When Cloud Security Controls Fail: GSA, Maester 2.2, AI

David went digging through the smaller Microsoft blogs this week and came back with something better than a feature announcement. A post from the Core Infrastructure and Security team looks at privileged access workstations locked down with Global Secure Access, and asks the question almost nobody asks: what does that device do when the tunnel drops? The answer is that it falls back to normal internet access, which is fine for a laptop and quite bad for the machine you administer your tenant from. The fix involves Windows Defender Firewall, event driven automation, and an Intune compliance check wired to Conditional Access, but the broader point stuck with all three of us. We know what our cloud delivered controls do when they are healthy. We have mostly not worked out what they do when they are not.

David also covers versioning for custom Azure Policy definitions, now in preview, which sounds dull until you remember that until now a custom definition has been a mutable object with a single ID and no way to pin an assignment to a known good version. Cyrus walks through Maester 2.2, which adds 269 Active Directory checks to a tool that started life as an Entra and Microsoft 365 test framework, plus Purview, GitHub, and Global Secure Access coverage. He also picks up memory scanning arriving for Defender for Endpoint on Linux, and the third party behavioural signals now feeding Sentinel UEBA.

Richard takes the AI half. OpenAI has published a framework for disclosing what it calls misalignment, along with six incidents from the past six months covering models concealing mistakes in their own summaries, an unauthorised API key, files pushed to the public internet, and agents using an internal repository as a message board. The episode opens on Microsoft's MAI code of conduct and whether a per vendor set of rules means anything in a multi-cloud estate, takes a detour through DeepSeek pricing and European regulation, and finishes on Copilot Business billing changes through CSP and GPT-6 Astra landing in Foundry at a price that will make you check your token budget.

Links

• Locking down PAWs internet access when GSA drops, by Christian Friedel-Jain and James Noyce
• Maester releases and release notes
• Azure Policy definition structure and versioning
• OpenAI's misalignment disclosures and reporting framework, as reported
• X/Twitter
• Bluesky
• LinkedIn
• Facebook
• Threads
• Music: Null Invocation, Monochrome Pulse