Change Notes
What changed, who it affects, and the tenant check to run now.
Delivers
Act, schedule, monitor, or ignore
Ops Log by Michal Jatczak
Operational answers you can verify in your own tenant.
Microsoft 365, Azure, security, and production AI notes built from primary sources, controlled tests, and clear operator decisions.
Written and reviewed by Michal Jatczak
ITSailor founder, operating from Malta
Editorial series
Choose the evidence you need.
The format tells you what evidence to expect before you open a note.
Operator Runbooks
Admin paths, commands, expected output, side effects, and rollback.
Delivers
A task you can execute and reverse
Lab Notes
Test conditions, screenshots, results, failures, and limits.
Delivers
Evidence with enough context to challenge it
Decision Memos
A direct recommendation, the trade-offs, and where it stops applying.
Delivers
A decision and its reversal trigger
Archive
Field notes
Search the archive or browse by operational topic.
More field notes
Change NoteModern Workspace
The Microsoft 365 July 2026 price change is really about commitment term
Microsoft reset Microsoft 365 list prices on 1 July 2026. The headline seat numbers moved a little; the commitment term moved a lot. Here are the confirmed figures and the tenant check to run before the next renewal.
By Michal Jatczak
Open note
Operator RunbookSecurity & Infrastructure
A 30-second Conditional Access read and the four gaps it usually surfaces
Four Conditional Access controls decide most of a Microsoft 365 tenant identity posture: admin MFA, legacy-auth block, MFA for all, and a device gate. Here is the read-only check that scores them and what each gap means.
By Michal Jatczak
Open note
Lab NoteSecurity & Infrastructure
The delegated OAuth grant that outlives the employee
Disabling an Entra account does not delete the delegated OAuth grants the person consented to. A third-party app can keep acting on a former employee until the grant itself is revoked. Here is how to read them and which scopes to treat as high risk.
By Michal Jatczak
Open note
Operator RunbookSecurity & Infrastructure
Mailbox forwarding rules survive the leaver: the offboarding check most runbooks skip
An enabled inbox forwarding or redirect rule keeps sending a departed employee mail long after the account is disabled. Here is how to find every one from Microsoft Graph and shut it before it becomes an exfiltration path.
By Michal Jatczak
Open note
Lab NoteSecurity & Infrastructure
What a Microsoft 365 offboarding scan finds after the account is disabled
Disabling an Entra account is the start of offboarding, not the end. Here are the eight access residues a read-only Microsoft Graph scan reads back, and why each one matters to an auditor.
By Michal Jatczak
Open note
Change NoteSecurity & Infrastructure
July 2026 Exchange Server security updates: confirm the build before removing the interim mitigation
The July 2026 Exchange SUs withdraw Microsoft's advice to keep the CVE-2026-42897 mitigation applied, but installing the update does not remove it. This note gives the per-SKU July build numbers, the PowerShell that reads the real SU level rather than the CU level, and the documented M2 rollback in an order that keeps the exposure window at zero, given that the code fix itself shipped in the June 2026 SU.
By Michal Jatczak
Open note
Operator RunbookAI & Automation
Onboarding automation: the role profile, the joiner event, and the five parts that break
An operator runbook for automated joiner provisioning in Microsoft Entra ID: the role-profile file, a normalised joiner event, a poll-for-readiness Graph sequence, the Temporary Access Pass trap that locks out day-one starters, and the formula to compute your own time saving.
By Michal Jatczak
Open note
Operator RunbookAI & Automation
Self-hosted LLM serving in the EU: runtime choice, GPU sizing, and the sovereignty argument
A runbook for deciding whether to self-host an open-weights model in the EU: the runtime field after TGI entered maintenance mode, GPU sizing computed from the model config instead of copied from a table, a corrected token-throughput cost model, and the DORA, NIS2 and AI Act record you will be asked for.
By Michal Jatczak
Open note
Lab NoteAI & Automation
Retrieval over a permissioned corpus: ACL handling, the update pipeline, and what to measure
A bench specification for retrieval over a corpus that carries permissions: the four access-control failure modes, why post-filtering starves an approximate index, where the cache breakpoint belongs, and the six numbers to record on every run.
By Michal Jatczak
Open note
Architecture Workshop
Apply the same method to your own environment.
Two hours in your tenant. You leave with a Microsoft 365 security baseline, a deployable architecture plan, and an Exit Kit you own.