A few dates from Microsoft are worth knowing:

They run quietly, attached to a library or list, and nobody sees them unless something goes wrong. Approval chains in finance and HR are the classic examples. The first sign of trouble is usually a business process stalling, such as an approval that never arrives or a notification that stops, days after go-live. By then it is hard to connect the problem back to the migration.

No. Those workflow platforms are retired in SharePoint Online, so each workflow needs to be converted or rebuilt, typically in Power Automate.

Version 4.1 can assess and migrate supported SharePoint Designer workflow actions to Power Automate. The result still needs testing, as converted flows can behave differently from the originals.

According to Microsoft, Subscription Edition supported SharePoint 2010 based workflows until 14 July 2026 and continues to support 2013 based workflows beyond that date.

Power Automate is Microsoft's recommended platform, and most common approval and notification scenarios can be rebuilt there. Some complex or long running processes may suit a third party tool better.

Combine tool scans with conversations with process owners, then monitor closely for the first few weeks after go-live in case anything still slips through.

Not sure what's hiding in your environment? GTconsult's migration assessment checklist, would be a good place to start.

With SharePoint Server 2016 and 2019 now past end of support, many organisations are asking whether a hybrid setup is a sensible long-term home or just a slower route to a full migration.

Barend Olivier, Delivery Manager at GTconsult, shares his view from the support desk: when hybrid genuinely earns its place, when it’s putting off the inevitable, and what that looks like in real client environments.

• Who should attend: IT managers, SharePoint administrators, and anyone still running on-prem SharePoint.

Nicole is joining GTconsult at a time when the industry is moving fast, particularly with AI reshaping how businesses work, solve problems, and grow. She's excited to sit at the intersection of people, projects, and technology, helping clients turn all that change into practical outcomes rather than just possibilities on a slide.

What stood out to her about GTconsult specifically is the balance we try to strike: chasing excellent solutions without losing sight of the people and culture that make good work possible in the first place.

Outside the office, Nicole keeps a good balance of movement, creativity, and community. She's often out for a run, on the tennis court with friends, or just spending time in nature. When she wants to slow down, she turns to hands-on creative hobbies like painting and sewing. Volunteering matters a lot to her too, so don't be surprised if you spot her on a weekend helping out at a beach clean-up or a local soup kitchen.

CVE-2026-45659 is a flaw in the way Microsoft SharePoint On-Premises servers handle .NET deserialization. In plain terms, SharePoint accepts requests from users and systems, and those requests arrive in a compressed, packaged format. Before SharePoint can act on a request, it needs to unpack it, a process called deserialization.

Attackers found a way to craft that package so that the unpacking process itself forces the server to run code it was never meant to run. Once that happens, the attacker can execute commands as the SharePoint service account, which means they effectively gain control over part of your environment.

Microsoft has rated CVE-2026-45659 as Important severity with a CVSS score of 8.8. Exploitation requires the attacker to first authenticate to the server, but only with a standard Site Member permission. No administrator rights and no user interaction are needed once that access is in place.

Last month's vulnerability, CVE-2026-32201, was a spoofing flaw, which relies on tricking a person. An attacker pretends to be someone else, often to commit fraud or to harvest real credentials through social engineering. It still requires a human to be fooled somewhere along the way.

Remote code execution skips that step entirely. Once an attacker has the required access, no one needs to be tricked into anything else. The attacker sends crafted code directly to the server, and the server runs it. That direct path is why RCE vulnerabilities are treated as far more serious than spoofing flaws.

This vulnerability affects SharePoint On-Premises only. If you are on SharePoint Online, you are not affected by this particular CVE.

•  SharePoint Server 2016 (and SharePoint Enterprise Server 2016, which uses the same security update)

•  SharePoint Server 2019

•  SharePoint Subscription Edition

Earlier reporting on this CVE referenced SharePoint 2013 as affected. Microsoft's confirmed advisory lists Server 2016, Server 2019, and Subscription Edition as the in-scope versions. If you are running SharePoint 2013, it reached end of support some time ago and no longer receives security updates of any kind, which is reason enough on its own to plan a move to a supported edition.

This vulnerability lands at an awkward time for anyone still running older SharePoint On-Premises versions. Mainstream support for SharePoint Server 2016 and 2019 ends on 14 July 2026. After that date, organisations still running those versions will no longer receive security updates, which means future vulnerabilities like this one will go unpatched.

If your organisation relies heavily on SharePoint and downtime feels too risky to plan a migration, it is worth remembering that the risk works both ways. Staying on an unsupported version carries its own quiet, growing cost.

1.  Patch immediately. The security update for CVE-2026-45659 was released on 21 May 2026. If you have not applied it yet, this is the first thing to do.

2.  Monitor your environment. Watch your SharePoint logs for anything related to deserialization, and keep an eye on the processes running under your SharePoint service account. Unusual or unexpected processes are often the first sign that something has gone wrong.

3.  Review your permissions. Move towards a zero trust approach where people and service accounts only have access to what they actually need. Avoid granting broad Site Member or higher permissions out of convenience.

If you are running anything older than SharePoint 2019, it is a good time to start planning your move to Subscription Edition, particularly with support for 2016 and 2019 ending on 14 July 2026.

Not every organisation has a dedicated SharePoint or security specialist on hand, and that is exactly where GTconsult can help. We know SharePoint back to front and offer security assessments to help you understand exactly where your environment stands and what to prioritise.

Watch the full conversation with Kyle Farr on YouTube (or right at the top of this blog) for the complete breakdown, read our coverage of last month's SharePoint spoofing vulnerability (CVE-2026-32201), or get in touch with GTconsult to talk through your SharePoint environment.

For the official technical advisory, see CVE-2026-45659 on the National Vulnerability Database.

The typical approach looks something like this: open the Microsoft Defender portal, see a list of recommendations, pick the ones worth the most points or that seem easiest, and start implementing.

Three months later, your score has barely moved. Or it moved briefly and then dropped back down. Or you've spent weeks on improvements that broke critical workflows and had to be rolled back.

The problem isn't lack of effort. It's lack of strategy.

Effective Secure Score improvement requires understanding three things most teams skip:

Get any of these wrong and you'll spend more time fixing problems than you saved by implementing the recommendation.

This pattern repeats across every recommendation in your Secure Score. What looks like a configuration change on the surface requires strategic thinking about business impact, technical dependencies, and change management.

IT teams often start with "quick wins"—recommendations that promise high point values with supposedly minimal effort.

The problem is that "quick" depends entirely on your environment's current state and complexity. Blocking legacy authentication might take 15 minutes in one organization and require weeks of application modernization in another.

More importantly, chasing points without understanding impact leads to a dangerous pattern: implementing changes that raise your score but don't actually improve your security posture in meaningful ways for your specific risk profile.

The organizations that successfully improve their Secure Score don't focus on quick wins first. They focus on right wins—improvements that align with their actual threat landscape and business priorities, regardless of point value.

Join our security analyst, Kyle Farr, on 10th of February 2026 for a live demonstration of strategic Secure Score improvement:

• Current state analysis - How to assess your score breakdown and identify what actually matters for your risk profile (not just point values)
• Prioritization framework - The decision criteria for determining which recommendations to tackle first based on business impact and technical dependencies
• Live implementation walkthrough - Watch a real security control get configured with proper testing and rollback planning
• Monitoring and sustainability - Building the processes that catch drift before it degrades your security posture
• Q&A for your specific challenges - Get answers about your environment's blockers and constraints

Naturally, I went full gorilla mode.

I did what any email admin would do. I:

And there it was:

A blocked file hash. A SHA256 fingerprint sitting there silently ruining lives.

No error. No alert. Just gone.

This is the Defender equivalent of:

When you first click open the email, the first thing that draws your attention is the Zoom logo. It's familiar/recognizable, so if you're skimming through, you may let your guard down and miss all the other red flags.