We're writing this the week most of our clients' change freezes start, which is the one week a year we stop closing tickets long enough to ask what the last twelve months actually taught us. Fourteen engagements this year touched hybrid identity, desktop delivery, or both, and one thread runs under nearly all of them: the password stopped being the thing worth defending. Adversary-in-the-middle phishing kits that steal a live session token, not a credential, moved from theoretical to routine in client tenants this year. Multi-factor authentication, the control we spent 2019 through 2021 pushing everyone toward, turned out to be necessary and no longer sufficient on its own.
That's the headline. The rest of 2022, for us, was Exchange Online finally cutting off Basic authentication on schedule, Azure Virtual Desktop and Citrix continuing to split the desktop conversation without either one winning outright, Windows 11 sitting mostly untouched in production despite shipping over a year ago, and — in the last two weeks of November — a chatbot that made every roadmap conversation we'd had since Labor Day feel slightly out of date. None of it resolved as neatly as a trends-to-watch slide would suggest. Here's what we actually did about each piece, and what we're not pretending is finished.
The year identity attacks learned to skip the password
In July, Microsoft's threat intelligence team published detail on a large-scale adversary-in-the-middle phishing campaign: reverse-proxy kits sitting between the user and the real Microsoft 365 sign-in page, harvesting the session cookie the instant multi-factor authentication completed. We'd read about token theft before; this is the year we started finding it, or evidence close to it, in client tenants. The mechanics are almost insulting in their simplicity — the user types a real password into what looks like a real sign-in page, approves a real MFA prompt, and the attacker, sitting in the middle the whole time, walks away with a token that's valid until it expires. No password or second factor required again.
We stopped telling clients "you have MFA, you're fine" sometime around August. What replaced it: shorter sign-in frequency windows on Conditional Access policies for anything touching finance or admin roles, sign-in risk policies actually set to block rather than just report, and, where the client had the appetite, a first wave of FIDO2 security keys for the accounts that would hurt most if they were the ones phished. None of this is complete anywhere yet. Continuous access evaluation helps revoke a stolen token faster in some scenarios; it doesn't cover every application, and we told every client that in writing rather than let a vendor slide imply otherwise.
The uncomfortable finding, in more than one tenant — a regional bank's among them — was that the weakest authentication sat on service accounts and shared mailboxes nobody had thought to put behind the same bar as the CEO. We've kept a multi-tenant VDI and Skype for Business estate at more than 10,000 concurrent users and 99.95% availability for years; none of that operational muscle memory made this year's identity problem easier, because the weak point was never uptime. It was an account nobody remembered provisioning.
Basic auth's execution date finally arrived
October 1 came and went, and Exchange Online actually turned off Basic authentication for the protocols still using it: POP, IMAP, older Exchange Web Services calls, Exchange ActiveSync clients that never got updated, and Remote PowerShell sessions authenticating the old way. Microsoft had delayed this cutover more than once before, so a few clients treated the October date as soft right up until the week it wasn't.
The work in the months before October looked the same everywhere: pull the sign-in logs, filter for legacy client apps, and find out who or what was still authenticating like it was 2015.
# Rough triage: who's still hitting Exchange Online with legacy auth
Get-AzureADAuditSignInLogs -Filter "createdDateTime ge 2022-08-01" |
Where-Object { $_.ClientAppUsed -in @('Exchange ActiveSync','Other clients','IMAP4','POP3','Authenticated SMTP') } |
Group-Object UserPrincipalName |
Sort-Object Count -Descending |
Select-Object Name, Count -First 25
The list was never mostly people. It was a scanner-to-email relay installed in 2014, an accounting package's SMTP submission, an on-call paging script written under a previous IT director. One state agency's list had eleven devices still authenticating with a shared mailbox password nobody could explain the origin of. Fixing it meant either moving the workload to modern authentication — an app registration, OAuth2, a proper connector — or, more often, moving it onto a device-based SMTP allow list scoped to a static IP. Not elegant, but honest about what a scan-to-email appliance from 2016 can actually support.
Passwordless work fed directly into this. Every FIDO2 or Windows Hello for Business rollout we ran this year forced an inventory of what actually authenticates and how — the same inventory Exchange needed. The two workstreams should never have been scheduled as separate projects; the clients who ran them together finished faster than the ones who didn't.
Desktop delivery split three ways, not two
Azure Virtual Desktop and Citrix DaaS spent 2022 doing what they did in 2021: neither closed the gap on the other. AVD keeps winning on raw Azure-consumption cost and on being the thing already inside a Microsoft 365 E3 or E5 entitlement. Citrix keeps winning on protocol resilience over bad last-mile networks and on management tooling that's a decade more mature than anything Microsoft ships natively — which is also the gap Nerdio and similar layers exist to close for AVD.
A 3,000-seat logistics client chose AVD this year largely because the licensing was already paid for. A regional healthcare group stayed on Citrix because a meaningful share of their clinicians work over rural, unreliable last-mile connections where protocol resilience is not a nice-to-have. Neither decision was about which platform is "better." Both were correct for the network the users actually sit behind.
What decided most engagements wasn't a feature list at all. It was FSLogix profile behavior under real login storms, and whether the client's existing image and application-packaging discipline — or lack of it — would survive a migration. A profile container strategy that works cleanly for 200 concurrent users can fall over at 2,000 for reasons that have nothing to do with which hypervisor sits underneath.
Windows 11 barely showed up in any of it. It shipped in October 2021, and by this December most of our client estates are still running Windows 10 in production, for a boring reason: Windows 10 is supported to October 2025, the hardware floor for 11 (TPM 2.0, Secure Boot, an approved CPU generation) excludes a meaningful slice of the device fleet still in service, and nobody could name a business-driven reason to rush it. We ran pilot rings anyway, mostly to catch app-compatibility surprises early, but "no rush" was the correct, boring answer for nearly every client this year, and we said so even when it wasn't the more exciting thing to tell a steering committee.
Then, in the last two weeks of November, a chatbot showed up
ChatGPT launched November 30, running on GPT-3.5, and by the second week of December we'd fielded more questions about it than about anything else that shipped this quarter. To be precise about what actually exists right now: a public chatbot with no enterprise data boundary, no admin console, and no tenant isolation, built on a model that is fluent and often wrong. There is no Microsoft 365 Copilot yet. There is no GPT-4 yet. Azure OpenAI Service exists, but access is still limited, and almost none of our clients are on it.
The immediate risk isn't exotic. It's a support engineer pasting a customer's ticket into a public chat window to get a better-worded reply, or a developer pasting proprietary code in to have it explained. That data leaves the building the moment it's typed, with no contract governing what happens to it afterward. We told clients this month, in writing, to do three things before the holiday break: publish one paragraph of acceptable-use guidance rather than a ten-page policy nobody will read, tell people what not to paste rather than pretend the tool doesn't exist, and watch Microsoft's own announcements closely, because a tenant-bounded, Microsoft-hosted version of this is obviously coming and nobody wants to be the last one with a plan for it.
An outright ban was the most common first instinct this month and the least durable answer. Every client who tried one in early December had already found it back in use by staff without IT's knowledge before the month was out — just with no visibility into how it was being used.
What we're carrying into 2023
None of the four threads above are finished, which is normal for a field note taken mid-fight rather than a failure of the note. The honest state of each, heading into January:
| Thread | State on December 13 | What's next |
|---|---|---|
| Token theft / AiTM defense | Conditional Access tightened for privileged roles only | Extend sign-in risk and session controls past the admin tier |
| Basic auth cutover | Exchange Online protocols off for most clients | Chase stragglers still on IP-scoped SMTP exceptions |
| AVD vs. Citrix | Decided per client, not settled platform-wide | Revisit FSLogix and image discipline before any Windows 11 move |
| Public AI tools | Interim acceptable-use guidance issued | Watch for a tenant-bounded Microsoft offering |
A few things we'd say to ourselves a year ago, if we could. MFA was never going to be the finish line, and we should have said so more loudly in 2021. Desktop virtualization decisions get made on operational maturity and network reality, not marketing slides, and the clients who let us skip the FSLogix conversation regretted it by summer. And whatever arrives next out of Redmond, wrapped around a large language model, will land inside identity and permissions systems that already have gaps in them — which means the governance work we've been arguing for since Purview's rebrand earlier this year, not the model itself, is what decides whether next year's version of this note reads as a relief or a mess.
If you're facing this
If your 2022 looked like ours — a Basic-auth deadline cleared with days to spare, an AVD-versus-Citrix decision you're still second-guessing, or a sudden run of "can we use ChatGPT" questions with no policy behind the answer — you're not behind, you're normal. Talk to us before you write that policy or sign that purchase order; we'd rather help you scope the actual work than watch you buy a tool that skips it.