Browse All News (667)

Kayla Cinnamon explains how to review agent-generated changes inside the GitHub Copilot app using three built-in panels: a diff view for inspecting edits, a terminal for running project commands, and a browser preview for validating UI changes before creating a pull request.

Allison announces a public preview of a refreshed repository-level pull request listing page on GitHub, focused on making it faster to find and act on PRs with improved filtering, advanced search, and a more compact, information-dense layout.

Allison announces a public preview that adds GitHub REST API endpoints for enabling and managing GitHub code scanning’s AI Scan for pull requests at both the organization and repository level, making it easier to roll out AI-powered security detections across selected repos without manual UI configuration.

yaronc announces a preview Fabric REST API that exposes item lineage as a dependency graph you can query from code, enabling automated impact analysis, documentation/catalog scenarios, CI/CD checks, and richer context for AI agents that need to reason about upstream sources and downstream consumers.

Rena Liu announces Azure AI Speech LLM 2607 and explains what changes for developers building speech-to-text and real-time voice experiences, including better multilingual and mixed-language recognition, improved punctuation and numeric transcription, lower latency, and a simpler phrase list parameter for domain-specific customization.

Allison announces GitHub Actions cache-mode, a generally available workflow/job setting that lets teams apply least-privilege access to the Actions cache and reduce cache poisoning risk by controlling whether jobs can restore and/or save caches.

Microsoft Security Research breaks down a large-scale business email compromise campaign that used AI-assisted executive impersonation and fake invoices to push finance teams into fraudulent ACH payments, and maps practical mitigations using Microsoft Defender for Office 365, Defender XDR, and Security Copilot.

Santhosh_Ravin1 announces a preview update to Microsoft Fabric’s Spark Native Execution Engine that adds native JSON reading and parsing. The post explains why JSON parsing often becomes a pipeline bottleneck in lakehouse workloads, and how keeping JSON in a columnar native path can improve end-to-end Spark job performance.

Dmitrii Korolev explains how C# 15 union types and closed class hierarchies behave in ASP.NET Core when serialized with System.Text.Json, including what works in Minimal APIs, MVC, SignalR, Blazor, and OpenAPI, plus the trade-offs around discriminator-free JSON and ambiguous payloads.

Allison announces the deprecation of the MAI-Code-1-Flash model across GitHub Copilot experiences and points Copilot Enterprise admins to the steps needed to enable the replacement model via Copilot model policies and settings.

Rob Lefferts explains how threat actors are using AI brands (like ChatGPT, Copilot, DeepSeek, and Claude) as social-engineering bait, and how Microsoft Defender helps detect and disrupt these campaigns across email, identity, endpoints, and SaaS signals.

Allison announces that the GitHub Actions Xcode 27 runner image now runs on macOS 27 (public preview), enabling Apple app validation against the latest macOS version while keeping the same workflow runner labels.

Juan Montes profiles Kinaxis’ Maestro platform and how it uses Azure (including AKS, Databricks, Azure OpenAI, Cosmos DB, and Azure AI Content Safety) to run large-scale supply chain scenario modeling, forecasting, and agentic AI experiences. The piece also touches on Kinaxis’ internal use of GitHub Copilot for an agentic, PR-driven development workflow.

Jakub Oleksy’s August 2026 GitHub availability report breaks down five production incidents across GitHub Actions, authentication, and Copilot services, including what failed, how GitHub mitigated impact, and what reliability work is planned next (capacity, autoscaling, retries, and regional failover).

Nick Brady rounds up July and August 2026 updates for Microsoft Foundry, including GA for Hosted Agents, Voice Live integration, and Toolboxes, plus Model Router pool/region changes and new model releases. It also calls out SDK migrations (Python/JS/Java/.NET) and runtime requirement bumps you should test before upgrading.

Allison announces a new npm security protection: after signing in with a recovery code, any npm account is placed under a 72-hour security hold that blocks publishing and other sensitive write actions while still allowing sign-in and package installs.

Allison announces CodeQL 2.27.0, highlighting native Linux ARM64 support, improvements to GitHub code scanning default setup, and multiple query and framework-modeling updates that improve vulnerability detection across C#, Java/Kotlin, C/C++, and Rust projects.

Microsoft Security Research and Lior Leizerovich introduce the Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework for understanding and prioritizing threats against cloud-hosted web apps and serverless platforms, with practical examples spanning identities, deployment pipelines, managed runtimes, and connected cloud resources.

Allison announces generally available enterprise managed permissions for GitHub Copilot agent operations, letting admins centrally decide which actions are blocked, require human approval, or run without prompting across supported Copilot clients.

Mark Russinovich, Eric Henry and Sai Vaidhyanathan lay out a practical way to decide when an Azure workload should use two availability zones versus three, focusing on component-by-component requirements like capacity after a zone loss, durability targets, and quorum-based behavior rather than defaulting to “three zones everywhere.”

Microsoft Security Research and co-authors document an intrusion pattern where passkey-themed helpdesk lures lead to identity compromise, MFA persistence, Microsoft Graph reconnaissance, and large-scale data collection from SharePoint, OneDrive, and Exchange Online, with practical hunting queries and mitigation guidance for defenders.

Allison announces expanded self-serve trial eligibility for GitHub Advanced Security on GitHub Enterprise Cloud, allowing more enterprises to evaluate GitHub Code Security and GitHub Secret Protection before purchasing.

Allison announces a new GitHub repository ruleset option that can block pull requests from merging when they introduce unresolved secret scanning alerts, adding an extra enforcement layer beyond push protection.

The Visual Studio Code Team shares the VS Code 1.138 Insiders changelog, focusing on Agent Host and Agents window improvements like shareable session links, side-by-side agent sessions, repo-first context attachment for issues/PRs, voice mode session awareness, and agent-session cleanup controls.

nschachter announces a Microsoft Fabric preview that adds table-level discovery to OneLake Catalog search, including Global Search and the OneLake Catalog Search API. The post explains how permission trimming works, what object-level security excludes, and which tenant setting admins should review before the late-September rollout.

Allison announces agentic autofix for GitHub Code Quality, letting teams select up to 25 findings and assign them to GitHub Copilot in one action. Copilot applies fixes on a branch, validates the changes, and opens a pull request for review, with usage governed by existing enterprise policy and AI credits.

Waldek Mastykarz explains how to pick a “minimal viable model” for AI coding work by running your own evals instead of defaulting to the most expensive option. Using GitHub Copilot Chat in VS Code, he compares model quality scores and per-run costs across real upgrade scenarios to show why “smarter” can be worse value.

Allison announces updates to GitHub Copilot for JetBrains, including enterprise-managed sandbox policies, cross-file cursor jumps for next edit suggestions, global project context in chat, and enterprise policy diagnostics. The release also adds a preview integration that connects Copilot CLI terminal sessions to IDE context and improves reliability across MCP and agent sessions.

Allison announces GitHub Enterprise Server (GHES) 3.22 general availability, highlighting updates for enterprise administration and collaboration, including Copilot CLI support for disconnected environments, enterprise teams, improvements to repository rulesets and required reviewers, and UI enhancements for issues and pull requests.

sbaynes announces codename MDASH, Microsoft’s multi-model agentic code-scanning system now deployed in Azure Government, aimed at finding and validating exploitable vulnerabilities across software supply chains with fewer false positives and more actionable results for security teams.

.NET Team announces .NET 11 Release Candidate 1, highlighting runtime, SDK, MSBuild, NuGet, and language updates, plus ASP.NET Core, .NET MAUI, and Windows Forms improvements. The post links to detailed release notes and includes download and tooling guidance for trying RC1 in production.

Javier Lozano, Chris Sfanos, and Jon Galloway announce that the call for presenters is open for .NET Conf 2026 Community Days, with session proposals accepted from September 8 through October 6, 2026, and a separate volunteer opportunity for helping run the event.

Aseem Datar explains how Microsoft Discovery applies agentic AI to scientific and engineering R&D, focusing on adaptive reasoning loops that explore multiple hypotheses, preserve evidence, and decide when to change strategy or involve domain experts. The post also highlights benchmark results for Discovery Engine with CLIO across several scientific domains.

Rahul Bhandari and Tara Overfield recap the September 2026 servicing releases for .NET and .NET Framework, highlighting security and non-security fixes, the list of addressed CVEs, and where to find release notes, installers, container images, Linux packages, and known issues for supported versions.

salilkanade1 announces updates to the Microsoft Fabric SQL Query Editor, focused on scaling web-based SQL development for large warehouses with a faster results grid, improved object exploration and IntelliSense, better query management, and tighter connections to OneLake analytics, semantic models, and operational workflows.

Justin Yoo walks through a practical profiling workflow for distributed .NET apps, showing how to identify which process owns a slow user interaction, use Visual Studio CPU profiling to rule out CPU-bound work, and then measure hidden async waiting that doesn’t show up in CPU samples.

davidwright walks through a practical, staged path for turning an Azure-hosted SaaS app into a transactable Azure Marketplace offer, using Git-Ape “skills” to generate version-controlled decision records for offer selection, multi-tenancy, landing zones, fulfillment/metering, security evidence, deployment blueprints, and Partner Center onboarding.

Allison’s weekly Copilot changelog highlights new model options (Claude Fable 5.1 and Gemini 3.8 Flash), stronger content protection via honored content exclusions in Copilot app/CLI, and VS Code 1.136 updates aimed at managing agent sessions and getting pull requests ready to merge.

Shayak Lahiri explains why Edge AI shifts security responsibility into customer-owned infrastructure, and outlines practical patterns for protecting model weights, credentials, and data. The post focuses on gating sensitive asset release using runtime attestation and artifact provenance, plus deterministic mediation to constrain what models can do.

Allison announces general availability of OpenAI’s GPT-6 Astra in GitHub Copilot, highlighting its strength on long-horizon, agentic coding tasks, how it’s billed under usage-based pricing, and where developers and admins can enable and select the model across supported IDEs and clients.