https://ph7x.com/blog/ What we learn moving organisations onto the Microsoft cloud. Method, not opinion. en https://ph7x.com/blog/farm-solutions-spfx-or-external-services-on-subscription-edition/ https://ph7x.com/blog/farm-solutions-spfx-or-external-services-on-subscription-edition/ A farm that upgrades to Subscription Edition does not make its custom code compatible, secure or supported. Each component is decided on its own: kept as a farm solution, rebuilt on the SharePoint Framework, moved to an external service, or retired. What Microsoft documents for each, and what decides between them. Sun, 01 Nov 2026 00:00:00 GMT https://ph7x.com/blog/migrating-sharepoint-server-code-and-elevated-privileges/ https://ph7x.com/blog/migrating-sharepoint-server-code-and-elevated-privileges/ A WSP that deploys on Subscription Edition has not proved its authorization boundary. Review caller intent, elevated object lifetime, external identities and business acceptance before retaining, refactoring, extracting or eliminating server-side code. Sun, 01 Nov 2026 00:00:00 GMT https://ph7x.com/blog/a-report-can-look-complete-and-still-be-impossible-to-verify/ https://ph7x.com/blog/a-report-can-look-complete-and-still-be-impossible-to-verify/ 494 SOC 2 reports, allegedly 99.8% identical, and nothing in the system existed to notice. The uncomfortable part is not the fraud. It is that no automated check would have caught it. Fri, 21 Aug 2026 00:00:00 GMT https://ph7x.com/blog/the-green-test-that-measured-nothing/ https://ph7x.com/blog/the-green-test-that-measured-nothing/ A test suite can be green because the system works, or green because the test points at nothing. We collected our own specimens: a suite verifying a build nobody shipped, a read-only gate over a collector that could not load, a published guarantee table that never executed, a pinned assertion that was a fossil of a bug, and a suite that proved every rule and never ran the handler. Each one with the code, and the one-line question that catches all five. Tue, 11 Aug 2026 00:00:00 GMT https://ph7x.com/blog/the-confident-wrong-answer-is-worse-than-missing-evidence/ https://ph7x.com/blog/the-confident-wrong-answer-is-worse-than-missing-evidence/ A governance report told us a site had external sharing disabled. The site permitted anonymous links. Nothing was broken: a correct API returned a default value for a property it had never populated, and the default happened to be the safest word in the enum. Here is the mechanism, the code that reproduces it, Microsoft's own documentation of it, and the discipline that catches the whole class. Tue, 11 Aug 2026 00:00:00 GMT https://ph7x.com/blog/why-sharepoint-framework-still-runs-on-react-17/ https://ph7x.com/blog/why-sharepoint-framework-still-runs-on-react-17/ A retrospective on the SPFx 1.16–1.23.2 dependency boundary, updated to distinguish it from SPFx 1.24 and React 18.3.1. Platform compatibility requires more than changing a package version. Wed, 05 Aug 2026 00:00:00 GMT https://ph7x.com/blog/migrating-sharepoint-2016-and-2019-to-subscription-edition-the-scripts/ https://ph7x.com/blog/migrating-sharepoint-2016-and-2019-to-subscription-edition-the-scripts/ SharePoint 2016 goes straight to Subscription Edition. There is no hop through 2019, the method is database attach and nothing else, and the order of the service applications is not a preference. The sequence in PowerShell, from the inventory you take before touching anything to the checks you run before anyone is let in. Sat, 01 Aug 2026 00:00:00 GMT https://ph7x.com/blog/sharepoint-2016-2019-subscription-edition-and-online-what-actually-changes/ https://ph7x.com/blog/sharepoint-2016-2019-subscription-edition-and-online-what-actually-changes/ 2016 and 2019 both left support on 14 July 2026. Subscription Edition has no end date and cannot be bought outright. Online has features the others do not have, and Subscription Edition has two that are usually listed as impossible. A practical comparison, with the licensing that decides it. Sat, 01 Aug 2026 00:00:00 GMT https://ph7x.com/blog/developing-for-sharepoint-server-subscription-edition-the-practices-that-hold-up/ https://ph7x.com/blog/developing-for-sharepoint-server-subscription-edition-the-practices-that-hold-up/ Subscription Edition is supported until at least 2035 and its SharePoint Framework ceiling has not moved since 2023. That combination is the whole job: a long runway on an older stack. This is how to build on it well, with code that runs on the version your farm actually accepts. Sat, 01 Aug 2026 00:00:00 GMT https://ph7x.com/blog/a-copilot-agent-manifest-is-a-security-boundary-here-is-the-linter-for-it/ https://ph7x.com/blog/a-copilot-agent-manifest-is-a-security-boundary-here-is-the-linter-for-it/ Every scoping property in a Microsoft 365 Copilot agent manifest is optional, and in six places omitting one grants the widest scope instead of the narrowest. A JSON Schema validator approves those manifests, because nothing in them is invalid: something optional is missing. So we wrote the check that does catch it. It finds six problems in a manifest that passes every other test. Tue, 28 Jul 2026 00:00:00 GMT https://ph7x.com/blog/spfx-before-version-1-0-three-of-our-web-parts-in-the-official-microsoft-samples/ https://ph7x.com/blog/spfx-before-version-1-0-three-of-our-web-parts-in-the-official-microsoft-samples/ The SharePoint Framework developer preview came out in August 2016. Version 1.0 arrived in February 2017. Our first contribution to the official Microsoft 365 samples repository is dated October 2016, five months before there was a 1.0 to build against. Four of our web parts are in that repository today, and this is what each of them is for. Mon, 27 Jul 2026 00:00:00 GMT https://ph7x.com/blog/we-are-still-measuring-engineers-by-the-part-that-got-automated/ https://ph7x.com/blog/we-are-still-measuring-engineers-by-the-part-that-got-automated/ In 2025 DORA threw out its own scoreboard. The low, medium, high and elite tiers that the industry had quoted for a decade were replaced by seven team archetypes across eight measures. That is not a methodology footnote. It is the most used measurement framework in software admitting that the instruments no longer read the thing that decides whether a system survives. Mon, 27 Jul 2026 00:00:00 GMT https://ph7x.com/blog/one-agent-is-an-integration-a-hundred-is-a-governance-problem/ https://ph7x.com/blog/one-agent-is-an-integration-a-hundred-is-a-governance-problem/ Agents got production identities before they got a stable way to record what they did. Microsoft Entra Agent ID is generally available, with sponsors and expiry dates. The OpenTelemetry conventions for agent traces are still experimental. That gap is not a detail: it decides what you can responsibly put into production this year, and it turns an AI question into a governance one. Sun, 26 Jul 2026 00:00:00 GMT https://ph7x.com/blog/agents-decide-code-executes-knowing-the-line-is-the-job/ https://ph7x.com/blog/agents-decide-code-executes-knowing-the-line-is-the-job/ The promise is that agents replace applications. In the systems we build, they do not. An agent is very good at understanding a request, weighing options and choosing a tool. It is the wrong place for a payment, a tax rule or a permission check. This is where the line falls, and why putting it in the wrong place is expensive. Fri, 24 Jul 2026 00:00:00 GMT https://ph7x.com/blog/ai-solved-syntax-it-did-not-solve-judgement/ https://ph7x.com/blog/ai-solved-syntax-it-did-not-solve-judgement/ Three independent measurements, taken between 2025 and 2026, all point the same way: AI-generated code passes over 95% on syntax and 55% on security, and that second number has not moved in two years. The part you write got cheap. The part you decide did not. Wed, 22 Jul 2026 00:00:00 GMT https://ph7x.com/blog/the-state-of-sharepoint-in-2026/ https://ph7x.com/blog/the-state-of-sharepoint-in-2026/ Every year someone declares SharePoint dead. It never was. But in a matter of months, real parts of it reached the end of the line: SharePoint Online Add-ins and Azure ACS for SharePoint Online retired in April, and SharePoint Server 2016 and 2019, InfoPath and SharePoint Designer left support in July. Here is what actually ended, what replaced it, and what to build on now, on-premises and in the cloud. Sun, 19 Jul 2026 00:00:00 GMT https://ph7x.com/blog/windows-10-has-ended-windows-11-is-the-minimum-not-the-plan/ https://ph7x.com/blog/windows-10-has-ended-windows-11-is-the-minimum-not-the-plan/ Support ended in October 2025. Whether a fleet is already on Windows 11, paying for Extended Security Updates, or simply exposed, the decision underneath is the same: swap the PCs, or use the forced move to modernise the workplace behind them. This is the how, with the Intune, Autopilot and Azure commands, and the reason the same Windows 10 is free to keep alive in the cloud. Sun, 19 Jul 2026 00:00:00 GMT https://ph7x.com/blog/spfx-1-23-2-upgrading-is-not-changing-a-number/ https://ph7x.com/blog/spfx-1-23-2-upgrading-is-not-changing-a-number/ The previous version was pulled from npm for regressions, and that is the warning: the risk of upgrading the SharePoint Framework is almost never in the SharePoint runtime, it is in the build. What changed in Heft, in Sass and in npm audit, with the code showing how it was, how it is, and how it will be. Sun, 19 Jul 2026 00:00:00 GMT https://ph7x.com/blog/the-ai-assistant-that-only-reads-what-you-can-read/ https://ph7x.com/blog/the-ai-assistant-that-only-reads-what-you-can-read/ A badly built RAG searches with the application's identity, not the asker's, and the assistant answers with what the person should not see. The fix is not a filter someone can forget to write: it is passing the user's token and letting Azure AI Search enforce permissions inside the engine. Sun, 19 Jul 2026 00:00:00 GMT https://ph7x.com/blog/cookie-consent-banner-with-azure-tables-and-functions/ https://ph7x.com/blog/cookie-consent-banner-with-azure-tables-and-functions/ The banner you copy from a vendor can itself be a tracker. Build your own instead, with no third parties, and the hard part turns out not to be the banner: it is keeping the proof that the person consented. Here is all of it, from the browser to the Azure Table, step by step. Thu, 16 Jul 2026 00:00:00 GMT