Browse All Blogs (73)

Hidde de Smet's Blog compares Bicep and Terraform for Azure, focusing on resource ownership rather than syntax preferences. The guide explains deletion behavior, deployment previews, ARM API coverage, module defaults, and existing-resource adoption, then outlines a disposable pilot for testing each tool against your team's infrastructure requirements.

John Edward breaks down six Copilot Studio enhancements landing in general availability on October 26, 2026, focused on building and operating Copilot Chat (declarative) agents with more predictable conversation flows, better testing and evaluation, usage monitoring, and clearer lifecycle controls across environments.

Andrew Lock introduces CBOR as a compact binary alternative to JSON and explains where it fits compared to formats like Protobuf and MessagePack. He then demonstrates how to read and write CBOR in .NET using the low-level System.Formats.Cbor APIs, including conformance modes and practical decoding patterns.

John Edward explains how to monitor Copilot Studio agents in production by combining conversation analytics with application telemetry, security controls, and outcome-based metrics. The guide focuses on catching failures early (tool-call errors, latency, unsafe access), setting baselines and alerts, and tying cost and performance back to successful task completion.

Khalid Abuhakmeh shows how ASP.NET Core 11 can localize Minimal API validation errors using Microsoft.Extensions.Validation and standard resx resources, without FluentValidation or custom endpoint filters. The post includes a working Program.cs setup, resource key conventions, and an integration test harness that verifies responses across multiple cultures.

Jesse Houwing explains how to harden GitHub Actions OIDC authentication to Azure by switching to immutable subject claims, so federated credentials can’t be hijacked after a repo rename, transfer, or deletion. The post shows what changes in the subject claim and how to fetch the required IDs via the GitHub API.

John Edward explains when multi-agent systems are worth the added complexity, and how to design them so they stay predictable, secure, and testable. The article breaks down common orchestration patterns, communication/state design, guardrails, and practical evaluation metrics for cost, latency, and accuracy.

Jesse Houwing breaks down how real-world supply chain attacks have abused GitHub Actions workflows, then walks through the platform changes GitHub shipped in 2025–2026 (from safer pull_request_target behavior to lock files and cache controls) and ends with a practical checklist of hardening steps to apply now.

John Edward explains an upcoming Microsoft Entra default-permission change that lets ordinary users create agent blueprints unless admins disable it. The post breaks down what’s changing, what isn’t, and the specific Entra admin center setting IT teams should review before the November 2026 rollout.

John Edward explains the planner-executor loop as a practical architecture for building agentic systems on Azure, focusing on how to separate planning from execution, validate model outputs, and run tool calls safely. The article maps the pattern to Azure services and highlights reliability, observability, and access-control decisions needed for production use.

John Edward breaks down how to design stateful AI agents that can keep context across interactions, safely call external tools, and coordinate multi-step work with structured planning. The article focuses on practical system design: what to store, how to retrieve it, and how to control execution so agents behave reliably in production.

Jacquie Capur joins Matty Stratton to unpack what “meaningful control” over tooling looks like in practice: understanding dependencies, verifying reliability, and keeping a realistic exit path. They connect classic DevOps lessons (config management, Terraform, CI/CD) to today’s fast-moving AI tooling, open models, and data residency constraints.

Khalid Abuhakmeh shows how to replace ASP.NET Core Minimal API JSON output with the REDox serializer by implementing a custom IResult, then benchmarks REDox vs System.Text.Json to see whether serializer speedups translate into faster HTTP endpoints.

Khalid Abuhakmeh explains how C# 15 extends collection expressions with a new `with(...)` element, letting you pass constructor arguments (like comparers and capacity) without giving up the `[a, b, c]` syntax.

John Edward explains a planned Microsoft Entra ID change that lets users register passkeys and other passwordless methods as their first MFA option, removing the previous requirement to set up SMS or voice first. The post outlines rollout phases and what admins should review in Conditional Access and authentication method policies.

Khalid Abuhakmeh shows how to use C# 15 union types on .NET 11 to model a workflow as a single state value plus one Next method, with exhaustive switch expressions and typed inputs/results. He also covers how to persist and rehydrate workflow state using System.Text.Json with an explicit discriminator.

Khalid Abuhakmeh explains how Directory.Build.props lets you set shared MSBuild defaults (like Nullable, LangVersion, and analyzers) once for an entire .NET solution, how nested files behave, and when to switch to Directory.Build.targets or Directory.Packages.props for late-bound logic and centralized package versions.

John Edward outlines a practical audit process for old online accounts, focusing on reducing account-takeover risk through breach checks, password hygiene, MFA, recovery settings, and reviewing third-party access like OAuth tokens and API keys.

Thomas Maurer announces two NVIDIA GTC Berlin sessions covering Microsoft Sovereign Cloud updates and how to run Sovereign AI from Azure to the edge using Azure Local and Foundry Local, with an emphasis on control, compliance, resilience, and security requirements.

John Edward explains Microsoft’s Windows Update certificate rotation planned for 2027, including the two expiration deadlines and which Windows client and server versions need specific security updates to avoid losing access to Windows Update. It also outlines practical inventory, compliance, and recovery steps for IT teams.

Emanuele Bartolesi shares a practical fix for high CPU/disk usage on Windows 11 when running Claude, Codex, and GitHub Copilot tooling: adding targeted Microsoft Defender Antivirus folder exclusions. The post also calls out the security tradeoff and walks through the exact Windows Security steps to apply exclusions safely.

Andrew Lock shows how to shrink a .NET NativeAOT binary by using ILLink.Substitutions.xml to replace a runtime-only property with a compile-time constant, letting the linker remove an otherwise “reachable” dependency chain (including Azure.Identity and MSAL) and cutting output size by roughly 22–25%.

Samu Niemelä shares practical takeaways from FabCon 2026 on how Microsoft Fabric is maturing, from Fabric IQ grounding Copilot and agents in governed business semantics to new on-demand compute and stronger monitoring and governance features for running Fabric at scale.

Rob Bos shares a short pointer to his Azure Heroes session on how he works with GitHub Copilot, with a link to download the slides.

John Edward covers Microsoft’s new self-service onboarding flow for publishing new applications to the Microsoft Entra App Gallery, including built-in validation for SSO and provisioning integrations, submission tracking, and the rollout timeline from public preview to general availability in late 2026.

Khalid Abuhakmeh breaks down three built-in ways to convert strings to integers in C#: int.TryParse, int.Parse, and Convert.ToInt32. He explains when each is appropriate, what exceptions to expect, and how culture and number formatting (like thousands separators) can make parsing fail.

Khalid Abuhakmeh maps familiar Ruby on Rails concepts (conventions, Action Pack, Hotwire, Active Record, Sidekiq, and the Rails CLI) to their closest ASP.NET Core and .NET equivalents, with practical guidance on choosing MVC vs Razor Pages vs Minimal APIs, EF Core patterns, and background job options.

John Edward explains Microsoft’s 2026 retirement of SharePoint Online’s one-time passcode (SPO OTP) flow and the shift to Microsoft Entra B2B guest accounts for external sharing in SharePoint Online and OneDrive, including what breaks, what stays, and what admins should do before the October–November rollout completes.

Hidde de Smet explains why “agent-done” work can still create downstream toil, and how GitHub’s Agentic Engineering System (AES) helps teams make delegation reviewable and observable. The article proposes three practical handoffs—evidence packets, enforced stopping points, and release receipts—to reduce “handoff debt” and keep agent output aligned with team capacity.

John Edward covers Microsoft and AWS’s Azure Multicloud Interconnect for AWS announcement, focusing on what it changes for private, high-bandwidth connectivity between the two clouds and why it matters for teams running cross-cloud, data-heavy workloads.

Thomas Maurer argues that Azure Local should be evaluated as the infrastructure foundation of Microsoft Sovereign Private Cloud, not just as a hypervisor replacement. He breaks down connected vs disconnected operations, Azure Arc control-plane options, and the platform capabilities (AKS, data services, Foundry Local, GitHub Enterprise Local) that shape sovereignty and resilience.

Andrew Lock walks through the new experimental Device Bound Session Credentials (DBSC) support in ASP.NET Core for .NET 11, showing how to harden cookie authentication (including ASP.NET Core Identity) against session hijacking and what the registration/refresh protocol looks like in practice.

DevClass reports on Microsoft’s migration of the GitHub Copilot runtime from TypeScript/Node.js to Rust using AI agents, including token costs, release cadence, performance benchmarks, and the practical risks of compiler-passing regressions when LLMs generate Rust at scale.

Jesse Houwing breaks down a nasty PSScriptAnalyzer failure in GitHub Actions where Invoke-ScriptAnalyzer intermittently crashed with a missing Get-Command, then shows how Copilot-assisted investigation, benchmarking, and targeted fixes turned it into a deterministic, faster analyzer with evidence reviewers can rerun.

Hidde de Smet lays out a practical way to judge whether a repo is actually ready for AI coding agents, using GitHub Copilot cloud agent as the concrete example. It focuses on repeatable setup, shared commands, focused tests, CI enforcement, and security boundaries so agent sessions aren’t wasted on missing prerequisites.

Pieter Vandenheede breaks down four practical BizTalk migration paths—do nothing (short-term), coexistence, domain-by-domain migration, and big-bang replacement—and provides a decision matrix to help teams choose an approach that fits their constraints and risk tolerance.

Andrew Lock introduces Device Bound Session Credentials (DBSC), a browser/server protocol that makes stolen authentication cookies much harder to reuse on another machine. He explains the threat model (cookie theft and session hijacking), how DBSC uses TPM-backed keys and signed challenges, and what endpoints a server needs to add to support it.

Pieter Vandenheede explains how to decide whether to keep BizTalk after Microsoft confirmed BizTalk Server 2020 is the final release, and what conditions make “staying” a deliberate (and limited) choice. He also outlines practical signals that it’s time to move and frames the shift from “if we migrate” to “how we migrate safely.”

Thomas Maurer explains how Adaptive Apps and the open-source Radius control plane help teams engineer, test, and prove application portability across Azure, Azure Local, and other Kubernetes environments by separating app intent from environment-specific implementations.

Pieter Vandenheede breaks down Microsoft’s BizTalk Server lifecycle update, what stays supported through 2028/2030, and why “support isn’t strategy” for long-term integration platforms. He outlines practical next steps: inventorying your integration landscape, planning timelines, and evaluating Azure Integration Services (including Logic Apps) as the direction Microsoft is investing in.