spectral surveys.
Reports confirmed on Thursday that Microsoft's August Patch Tuesday update KB5121003 causes Microsoft Teams and the new Outlook to crash on ARM64 devices like the Surface Laptop 7 and Surface Pro 11. Affected systems generate 0x80073CFC dependency errors due to corrupted AppModel Runtime package states, while standard Win32 software remains functional.
Why it matters
: Dependency failures between OS updates and MSIX app packages create immediate productivity disruptions for users on Snapdragon and ARM-based laptops. System administrators should pause KB5121003 deployments on ARM64 fleets until Microsoft provides a servicing stack update.
Cloud Identity Platforms Suffer Direct Backend Deserialization Risks As identity boundaries expand across SaaS and infrastructure, attackers are probing core cloud authentication engines for untrusted deserialization bugs to achieve remote execution without needing client-side credentials.
Adversary-in-the-Middle Toolkits Bypass Standard Session Controls Enterprise security controls are shifting focus from password capture to post-authentication session security as threat actors abuse token endpoints and replayed cookies to impersonate valid users.
Enterprise AI Projects Confront Unmanaged Execution Overhead Organizations deploying multi-step AI agents are hitting structural friction where uncoordinated token consumption and maintenance hours erode localized productivity gains.
Public Charging Networks Standardize on High-Output Hardware Third-party operators and OEM-backed ventures are rapidly deploying 500kW NACS hardware to resolve availability and reliability bottlenecks along major highway corridors.
Unconditional Direct Support Proves Effective for Local Economic Mobility Municipal and county pilots providing direct cash transfers and targeted property tax relief are delivering measurable improvements in infant health, family budgets, and educational retention.
What to Expect
2026-08-24—China launches Chang'e-7 lunar south pole probe targeting Shackleton Crater.
2026-08-25—Oklahoma holds runoff elections featuring contested primary races and high super PAC ad spending.
2026-09-01—Microsoft begins automated Entra ID passkey registration prompts and transitions Viva Connections site management to the SharePoint admin center.
2026-09-15—Power Apps canvas applications reach general availability for Dataverse online/offline access mode toggles.
2026-10-02—TiE Boston hosts TiECON East 2026 in Burlington, Massachusetts, focusing on technology scaling challenges.
How We Built This Briefing
Every story, researched.
Every story verified across multiple sources before publication.
🔍
Scanned
Across multiple search engines and news databases
360
📖
Read in full
Every article opened, read, and evaluated
126
⭐
Published today
Ranked by importance and verified across sources
12
— The Tenant Desk
🎙 Listen as a podcast
Subscribe in your favorite podcast app to get each new briefing delivered automatically as audio.
Apple Podcasts
Library tab → ••• menu → Follow a Show by URL → paste