Replacing a Windows device has always been two migrations wearing one name. OneDrive owns the files. Windows Backup for Organizations finally owns the settings, and at 26H2 it becomes the default.
Multi-Admin Approval assumes any admin account, including the most privileged one in the tenant, might be an attacker by the time it makes a change. For protected resources, no single account changes anything alone.
Delegation in Intune is two questions asked separately: what an administrator may do, and which objects exist for them at all. The scoped-permissions change finally makes the answers honest.
For years the network and the identity were governed separately, and the seam between them was where attackers lived. Global Secure Access closes that seam by making the network path itself something the identity system authorizes.
Every control produces a record, and a control whose record no one keeps is one you are only assuming works. Watching identity turns the directory's exhaust into something you can alert on and answer questions with later.
Bringing an outsider into your directory is a trust decision wearing the clothes of a convenience feature. External identity is deciding how much of someone else's security posture you will inherit as your own.
Access is not an event, it is a lifespan. Access reviews and lifecycle workflows make provisioning, recertification, and deprovisioning something the platform runs rather than something people remember to do.
Most access is granted by hand and never taken back. Entitlement management turns access into a governed object with a requester, an approver, a reason, and an expiry.
