Today on The Tenant Desk: Microsoft is rolling out new administrative tooling to rein in unchecked AI agent sprawl. We also break down a critical authentication bypass abusing trusted Windows processes, updated telecom MFA retirement timelines for Entra ID, and a bipartisan push to reshape Social Security benefits for the physical trades.
Microsoft announced on Wednesday, September 23, that it is updating the Agent Registry in the Microsoft 365 admin center to group duplicate listings for custom AI agents into single unified records. Previously, identical agents published across multiple scopes or versions created separate registry entries. The new administrative interface introduces a flyout version selector, allowing administrators to view version history and apply global governance blocks that enforce policy across all versions simultaneously. The worldwide rollout began in mid-September 2026 and is scheduled to complete by late September 2026.
Why it matters
This registry consolidation resolves significant administrative friction caused by inflated agent counts, but it alters underlying inventory reporting. M365 consultants and tenant administrators must update automated PowerShell export scripts, Power BI governance dashboards, and client compliance documentation to account for the sudden drop in total listed agent entries. Because governance blocks applied to a consolidated listing instantly cascade across all historical and current agent versions, administrators must carefully evaluate version dependencies before executing tenant-wide blocks.
Building on the commercial Agent 365 multi-cloud updates we tracked earlier this week, Microsoft released a new capability on Wednesday introducing a Microsoft-managed Agent 365 CLI enterprise application. This update eliminates the prerequisite for administrators to manually register, consent to, and maintain a tenant-owned app registration during command-line interface onboarding. Existing customer-owned CLI app configurations remain functional, and tenant security controls—including Conditional Access policies and Security Defaults—continue to be enforced under the Microsoft-managed application framework.
Why it matters
Removing manual app registration friction significantly accelerates developer and administrative deployment of Agent 365 management tooling. However, transferring app ownership to a Microsoft-managed service principal alters how authentication traffic is evaluated in Azure AD audit logs and Conditional Access evaluations. Tenant administrators configuring Agent 365 management across Linux or macOS developer endpoints must review updated interactive and device-code authentication guidance to ensure non-Windows admin workstations comply with existing access policies.
Expanding on the October 2026 application deprecation deadlines we covered yesterday, Microsoft issued updated lifecycle guidance reminding enterprise administrators of the upcoming October 13, 2026 milestone. The cutoff marks the complete end of security patches for the entire Office 2021 and Office LTSC 2021 suite, Windows 10 2016 LTSB, and the third and final year of Windows Server 2012 and 2012 R2 Extended Security Updates (ESU). Additionally, Windows Server 2022 shifts from Mainstream to Extended Support on the same date, requiring paid support contracts for non-security hotfixes.
Why it matters
This hard lifecycle boundary presents immediate budget and compliance exposures for organizations maintaining legacy on-premises infrastructure or perpetual desktop software. Unlike operating systems with extended paid buffer periods, Office 2021 application suites reach absolute end-of-life without further patch options. IT consultants must conduct asset inventories immediately to map legacy workloads toward Microsoft 365 Apps or Office LTSC 2024, ensuring migration costs are built into upcoming budget cycles.
Following Tuesday's finalized timeline for the February 2027 retirement of telecom multi-factor authentication we covered, Microsoft issued fresh guidance on Wednesday urging administrators of Entra ID workforce tenants to transition users to phishing-resistant passkeys. To facilitate tenant auditing, Microsoft released the Entra SMS/Voice Policy Scanner PowerShell script. The tool enables administrators holding Global Reader or Security Reader roles to identify all user accounts, Conditional Access policies, and authentication method configurations still relying on legacy telephony delivery.
Why it matters
Following the August decommissioning of SMS sign-in for Entra ID Free tenants, this update provides administrators with the exact diagnostic tooling needed to prepare commercial tenants for the 2027 cutoff. Operating system and identity teams must execute script scans immediately to catalog legacy fallback dependencies across break-glass accounts and field personnel. Identifying these accounts early is critical for planning FIDO2 hardware key distribution or configuring third-party telephony integrations via the Microsoft Security Store before native access is cut off.
On Thursday, September 24, insurance provider Hiscox detailed its scale-out of Microsoft Copilot Studio, expanding active user adoption from 4% to 74% and generating 6,000 custom citizen-built AI agents. To manage agent sprawl, permission boundaries, and functional duplication, Hiscox implemented Microsoft Agent 365 alongside a risk-tiered internal review framework called RAISE. The central control plane allows IT administrators to inventory active agent identities, audit underlying data connectors, and identify heavily duplicated agent builds to convert them into enterprise-managed solutions.
Why it matters
Hiscox's deployment provides a concrete enterprise case study on managing the transition from unmonitored citizen development to structured AI governance. Permitting rapid, bottom-up agent creation without pre-deployment gates drives high employee engagement but risks severe permission drift and shadow IT liabilities if unmanaged. Enterprise consultants can reference this pattern when advising clients: leveraging Agent 365 as an inventory and auditing control plane allows organizations to permit self-service Copilot Studio development while retroactively identifying high-value agents for IT hardening.
Reported on Wednesday, September 23, Accenture's Enkitec Group deployed an enterprise multi-agent system utilizing Oracle Deep Data Security and a Model Context Protocol (MCP) server across 925,000 documents in 27 Oracle product namespaces. The production architecture handles 300 simultaneous agent queries in under 15 seconds by enforcing cell-, row-, and column-level database permissions on every dynamically generated SQL query using Oracle AI Database 26ai. Authorization is evaluated directly within the database engine using runtime context and declarative SQL grants rather than relying on application-layer filtering.
Why it matters
This implementation establishes a critical architectural blueprint for enterprise AI: decoupling agent orchestration and prompt handling from data-tier authorization. Attempting to restrict AI context access using system prompts or application RBAC frequently fails under complex retrieval-augmented generation (RAG) scenarios. For SharePoint architects and M365 consultants, this underscores that autonomous agents must interact with systems of record where security boundaries are enforced natively at the database layer on every execution path.
On Thursday, September 24, Varonis Threat Labs disclosed a post-compromise technique dubbed TrustSink affecting Microsoft Entra ID. An attacker possessing Global Administrator or Authentication Policy Administrator privileges can register a rogue External Authentication Method (EAM) provider configured via OpenID Connect (OIDC). During second-factor authentication, the rogue provider renders a pixel-perfect fake Microsoft password prompt to harvest plaintext user credentials before issuing a valid signed token back to Entra ID. Because the rogue provider remains registered in the tenant, standard administrative password resets fail to evict the attacker, as new credentials are harvested on the user's next sign-in attempt.
Why it matters
TrustSink reveals a critical architectural vulnerability where cloud identity extensibility features can be weaponized for un-evictable credential harvesting. Because Entra ID inherently trusts the signed authentication token issued by an authorized OIDC endpoint, the platform cannot inspect or validate the HTML rendered by the external provider. For identity architects and security consultants, this shifts the defense priority toward enforcing strict Privileged Identity Management (PIM) for Authentication Policy Administrator roles and actively auditing tenant Authentication Methods Policies for unauthorized EAM registrations.
Security researchers at Huntress published technical findings on Wednesday, September 23, detailing an authentication bypass technique utilizing WWAHost.exe—a legitimate, Microsoft-signed Windows Web App Host binary—combined with sideloaded AppX packages. By enabling Developer Mode or enterprise sideloading policies on a target endpoint, an attacker can execute remote JavaScript within the trusted process to trigger the legacy WebAuthenticationBroker API. This renders a genuine Microsoft sign-in prompt under a signed system process, capturing OAuth access and refresh tokens with broad Microsoft Office delegated scopes without raising traditional endpoint detection alerts.
Why it matters
This research highlights an acute architectural risk where signed OS binaries and built-in WinRT components can be co-opted to bypass endpoint security controls and extract persistent tokens. Because the login window is rendered by an authentic OS binary, endpoint detection and response (EDR) agents and end users cannot easily identify the malicious wrapper. Endpoint administrators and security teams must audit and restrict Developer Mode and AppX sideloading registry keys via Intune or Group Policy while monitoring for abnormal token generation tied to non-standard user-agent strings.
On Wednesday, September 23, the House Judiciary Committee released a formal report alleging that Special Counsel Jack Smith's investigation into former President Donald Trump violated the U.S. Constitution's Speech or Debate Clause. Citing primary grand jury subpoenas and prosecutor testimonies, the report states that federal investigators obtained phone toll records for 17 Republican lawmakers and text message data involving up to 44 members without utilizing independent filter teams or disclosing congressional record ownership to magistrate judges.
Why it matters
This report highlights complex legal and constitutional friction regarding executive law enforcement subpoenas, grand jury oversight, and legislative privilege. By documenting the exact administrative mechanisms and filter-team omissions used during federal record seizures, the primary transcripts offer an empirical baseline for evaluating executive branch authority over congressional communications. The findings are expected to drive legislative proposals amending federal investigative guidelines and subpoena notice requirements for constitutional officers.
Representative Haley Stevens (D-Mich.) introduced the Blue Collar Social Security Fairness Act on Wednesday, September 23. The proposed legislation establishes a point-based system—requiring 20 years or 15 qualification points in physically demanding fields such as construction, roofing, manufacturing, and nursing—to permit workers to collect unreduced Social Security retirement benefits at age 60. The bill arrives as official actuaries project Old-Age and Survivors Insurance (OASI) trust fund depletion by late 2032.
Why it matters
This legislative initiative directly targets the structural divergence between statutory retirement age increases and the physical career longevity of manual trade workers. For economic analysts and workforce planners, the proposal introduces a concrete mechanism to protect lower- and middle-income laborers whose earning capacity is cut short by physical wear. It also adds a major structural variable to ongoing congressional debates regarding federal entitlement solvency and trust fund reform.
Adding to the wave of regional data center pushback we've tracked across Massachusetts and Connecticut, residents of Bow, New Hampshire, voiced intense opposition on Tuesday to a proposed 350-megawatt hyperscale facility at the closed Merrimack Station coal plant site. Evaluated by Granite State Power and Eversource, the project faces backlash over thermal river discharge, acoustic noise, and grid capacity strains. Following the meeting, New Hampshire Governor Kelly Ayotte announced her opposition to the project, stating she will propose a statewide data center construction moratorium in her 2027 state budget.
Why it matters
This dispute illustrates the escalating regulatory and municipal barriers facing hyperscale compute expansion across New England. As developers attempt to repurpose retired fossil-fuel power plants to leverage existing transmission infrastructure, local communities and state executives are rejecting the environmental trade-offs despite substantial municipal property tax revenues. IT infrastructure architects and site planners must factor growing regional moratoriums and community opposition into long-term compute expansion strategies.
A corrupted over-the-air firmware update deployed through Samsung's SmartThings platform on Tuesday, September 22, rendered 2024 four-door Bespoke AI smart refrigerators completely inoperable. Affected appliances become stuck in an infinite boot loop showing a 'checking' display message, disabling cooling compressor functions and forcing owners to throw out spoiled food. The issue has triggered hundreds of formal consumer complaints, particularly in South Korea ahead of the major Chuseok holiday period.
Why it matters
This failure underscores the consumer risks inherent in tethering core household appliances to mandatory cloud update platforms without robust local rollback partitions. For technical consultants and family power users, it highlights why smart home deployments must isolate critical physical infrastructure from unvalidated remote firmware pushes. Manufacturers face escalating legal and reputational liabilities when cloud dependencies turn high-end home appliances into bricked units.
Data Permission Hygiene Dictates Enterprise AI Safety Across Microsoft 365 and multi-cloud environments, enterprise deployments of Copilot and custom agents are exposing legacy content oversharing. Governance reports and architectural standards like TAR-8 emphasize that security risks stem from unclassified files and unmonitored service accounts rather than AI model defects.
Protocol-Layer Authorization Overrides Prompt-Level Safeguards Major enterprise vendors are shifting administrative policy enforcement directly into execution layers like the Model Context Protocol (MCP) and database engines. Relying on system prompts or user-interface controls leaves systems vulnerable, forcing architects to enforce database-native and protocol-level grants.
Identity Deprecation Deadlines Force Infrastructure Overhauls With Microsoft setting firm cutoffs for native telecom SMS authentication and Exchange Web Services (EWS), tenant administrators must replace legacy fallback workflows with phishing-resistant passkeys and Microsoft Graph integrations before early 2027.
Post-Authentication Exploits Target Identity Extensibility Points Security research demonstrates that threat actors are moving past initial MFA barriers by abusing OAuth device code flows, Windows AppX binaries, and custom Entra External MFA providers (TrustSink) to capture refresh tokens and plaintext credentials.
Regional Grids Clash with Hyperscale AI Energy Demands In New Hampshire and broader New England, local communities and state leaders are mounting pushback against 350MW+ hyperscale data centers, citing grid stability, noise, and environmental impacts despite promised municipal tax revenues.
What to Expect
2026-10-13—Microsoft end-of-support deadline for Office 2021, Windows 10 2016 LTSB, and Windows Server 2012/2012 R2 ESUs.
2027-02-01—Final retirement of native SMS and voice first-factor authentication in Microsoft Entra ID workforce tenants.
How We Built This Briefing
Every story, researched.
Every story verified across multiple sources before publication.
🔍
Scanned
Across multiple search engines and news databases
436
📖
Read in full
Every article opened, read, and evaluated
126
⭐
Published today
Ranked by importance and verified across sources
12
— The Tenant Desk
🎙 Listen as a podcast
Subscribe in your favorite podcast app to get each new briefing delivered automatically as audio.
Apple Podcasts
Library tab → ••• menu → Follow a Show by URL → paste