Weekly briefing

Week 48 · 29 Nov – 5 Dec 2021 UTC · assess the changes, then plan the next dates.

What to assess first

29 Nov – 5 Dec · dates to 4 Jan Check coverage

Act on1

Dec2021
Known issueDec 2021
AD FS users will see more login prompts to ensure that the correct user is signed in.
Identity-platform authentication changes
Related evidence (6)
- AppId Uri in single tenant applications will require use of default scheme or verified domains
  Public source · Same source page; the statements may concern different changes
- Error 50105 has been fixed to not return interaction_required during interactive authentication
  Public source · Same source page; the statements may concern different changes
- Microsoft Entra Connect 1.6.16.0
  Public source · Suggested by a shared curated topic and product; not a verified connection
- Microsoft Entra Connect 2.0.28.0
  Public source · Suggested by a shared curated topic and product; not a verified connection
- Microsoft Entra Connect 1.6.14.2
  Public source · Suggested by a shared curated topic and product; not a verified connection
- Microsoft Entra Connect 2.0.25.1
  Public source · Suggested by a shared curated topic and product; not a verified connection

Coming up3

14Dec
Patch TuesdayScheduled for 14 Dec 2021
Patch Tuesday, 14 December 2021
The second Tuesday of the month, when Microsoft releases security updates for Windows, Office, and servers.
29Dec
CISA KEV deadlineDue 29 Dec 2021
Microsoft Windows AppX Installer Spoofing Vulnerability
CVE-2021-43890
1Dec
CISA KEV deadlineDue 1 Dec 2021
Microsoft Windows Win32k Privilege Escalation Vulnerability
CVE-2021-40449
Same day: CISA KEV deadline: Microsoft Excel Security Feature Bypass; CISA KEV deadline: Microsoft Exchange Server Remote Code Execution Vulnerability

How this list is chosen

Changes from 29 Nov 2021 – 5 Dec 2021 UTC and dates due up to 4 Jan 2022. Dates are the source's own, or labelled as the day ChangeIntel observed a change; never inferred effective dates.

Ranked by kind: exploited vulnerabilities, then up to 3 dates, open known issues, and other notable changes, with at most one entry per feed. Service incidents are on the status board; security baseline downloads, first captures of a document, and metadata-only documentation checks are left out. This is a view of retained evidence, not a reconstruction of everything known at the time.

The briefing is selective. Browse every dated change, review upcoming dates or check the period's coverage.