Petri

In this episode of First Ring Daily, Brad Sams and Paul Thurrott discuss Project Zenith, the just-announced pre-configured Windows experience for developers that will first become available on PCs with AMD’s Ryzen AI Halo.

Key Takeaways: Microsoft Sentinel now supports multiple accounts through a single connector configuration for Auth0, CrowdStrike Falcon, and Salesforce Service Cloud. Organizations can consolidate security telemetry into one Sentinel workspace instead of deploying duplicate connectors. Existing analytics rules, workbooks, playbooks, and detections continue to work with the consolidated data.

Key Takeaways: Microsoft will begin enabling Memory Integrity on more eligible Windows 11 devices in October 2026. This feature helps protect Windows against kernel-level attacks using Virtualization-based Security. Older hardware and incompatible drivers remain a consideration, which is why Microsoft is using a phased rollout approach. Microsoft plans to automatically enable Memory Integrity protection on more eligible Windows 11 devices.

Key Takeaways: Spring Ring used Microsoft Teams chats and calls to impersonate IT support personnel. Researchers observed attacks targeting more than 150 employees across at least 10 organizations. The campaign included attempts to deploy remote access tools and conduct NTLM relay attacks. A new voice phishing campaign called Spring Ring is exploiting Microsoft Teams to trick employees into granting attackers access to corporate systems.

Key Takeaways: Microsoft and AWS have introduced Azure Multicloud Interconnect for dedicated private connectivity between their cloud platforms. This service is designed to reduce the networking complexity associated with multicloud deployments. Microsoft says the offering can support high-bandwidth workloads.

Many organizations are excited about Microsoft 365 Copilot and all that it offers, but Copilot readiness is not mainly a licensing or rollout problem; it is a data exposure problem. Data exposure may include sensitive files that have been overshared or permissions that have accumulated over time. These shortcomings can be difficult to fix, because it is unlikely that anyone within an organization has a complete picture of where critical business data resides and how that data should be secured.

Key Takeaways: Microsoft Entra tenant governance and user-centric access reviews are now generally available. Lifecycle Workflows gain cloning support, while new preview features target AI governance and hybrid identity scenarios. Administrators should prepare for the retirement of MemberOf-based configurations and upcoming permission changes.

Key Takeaways: September 2026 security updates will require Hotpatch-enabled devices to reboot. October 2026 already includes a scheduled baseline update that also requires a restart. Microsoft expects the reboot-free Hotpatch cycle to resume in November 2026. Microsoft is temporarily pausing the reboot-free Hotpatch experience for the next two monthly security updates.

Key Takeaways: IT teams can now use Remote Help on unattended Windows devices without requiring a logged-in user. OS version assignment filters are now generally available for managed devices and apps. Microsoft Intune introduces a redesigned device management page and expands the protected apps list. Microsoft Intune’s 2608 service release brings various management and security updates for enterprise customers.

An employee calls the service desk. They’ve replaced their phone, they explain, and can’t access Microsoft Authenticator. They know their employee number and their manager’s name, and just need to access their account before an important meeting. They even sound like the employee. So how does the service desk know who is actually calling?